Caltex Lytton Refinery and Terminal

Safety Case Summary

Version 1.0 August 2020

Table of Contents

Message from the General Manager Manufacturing 3

Glossary 4

Introduction 5

Caltex Australia 6

Caltex Lytton Refinery and Terminal 7

From Crude Oil to Customers 8

Hazardous Chemicals 10

Safety Assessment 11

Control Measures 12

Safety Management System 13

Emergency Response 14

What to do in an Emergency 15

Message from the General Manager Manufacturing

Here at Caltex, we are committed to protecting the health and safety of our workers, visitors, the public, and the communities that we operate in. Our top priority is to ensure that we conduct our operations safely and prevent injury or illness to anyone who has the potential to be affected by our operations. To achieve this, the activities that we undertake at the Caltex Lytton Refinery and Terminal are performed in a manner that ensures all reasonable and practicable steps are taken to mitigate risks to health and safety. The key to doing so is to understand the hazards involved in our operations, the potential consequences of an incident involving these hazards, and the controls that exist to eliminate or minimise the risk of a major incident. Caltex has conducted a comprehensive safety assessment to systematically and thoroughly identify the hazards on site, the potential adverse consequences of an incident, and the risk posed to people both on and off site. The safety assessment also considers the control measures that are in place to prevent or mitigate the effects of such incidents, and what more could be reasonably and practicably done to further minimise risk. To support this process, Caltex operates in compliance with the Operational Excellence Management System (OEMS) which ensures that we continue to achieve safe and reliable operations. The OEMS helps us to monitor and review our performance in health, safety and environmental matters. The structure of the OEMS means that we continually improve our processes to ensure ongoing safety.

Workers from every part of our business, including from operations, engineering, reliability and corporate, are consulted throughout the safety assessment process and the performance of the OEMS. We empower our employees with the authority to stop work if they believe that something is unsafe. Through this process we seek to instil the tenet principle of “do it safely or not at all”. Robust emergency response systems and procedures are a key part of managing the complex risks associated with operations such as ours. The wide range of equipment capability and capacity, combined with the thorough and in-depth training of our emergency response teams, means that should an incident occur, we are ready to respond in a coordinated and timely way to limit the consequences of any event. In line with Queensland work health and safety laws, the Caltex Lytton Safety Case demonstrates how all these elements work together to ensure that our operations are conducted safely and reliably. Caltex values the communities in which we operate and is committed to engaging with them. This document summarises the Caltex Lytton Safety Case and is intended to provide the community with information on how safety risks are managed through the use of appropriate systems, processes, equipment, and people.

Troy McDonald General Manager Manufacturing

3

Glossary Caltex Lytton Manufacturing refers to the Caltex Lytton Refinery, Terminal, and Lubricants Plant. It is part of Caltex Australia’s Fuels & Infrastructure business, and headed by the General Manager Manufacturing. Caltex Lytton MHF refers to the Caltex Lytton Refinery, Terminal, and associated wharves and pipelines, which are classed as a Major Hazard Facility (MHF). The Caltex Lytton MHF excludes the adjacent Lubricants Plant. Consequence in this document, refers to the degree of harm that might result from a Major Incident. Control Measure in this document, refers to a measure taken to eliminate or minimise the risk of a Major Incident. Likelihood is the probability that an event with a particular consequence will occur. Loss of Containment (LOC) refers to an unplanned or uncontrolled release of material from primary containment. Major Incident in this document is any Loss of Containment involving Schedule 15 Chemicals that has the potential to result in one or more workplace fatalities, or one or more severe injuries to the public. Major Incident Hazard is a hazardous material that has the potential to cause a Major Incident such as a chemical or hydrocarbon. Major Hazard Facility (MHF) means a facility:

at which Schedule 15 Chemicals are present or likely to be present in a quantity that exceeds their threshold quantity;

that is determined by the regulator under Part 9.2 of the Queensland WHS Regulation to be a Major Hazard Facility.

Operational Excellence Management System (OEMS) A standard approach at Caltex for achieving world-class performance in safety, health, environment, reliability, quality and efficiency. Process Safety is the discipline of managing the integrity of operating systems and processes that involve hazardous materials by applying good design principles, engineering, and operation

practices. It deals with the prevention and control of incidents that involve the release of hazardous materials which have the potential to result in harm to people, property and the environment. Risk is the combination of the worst case consequence and the likelihood of the worst case consequence occurring. Safety Case is a structured argument, supported by evidence, intended to justify that a system is acceptably safe for a specific application in a specific operating environment. The Safety Case for an MHF such as the Caltex Lytton MHF contains technical, management and operational information covering the hazards and risks that may lead to a Major Incident at the MHF and their control, and provides justification for the measures taken to ensure the safe operation of the facility. Safety Assessment is the process by which the Operator of a Major Hazard Facility systematically and comprehensively investigates and analyses all aspects of risks to health and safety associated with all Major Incidents that could occur in the course of the operation of the Major Hazard Facility. The Safety Assessment is summarised in the Safety Case. Safety Management System (SMS) is a comprehensive and integrated system for managing health and safety risks at a Major Hazard Facility. At Caltex, the SMS is incorporated within the Operational Excellence Management System (OEMS). Schedule 15 Chemical means a hazardous chemical that is specified in Schedule 15 of the Queensland WHS Regulation. So Far As Is Reasonably Practicable (SFARP) Where a risk to health or safety is reduced SFARP, it means that all “reasonably practicable” efforts were taken to minimise or eliminate that risk. The determination of what is “reasonably practicable” considers multiple factors, including likelihood, the potential degree of harm, cost, and suitability of controls. Queensland Work Health and Safety (WHS) Act and Regulation provides a framework to protect the health, safety and welfare of all workers at work. It also provides protection for the general public so that their health and safety is not placed at risk by work activities.

4

Introduction

The Caltex Lytton Refinery and Terminal are licensed to operate under the WHS Act and Regulation as a Major Hazard Facility (MHF). The Refinery and Terminal are classed as an MHF due to the large volumes of Schedule 15 Chemicals, including flammable liquids, flammable gases, and toxic gases that are stored and processed on site. The WHS Act requires a Major Hazard Facility (MHF) to:

Eliminate risks to health and safety, so far as is reasonably practicable (SFARP); and

If it is not reasonably practicable to eliminate risks to health and safety, to minimise those risks so far as is reasonably practicable.

The WHS Regulation requires an MHF to at all times hold a current Safety Case which documents the hazards and risks at the MHF that may lead to a Major Incident. The Safety Case must also describe the control measures in place to minimise the likelihood and potential consequence of a Major Incident, and demonstrate the adequacy of these control measures to ensure the safe operation of the MHF. All MHFs must be granted a license to operate by Workplace Health and Safety Queensland. Workplace Health and Safety Queensland monitors Caltex Lytton MHF through regular audits to ensure the hazards and risks associated with its operations are appropriately managed. The facility’s licence to operate is dependent on the outcomes of the Safety Case submission and audits. Caltex Lytton MHF is required to submit its Safety Case to Workplace Health and Safety Queensland at least once every five (5) years for review and approval. The Safety Case was last submitted in July 2019, which was the second submission under the 2011 legislation. The Safety Case demonstrates that Caltex Lytton MHF has taken sufficient measures to ensure safe operation by focusing on Major Incident prevention and mitigation, ensuring adequacy of control measures, having a robust process for managing controls and driving continuous risk reduction to ensure that risks are being minimised so far is as reasonably practicable. The safety management system works to track effectiveness of this process and drive continuous improvement. The Safety Case is prepared in consultation with workers who contribute to and review the content prior to submission. This Safety Case Summary fulfils the requirement of Section 572 (Information for local community – general) of the WHS Regulation, by providing a summary of the Safety Case to the local community including the name and location of the MHF, contact details for further information, a description of the MHF’s operations, the means by which the community will be notified of a Major Incident occurring, and the actions that members of the

community should take in the event of a Major Incident.

Caltex is committed to operating safely and protecting the health of its workforce, the surrounding communities and the environment. The purpose of this document is to provide

information to the community regarding the management of process safety at the Caltex Lytton Refinery and Terminal. It contains a description of the facility’s operations and how the

community will be notified in the event of a potential incident.

5

Our Company

Ampol Limited (ASX:ALD) is an independent Australian company and the nation’s leader in transport fuels. We manage the country’s largest petrol and convenience network as well as refining, importing and marketing fuels and lubricants. We are backed by experience with a history spanning over 120 years, having grown to become the largest transport fuels company listed on the Australian Securities Exchange. In recent years we have expanded our national and international footprint to develop a reliable and adaptable supply chain extending from the regional hub of Singapore, where we operate our trading and shipping office, to the Australian end consumer, serving over 80,000 customers in markets such as defence, mining, aviation and over three million retail customers every week. Our robust supply chain is underpinned by our market-leading infrastructure, including 19 terminals, five major pipelines, 89 depots, approximately 800 controlled retail sites, 2,000 associated sites and the Lytton refinery. This network is supported by over 7,800 people across Australia and overseas. Launching off our Australian operations, we have presence in the New Zealand fuels market as owner of Gull New Zealand, which operates one of the largest independent import terminals in the country and a retail network. We also have a 20 per cent equity interest in Seaoil in the Philippines. These international operations are in addition to our trading and shipping offices in Singapore and the United States of America. Ampol Limited, formerly Caltex Australia, returned to the iconic Australian name following shareholder approval on 14 May 2020. The national brand roll out across our retail network will begin in January 2021 and be completed by the end of 2022. The Lytton refinery will also be rebranded to Ampol in by this date.

Ampol places the highest priority on the safety, health and security of its workforce and the community. This is reflected in our company policies, which provide a guide to all workers as

to how business must be conducted, particularly with respect to the health, safety and wellbeing of the workforce, neighbours, customers and the public.

6

Lytton Refinery and Terminal

The Caltex Lytton Refinery processes crude oil and other feedstocks, which are imported by ship from overseas, into a number of useful products including petrol, diesel, jet fuel and LPG. The finished products are stored in large tanks before being distributed to customers via pipeline, ship or road tanker. The adjacent Caltex Lytton Terminal allows these products to be loaded into road tankers for subsequent delivery by road around Queensland and in northern New South Wales. Together, the Caltex Lytton Refinery and Terminal are classified as a Major Hazard Facility (MHF) under the WHS Act because the site stores, processes and produces large volumes of hazardous materials, referred to as Schedule 15 chemicals in excess of threshold quantities.

The Caltex Lytton Refinery and Terminal has produced and distributed fuels and other products for Australia since 1965. The Refinery and Terminal are located in the Brisbane suburb of Lytton, approximately 15 kilometres east of the CBD. It is neighboured by several other

industrial facilities, with the closest residential suburb being Wynnum.

A number of other assets that support the operation of the Refinery and Terminal are also considered part of the Caltex Lytton MHF. These are:

The Crude Wharf at the Port of Brisbane, where crude oil is received by ship;

The crude and multi-purpose pipelines that run between the Crude Wharf and the Refinery;

The Products Wharf, adjacent to the Refinery, where product from the Refinery is loaded onto ships; and

Pipelines NPPL1 and NPPL2 which enable delivery of product from the Refinery, under the Brisbane River, to several customer terminals on the northern side of the river.

The adjacent Caltex Lubricants Plant is not part of the Caltex Lytton MHF. However, the Refinery, Terminal and Lubricants Plant are collectively referred to as Caltex Lytton Manufacturing, and its operation is overseen by the General Manager Manufacturing and supported by the Manufacturing Leadership Team.

7

CALTEX BOUNDARY LEASED FROM POB REFINERY BOUNDARY LUBRICANTS BOUNDARY TERMINAL BOUNDARY NPPL1 NPPL2 CRUDE & BUNKER PIPELINES CALTEX LYTTON MHF

From Crude Oil to Customers Crude oil is a naturally occurring mixture of hydrocarbons, organic compounds and trace metals, which is extracted as a liquid from underground reservoirs. It is typically black or dark brown and varies in composition and properties, depending on where it is sourced. Once extracted, crude oil can be processed at a refinery where it is converted into useful products such as transport fuels and specialty chemicals. The crude oil that is refined at the Caltex Lytton Refinery is sourced from all parts of the world including Asia, Australia, New Zealand, Papua New Guinea, West Africa, and the USA. It is delivered by ship to the Crude Wharf then pumped via the crude pipeline to large storage tanks at the Refinery before being processed. A high level process flow diagram of the refining process is provided on page 9. The first step of the refining process is to send the crude oil to the Crude Distillation Units where it is heated to over 300°C and distilled in a distillation tower into individual streams such as LPG, naphtha, kerosene, diesel, and reduced crude. Each of these streams must be processed further before it becomes a useful product for the customer. At a high level:

LPG is sent to the Saturates Gas Plant for further distillation and treatment before it stored as LPG;

Kerosene is sent to the Jet Treaters for washing, drying and further treatment before it is stored as jet fuel;

Diesel is sent to the Diesel Hydrotreating Units to reduce sulphur levels before it is stored as diesel fuel;

Reduced crude is sent to the Fluidised Catalytic Cracking Unit where large, low-value hydrocarbons are “cracked” into smaller, higher-value ones that are either sent to storage as a petrol blending component, or sent to the Polymerisation, Alkylation or Diesel Hydrotreating Units for further processing, while the remaining heavy hydrocarbons are sent to storage as clarified oil, a heavy fuel oil product used by marine transport; and

Naphtha is further refined in the Isomerisation Unit and in the Reformer Unit to produce petrol components that can be blended into different grades of petrol (i.e. unleaded, premium unleaded and super premium unleaded).

Although each Unit is based on a specific chemical process or technology, all of them involve the use of high temperature, pressure, and/or chemical reactions and operate continuously 24/7. The refined products are run down into large storage tanks in the Refinery tank farm for storage until ready for distribution. There are approximately 50 tanks of varying types and sizes in the Refinery tank farm, storing crude oil, intermediate components and finished products. Each tank is designed to store a specific type of product. While most tanks operate at atmospheric pressure, the LPG storage vessels are pressurised vessels designed to store LPG in liquid form.

The Caltex Lytton Refinery was commissioned in 1965 with an initial capacity to process

6,000 tonnes/day of crude oil. The Refinery now processes more than 13,500 tonnes/day

of crude and other intermediate feedstocks into finished products. In 2018, the Refinery

produced over 6 billion litres of high-value product, including petrol, diesel, jet fuel, and

LPG.

Laboratory testing is conducted around the clock to ensure that feedstocks, intermediates and products meet the correct specifications. Several utility systems support the Refinery’s process units, including: Flare system; Fuel Gas and Natural Gas; Steam generation and distribution; Cooling Water; and Air. Across a number of the process units, flammable gas may sometimes be discharged through pressure relief valves and blowdown lines. If the gas is allowed to accumulate, this can create a flammable atmosphere which poses a fire or explosion risk. To ensure this does not happen, the flare system consists of a network of piping which directs the relieved gas to a single, safe location (i.e. the flare) for burning. Lytton Refinery has two flares — the ground flare and the elevated flare. Some of the light hydrocarbon gases that result from the refining process are not able to be liquefied and sold as a product. Instead, these gases, referred to as Refinery Fuel Gas, are collected and distributed to several furnaces to provide heat for refining processes. Imported natural gas is used to supplement this to meet heating requirements. The Refinery also has a dedicated Waste Water Treatment Plant used to treat wastewater generated from the refining process. The plant ensures that water is thoroughly treated using a biological treatment process and tested for compliance with license conditions before it is discharged to the Brisbane River.

8

Refined and certified products are distributed to the market in one of several ways:

Pipelines NPPL1 and NPPL2 allow product to be pumped directly from the Refinery to several customer terminals on the North side of the Brisbane River;

Product can be pumped from the Refinery and loaded onto ships at the Products Wharf;

An LPG loading facility at the Refinery allows road tankers to load LPG for subsequent delivery; and

Product is pumped from the Refinery to the adjacent Terminal for loading into road tankers.

The Terminal is configured to receive all grades of petrol, diesel, and jet fuel from the Refinery’s tank farm. The fuels are pumped to the Terminal’s Tanker Truck Loading Rack (TTLR) where road tankers of up to 25,000 litres are loaded with fuel 24 hours a day, 7 days a week.

On an average day, over 150 trucks pass through the TTLR to load fuel for subsequent delivery to customer sites and convenience retail service stations. The Refinery and Terminal consist of numerous vessels, columns, tanks, and other equipment which are all connected through a network of pipes and pumps. A sophisticated system of valves, instrumentation, and a central control system allows the process to be controlled by skilled operators from a central control building adjacent to the process units. Operation of the Refinery and Terminal requires a highly skilled and competent workforce. Over 300 employees and a further 300 contractors are employed across a diverse range of roles – ranging from operations, engineering, maintenance, inspection, planning, business, and more - to ensure the facility is operated safely and efficiently. The Refinery and Terminal are manned 24 hours a day, 7 days a week.

9

The Refining and Distribution Process

Process Flow Diagram

Petrol

Petrol

Petrol Petrol

Hazardous Chemicals

Crude Oil Crude oil is a mixture of hydrocarbons ranging from light hydrocarbons (such as propane and butane which make up LPG) to heavy hydrocarbons (such as clarified oil). It is a flammable liquid with a low flashpoint. It is unlikely to pose an explosion risk, unless heated and vaporised or atomised. Crude oil is unloaded from ships at the Crude Wharf and pumped via pipeline to the Refinery’s tank farm where it is stored in large floating roof tanks, before being sent for further processing. Flammable Hydrocarbon Products Refinery products such as petrol and jet fuel are flammable liquids with a low flashpoint. If sprayed, vaporised or atomised, they can be explosive. These products, and their intermediate streams such as naphtha and kerosene, are found in equipment across the Refinery, sometimes at high temperature and pressure. They are stored in atmospheric storage tanks designed for this purpose. From storage, they can be pumped to the Terminal for truck loading, pumped through pipelines NPPL1 and NPPL2, or pumped to the Products Wharf for ship loading.

Hydrogen (H2) Hydrogen is an odourless, colourless, highly flammable and potentially explosive gas. It has a low ignition energy and wide flammability limit. Hydrogen is produced in the Reformer Unit and used as feed in the Diesel Hydrotreating Units to remove sulphur from diesel. Residual hydrogen gas goes to Refinery Fuel Gas which is combusted in furnaces around the Refinery. Hydrogen is produced and consumed within the refining process and is therefore not stored at the Caltex Lytton MHF. Liquefied Petroleum Gas (LPG) LPG is a colourless, odourless, flammable and potentially explosive gas. LPG is a generic name that refers to light hydrocarbons such as propane, propylene, butane and mixtures thereof. LPG is naturally present in crude oil. LPG is also a product of reaction in the Fluidised Catalytic Cracking Unit and Reformer Unit. LPG is stored at the Refinery under high pressure in liquid form in storage bullets and spheres. Hydrogen Sulphide (H2S) Hydrogen sulphide is a colourless, flammable gas that is toxic and characterised by a rotten egg odour. Hydrogen sulphide is generated as a by-product of the refining process, due to the presence of sulphur in crude oil. Hydrogen sulphide is routed to Refinery Fuel Gas, which is sent to furnaces around the Refinery for combustion. There is no storage of hydrogen sulphide at the Caltex Lytton MHF. Hydrogen Fluoride (HF) Hydrogen fluoride is a toxic and highly corrosive substance that is stored and circulated under pressure as a liquid but which forms a white vapour cloud that, if released to atmosphere, is irritating to the eyes, skin and nasal passages. Hydrogen fluoride is used as a liquid catalyst in the Alkylation unit to produce high value petrol components.

The Caltex Lytton MHF stores, handles, and processes large quantities of hazardous materials,

including Schedule 15 Chemicals, which can be broadly categorised as flammable liquids, flammable

gases and toxic gases. These materials, under certain conditions, have the potential to lead to a Major

Incident as a result of a fire, explosion or toxic gas release. This section summarises some of the key hazardous materials onsite, how they are used at

Caltex Lytton MHF, and the hazards associated with these materials.

10

Safety Assessment

The Safety Assessment involves a wide range of risk assessment studies that examine health and safety aspects, including qualitative and quantitative risk assessments, operability and maintainability reviews, fire and explosion analysis, and assessments against Australian and industry standards. A key part of the Safety Assessment at Caltex Lytton is the Process Hazard Analysis (PHA) program which has been an embedded process at Lytton for more than 15 years. The PHA program is an ongoing series of rigorous reviews which provide a qualitative assessment of the risk of a Major Incident for each process unit at the Caltex Lytton MHF, and identifies all the potential:

Causes e.g. failure of level gauging on petrol storage tank;

Consequences e.g. loss of containment of petrol from a storage tank with potential for ignition resulting in fire; and

Control measures in place e.g. independent high level gauging and firefighting systems.

A PHA study is a detailed systematic review conducted every five years for each process unit by an experienced team of people from the operations, engineering, maintenance and inspection teams across the Refinery and Terminal. The output of the PHA program is a comprehensive database of all the Major Incidents that have the potential to occur at Caltex Lytton MHF. Risks are ranked based on worst case consequence and likelihood with consideration given to the controls in place and then compared against Caltex risk acceptance criteria. This allows risk reduction recommendations to be prioritised to ensure that the highest risks are progressively addressed. This database is used to drive capital investment and improved administrative controls to address the identified risks and ensure continual risk reduction. Some of the potential causes of a Major Incident that have been identified through the PHA program include: equipment failure; corrosion; overpressure of a tank, piping or other equipment; failure of a pump seal; failure of operating or maintenance procedures; unintended or runaway chemical reactions; and accidental impact of vehicles/mobile plant colliding with process equipment. These events have the potential to lead to a loss of containment of a Schedule 15 chemical. Depending on the nature of the loss of containment (the type and volume of chemical, temperature, pressure), surrounding conditions and the potential for ignition, this could result in one or more consequences such as a fire, explosion or toxic gas release.

The Safety Assessment is a continual process for ensuring that risks are continually minimised so far as is reasonably practicable (SFARP). This means that any identified risks are assessed to determine whether there are additional measures that could be reasonably implemented. Any recommended actions to reduce the higher level risks are incorporated into risk reduction plans that are tracked to completion by management. The Safety Assessment is always conducted in consultation with workers, who are engaged via direct participation in risk assessments and reviews, such as Health, Safety and Environment (HSE) committee meetings, training days and safety meetings. Potential Off-Site Consequences The potential major incidents at the Caltex Lytton MHF, identified and analysed through the Safety Assessment process, are very unlikely to have offsite consequences. There are multiple control measures in place (which are summarised on page 12) so that any potential for offsite consequence is minimised. Major incidents and their potential offsite consequences relate to release of flammable material or toxic gas releases which are summarised in the table below. In the event of an emergency, follow the guidance provided on page 15.

The Safety Assessment is the process by which Caltex Lytton MHF systematically and comprehensively identifies and analyses all aspects of risks to health and safety associated with the potential Major Incidents that could occur

at the facility, and the effectiveness of the control measures in place. This process for risk identification, risk assessment and risk treatment ensures that Major Incident risks are continually minimised so far as is reasonably

practicable.

Hazard Potential Off-Site Consequence

Release of flammable liquid (e.g. crude oil,

petrol)

Potential for ignition and fire. Consequences are expected to be contained onsite at the Refinery and Terminal, however, there is potential for mild transient health impacts to industrial and residential neighbours (e.g. irritation of the respiratory

system).

A flammable liquid release may also result in smoke, visible flaring at the Refinery, noise and public disruption as a result of possible road closures, evacuation, and other actions by emergency services.

Release of flammable gas or vapour (e.g.

hydrogen, LPG or petrol vapour)

Potential for ignition and fire or explosion which is likely to be contained onsite. Consequences are dependent on wind speed and direction. Potential for explosion could result in light damage to nearby industrial buildings with injuries requiring medical

treatment, though this is a very unlikely.

A flammable gas or vapour release may also result in smoke, visible flaring at the Refinery, noise and public disruption as a result of possible road closures, evacuation and other actions by emergency services.

Release of toxic gas (e.g. H2S, HF)

Depending on wind direction and strength a H2S toxic gas release could result in offsite odours and potentially short term health impacts to industrial and residential neighbours. Also, depending on wind direction and strength, a HF gas release

has the potential for health impacts to industrial and residential neighbours, though the additional control measures in place to mitigate HF releases at the Caltex Lytton MHF make this an extremely unlikely event.

A toxic gas release may also result in visible flaring at the Refinery, noise and public disruption as a result of possible road

closures, evacuation, and other actions by emergency services.

11

Control Measures

For a given hazard and initiating cause, multiple diverse and independent controls are in place to prevent the hazard from leading to a Major Incident. Controls include engineered solutions (e.g. pressure relief systems), administrative controls (e.g. management of change procedures) and behavioural controls (e.g. operational discipline) as well as mitigating controls to limit the consequences and prevent escalation (e.g. fire detection and automatic deluge systems). This concept is illustrated in the Swiss Cheese Model below. The model illustrates how, despite having multiple controls in place to prevent an incident, an incident can still occur if the “holes” or weaknesses in each control layer line up simultaneously. The model demonstrates the importance of not only ensuring the integrity of each control layer but also the need for multiple layers of control for a particular hazard. Historically, incidents at refineries and terminals across the world have occurred due to a combination of contributing factors, or holes in the layers of Swiss Cheese, such as poorly designed systems and/or equipment, inadequate maintenance, inadequate adherence to operational procedures and failure to detect unusual process conditions.

The Onion Diagram below provides an overview of the hierarchy of controls required to operate a plant safely. As per the Onion Diagram, the key control measures that are in place at Caltex Lytton MHF include:

Adherence to strict design and construction standards for any new or modified assets;

The use of a Distributed Control System (DCS) for control of the Refinery and Terminal processes from a central control building;

Alarms to warn of any unusual process conditions;

Emergency Shutdown (ESD) systems, designed to avoid exceedances beyond safe operating limits and to automatically bring the plant back to a safe state;

Pressure relief systems to protect tanks, piping and other equipment from overpressure;

Continual surveillance around the plant by trained operators to identify any differences from normal operating conditions;

Operating procedures for non-routine Unit operations, as well as start-up and shut-down;

Management of equipment integrity through regular inspection and maintenance;

Management of Work procedures to ensure any maintenance, inspection and project work is planned, executed and handed back to the operations team in a systematic manner and a safe state;

Permit to Work procedures and safe work practices to ensure that all risks associated with work are identified, risk assessed and mitigated before work commences;

Traffic management to control the movement of vehicles around the facility, minimising the risk of impact to the plant;

Exclusion zones which limit the presence of non-essential personnel around process areas during elevated risk periods such as Unit start-up or shut-down;

Provision of training and competency, including statutory training and specific technical job competencies, to ensure all workers are able to conduct their activities in a safe manner;

Management of Change procedures to ensure that the effect of proposed changes and their impacts to health and safety risk are understood and managed appropriately;

Fire and gas detection systems, often linked to automatic deluge systems, which provide early detection and warning to prevent incident escalation;

Strict security procedures to control access into, out of, and within the Refinery and Terminal boundaries;

Strict network security to ensure that the facility’s technology and information systems are protected from malicious attack;

Emergency response equipment and procedures to ensure an effective and coordinated response to an incident.

A control’s effectiveness is ensured through appropriate design of the control, routine inspection and/or testing, as well as monitoring of the control’s performance against relevant performance standards. Examples of controls to mitigate the consequences in the unlikely event of a HF release from the Alkylation unit include a comprehensive network of HF detectors designed to detect the most minute leaks; an automated water curtain system to “knock down” a HF cloud in the event of a release; and a Rapid Acid

Transfer System designed to rapidly remove circulating HF from the process to minimise the potential release quantity.

A control measure (or simply “control”) is a measure to eliminate or minimise risk and can refer to things like equipment, systems or procedures. Controls that eliminate or reduce the risk of a Major

Incident occurring are referred to as preventative, while those that reduce the magnitude and severity of the consequences are referred to as mitigative. Caltex Lytton MHF has a wide range of preventative as well as mitigative control measures to minimise the potential for Major Incidents.

The Swiss Cheese Model

The Onion Diagram

Safety Instrumented System Layer

12

Safety Management System

At Caltex Lytton MHF, the effective application and continuous improvement of the OE Processes support the control measures for Major Incident risk. Governed by OE expectations and objectives, these processes also call upon corporate policies and standards where applicable. The key OE Processes that support control measures for Major Incident risk at Caltex Lytton MHF include: Process 1 - Leadership, Governance and Continuous Improvement Process 2 - Facilities Design and Construction Process 3 - Facilities Risk Management Process 4 - Management of Change Process 5 - Control and Authorisation of Work Process 6 - Safe Work Practices Process 7 - OE Culture and Consultation Process 8 – Occupational Health and Hygiene Process 9 - Driver and Transport Safety Process 10 - Process Safety Information Process 11 - Document Management Process 12 - OE Training and Competency Process 13 - Asset Operation and Optimisation Process 14.1 - Inspection and Condition Monitoring Process 14.2 - Assessment of Reliability Risks Process 14.3 - Equipment Criticality, Maintenance Planning and Execution Process 14.4 - Management of Safety Critical Equipment and Instruments Process 15.1 - Third Party HSE Management Process 15.3 - Road Freight Transport Management Process 16 – Environmental Management Process 18 - Security of Personnel and Assets Process 19 - Emergency Management Process 20 - Incident and Injury Management Process 21 - Compliance Assurance and Advocacy

The OEMS consists of three integral parts: 1. Leadership Accountability and Culture which ensures that leaders within Caltex exhibit strong, visible, accountable leadership to embed Operational Excellence in the Caltex culture; 2. The Management System Process (MSP) which maintains high performance in Operational Excellence through disciplined measuring of performance and acting on results; and 3. The Operational Excellence (OE) Processes which are the processes that set the standards and requirements that must be met by the business.

A Safety Management System (SMS) is a comprehensive and integrated system for the management of health and safety risks at a

MHF. At Caltex, the SMS is referred to as the Operational Excellence Management System (OEMS). The OEMS provides a framework

for Caltex to systematically identify and manage risks to process safety, as well as

personal safety and health, the environment, reliability, quality and efficiency.

The OEMS is effective because it requires leader-driven assessment of strengths and gaps, completion of risk management actions, regular review of progress and continual improvement. The Manufacturing Leadership Team at Caltex Lytton MHF recognises the importance of the OEMS and is committed to ensuring that it remains effective. This is currently achieved by conducting 6 or 12-monthly reviews of each OE Process and its performance metrics to track the effectiveness of the associated control measures and drive continuous improvement. Through disciplined use of the OEMS, Caltex Lytton MHF integrates OE processes, standards, procedures and behaviours into its daily operations. The OEMS itself is regularly reviewed to ensure it remains in line with best practice.

13

Emergency Response

The Emergency Management System works to:

Prevent occurrence of an emergency;

Prepare for a possible emergency;

Enable the site to respond effectively to mitigate the effects of an emergency; and

Enable an effective recovery following an emergency. Caltex Lytton MHF has a comprehensive Emergency Response Plan to be enacted in an emergency, which is further supported by a full suite of procedures and plans for specific emergency scenarios e.g. tank fire, flammable gas release, hydrogen fire, toxic gas release. The facility has a clear emergency command structure which ensures roles and responsibilities in an emergency are understood. Personnel in these roles undergo regular training which involves both desktop and practical exercises to ensure a coordinated response in an emergency situation. Caltex Lytton MHF works closely with external emergency response authorities, such as Queensland Fire and Emergency Services, Queensland Ambulance Service and Queensland Police Service. Caltex Lytton MHF provides a copy of its Emergency Response Plan and supporting documents to Queensland Fire and Emergency Services each time it is updated.

Caltex Lytton MHF also has a comprehensive range of emergency response equipment, both fixed and mobile, to limit the consequences of a Major Incident and prevent escalation, including:

Building fire detection and alarm systems across the facility;

Fixed gas detectors installed around the facility, and portable gas detectors worn by personnel, which provide early warning of a loss of containment of flammable or toxic gas;

CCTV which enables monitoring of process areas from the central control building;

Water and foam deluge systems installed across storage tanks and other critical equipment, such as pumps and compressors, and the Terminal Tanker Truck Loading Gantry to provide cooling and protect from radiant heat;

Five onsite fire trucks with varying capacity and capability to respond to a range of fire scenarios;

Fixed hydrants and monitors installed around the facility;

Six mobile monitors, and a mobile water/foam pumping system;

Four oil spill response boats; and

Onsite first aid and medical response vehicles, both available 24 hours a day, 7 days a week.

Emergency response is acknowledged at Caltex Lytton MHF as a key mitigative control

measure to limit the consequences of a potential Major Incident should one occur. Caltex Lytton MHF has a comprehensive Emergency Management System in place

which ensures that the facility is able to deliver an effective and coordinated response

in an emergency.

14

What you might see and hear Site alarms and sirens are intended to initiate a response from on-site personnel not to notify the community or neighbours. Howev-er, due to their volume, sirens may be heard some distance away from the facility. There are three sirens you might hear:

Refinery emergency alarm: alternating-pitch electronic siren for one minute (tested at noon every Friday immediately fol-lowed by all-clear alarm.)

Terminal emergency alarm: continuous siren (tested at 2:00PM every Friday immediately followed by all-clear alarm).

All clear alarms: four short blasts on an air horn.

Outside of testing, the emergency sirens indicate that an emergency incident has occurred and a site response is underway. See What to do in an Emergency on page 15 for more information. We also have a visible elevated flare, which is intermittently used, although it has a pilot flame burning at all times and a flow of steam to prevent smoke. The flare is an essential part of refinery operations as it allows for excess gas that may be generated during abnormal operation to be safely burned. While the elevated flare may be used in an emergency situation, it is not an indication that an emergency is underway. Use of the elevat-ed flare is a highly controlled and safe procedure and there is no need for you to report this to us or have any concerns. Caltex has an ongoing maintenance program in place which ensures the major process units and equipment located at our Lytton refinery are in effective working order and the refinery continues to operate reliably. At times, this requires bringing the elevated flare into opera-tion for the refinery to continue to operate safely. In the event of planned maintenance requiring temporary use of the elevated flare, we will endeavour to notify the community by email distribution ac-cording to our refinery neighbour notification list. If you have any concerns or questions about the sirens or the flare, or would like to be added to our refinery neighbour notification list, please contact our 24-Hour Toll-Free Community Hotline on the back of this document.

What to do in an Emergency

In the event of an emergency, the community should follow all directions given by

Emergency Services.

The Refinery emergency alarm is a 1-minute alternating pitch on the electronic siren, which is tested each Friday at 12pm. The Terminal emergency alarm is a continuous siren, which is tested each Friday at 2pm. If the emergency alarm is sounded outside of testing, Caltex will contact Emergency Services who will then take action to inform the community if there is any requirement to act. In the event of an emergency, the community should follow all directions given by Emergency Services. Caltex will work with Emergency Services to determine safe exclusion zones and determine whether a community evacuation is necessary.

15

Until notification of an evacuation is given, local residents should: Go (or stay) inside and close doors

and windows; Turn off air conditioners; Monitor television and radio news

bulletins for updates. No attempt should be made to approach the site of the incident. Where possible, please keep surrounding roads clear for use by Emergency Services vehicles. Emergency Services will inform the community when the emergency is over.

Appendix Caltex Lytton MHF Licence

16

17

For further information about Caltex Lytton Manufacturing, please call the Toll Free Community Hotline on the number below.

Address 41 South Street, Lytton QLD 4178 (Refinery) 1 Tanker Street, Lytton QLD 4178 (Terminal)

Phone

24-Hour Toll-Free Community Hotline 1800 675 487