Appendix E
Additional Information Concerning Risk
QUANTITATIVE RISK ASSESSMENT
The Army’s quantitative risk assessment (QRA) for the Tooele Chemical Agent Disposal Facility (TOCDF) estimates the risk to the public and to workers from accidental releases of chemical agent associated with all activities during storage and throughout the disposal process (U.S. Army, 1996a). Activities associated with the disposal process include:
-
munitions handling in preparation for transport to the disposal facility
-
transport of munitions to the disposal facility
-
the disposal processes
The QRA includes all identified potential causes of release, except for intentional acts, such as sabotage and terrorism. Releases resulting from both internal initiating events (events that originate inside the facility or that result directly from activities during the disposal process) and external events (such as earthquakes, aircraft crashes, and tornadoes) are included.
The factors in developing a QRA for a chemical agent and munitions storage and destruction site are shown in Figure E-1, which shows as the two primary sources of risk (1) the stockpile itself (storage risk) and (2) the destruction of the stockpile (processing risk). The actual risk posed by either or both sources depends on whether or not risk-initiating events occur.
Stockpile-related risks from sabotage, terrorism, and war are reportedly evaluated and managed by specific government agencies and are not considered in publicly available site-specific risk assessments.
Storage Risk
The stockpile is hazardous principally because of the inherent toxicity of the anti-cholinesterase nerve agents, GB and VX, and mustard agents, H, HD, and HT. Because of its toxicity and volatility, agent GB presents the greatest hazard offsite. The risks associated with stockpile storage are almost all related to releases of agent as a result of either internal events—such as handling accidents during stockpile manipulation and maintenance, the deterioration of containment systems, the spontaneous detonation of munitions, or the spontaneous ignition of propellant—or external events such as natural disasters and airplane crashes.
Processing Risk
Agent destruction imposes risks above and beyond the inherent risks associated with the existence and maintenance of the chemical agent and munitions stockpile. The transportation of chemical agent from storage to the destruction facility, the unpacking and disassembly of munitions and containment systems, and the actual process of agent destruction are activities during which agent could potentially be released. Like the storage risk, the predominant processing risk is associated with agent toxicity, although the quantities of agent being processed at any given time are small compared with the original inventories in the stockpile and are much better protected than in the stockpile.
Potential hazards other than agent toxicity that can contribute to processing risk include the toxic effects of products of incomplete combustion of agent and other hazardous materials used in the disposal process, as well as the effects of fire or explosion. (Because the quantity of the products of incomplete combustion is substantially smaller than the original quantity of agent, combustion products generally represent a lesser hazard.) Release of toxic by-products can occur during process upsets, a possibility allowed for in an
NOTE: This appendix is adapted from NRC (1997).
upper-bound calculation in the QRA. External events such as earthquakes could cause the release of dangerous materials, such as propane or sodium hydroxide, from on-site storage tanks, as well as shutdown of the disposal process and possible one-time release of products of incomplete combustion from a furnace at shutdown.
Risk Receptors
There are three potential risk receptors: workers, the public, and the environment. Because of their proximity to the stockpile and agent-processing operations, workers are at risk from exposure to the acute lethal (and nonlethal) hazards associated with agent releases, regardless of the initiating event. They are also potentially at risk from long-term exposure to agent at very low concentrations and to the products and by-products of agent destruction. The only known latent effects are cancers following exposure to mustard (NRC, 2001a).1
Risks to the public stem primarily from releases of agent caused by external events, although the public could also be put at risk by long-term exposure to the products and by-products of agent destruction, if they were released into the environment as a result of chemical agent destruction processes. Environmental risk is associated almost exclusively with the release of agent and the products and by-products of agent destruction beyond site engineering controls.
Risk Measures
For humans (both workers and the public), the three potential consequences of the risk posed by either stockpile storage or agent destruction are acute lethality, acute and latent noncancerous health effects, and latent cancer. The potential adverse consequences for the environment are the contamination of land and water, and adverse effects suffered by native or endangered species.
Risk Mitigation
Risk is most effectively mitigated or prevented before a hazardous material is released. However, after a hazardous material has been released, but before it reaches a receptor, the consequences of the release can be reduced. Risk mitiga-
tion can include measures taken at the spill site (e.g., containing the spill) or at the receptor site (e.g., using protective masks), and emergency response measures (e.g., sheltering, evacuation). The Army’s 1996 site-specific QRA takes into account some of these measures (U.S. Army, 1996a). However, the primary purpose of the QRA is to calculate a realistic estimate of risk to the public. The analysis is not structured to measure the effectiveness of the local Chemical Stockpile Emergency Preparedness Program (CSEPP).
Uncertainty
To provide the most realistic representation of risk, all forms of uncertainty are considered. Rather than assuming the existence of some representative condition prior to the accident scenario, a study models the full range of conditions and other uncertainties that can affect the scenario. Results include uncertainties in the frequency and consequences of each scenario. The upper uncertainty bound shown for the QRA risk estimates is a measure of the analysts’ confidence in the results. There is a 95 percent chance that the risk is less than the upper bound.
For those readers desiring more details on risk assessment and risk management, Appendix A of the National Research Council (NRC) report Risk Assessment and Management at Deseret Chemical Depot and the Tooele Chemical Agent Disposal Facility (NRC, 1997) develops the bases for the presentations of risk (risk profiles and expected fatalities), explains how to interpret the results, and discusses various measures according to which risks can be compared.
QRA RESULTS: THE ARMY’S 1996 ANALYSIS
Results from the published QRA for the Tooele Chemical Agent Disposal Facility (TOCDF) (U.S. Army, 1996a) are used below to illustrate the form of QRA results.
Risk to the Public from Stockpile Storage
The risk-dominant initiating event for release of agent stored in the chemical stockpile at DCD is an earthquake (U.S. Army, 1996a). Although earthquakes are infrequent, they have widespread effects and could cause the release of much more chemical agent than other types of accidents. Seismic events that would contribute to storage risk are those with mean accelerations above 0.2 g and recurrence intervals of 1,000 years or more. Such earthquakes significantly exceed normal building code design values and thus can lead to failures of equipment and structures. Overall, according to the Army’s 1996 QRA for TOCDF, earth-quake-initiated events account for 82 percent of the average public fatality risk associated with continued storage of the stockpile; of the remaining 18 percent of the average public fatality risk, leaks of agent GB from ton containers account for 11 percent (Figure E-2).
An aircraft crash into storage structures and the electro-magnetic effects of lightning (which could cause a fire in a storage igloo or cause an M55 rocket to ignite) were also considered in the Army’s 1996 QRA. The results (see Figure E-2) indicated that the impact of these initiators is only 2 percent and 4 percent, respectively, of the total storage risk. Risks from normal stockpile maintenance, such as isolating leaking munitions, account for about 1 percent of the storage risk. These maintenance activities are infrequent, and the potential for a significant release is small because the number of munitions handled at any given time is limited.
Risk to the Public from Disposal Operations
The risk to the public from processing of chemical weapons is compared with the risk of continued storage in Figure E-3. The 1996 QRA put the risk level for the first campaign of GB disposal at about 0.00006 fatalities per year with a
processing duration of about 9 months (U.S. Army, 1996a). Note, however, that the stockpile storage risk decreases at the end of that time by two-thirds because the agent posing the greatest risk would be removed from the stockpile during the first disposal campaign.
By the end of the fifth campaign at TOCDF (GB ton containers nearly 3 years into disposal operations), the risk of both storage and processing have essentially disappeared. Nevertheless, although the risk is small, it is clear that storage risk is still much greater than processing risk and that accepting the processing risk for 3 years dramatically reduces the total risk.
Using the information shown in Figure E-3, risk managers at TOCDF ascertained the relative effects of various agent destruction campaigns. This information was used to reorder the disposal campaigns to minimize the total overall risk.
For disposal processing at TOCDF, the 1996 QRA results show that the risk of public fatalities is dominated by earthquakes (97.4 percent) as the most dangerous risk-initiating event (Figure E-4). A structural failure in the unpack area of the container handling building area caused by an
earthquake stronger than the building is designed to withstand could have severe consequences partly because munitions are unpacked in this area and are not protected by transport containers. The same earthquake would undoubtedly lead to the release of much more agent from the DCD storage area next to TOCDF.
The QRA results shown in Figure E-4 also indicate that internal events associated with processing account for less than 1 percent (i.e., 0.8 percent) of the risk at TOCDF and that nearly all of this risk is associated with handling rather than with actual agent destruction. The 1996 study credits the low risk of processing to the safety and mitigation features of the baseline system and the limited quantities of agent available for release during processing (U.S. Army, 1996a).
Risk to Workers from Disposal Operations
Workers at TOCDF, including all support and administrative staff at the facility or in nearby buildings and munition handlers responsible for removing munitions from the stockpile and transporting them to the disposal facility, were included in the Army’s 1996 risk assessment. Although the study addressed only worker risks associated with accidents involving release of agent, processing and handling workers can be directly affected by the blast of an explosion, for example, or by dispersal of agent from an accident, and both of these effects were included. (Industrial-type risks, e.g., being crushed by a lift-truck, were not considered.) The QRA results indicated a 1 in 7 probability of a worker fatality in the total disposal-related worker population in the 7.1 years of disposal processing. Figure E-5 shows the contributors to the average risk of fatality for disposal-related workers.
The 1996 QRA indicates that risks to disposal workers from agent-related accidents are substantially higher than the risks to the public, as would be expected because of the proximity of the workers to the chemical agent. Small releases that would not have an impact at a significant distance could still be lethal to workers in the immediate area. According to the QRA, for the workforce of about 500 workers at TOCDF, if the 0.13 expected fatalities per 7.1 years of operation are dominated by single-fatality accidents, then the individual disposal-worker risk at TOCDF is about 4 x 10–5 per year.
The risk for other on-site workers (outside the TOCDF and DCD storage area) is evaluated in the same manner as the risk to the public. The probability of one or more fatalities for other on-site workers during the 7.1 years of disposal processing is 5 x 10–4 (1 in 2,000). With about 100 workers in this category, and assuming that most accidents cause a single fatality, the individual annual risk is 1 x 10–6 (1 in 1 million per year) for other on-site workers.
QRA: RECENT ADVANCES
The recent, as yet not published, Army QRAs for the third-generation facilities for chemical demilitarization have extended the methodology for assessing the effects of lightning, tornados, fires, events of special interest at each site, and human actions (and errors), and for understanding worker risk. The analysis for lightning draws on recent advances in tracking the position and strength of lightning strikes throughout the United States and new data that corrects long-held assumptions about the distribution of lightning. New technology for understanding the behavior of lightning within igloos has also been important. The analysis of risk from fire has shifted from the use of a physics model and nuclear power plant fire data to a more data-driven analysis, with more applicable data from chemical process plants having a significant impact on the results. After the
events of September 11, 2001, the Army decided to reconsider the publication of site-specific QRAs for the third-generation incinerator-based chemical demilitarization facilities. However, the committee ascertained that these QRAs confirm the dominance of the risk of continued storage of aging chemical weapons.
Improvements in the analysis of worker risk have resulted from an increased focus on worker activities and the adoption of more general methods for analyzing the effects of human error. For a number of reasons discussed in the NRC report Risk Assessment and Management at Deseret Chemical Depot and the Tooele Chemical Agent Disposal Facility (NRC, 1997), very little modeling of human performance was done in the 1996 QRA for TOCDF.2 For example, workers directly involved in an accident were assumed to be killed, either from exposure to agent or from an explosion.
As attention in the chemical demilitarization program has shifted to include worker risk, more significant modeling of human action has been performed. None of these improved analyses have yet been published. A variety of human reliability analysis methods have been used (Gertman and Blackman, 1994). For ongoing work, new approaches that account for details of context and human cognitive function are being adapted (Hollnagel, 1998; USNRC, 2000). With more careful and complete analysis, new scenarios especially important to worker risk are being developed.