Click for next page ( 94


The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 93
4 SAFETY CONCERNS The committee was asked to address the safety concerns that could arise during the marine application and operation of hydrocarbon vapor control and recovery systems. In this chapter, the potential hazards attributable to the installation and operation of these systems are identified and evaluated. Historical performance data, the European experience with vapor control and recovery systems, and potential acci- dent scenarios are discussed. Various approaches to minimize the risk of accidents at such facilities are suggested. ACCIDENT SCENARIOS Three main types of undesirable events may occur during marine trans- fer of liquid hydrocarbons or during ballasting: 1. a fire resulting from the ignition of a liquid spill or an uncon- fined flammable vapor cloud; 2. an explosion resulting from the ignition of a flammable vapor/air mixture in a partially or totally confined area; and 3. water pollution as a result of an accidental liquid release. Fires and explosions require the presence of ignition sources having an adequate level of energy. These sources include static discharge, lightning, the use of improper electrical equipment, smoking, open flames, and unguarded combustion systems. Human error is the major con- tributing factor to the presence of practically all ignition sources, except for lightning. Static buildup can, for example, be minimized by loading tanks at velocities consistent with accepted industry guidelines (International Chamber of Shipping et al., 1986) and by minimizing splashing. Failure to adhere to standard operating procedures, such as allowing an adequate time period for static charge dissipation before dipping, sampling, and ullaging, has been cited as a major contributing factor to static charge ignition. Similarly, failure to adhere to nonsmoking requirements, failure to use explosion-proof motors and other electrical components, and the absence of flame and detonation arrestors, or the 93

OCR for page 93
94 presence of inadequately maintained units, can all be traced to operator error and failure to follow standard operating procedures. Water pollution during transfer operations occurs when a tank or transfer pipe ruptures or leaks or when the tank is overfilled. Tank rupture may occur as a result of overpressurization, an internal explo- sion, or an implosion due to fast liquid withdrawal. The transfer hose/ piping may rupture because of mechanical damage or sudden vessel move- ment, such as during inclement weather. Corrosion could also contribute to tank and pipe failures. A small explosion in a vapor transfer pipe could rupture the pipe or result in the propagation of a detonation wave to both vessel and shore tanks; either of these losses of integrity could result in the release and ignition of the contents. The extent of the hazard is obviously a function of the preventive measures employed to minimize the frequency of such occurrences and the measures taken once the accident occurs to ~ e minimize its consequences. These types of accidents may occur regardless of whether vapor con- trol and recovery systems are in use. They may be related, in that the occurrence of any one may lead to another. An accidental spill may, for example, be ignited and result in a fire which may engulf pressurized containers and result in explosions. For accidents during marine transfer of hydrocarbon fuels, the details of each accident scenario will depend on several factors, including: 0 type of delivery or receiving vessel, such as inland barge, ocean barge, or self-propelled tankship; O type and quantity of liquid cargo being transferred, for example, crude oil, gasoline, liquefied natural gas, or liquefied petroleum gas; 0 presence, if any, and types of vapor control and recovery systems used, such as adsorption, absorption, incineration, vapor balance, re- frigeration, and inerting, or any combination; location of the initial event, for example, above deck, below deck, in transfer lines, or in shore facilities; 0 operations underway, such as ballasting or loading; presence or absence of adequate, well-maintained and tested auto- matic detection, alarm, and hazard control equipment; and presence or absence of properly trained operating and response personnel. HISTORICAL ACCIDENT DATA Historical accident data are a valuable tool for determining poten- tial failure modes and future accident scenarios. Although the data base for vapor control and recovery system accidents is not large, it can be examined together with general marine accident causes to visual- ize potential accidents involving vapor control and recovery systems and to suggest preventive approaches.

OCR for page 93
9s General Marine Liquid Transfer Accident Data Marine accident data on fires, explosions, and water pollution dur- ing the transfer of liquid hydrocarbon fuels were extracted from U.S. Coast Guard computerized files. The data were limited to accidents occurring in U.S. ports during loading, discharging, and ballasting of barges and tankers. In the period from 1980 to September 1986, there were 18 fires/ explosions involving barges. Three of the barges were total losses, while seven were rendered unseaworthy. The accidents resulted in six deaths and an equal number of injuries. Twelve of the fires/explosions occurred in the cargo tanks, five in the pump room and machinery space, and one was of unknown location. Ten accidents of known origin involved human error as the major contributing factor. Eight of the accidents were directly attributable to personnel disregarding proper safety pre- cautions and regulations, improper securing or rigging, and careless- ness. The remaining two incidents were caused by static electricity and a mechanical material failure. Two of the barges (Hollywood 1015 and Hollywood 1016) were involved in the same explosion and fire (U.S. Department of Transpor- tation, 1986~. Ignition was attributed to a flashback from an acrylo- nitrile vapor flare system. This explosion is discussed in more detail later in this chapter. For the same period, there were 22 fire/explosion accidents in tank- ships, in which 6 deaths and 8 injuries occurred. Two of the vessels were total losses, while 11 were rendered unseaworthy. The locations of the fires/explosions were: e Machinery space--9 0 Cargo tanks--5 0 Pump room--3 0 Boiler--3 e Electrical equipment--1 0 Unknown--1 The contributing factors were known in 19 cases. Six were directly attributed to personnel error, while 13 were due to vessel equipment failure (i.e., mechanical, electrical, fatigue), most of which could have been prevented through proper maintenance and inspection. None of these tanker accidents involved any type of vapor control and recovery system, since none were employed at the time. The data do illustrate, however, the high frequency of accidents due to human error. Data from Lloyd's List (Table 4-1) provided information on 26 explo- sions that took place over a 12-year period on vessels equipped with inert gas systems (see Chapter 2~. These accidents are not restricted to marine transfer operations. However, the table confirms that an inert gas (IG) system is not a panacea for tanker fires and explosions. It must be well maintained and operated to minimize the probability of fire or explosion. Operating under the false assumption that the mere presence of an IG system ensures that the tanks are inerted may lead to fires or explosions.

OCR for page 93
3 ., ~ ,5 ~ ~m ~ .! rig, 1; t`~ . ~ I've ~'5! 1~ .~,.~l 5~ I- i: ]~] 's811 l ~ t~? ti? ti ~& ~ AL f~ .5 .g 0 ~ 0~ rn ~0 ~ d. 0 ~ Do ~ ~ ~ a, ~ON ~ ~ ~ ~ C51 - -- ~ - - - - ~ - 0 so- ~m a, ~ 0~ Cal o o Q E o o CO n ~ I) O O '- ~E X o ~ ~ oo 0 0 ~ ~ Lr o o o ' ~ v v ~ ~ v v o o o co o .~- ~-~- ~n {D ~U] 1D {D o o c . - o o ~ ~z ~ ~ ~ 0 ~D oo ~ ~ N N ~ O C) O ~ bC o :r: 0 0 00 ~ O O ~ - r~, ,~ ~ ~ ~ _ _ ~ ~ ~ O 4 ~ ~ O :~ o ~ '~ O C) ~ ~ o ~ E E ~ q; m~ ~o o o 0 oo 0 0 ~ oo IS) ~ N ~ d ~ ~) 000 0 0 0 mmm m m mmm a, d~ 10 0 N (t) O O ~ ~- ~ N ~ d ~ C~ c~) lo ~ - ~o N ~) O O C ~0 N N ~N ~) N - 1 N N N ~N ' - ~ O :` ~ E ~: O oo r~ ~ N C~ O . - ~n O o~ ~ a ~be ~ q) q) bo ~ - 0 00 ~i ~ O ._] Q E~ q) ~ ~ u~ ~ ~ ~ be bo~ ~ ~ ~ q) ~ ~ct q) 5- ~ Cn >:: O ~ ~r~ ~) r~ ~ ~ ~ ~) d. 0 N O O O O ~ ~ 11 0 U] .N

OCR for page 93
97 The latest edition of the International Safety Guide for Oil Tankers and Terminals (International Chamber of Shipping et al., 1986) acknowledges the possibility of explosions aboard tankers equipped with IG systems and warns of hazards due to static electricity and pyrophoric iron sulfides in case of a failure in the system during discharge. Marine Liquid Transfer Accidents with Vapor Control and Recovery Systems Very few vapor control and recovery systems are in operation today. Their use is limited mainly to vessels transporting highly toxic, flamma- ble, and malodorous materials. Thus, the number of accidents involving these systems has been relatively small, and the data are not statisti- cally significant to allow the prediction of accident frequencies. How- ever, available historical data allow one to anticipate the kinds of accidents that might involve vapor control and recovery systems should they become more widely used. As far as could be determined, only one accident occurred in the United States involving a vapor control and recovery system during the period from 1980 to September 1986. This accident occurred at 21:30 on November 1, 1983, when the tank barges Hollywood 1015 and Rolly- wood 1016 exploded, burned, and sank while transferring acrylonitrile at the barge dock of the Sohio Chemical Company, Vistron Green Lake, Texas (U.S. Department of Transportation, 1986~. All the cargo tank lids were blown off both barges. Two operators received minor injuries, and a tug in attendance was slightly damaged. The barges were receiving acrylonitrile from the storage area through about 10,000 ft of 10-in. pipe. The vapors created during the loading operation were transported through the tank barges' vapor recovery system piping and burned in a flare at the dock. A combination of events led to a flame flashing back from the flare to the barges. The Coast Guard investigation showed that the flashback occurred when the vapor flow rate in the recovery system fell below that of the flashback velocity of acrylonitrile. The flame propagated through the flame arrestor, which was useless because it had three holes ranging in size between 0.5 in. and 1.5 in. Plates were deformed, near- ly doubling the 1-mm minimum required distance between plates. The damage had apparently been caused by thermal expansion before the acci- dent. In addition, a water seal pot located ashore was not filled to the appropriate level (attributed to operator error and dirtiness of the sight glass). The seal-pot level alarms were also disconnected (due to operator error). Anecdotal information on European casualties involving vapor control systems used in loading self-propelled river barges was given to the - ^On European waterways, cargo is carried on "barges" that often contain living quarters and propulsion machinery. There is no American equivalent of these vessels, which in this country would be classed as small tankships.

OCR for page 93
98 committee (personal communication, Robert Conn, Shell Oil Co., Houston, Texas, fall, 1986~. This information is incomplete and in some cases vague as to the precise circumstances of the accidents, but it does point to some potential problem areas. Fires and explosions can result from over- and underpressurization of cargo tanks during closed loading or discharge, owing to defective or improperly used tank level gauging and alarms or to excessive cargo transfer rates. Static discharges from a variety of causes can bring about ignition of vapors, especially if vessels and transfer equipment are not properly grounded or if cargo- loading rates are excessive (NTSB, 1987~. Detonation arrestors in- stalled in vapor lines to stop detonation waves can fail to prevent fires, especially if the lines have bends in them. (In at least one case, a detonation wave burst every right-angle bend in a vapor line, passing through several detonation arrestors.) Vapor Control and Recovery Systems in the Petrochemical Industry Vapor control and recovery systems are employed in the petrochemical industry at numerous locations. They do not appear to present any parti- cular or additional hazards to the industry. However, these systems are operated continuously and are maintained and checked regularly as part of the overall process. In general, vapor control and recovery systems at petrochemical facilities are operated from central control rooms that are continuously manned, and where malfunctions are quickly noted and corrected. Generally, each system is dedicated to one vapor stream of relatively well-known composition and physical condition. It would be unreasonable to expect vapor control and recovery sys- tems operated by smaller, less sophisticated operations to receive the same care and attention they would in larger units of the industry. Differences in operating conditions include: o lack of personnel trained in vapor control and recovery system maintenance, operation, and repair; o sporadic nature of marine transfer operations, so that systems may sit idle for long periods of time; 0 variety of products that may be transferred, which require greater system flexibility; and o assortment of connecting hoses and pipe diameters that must be dealt with. POTENTIAL HAZARDS OF VAPOR CONTROL AND RECOVERY SYSTEMS General Hazards Before examining the potential hazards associated with the operation of specific systems, it would be appropriate to identify common features that may contribute to an increase in risk due to the installation and use of the systems.

OCR for page 93
99 Vapor control and recovery systems are inherently more complex pro- cesses than the simple pumping and vapor venting operations employed today. Complex add-on systems do not necessarily and automatically increase the hazards of an existing operation. Vapor control and recov- ery systems can be designed to operate as safely as existing systems by using appropriate detection, alarm, and control devices and redundant safety components, but at an increased cost. Such highly sophisticated chemical processing systems will require that they be operated by well- trained personnel and maintained and inspected regularly. Presently, tankermen and shore crews have minimal technical training and educa- tional background. Barge tankermen, for example, may be transient and may not have substantial technical education. Most have U.S. Coast Guard tankerman certificates, for which they are not retested on a regular basis. In addition, any licensed master, mate, pilot, or engi- neer is automatically certificated as a tankerman, with no requirement for experience in loading and unloading barges. It is a recognized fact that human error is the major cause of industrial accidents. Unless well-trained, technically educated, dedicated personnel are assigned to the operation and maintenance of such systems, errors in judgment and improper procedures will be the major causes of accidents. Vapor control and recovery systems require the use of closed vapor collection systems with relatively long transfer lines. To allow for the high rate of loading and discharging of the liquid product, vapor lines are designed to have the largest practicable diameter. The acci- dental introduction of air into such a pipeline system is an invitation to a major disaster. Ignition in a long duct results in an accelerating wavefront and possibly a detonation. The effectiveness of commercially available detonation arrestors in stopping the fast, propagating flames of all potential fuel vapors is questionable. Bends in the vapor line tend to shorten the time to and increase the likelihood of detonation (but do not increase the maximum pressure). Since the shore facility and vessel are connected via the vapor line, an explosion at either location or within the vapor line may propagate to and damage all interconnected storage tanks. Since vapor control and recovery systems are closed operations, special precautions must be taken to prevent overfilling and spillage during loading. Overloading may result in liquid entering the vapor lines and rupturing them. High-level alarms and automatic shutoff valves are not totally reliable. Electronic and mechanical level indi- cators have problems with solidifying and polymerizing products and corrosive cargoes. Redundant gauging systems, operating on different principles, may be required to ensure reliable operation. Because of the care that must be taken during loading and discharg- ing of cargoes at terminals equipped with vapor control and recovery systems and because of the limitations on pumping rates imposed by the size of the vapor return lines, the duration of a typical transfer opera- tion will be increased. Not only will this increase the period Where small diameter vapor return lines limit pumping rates, a significant risk of tank overpressure exists.

OCR for page 93
100 during which the facilities are at risk, but operators will tend to take shortcuts to speed the process and reduce costs without realizing the potential hazard. The nonuniformity of vessels and their connections and the wide vari- ety of cargoes that may be handled by one vessel in separate transfer lines present a potential problem of incompatibility between vessels and shore facilities. Jury-rigged connections for the purpose of expediting the transfer process will increase the risk of accidents. Another operational concern is the need for adequate documentation of barges. Barges are often "tramped" along their routes, passing from hand to hand as they move toward their destinations. They are required to carry documentation so that tankermen and towing personnel know about the materials and cargo systems they are handling. These requirements must be conscientiously carried out. The hazards of poor documentation would be magnified by closed loading and vapor handling. Specific Hazards of Vapor Control and Recovery Systems Vapor Balancing Loading and venting rates must be carefully balanced to avoid ruptur- ing or imploding cargo tanks. Present barge designs allow permanent de- formation of the tanks at pressures as low as 3 psig and rupture at 4-7 psi". The tanks could distort or implode at a vacuum of only 1 psi". Pressure/vacuum (PV) valves have been known to stick shut or open owing to the accumulation of dirt, corrosion, and solidified or poly- merized products. Thus, PV valves cannot be relied on completely for over- or under-pressure protection. The blowing or pigging of lines has also been cited as a major cause of tank failure in Europe. A vapor flow rate that exceeds the venting capacity of the line can lead to a sharp increase in pressure and line or tank rupture. Carbon Adsorption The major problem associated with carbon adsorption vapor control and recovery systems is the potential for spontaneous heating and igni- tion of the carbon bed, especially after shutdown (Naujokas, 1985~. Vacuum stripping of the carbon bed is preferable to steam stripping, since it avoids subjecting the bed to high temperatures. At oxygen con- centrations as low as 10 percent, the bed can gradually heat up to the ignition temperature. Fires in carbon beds are difficult to extinguish. Combustion Systems Incineration and flare systems are both susceptible to compressor failure and flame flashbacks, particularly during startup and shutdown. If a flare is accidentally extinguished (e.g., by wind), an explosion

OCR for page 93
101 may occur on reignition. Several accidents have been reported during or after taking flare systems out of service for maintenance (Kilbyj 1968~. Absorption High-pressure absorption systems require the use of a compressor that would raise the pressure of the hydrocarbon-rich air to 100-200 psi. Gasket failure in the compressor may lead to a leak and subsequent ignition of the released vapor. A failure in the hydrocarbon supply line or a reduction in the vapor introduction rate may bring its concen- tration to within the flammable range, leading to a compressor explo- sion. Refrigeration Refrigeration systems operate at temperatures below -100F. Several problems arise at low temperature. Changes in the properties of contain- ment materials may render them brittle, for example. Freezing and accu- mulation of such components as water vapor, carbon dioxide, and hydrocar- bon hydrates can also clog the system. Compressors used in conjunction with refrigeration systems also introduce additional possible ignition sources. TECHNOLOGIES TO REDUCE THE RISK OF FIRE AND EXPLOSION Hydrocarbon vapor control at marine terminals will require careful design and risk analysis of the design to identify weaknesses in the system. Vapors being returned from a tankship or tank barge may fre- quently be in the explosive range (about 1-10 percent hydrocarbon in oxygen, with variations depending on hydrocarbon type, moisture, and other factors). Handling these vapors will add some degree of risk to cargo transfer operations. However, the terminal and marine trans- portation industries have much experience in dealing with these risks safely, and a range of technologies can be applied to prevent or limit the effects of fires and explosions. Inerting or Enrichment of Vapors The terminal operator must generally require that the vapors are either inert (owing to the addition of nonreactive gas) or overrich (with the addition of a reactive gas) to ensure that the vapors are either above or below the explosive range. For some terminals that * An independent survey found that more than 70 percent of barges engaged in the carriage of gasoline or diesel cargoes routinely con- tained vapors in the flammable range (NTSB, 1987~. ,

OCR for page 93
102 serve only tankships, which are generally inerted, this decision may be irrelevant. For terminals that load tank barges and smaller, noninerted tankships, however, it will be very important. If the vapor control system will have any flame or mechanical source of ignition such as a compressor or blower, inerting is very highly recommended. Likewise, inerting should be considered if the vapors are to be transferred any appreciable distance or at high velocity, since electrostatic charges can be generated by hydrocarbon vapors flowing in a pipe. Vapors may be inerted or enriched as they enter the system by inject- ing inert gas or light hydrocarbon gas into the vapor line at the dock. This operation, of course, requires careful monitoring and control and significantly increases the load on process equipment associated with the vapor control system. However, these costs may be necessary to ensure safety if a convenient and safe location for the process equip- ment is not available on the dock, immediately adjacent to the vessel. Inerted or enriched systems should include reliable and well- maintained oxygen or hydrocarbon concentration sensors with associated alarms, process shutdowns, and quick-closing valves to stop the flow of vapors to possible ignition sources if an explosive vapor mixture is detected. Regardless of whether vapors are inerted, ignition sources should be avoided wherever possible in designing recovery systems. Designs should be scrutinized to eliminate unnecessary flames, mechanical friction, compression, exothermic chemical reactions, and sources of electrostatic discharge. Obviously, all potential ignition sources cannot be elimi- nated in systems where vapors must be transferred over long distances or where flaring or incineration is the control process chosen. Passive Safety Devices Since active safety systems are subject to mechanical failure and human error, passive safety devices should be included in the system design. One such passive device is the detonation arrestor? which is similar to many flame arrestors in that it provides a large heat- conducting surface to cool and quench flames. Detonation arrestors differ significantly from flame arrestors, however, in their rugged construction, which permits them to remain effective when the flame front is accompanied by the extreme pressure front that results from a fully developed detonation traveling through the pipe. Common end-of-line flame arrestors are totally ineffective in handling such fast-moving flame fronts and should be used only at open- ings into the system, to prevent flames from entering. Flame arrestors for use at openings to the atmosphere should have U.S. Coast Guard approval. In-line detonation arrestors, in the large sizes suitable for use in tank vessel vapor control, are relatively new and should be installed according to carefully worked out designs. Research and development in detonation arrestor design at the necessary large sizes and vapor capaci- ties are desirable. Each installation will require testing, conducted

OCR for page 93
103 in accordance with a procedure that tests the device against more severe conditions (such as longer pipeline run-up distances and more pipeline bends) than the specific application may call for. An example of such a test can be found in the International Maritime Organization document known as MSC Circular 373 (International Maritime Organization, 1984~. Additional assurance may be gained by having this test performed in a mock-up of that part of the system protected by the detonation arrestor. Flame arrestors should be located at every opening from the system to the atmosphere. Detonation arrestors should be installed in-line, upstream of the vapor control process, and at each possible ignition source. Additionally, a detonation arrestor should be located near the dock vapor connection and on the tank vessel at its vapor flange. Since very high pressures are associated with a detonation flame front, a rup- ture disk should be installed downstream near the detonation arrestor, oriented to allow the pressure front and flame to blow into a safe area should a detonation occur. In long or complex vapor piping, additional rupture disks should be located at all 90 bends. Another technology that should be considered as a backup safety measure on shoreside installations is the explosion suppression system. This is a simple device that detects the sudden pressure rise that accom- panies the ignition of the vapor and, within milliseconds, inhibits the flame front with a blast of the fire suppression chemicals halon 1301 or 1211. Pressurized baton cylinders and sensitive pressure detectors are connected to the piping at as many points as necessary to ensure com- plete flooding and early detection of an explosion. For the system to be effective, cylinders and sensors must be spaced closely enough to prevent the combustion from having the time to develop into a high-speed detonation. The unit costs of the cylinders and sensors are relatively low, and these devices should be considered for any location in the piping where an ignition is likely to occur. MITIGATION MEASURES To ensure the safe operation of vapor control and recovery systems, the following measures must be considered: 1. Minimum requirements should be developed for the scheduled main- tenance and inspection of all vapor control and recovery system compo- nents and control and alarm devices, including IG systems, PV valves, flame and detonation arrestors, level gauges, compressors and blowers, pilot flames, and oxygen monitors. 2. Training programs and minimum educational requirements should be developed for both shore and vessel operators of vapor control and recov- ery systems. 3. Except in special cases, where the probability of encountering ignition sources can be shown to be exceptionally low, vapors should be required to be inerted before being treated or transferred any signifi- cant distance. Minimal considerations for such noninerted cases would include (a) process equipment free of ignition sources, (b) no blowers or other flow-assist devices in vapor lines, and (c) theoretical calcula

OCR for page 93
104 tions and test data showing that the proposed vapor piping is short enough, and the flow velocity low enough, to minimize the likelihood of an electrostatic charge being generated in the pipe. 4. Data on the reliability of detonation arrestors should be devel- oped by testing under realistic field conditions Berg., long vapor pipeline runs, 90 bends). 5. Installation of a secondary explosion suppression or control sys- tem should be considered. One approach is to use halon suppression systems; another is to install blowout panels or rupture discs at inter- mittent locations along the vapor line to prevent pressure buildup as a result of an internal explosion, minimizing the probability of shock generation and propagation through the arrestor. (See the discussion of these technologies in Chapter 3.) Another desirable alternative, espe- cially in instances where the vessel operator has little control over the procedure used in the shore facility, is to install a shipboard pres- sure control system to allow the ship to control the cargo tank pressure independent from the shore facility. 6. From a safety standpoint, it is important to standardize opera- tions and transfer and communication equipment to ensure compatibility between different types of vessels and all shore facilities they serve. Vessels that visit ports in different states should not be confronted with requirements for different procedures and equipment. Connecting flanges must be of the same size. System pressures must be similar. Detonation arrestors and other safety equipment must be compatible with corresponding items aboard vessels. Procedures at all facilities must be consistent. 7. Redundant, reliable level gauging systems need to be employed on marine tankships, with high-level alarms at 95 percent and an automatic pump shutdown at a higher level (such as 98 percent), with manual over- ride. In addition, an improved communications system between vessel and shore facilities needs to be established to ensure that the tanks will not be overfilled. 8. New hazard mitigation technologies need to be evaluated. Re- search is needed to investigate the effectiveness of monomolecular layers and vapor suppression foams that may be used to minimize vapor generation in marine tanks. Methods for the application and replen- ishment of these additives in the tanks should be developed. Their effect on the quality of the product and their compatibility with tank materials should also be investigated. RISK ANALYSIS One of the questions addressed by the committee was whether or not vapor control and recovery systems would increase the risk of fire and explosion accidents should they be installed and operated at marine transfer facilities. To answer this question properly requires the cal- culation of risk. Such a calculation is also necessary to compare the costs and benefits of these systems to society. The expected annual losses due to accidents involving vapor control and recovery systems should be added to the annual cost of operating these facilities and

OCR for page 93
105 include: capital investment; regulatory costs associated with the admin- istration, enforcement, and inspection of vapor control and recovery systems; and operating costs, including additional specialized labor, maintenance, and training. The risk of an accident may be defined as the potential loss over a specified period of time. It is equal to the product of the expected frequency or probability of occurrence and the potential severity or consequence of the accident: Risk = Frequency x Severity. Frequency is usually measured in terms of the probable number of acci- dent occurrences per unit time, while severity is measured in terms of the potential number of fatalities or injuries and the dollar loss due to property damage and downtime with each occurrence. Because of the limited number of vapor control and recovery systems used today and the relative short history of their use, both in the United States and Europe, there are not enough historical data to quan- tify the potential increase or decrease in risks associated with their use. Furthermore, the risks of accidents involving these systems are highly dependent on such factors as the geographic location of the marine terminal, the size of the exposed population, the value of the terminal and adjacent property that might be affected in case of an accident, the frequency with which the system is operated at the site, and the preventive and protective measures deployed at the site. Since the assessment of the risks associated with vapor control and recovery system operations is highly site-specific, it will be necessary to carry out risk calculations for each type of system at various "typi- cal" terminal locations. Such calculations require that the potential frequency of a postulated accident (such as the historical accidents described and those postulated for specific systems earlier in this chap- ter) be estimated using a fault tree analysis. This is a systematic procedure in which all immediate and alternative steps that could have led to the undesirable event are identified and displayed in the form of an upside-down tree. These steps, in turn, are traced back through the system until one arrives at the ultimate causes that initiated the sequence of smaller events that led to the undesired event. These causes may be failures of individual hardware components, materials, or control instruments, human error, or other factors which either singly or in combination could have led to the hazardous event. The fault tree is then quantified by entering the probabilities of occurrence of the basic failures. Probabilities of material and equip- ment failure and of human error are available from various sources. If not, they may be estimated using engineering judgment and historical data. It is possible then to calculate the probability of occurrence of the undesired event and to identify those basic failures and paths that are most critical (i.e., those with the highest probabilities of occur- rence). Priorities can then be established for taking corrective action. The quantitative fault tree may also be used to gauge the contribution of a specific mitigation measure toward reducing the over- all frequency of the undesired event.

OCR for page 93
106 The severity of an accident may be estimated by using injury and damage criteria and analytical or empirical models that can predict the extent of the hazardous zone or accident footprint (e.g., distribution of thermal radiation distribution from a fire in a storage tank or from a flammable cargo spilled on water, contours of overpressures from an explosion, and vapor concentration profiles from a toxic gas release). The hazardous zone is superimposed upon a detailed map of the affected area to estimate the potential for public exposure and property damage. There are two major drawbacks to risk analysis. First, in devel- oping the fault tree, the analyst may unknowingly omit certain sequences of events that could lead to accidents, or he may omit events he judges to be highly unlikely. Such an oversight is particularly more likely to occur when analyzing complex systems with little historical background. The work of Wagenaar (1986), which uses a data base of 100 shipping accidents, provides some evidence that increased system complexity adds risk. Wagenaar states that complexity makes it impossible for humans to comprehend cause-effect relationships and therefore they cannot make judgments about the riskiness of their actions or inactions. The other problem with risk analysis concerns uncertainty. There are uncertainties associated with the probabilities of occurrence of events, particularly as they apply to human-related events. In addi- tion, some uncertainties are associated with the models used to predict the consequences of accidents. Thus, it is important to assign uncer- tainty bands to all values assumed in the risk analysis. Secondary Impacts The increased cost of operating marine transfer terminals and ves- sels due to the regulation of vapor emissions may induce firms to leave the shipping business completely, or to transfer their business to unreg- ulated terminals, if available. The increased costs may also displace some water shipping to other modes of transport that are less safe, as outlined below. On a ton-mile basis, most of the hazardous materials transported annually in the United States are moved in domestic waterborne commerce by bulk containers, such as tankships or barges (see Table 4-29. U.S. tankers and barges contributed 636.5 billion ton miles of the hazardous transport service in 1982. This constitutes 81 percent of all hazardous material transport on a ton-mile basis. Although substantial underreporting exists in all sectors, marine accident rates are extremely low relative to other modes of shipping. Abkowitz and List (1986) have shown that marine transport on a ton-mile basis is the safest mode of shipping, followed by rail and truck. The overall incident rate for marine transport is 0.76 incident (involving hazardous material spill, injury, or death) per billion ton-miles, while the incident rate for rail is 67 and for truck 150. Furthermore, the two classes, flammable and combustible liquids, have the lowest incident rate of all classes of hazardous materials transported on water (0.59 and 0.12 accident per billion ton-miles, respectively).

OCR for page 93
107 TABLE 4-2 Estimated Transportation of Hazardous Materials in the United States, by Mode in 1982 Tons ModeNumber of Vehicles/Vessels Transported Ton-Miles Used for Hazardous Materials (million) (billion) . . Truck 337~000 dry freight or flat 927.0 93.6 bed 130,000 cargo tanks Rail 115,600 tank cars 73.0 53.Oa Waterborne 4,909 tanker barges 549.0 636.5 Air 3,772 commercial planes 0.285 0.459 Total 1,500.0 784.0 al983 data; 1982 data had too many errors to allow calculations. Source: Adapted from U.S. Congress, Office of Technology Assessment (1986~. Reproduced in Abkowitz and List (1986~. Not included in this analysis is pipeline transport. There are no reliable data on the total amount of intra- and interstate flammable and combustible liquids transported by pipeline. An analysis carried out by the American Petroleum Institute (Rusin, 1979) estimated that the total throughput of all combustible and flammable liquids in the United States in 1977 was 1.896 billion barrel-miles per day. During the same year, 237 accidents were reported to the Materials Transportation Bureau of the U.S. Department of Transportation (1984~. These data suggest that the accident rate for liquid pipeline transport is about 2 accidents per billion ton-miles, more than twice the rate of water transport. Data indicate that regulatory strategy analysts should include an estimate of the displacement of water transport into less safe trans- portation modes. Reduced hydrocarbon emissions at marine transfer facilities may be attained at the expense of more fires and explosions during railroad, truck, or pipeline transport. Russo (1987) has argued that the cost to society of displacement or loss of jobs is an important benefit-cost parameter. Not only is there lost income but there are emotional costs manifested in disease, di- vorce, and domestic violence. Although this microperspective has been challenged, policy analysts may have to weigh these costs in their . . c .ecls Ions .