Impact of wildfires on Canada’s oil sands facilities

. Exponential growth of oil and gas facilities in wildlands from one side and an anticipated increase of global warming from the other have exposed such facilities to an ever-increasing risk of wildﬁres. Extensive oil sands operations in Canadian wildlands, especially in the province of Alberta, along with the recent massive wildﬁres in the province, require the development of quantitative risk assessment (QRA) methodologies which are presently lack-ing in the context of wildﬁre-related technological accidents. The present study is an attempt to integrate Canadian online wildﬁre information systems with current QRA techniques in a dynamic risk assessment framework for wildﬁre-prone process plants. The developed framework can easily be cus-tomized to other process plants potentially exposed to wildﬁres worldwide, provided that the required wildﬁre information is available.


Introduction
Rising temperatures and climate change have increased the risk of weather-related hazards in Europe (European Joint Research Centre, 2017). Canada and the US are no exception as evident by the recent hurricanes, floods, and wildfires which devastated the states of Texas and California in the US and the provinces of British Columbia and Alberta in Canada. Aside from the impact of such natural disasters on the environment and urban areas, their effect on industrial plants and hazardous facilities (process plants, nuclear plants, etc.) has started to raise concerns in academia, the industry, and regulatory bodies.
Massive fires in a refinery in Turkey in 1999 during the Kocaeli earthquake, substantial release of petroleum products and chemicals in the US during Hurricane Katrina in 2005 and Hurricane Harvey in 2017, extensive damage to coastal industrial complexes in Japan in 2011 during the Great Sendai Earthquake and the following tsunami, and shutdown of oil sands plants which incurred enormous oil production losses during massive wildfires in Canada in 2016 are just some examples among others.
Although the hazard of wildfires in ecological and urban risk assessment studies has long been recognized (Preisler et al., 2004;Scott et al., 2012Scott et al., , 2013), the relevant work in the context of wildland-prone industrial complexes has been very limited (FireSmart, 2012;Khakzad et al., 2018). In Europe, for example, Seveso Directive III (2012) has only recently mandated the member states to consider the probability of natural disasters in the risk assessment of major accident scenarios when preparing safety reports (Article 10), with an explicit mention of floods and earthquakes (the Annex II) but not of wildfires. Most European countries that consider natechs (natural hazards triggering technological disasters) have likewise limited their focus to only a few natural hazards (Krausmann and Baranzini, 2012). Table 1 exemplifies some of such efforts.
Exponential growth of industrial facilities and the subsequent prolongation of wildland-industry interfaces from one side and an anticipated increase of global warming from the other are expected to increase the frequency and severity of technological accidents caused by natural disasters, including wildfires.
In May 2015, a massive wildfire in northern Alberta, Canada, spread into the oil sands areas, threatening several operations and keeping about 10 % of the production offline. Two major petroleum companies, Canadian Natural and Cenovus Energy, shut down their 80 000 and 135 000-barrel-aday operations, respectively, for safety precautions as the fires approached Foster Creek oil sands facility and Caribou South natural gas plant (Mining.Com, 2015). Table 1. Natural hazards considered in safety assessment and management of process plants in the European Union (Krausmann and Baranzini, 2012 All-hazards approach * * It is not identified whether it accounts for wildfires. In May 2016, a wildfire burned part of Fort McMurray, Alberta, Canada, and spread towards oil sands plants north of the city where major oil sands production plants Syncrude and Suncor Energy along with some smaller petroleum operations were located, resulting in a 40 % drop in production at nearby oil sands facilities (Fig. 1).
The operations shutdowns or reductions were also influenced by precautionary shutdowns of pipeline carrying diluent, a flammable substance needed to thin the oil sands' bitumen, resulting in a reduction of the oil sands' output of roughly as much as 1 million barrels a day (Maclean's, 2016a). The wildfire did not cause damage to oil sands plants and process equipment, but it burned down a 665-unit worker accommodation camp in northern Fort McMurray (Global News, 2016a). But what would have happened if the fire had reached the oil sands mines and the production facilities?
As far as the oil sands mines are concerned, bitumen, the main component of oil sands, does not easily catch fire (Global News, 2016b). Considering the fact that 80 % of bitumen is buried deep underground, the bitumen in oil sands mines is mixed with sand (similar to asphalt), and would probably smolder if ignited (Maclean's, 2016b). However, oil sands projects rely on two highly flammable substances for the extraction, processing and transport of bitumen: natural gas and diluent, which is a very light petroleum substance.
Natural gas is used to generate power for the plants and heat up the steam used to liquefy the bitumen. Diluent, on the other hand, is used to dilute the crude bitumen thin enough to flow through pipelines. Both the natural gas and diluent can pose high risks if exposed to fire, though the pipes carrying them are usually buried underground.
Oil sands process plants are usually accompanied by large tank terminals in the vicinity to store oil products. Exposed to external fires (such as wildfire), buckling of atmospheric storage tanks and spill of hydrocarbons, tank fires, vapor cloud explosions, and explosion of pressurized tanks can be recognized as potential risks (Heymes et al., 2013, Godoy 2016). In case one or more storage tanks are ignited by the wildfire, the tank fire(s) can impact adjacent storage tanks, leading to a fire domino effect.
In order to protect oil sands facilities from wildfires (and also protect the forest from potential ignition sources at the facilities), there is a buffer zone (safety distance in the form of vegetation-free ground) between facilities and forest vegetation. In the absence of methodologies for quantitative risk assessment and management in wildland-industrial interfaces, such buffer zones are usually determined based on rule-of-thumb guidelines (e.g., see FireSmart, 2012). Numerical simulations of storage tanks exposed to wildfire have, however, demonstrated that in most cases such safety distances would not suffice (Heymes et al., 2013).
Due to extensive oil sands operations in Canadian wildlands, in the present study, we have developed a dynamic framework, mainly based on available techniques and daily updated wildfire maps made available online by the government of Canada, to assess the impact of wildfires on oil sands facilities. Since the framework is modular, it can be tailored to assess the risk of wildfires at process plants in wildfireprone areas worldwide. Section 2 revisits the Canadian wildland fire information system; in Sect. 3, the components of wildfire risk assessment are described and quantified; Sect. 4 is devoted to the impact assessment of wildfires on process facilities; Sect. 5 concludes the study.

Canadian Wildfire Information System
In Canada, two systems are being used to determine the characteristics and the hazard of wildfires: the Canadian Forest Fire Weather Index (FWI) System and the Canadian Forest Fire Behavior Prediction (FBP) System. The former is mostly concerned with the estimation of wildfires' basic components (e.g., flammability of vegetation), whereas the latter deals with the dynamics of wildfires (e.g., fire intensity). Since in the present study the identification and quantification of wildfires in Canadian wildlands are mainly based on the foregoing two systems, they will be recapitulated in this section.

Forest Fire Weather Index System
Wildfires, like other types of fire, can be defined using the fire triangle consisting of fuel (trees, grasses, shrubs), oxygen, and heat source. As far as the fuel is concerned, parameters such as the Fine Fuel Moisture Code (FFMC), which is the moisture content of litter and other crude fire fuels, Duff Moisture Code (DMC), which is the moisture content of loosely compacted organic layers of moderate depth and woody materials, and Drought Code (DC), which is the average moisture content of deep compact organic layers and large logs, are taken into account to determine both the ease of ignition and the flammability of the available fuel.
DMC and DC are combined together to determine the total amount of combustible materials in the form of a so-called Buildup Index (BUI). Accordingly, the wind and the FFMC are combined to predict the rate of fire spread in the form of a so-called Initial Spread Index (ISI). Having the BUI and the ISI, the FWI, as an indication of fire danger, can be determined as shown in Fig. 2 (Natural Resources Canada, 2018). Figure 3a illustrates the FWI of Canada (0 ≤ FWI ≤ 30) on 1 May 2016, a day before the Fort McMurray wildfire. Based on the FWI and the type of fire (surface fire, crown fire, intermittent crown involvement), the fire danger index can be determined (low, moderate, high, very high, extreme) as an indication of how easy it is to ignite the forest fuel, how difficult it is to control the fire, and the type of firefighting equipment needed (pumps, tanker trucks, bulldozer, aircraft, etc.) as shown in Fig. 3b.

Forest Fire Behavior Prediction System
To quantify the impact of wildfires on industrial plants, quantitative estimates of head fire spread rate, fuel consumption and fire intensity are needed. The FBP System employs PROMTHEUS -a deterministic wildland fire growth simulation model based on Huygens' principle of wave propagation -to estimate the fire area, perimeter, perimeter growth rate, and flank and back fire behavior (Tymstra et al., 2010). The rate of spread (ROS) is the predicted speed (m min −1 ) of the fire head (fire front), which is calculated based on the fuel Head fire intensity (HFI) is an estimate of the energy output per meter of the fire front (kW m −1 ), calculated based on the ROS and total fuel consumption (kg m −2 ). The ROS and HFI indices calculated by the Canadian Wildland Fire Information System a day before the start of the Fort McMurray wildfire are shown in Fig. 4a and b, respectively (Natural Resources Canada).

Wildfire risk assessment
In wildfire risk assessment, the ignition probability, burn probability (the probability that wildfire reaches to a certain spot), type of fire (surface fire, crown fire, intermittent crown involvement) and fire intensity are the main factors to take into account (Scott et al., 2013).
Many methodologies have been developed to predict the lightning-induced ignition probability (Latham and Schlieter, 1989;Anderson, 2002) and human-induced ignition probability (Lawson et al., 1994) to model surface fire spread (Rothermel, 1972), crown fire spread (Rothermel, 1991), and the transition between surface and crown fire spread (van Wagner, 1977). Accordingly, a number of software tools such as FARSITE (Finney, 1998), FlamMap5 (Finney, 2006), FSPro (Finney et al., 2011a) and FSim (Finney et al., 2011b) have been developed based on historical records of regional wildfires, weather conditions, type and density of vegetation in the landscape, and the topology of the landscape. Using the developed models and software tools, the risk imposed by wildfires on an oil sands facility can be modeled as the 3156 N. Khakzad: Impact of wildfires on Canada's oil sands facilities  product of the wildfire probability, P W , and the severity of consequences, preferably in monetary units as (1) Given the geographical location of the facility, the probability of wildfire at the borders of the facility can be estimated as the probability of having a small fire somewhere at the landscape (P I ) times the probability of the small fire growing to a wildfire larger than 400 m 2 in area and reaching the location of the facility (P B ): (2) P I and P B are also known as ignition probability and burn probability, respectively. Exposed to a wildfire, the potential consequences and their severity depend on the wildfire intensity and the facility's vulnerability to wildfire: C = f (fire intensity, facility's vulnerability) 1 . In the following sections we will describe the components of wildfire risk in further detail and explain how they can be estimated or acquired from available (mostly freely accessible) models and databases, with a particular emphasis on the Canadian Forest Fire System.

Ignition probability
Wildfires can be categorized as hydrogeological events which are bound to increase, especially due to global warm-ing. Every degree in warming increases the possibility of lightning, which is one of the major triggers of wildfires, by 12 % (Romps et al., 2014). Likewise, 15 % more precipitation would be needed to offset the increased risk of wildfires due to a 1 • C increment of warming (Flannigan et al., 2016). Nevertheless, man-made fires (burning campfires, cigarettes) account for 80 % of wildfires (National Geographic, 2018.).
Weather conditions such as temperature, relative humidity, and wind speed are key factors in the probability estimation of an ignition (small fire) which can lead to a wildfire. In addition to the weather conditions, the vegetation moisture content (equal to FFMC) plays a key role, not only in the initiation of fire (the ignition probability) but also in the continuation and spread of fire (fuel flammability) (Chuvieco et al., 2004).
Based on the measurement of FFMC in consecutive time periods before the start of a potential wildfire, the logistic regression has been used to roughly predict P I based on FFMC (Larjavaara et al., 2004;Jurdao et al., 2012). Similarly, Preisler et al. (2004) used the logistic regression to predict the probability of small fires (fires in areas less than 0.04 ha) as an equivalent to P I based on, among others, the burning index, fire potential index, Drought Code, wind speed, relative humidity, dry bulb temperature, day of the year, and the elevation. Lawson et al. (1994) developed an application called the Wildfire Ignition Probability Predictor (WIPP) to predict, on an hourly or daily basis, the P I of man-made wildfires in British Columbia forests, Canada. Based on the calculations of FFMC and 10 m wind speed, WIPP estimates the P I in three categories as low (0 %-50 %), medium (50 %-75 %), and high (75 %-100 %). Considering lightning as one of the main triggers of wildfires, Canadian Wildland Fire System estimates the time-dependent probability of lightning-caused ignitions as (Anderson, 2002): where P LCC is the probability of a long-continuing current (85 % for positive flashes, 20 % for negative flashes across Canada); P ign is the probability of ignition given a longcontinuing current, determined by fuel type, forest floor depth, and moisture conditions (Latham and Schlieter 1989;Anderson 2002); P sur is the probability that a smoldering ignition will continue to survive as a smoldering fire, determined by the fuel moisture, the bulk density, and the inorganic content of the forest floor (Hartford 1989;Anderson 2002); P arr is the probability of a smoldering fire escalating to a flaming fire (Lawson et al., 1994;Forestry Canada Fire Danger Working Group, 1992;Anderson, 2002).
Wildfire-prone provinces in Canada such as Alberta and British Columbia provide ignition probability maps on a daily basis both for the current day and the next day. Figure 5 depicts the P I map for the province of Alberta administrated by Alberta Agriculture and Forestry.

Burn probability
Burn probability (P B ) is the conditional probability that a small fire somewhere in the landscape would escalate to a wildfire and burn somewhere else in the landscape. Estimation of P B is challenging as the spread of wildfire from one point to another is a complicated process affected by many factors such as the type of vegetation (fuel), weather conditions, and land topology. These factors, in turn, consist of several key parameters such as the flammability of fuel, vertical arrangement of fuel, moisture content of fuel, wind speed and direction, relative humidity, the orientation of fire (downhill or uphill) and the type of fire (surface fire, crown fire, surface-crown transition).
Considering the foregoing fire spread parameters, P B can be estimated as the relative frequency of wildfires' burning a certain spot, given a number of small fires at different spots of the landscape (Scott et al., 2013). Models developed for wildfire spread simulation include empirical, semiempirical, and physical models (Pastor et al., 2003). Some of these models such as FARSITE 2 (Finney, 1998) and Behave-Plus (Andrews, 2013) need detailed spatial information on topography, fuels, and weather conditions, not readily available for many locations of interest. A comprehensive review of wildfire simulation models can be found in Papadopoulos and Pavlidou (2011). Less sophisticated models and software have also been developed for fire spread modeling and investigation of whether a small fire at point A would evolve as a wildfire at point B in the landscape.
To estimate P B , fire spread models should simulate thousands of wildfires from various ignition points (Finney, 2002). For instance, Fig. 6 schematizes a fire spread model 3 in which a random small fire (ignition) somewhere in the landscape (Fig. 6a) evolves to a wildfire (Fig. 6b) and reaches an oil sands plant (Fig. 6c). The probability of the wildfire reaching the oil facility can thus roughly be estimated as where N is the total number of simulations, that is, the total number of random small fires at different spots of the landscape; and n is the total number of simulations in which a small fire turned out as a wildfire and reached the facility. Similar attempts have been made, for example, using NetLogo (Wilensky, 1997), which is a multi-agent programmable modeling environment, to model fire spread though it is based on simplistic assumptions and uses tree density as the only parameter.

Fire intensity
Head fire intensity (HFI) is the rate of heat release per unit length of the fire head (kW m −1 ), regardless of the fire's depth. HFI, which is also known as Byram's fire intensity or frontal fire intensity, can be calculated as (Byram, 1959) where H (kJ kg −1 ) is the fuel's low heat of combustion, w (kg m −2 ) is the fuel's combustion rate in the flaming zone, and r (m s −1 ) is the fire's spread rate in the direction of the fire head (Fig. 7). H is equal to the high heat of combustion minus the heat losses from radiation, incomplete combustion, and fuel moisture. Compared to the other parameters in Byram's fire intensity, H varies slightly from fuel to fuel and can thus be considered as a constant. Alexander (1982) suggests a basic value of 18 700 kJ kg −1 . Values of r and w, however, can vary significantly for different fuels. Considering r, for instance, a grass fire may travel at a rate of r = 5 km h −1 , whereas fire in a dry eucalypti forest may travel at a rate of r = 1 km h −1 capable 3 The program is available from http://www.shodor.org/ interactivate/activities/Fire/ (last access: 20 September 2018).  of throwing embers up to 1 km ahead of the fire (Cheney, 1990;Cheney et al., 1998). As a result, HFI can vary from 15 to 100 000 kW m −1 (Byram, 1959), though it rarely exceeds 50 000 kW m −1 , and for most crown fires lies in the range of 10 000-30 000 kW m −1 (Alexander, 1982). Having the flame length, L(m), Byram (1959) has suggested Eq. (6) to calculate the HFI of surface fires: In case of crown fires, one-half of the mean canopy height should be added to L (Byram, 1959). Flame length (L), flame height (h), and the flame depth (D) have been depicted in Fig. 8. At very low wind speeds on level terrain, h and L can be considered to be the same. A thorough review of developed relationships to calculate the fire intensity based on the fire length can be found in Alexander and Cruz (2012).
Based on the flame length (L), the fire intensity (HFI) can also be classified into six classes (Scott et al., 2013) as listed in Table 2; this way, the observations of L can be used to make rough estimates of HFI.
The fire intensity classes in Table 2 can be associated with the wildfire ranks used by the British Columbia Wildfire Service 4 for a quick description of fire behavior based on wildfire visual observations (Table 3). Similar classes to those in Tables 2 and 3 are also provided by Canadian wildfire protection agencies such as Alberta Wildfire (Fig. 9), which accordingly can be used to infer the flame length (L) using Table 2 and then to estimate the fire intensity (HFI) using Eq. (6). As another option, the head fire intensity maps provided by the Canadian Wildfire System (Fig. 4b) can be used to directly identify the HFI.
Having the flame depth (D), the frontal fire intensity (HFI) can be converted to area-fire or reaction intensity Q (kW m −2 ) (Alexander, 1982): Considering the flame as a solid body (Butler and Cohen, 2000; Heymes et al., 2013), the amount of reaction intensity at a distance of x from the flame's ground center (see Appendix B) can be calculated using the Solid Flame Model (Mudan, 1987) as where F view , the view factor, is the fraction of the heat radiation received by a receptor (Assael and Kakosimos, 2010), and τ a ∈ [0, 1] is the atmospheric transmissivity, corresponding to the fraction of the thermal radiation received by the receptor considering the mitigation effect of humidity and carbon dioxide as well as the dissipation due to the distance. In the determination of safety zones, τ a = 1 is used for conservative results (Heymes et al., 2013).

Impact of wildfire on oil storage tanks
During wildfires, the main threats to oil sands facilities -either the process plant or the storage terminal -come from airborne embers and radiant heat. The threat of airborne embers is even greater since they are able to travel with wind for several kilometers ahead of the fire front. The accumulation of airborne embers near tank openings and vents or under the base of structures and process vessels, given enough vegetation or spilled flammable hydrocarbons, can ignite a firealso known as spotting (FireSmart, 2012) -which may easily escalate to a major fire and possibly a domino effect given the large inventory of flammable substances stored in the facility. Assessing the risk of wildfires' embers is very tricky considering several influential parameters such as the direction and speed of the wind, the trajectory of embers, the accumulation of embers near critical spots, availability of on-site vegetation or spilled hydrocarbons, whose prediction is subject to large uncertainties if not impossible. Despite the difficulties in impact assessment of wildfire embers, simple protection and mitigation measures can be taken to effectively reduce their threat. For instance, limiting the use of floating roof tanks as the most common type of tanks reportedly involved in tank fires (Godoy, 2016), encouraging the use of cone roof tanks to prevent embers from landing around openings and vents, turning the vents downward and covering the openings with wire mesh, removing vegetation around tanks and combustible structures and equipping the structures and storage tanks with sprinkler systems are some of the measures to tackle the risk of airborne embers (FireSmart, 2012).
Aside from the impact of embers, the radiant heat emitted from the wildfire can threat the integrity and safety of process vessels and storage tanks. The type and severity of such an impact depends on the intensity of the radiant heat received by target vessels as well as their type (atmospheric, pressurized, pipeline, etc.) and dimension (usually their volume). Radiant heat acts as a thermal load on the wall of the vessels, which are categorized as thin-walled structures, and affects the stiffness and strength properties of the wall material (usually steel in the oil and gas industry).
In the case of atmospheric storage tanks such as oil and gasoline tanks, this change in properties results in wall weakening and is usually followed by large radial displacements in the form of buckling (Godoy, 2016). Buckling of steel stor- Highly vigorous surface fire with torch--Grey to black smoke ing, or passive crown fire -Organized surface flame front -Moderate to fast rate of spread on the ground -Short aerial bursts through the forest canopy -Short-range spotting 5 Extremely vigorous surface fire -Black to copper smoke or active crown fire -Organized crown fire front -Moderate to long-range spotting and independent spot fire growth 6 A blow up or conflagration; -Organized crown fire front extreme and aggressive fire behavior -Long-range spotting and independent spot fire growth -Possible fireballs and whirls -Violent fire behavior probable -A dominant smoke column may develop which influences fire behavior age tanks subject to thermal loading has been thoroughly investigated in Liu (2011) and Mansour (2012). A review of oil storage steel tanks under different types of loads, including thermal loading, can also be found in Godoy (2016). Exposed to external fires, empty or partially filled storage tanks may receive temperatures up to 5 times higher than completely filled tanks, and thus are more susceptible to buckling. For partially filled tanks, there is even a jump between the temperature below and above the liquid level (Liu, 2011).
In addition to the possibility of buckling, which endangers the integrity of storage tanks, petroleum products may ignite spontaneously at their auto-ignition temperatures in normal atmosphere without even direct impingement of wildfire flames or airborne embers. The auto-ignition temperature of most petroleum products is between 200 and 250 • C, well below the temperature required for buckling of steel storage tanks and easily reachable for storage tanks exposed to the radiant heat of wildfires. For intact atmospheric storage tanks, the auto-ignition of flammable contents would most proba- Figure 10. An exemplary storage plant exposed to the heat of wildfire.
bly lead to tank fires, while for damaged storage tanks with spilled fuel in the catch basins, it would lead to pool fires.
For pressurized tanks such as LPG 5 tanks, on the other hand, a BLEVE (boiling liquid expanding vapor explosion) is the most likely scenario. A BLEVE occurs when the increase in the internal vapor pressure of the tank exposed to an external fire grows beyond the strength of the already weakened tank wall, leading to the formation of a tear. If the tear spreads to the entire length of the tank, a BLEVE occurs, followed by a fireball; otherwise, a jet fire would be expected (Birk and Cunningham, 1994). In order to prevent an increase in the internal overpressure, pressurized tanks are usually equipped with pressure relief valves or fusible plugs, which are nevertheless likely to be damaged and fail to operate (CSB, 2008). Furthermore, to prevent a BLEVE, the American Petroleum Institute (API) has identified a maximum heat radiation intensity of 22 kW m −12 to which LPG tanks should be exposed (API, 1996). Performance and safety of LPG tanks exposed to radiant heat of wildfires have been investigated by Heymes et al. (2013).
Despite the fact that the risk of radiant heat seems easier to quantify (than the risk of airborne embers) based on current techniques and available databases, it is missing in the available directives and guidelines. For instance, FireSmart ® , a Canadian field guide for protecting oil and gas facilities against wildfires, identifies a rule-of-thumb minimum safety distance of 3 m for propane tanks (pressurized tank) from forest vegetation (FireSmart, 2012). However, Heymes et al. (2013) showed that even a small fire of 2 m high and 5 m wide is able to increase the internal pressure of LPG tanks and eventually lead to a BLEVE and subsequent fireball.
To quantify the impact of a wildfire on an oil and gas facilities, the damage probabilities of the process vessels exposed to the wildfire's radiant heat (i.e., the primary vessels) as well as the damage probability of neighboring vessels exposed to the heat radiation of fires at the primary vessels need to be assessed. In this regard, dose-response relationships which associate the damage probability of process vessels with the intensity of received heat radiation can be used.
For instance, Cozzani et al. (2005) developed simplified probit functions to correlate the time to failure (ttf) of vessels to their size and the intensity of received heat (a minimum required value of 15 kW m −2 for atmospheric vessels and 50 kW m −2 for pressurized vessels). Equations (9)-(11) can be used to assess the damage probability of atmospheric process vessels, including the storage tanks: ln (ttf) = −1.13 ln (Q x ) − 2.67 × 10 −5 V + 9.9 (9) Y = 12.54 − 1.85 ln(ttf) (10) where ttf(s) is the time to failure of the exposed vessel (due to the wildfire's heat or a primary tank fire's heat); Q X (kW m −2 ) is the received heat radiation by the vessel, calculated using Eq. (8); V (m 3 ) is the volume of the vessel; Y is the probit value; P is the damage probability of the vessel; φ(.) is the cumulative standard normal distribution. For the sake of exemplification, consider the hypothetical tank farm in Fig. 10, where atmospheric storage tanks T1 and T2 are exposed to the wildfire's radiant heat of greater than 15 kW m −2 and may catch fire. Tank T3 is too far to be damaged directly by the wildfire's heat radiation but may be damaged via a domino effect given wildfire-induced fires at T1 or T2.
Given the characteristics of the wildfire, the location of the tank farm (e.g., using Fig. 4b) and the distance of the storage tanks from the head fire, the amount of radiant heat received by T1 and T2 can be calculated using Eqs. (7) and (8); accordingly, the conditional damage probabilities of the tanks given the wildfire, i.e., P (T1|wf) and P (T2|wf), can be estimated using the probit functions given in Eqs. (9)(10)(11). Given that the wildfire would ignite tank fires at either T1 or T2, three mutually exclusive domino effect scenarios can be envisaged in which T3 would be damaged and catch fire from either T1 or T2 (Fig. 11).
As a result, P (T3|wf) can roughly be estimated as the aggregation of the three domino effect scenarios as  catches fire as it is exposed to the heat of the wildfire, and triggers secondary fires at T2 and T3 via a domino effect. (b) T2 catches fire as it is exposed to the heat of the wildfire, and triggers secondary fires at T1 and T3 via a domino effect. (c) Both T1 and T2 catch fire as they are exposed to the heat of the wildfire, and trigger a secondary fire at T3 via a domino effect. Tanks directly impacted by the wildfire have been highlighted yellow. Similar to P (T1|wf) and P (T2|wf), the conditional probabilities P (T1|T2), P (T2|T1), P (T3|T1) and P (T3|T2) can be estimated using probit functions in Eqs. (9)-(11) based on the amount of heat radiation a secondary tank receives from fire at a primary tank. Having the conditional damage probabilities of the storage tanks (conditioned on the occurrence of a wildfire of given characteristics), the marginal damage probabilities, e.g., for T3, can be calculated as P (T3) = P w · P (T3|wf) = P I · P B · P (T3|wf).
For large oil and gas facilities with many process vessels of different types and dimensions, for which complicated interaction among the process vessels would not allow a manual calculation of damage probabilities, more sophisticated techniques such as a Bayesian network (Khakzad, 2015) can be employed.

Conclusions
The present study has been inspired by recent massive wildfires in the province of Alberta, Canada, jeopardizing the operation and safety of oil sands facilities as a key contributing factor to the nation's economy. Despite the extensive oil sands operations in Canadian wildlands and an everincreasing risk of wildfires, mainly due to global warming, quantitative methodologies for assessing and managing the risk of wildfires in the context of natechs (i.e., technological accidents triggered by natural disasters) are lacking.
In the present study, we made an attempt to develop a risk assessment methodology for wildfire-prone oil sands facilities by integrating the Canadian online wildfire information system and available quantitative risk assessment (QRA) techniques. Since the wildfire information system is updated on a daily basis, providing forecasts for the same day and the next day, the developed methodology can help facilities owners and safety managers predict the risk of wildfires at least a day ahead of time and thus devise appropriate protection and mitigation measures.
In most wildland oil and gas facilities, the separation distances (buffer zones) between oil facilities and forest vegetation are usually determined based on approximate analyses (e.g., in Canada, it is based on FireSmart ® guidelines). As such, similar methodologies to the one proposed in the present study can be developed, not only for the risk-based identification of more dependable buffer zones, but also for the design of oil facilities so as to increase their robustness against wildfire-induced damage and potential domino effect scenarios.
Data availability. No data sets were used in this article. Initial Spread Index L: flame length P (.): marginal damage probability of target vessel P (.|wf): conditional damage probability of target vessel given a wildfire P arr : probability of a smoldering fire escalating to a flaming fire P B : burn probability P ign : probability of ignition given a long-continuing current P I : probability of ignition P LCC : probability of a long-continuing current P sur : probability that a smoldering ignition survives P w : probability of wildfire Q: reaction intensity Q x : heat radiation at the distance of x r: fire's rate of spread in the direction of the fire head ROS: rate of spread ttf: time to failure of target vessel V : volume of target vessel w: fuel's combustion rate in the flaming zone WIPP: wildfire ignition probability predictor x: horizontal distance from the flame's center Y : probit value τ a : atmospheric transmissivity φ: cumulative standard normal distribution 3164 N. Khakzad: Impact of wildfires on Canada's oil sands facilities A = α 2 + (β + 1) 2 − 2α (β + 1) sin θ B = α 2 + (β − 1) 2 − 2α (β − 1) sin θ C = 1 + (β 2 − 1)cos 2 θ ∅ = (β − 1)/(β + 1) E = α cos θ β − α sin θ F = β 2 − 1.
The angle of tilt, θ, can be calculated as a function of wind speed u w as (Pritchard and Binding, 1992) tan θ cos θ = 0.666 F r 0.333 Re 0.117 , where Fr is the Froud number Fr = u 2 w g∅ , and Re is the Reynolds number Re = u w ρ a ∅ η a , both non-dimensional numbers. ρ a and η a are, respectively, the density (∼ 1.21 kg m −3 ) and viscosity (∼ 16.7 µPa s) of air; g is gravitational acceleration (∼ 9.81 m s −2 ). Figure B1. Flame as a tilted cylinder.