Ensuring Railroad Tank Car Safety: Special Report 243 (1994)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Fittings Manway Housing Safety / .'VaIve Bottom Fittings NA NAE IC)M TRANSPORTATION RESEARCH BOARD National Research Council

1994 TRANSPORTATION RESEARCH BOARD EXECUTIVE COMMrVrEE Chairman: Joseph M. Sussman, JR East Professor and Professor of Civil and Environmental Engineering, Massachusetts Institute of Technology, Cambridge Vice Chairman: Lillian C. Liburdi, Director, Port Department, The Port Authority of New York and New Jersey, New York City Executive Director: Robert E. Skinner, Jr., Transportation Research Board Brian J. L. Berry, Lloyd Vie! Berkner Regental Professor and Chair, Bruton Center for Development Studies, University of Texas at Dallas Dwight M. Bower, Director, Idaho Transportation Department, Boise John E. Breen, The Nasser I. Al-Rashid Chair in Civil Engineering, Department of Civil Engineering, The University of Texas at Austin Kirk Brown, Secretary, Illinois Department of Transportation, Springfield David Burwell, President, Rails-to-Trails Conservancy, Washington, D.C. L. G. (Gary) Byrd, Consultant, Alexandria, Virginia A. Ray Chamberlain, Vice President of Freight Policy, American Trucking Associations, Alexandria, Virginia (Past Chairman, 1993) Ray W. dough (Nishkian Professor of Structural Engineering Emeritus, University of California, Berkeley), Structures Consultant, Sunriver, Oregon Richard K. Davidson, Chairman and CEO, Union Pacific Railroad, Omaha, Nebraska James C. DeLong, Director of Aviation, Denver International Airport, Colorado Delon Hampton, Chairman and CEO, Delon Hampton & Associates, Chartered, Washington, D.C. Don C. Kelly, Secretary and Commissioner of Highways, Transportation Cabinet, Frankfort, Kentucky Robert Kochanowski, Executive Director, Southwestern Pennsylvania Regional Planning Commission, Pittsburgh James L. Lamniie, President and CEO, Parsons Brinckerhoff, Inc., New York City William W. Millar, Executive Director, Port Authority of Allegheny County, Pittsburgh, Pennsylvania (Past Chairman, 1992) Charles P. O'Leary, Jr., Commissioner, New Hampshire Department of Transportation, Concord Brig. Gen. Jude W. P. Patin (retired), Secretary, Louisiana Department of Transportation and Development, Baton Rouge Neil Peterson, former Executive Director, Los Angeles County Metropolitan Transportation Commission, Redondo Beach, California Darrel Rensink, Director, Iowa Department of Transportation, Ames James W. van Loben Sels, Director, California Department of Transportation, Sacramento C. Michael Walton, Ernest H. Cockrell Centennial Chair in Engineering and Chairman, Department of Civil Engineering, University of Texas at Austin (Past Chairman, 1991) David N. Wormley, Dean of Engineering, Pennsylvania State University, University Park Howard Yerusalim, Secretary of Transportation, Pennsylvania Department of Transportation, Harrisburg Robert A. Young ifi, President, ABF Freight Systems, Inc., Fort Smith, Arkansas Mike Acort, President, National Asphalt Pavement Association, Lanham, Maryland (tx officio) Roy A. Allen, Vice President, Research and Test Department, Association of American Railroads, Washington, D.C. (cx officio) Andrew H. Card, Jr., President and CEO, American Automobile Manufacturers Association, Washington, D.C. (cx officio) Thomas J. Donohue, President and CEO, American Trucking Associations, Inc., Alexandria, Virginia (cx officio) Francis B. Francois, Executive Director, American Association of State Highway and Transportation Officials, Washington, D.C. (cx officio) Jack R. Gilstrap, Executive Vice President, American Public Transit Association, Washington, D.C. (cx officio) Vice Adm. Albert J. Herberger, Administrator, Maritime Administration, U.S. Department of Transportation (cx officio) David R. Hinson, Administrator, Federal Aviation Administration, U.S. Department of Transportation (cx officio) Gordon J. Linton, Administrator, Federal Transit Administration, U.S. Department of Transportation (cx officio) Ricardo Martinez, Administrator, National Highway Traffic Safety Administration, U.S. Department of Transportation (cx officio) Jolene M. Molitons, Administrator, Federal Railroad Administration, U.S. Department of Transportation (cx officio) Dharmendra K. Sharma, Administrator, Research and Special Programs Administration, U.S. Department of Transportation (cx officio) Rodney E. Slater, Administrator, Federal Highway Administration, U.S. Department of Transportation (cx officio) Lt. Gen. Arthur E. Williams, Chief of Engineers and Commander, U.S. Army Corps of Engineers, Washington, D.C. (cx officio)

Special Report 243 ENSURING RAILROAD TANK CAR SAFETY Committee for the Study of the Railroad Tank Car Design Process TRANSPORTATION RESEARCH BOARD National Research Council National Academy Press Washington, D.C. 1994

Transportation Research Board Special Report 243 Subscriber Category VII rail Transportation Research Board publications are available by ordering directly from TRB. They may also be obtained on a regular basis through organizational or individual affiliation with TRB; affiliates or library subscribers are eligible for substantial discounts. For further information, write to the Transportation Research Board, National Research Council, 2101 Constitution Avenue, N.W., Washington, D.C. 20418. Copyright 1994 by the National Academy of Sciences. All rights reserved. Printed in the United States of America NOTICE: The project that is the subject of this report was approved by the Governing Board of the National Research Council, whose members are drawn from the councils of the National Academy of Sciences, the National Academy of Engineering, and the Institute of Medicine. The members of the committee responsible for the report were chosen for their special competencies and with regard for appropriate balance. This report has been reviewed by a group other than the authors according to the procedures approved by a Report Reviev.' Committee consisting of the members of the National Academy of Sciences, the National Academy of Engineering, and the Institute of Medicine. The study was sponsored by the Federal Railroad Administration of the U.S. Department of Transportation. Library of Congress Cataloging-rn-Publication Data Ensuring railroad tank car safety / Committee for a Study of the Railroad Tank Car Design Process, Transportation Research Board, National Research Council. p. cm. - (Special report ; 243) ISBN 0-309-05518-0 1. Tank cars—Safety measures. I. National Research Council (U.S.). Transportation Research Board. Committee for a Study of the Railroad Tank Car Design Process. II. Series: Special report (National Research Council (U.S.). Transportation Research Board) 243. TF481.E58 1994 363.17—dc2O 94-31903 CIP Cover design: Karen L. White

COMMITTEE FOR THE STUDY OF THE RAILROAD TANK CAR DESIGN PROCESS HERBERT H. RICHARDSON, Chairman, Texas A&M University System, College Station ROBERT G. LOEWY, Vice Chairman, Georgia Institute of Technology, Atlanta EDWARD J. BENTZ, JR., E.J. Bentz and Associates, Springfield, Virginia LAWRENCE W. BIERLEIN, Swidler & Berlin Chartered, Washington, D.C. GEORGE P. BINNS, National Railroad Passenger Corporation (Amtrak), Philadelphia, Pennsylvania LEIGH B. BOSKE, University of Texas, Austin THOMAS H. DALRYMPLE, Trinity Industries, Dallas, Texas LEMOINE V. DICKINSON, JR., Failure Analysis Associates, Alexandria, Virginia THEODORE S. GLICKMAN, Resources for the Future, Washington, D.C. MILTON R. JOHNSON, lIT Research Institute, Chicago, Illinois HENRY B. LEWIN, Transportation Communications International Union, Washington, D.C. JOHN P. PROvINSKJ, E.I. DuPont De Nemours & Co., Wilmington, Delaware PHANI K. RAJ, Technology and Management Systems, Inc., Burlington, Massachusetts DEBORAI-I K. SHAvER, ICF Incorporated, Fairfax, Virginia J. REED WELKER, University of Arkansas, Fayetteville Liaison Representatives ROBERT CHIPKEVICH, National Transportation Safety Board JEAN PIERRE GAGNON, Transport Canada, Ottawa, Ontario PAUL KINNECOM, Association of American Railroads, Washington, D.C. Charles Hochman, Research and Special Programs Administration, U.S. Department of Transportation JOSE S. PEIA, Federal Railroad Administration, U.S. Department of Transportation Transportation Research Board Staff STEPHEN R. GODWIN, Director, Studies and Information Services THOMAS R. MENZIES, JR., Study Director WALTER J. DIEWALD, Senior Program Officer NANCY A. ACKERMAN, Director, Reports and Editorial Services NORMAN SOLOMON, Assistant Editor

PREFACE SECTION 21 OF THE HAZARDOUS MATERIALS TRANS- portation Uniform Safety Act of 1990 [Public Law 101-615 (Nov. 16, 1990)] calls for the Secretary of the U.S. Department of Transportation (DOT) to enter into a contract with an appropriate disinterested expert body for a study of: (1) the railroad tank car design process, including specifications development, design approval, repair process approval, repair account- ability, and the process by which designs and repairs are presented, weighed, and evaluated, and, (2) railroad tank car design criteria, includ- ing whether head shields should be installed on all tank cars that carry hazardous materials. In carrying out the study described in paragraph (1), such expert body shall also make recommendations as to whether public safety considera- tions require greater control by and input from the Secretary with respect to the railroad tank car design process, especially in the early stages, and such other recommendations as such expert body considers appropriate. DOT, acting through the Federal Railroad Administration (FRA), con- tracted with the Transportation Research Board (TRB) to conduct the study. TRB convened a study committee composed of experts in tank car design, chemical and mechanical engineering, hazardous materials safety, chemical shipping, railroad operations and labor issues, and transporta- tion economics and regulatory policy. To enhance its knowledge of the subject matter, the study committee invited the participation of liaison representatives from FRA, the Research and Special Programs Administra-

vi Preface tion, the National Transportation Safety Board, Transport Canada, and the Association of American Railroads (AAR). During its four meetings, the committee also met with representatives from the Chemical Manufac- turers Association, Railway Progress Institute (RPI), AAR's Bureau of Explosives (BOE), and other parties expressing an interest in the study. The principal charge to the committee was to examine the process that has evolved for establishing and implementing tank car design standards, including standards for tank car construction, maintenance, and repair. Industry, and especially AAR's Tank Car Committee (TCC), is critical to this process. The overall system for ensuring tank car safety consists of a framework of government and industry standard-setting, enforcement, research, and data activities that affect how tank cars are built and main- tained, operated by railroads, and used to ship materials with varying hazard characteristics. Within this framework, the TCC assists DOT and industry in instituting tank car engineering standards and provides a forum for considering engineering needs. Hence, the effectiveness of gov- ernment and industry cooperation to ensure tank car safety, through the TCC and other means, was a central focus of the study. In further defining the study scope, the committee concluded that assessments of specific tank car safety needs and measures to address them were not possible given the time and resources available. Rigorous techni- cal, economic, and safety evaluations are necessary to determine the safety needs of individual hazardous materials and tank car design types. These determinations are made by DOT, either implicitly or explicitly, when assigning hazardous commodities to tank car design types that provide varying levels of commodity protection. Hence, rather than examine the protection needs of individual hazardous commodities and tank car design types, the study examines how DOT determines which hazardous com- modities must be shipped in the safest tank cars, including those with head protection' and other safety features. ACKNOWLEDGMENTS In addition to the valuable contributions of the liaison representatives, the study committee's efforts were aided by the cooperation and assistance of several other individuals. Claire L. Orth, Chief of FRA Equipment and Operating Practices Research, and James H. Rader, FRA Hazardous Mate- rials Safety Specialist, commented on numerous drafts of the report and provided information on FRA regulatory, research, and enforcement pro- grams. During the committee's first meeting, Dr. William J. Harris, Jr., Associate Director of the Texas Transportation Institute and former AAR Vice President of Research and Test, gave a historical overview of industry efforts to improve tank car safety.

Preface vii Earl A. Phillips, Director of the RPI-AAR Railroad Tank Car Safety Research and Test Project, briefed the committee on the project's data program and key research findings, and Christopher P. Barkan, Manager of AAR's Environmental and Hazardous Materials Research program, discussed current AAR research activities aimed at improving the safety of tank cars and hazardous materials transportation by rail. John Badger, Director of Transportation and Distribution Services for Olin Chemicals, and Frank J. Principi, Manager of Distribution Safety for the Chemical Manufacturers Association, met with the committee to discuss some per- spectives of chemical shippers on tank car safety issues and the design process. Alan D. Maty, Chief Inspector of AAR's BOE, summarized tank car incident statistics collected by BOE and discussed his experiences in responding to tank car incidents. AAR liaison Paul G. Kinnecom and the members of the AAR Tank Car Committee were most accommodating to TRB staff and individual study committee members who attended TCC meetings. Special appreciation also is expressed to Alvin DeLong, FRA Hazardous Materials Safety Inspector, for arranging a rail yard field visit and to Allen Norton, Daryl Gamier, Jerry Pennington, Steve Randall, Charlie Eller, and the rest of the staff of Trinity Industries' Longview, Texas, tank car assembly plant for providing an interesting and instructive tour of the tank car fabrication process. Thomas R. Menzies managed the study and drafted the final report under the guidance of the committee and with assistance from Walter J. Diewald. The study was conducted under the overall supervision of Robert E. Skinner, Jr. The final report was edited and prepared for publication under the supervision of Nancy A. Ackerman, Director, Reports and Editorial Services, Transportation Research Board. Norman Solomon was the editor for the report. Marguerite E. Schneider and Frances E. Holland typed drafts of the manuscript and provided administrative support. The final report was reviewed by an independent group of reviewers according to National Research Council report review procedures. NOTE 1. The term "head shield" is used in the legislative charge for this study. Although this term is sometimes used in reference to a particular type of head protection (steel plates mounted in front of the tank heads), the study committee believes that Congress used the term in a broader sense, to encompass all types of head protection systems that meet federal requirements. To avoid ambiguity and unintended references to specific devices, the study committee chose to use the more general term "head protection" instead of "head shield" throughout the report.

CONTENTS EXECUTIVE SUMMARY 1 INTRODUCTION 18 Background Issues, 20 Study Scope and Approach, 24 Report Organization, 25 2 TANK CAR DESIGN AND USE CHARACTERISTICS 28 Key Developments in Tank Car Design, 28 Principal Design Features, 31 Design Types, 40 Tank Car Use and Operational Characteristics, 46 Key Points and Findings, 56 3 TANK CAR REGULATION AND SAFETY PERFORMANCE 61 Tank Car Regulations, 61 Tank Car Safety Performance, 71 Key Points and Findings, 82

4 GOVERNMENT AND INDUSTRY ACTIVITIES TO ENSURE TANK CAR SAFETY 87 Government Activities, 87 Industry Activities, 93 Design Approval and Certification of Other Vehicle and Container Types, 103 Key Points and Findings, 107 S SUMMARY OF FINDINGS, KEY ISSUES, AND RECOMMENDATIONS 114 Summary of Process for Ensuring Tank Car Design Safety, 114 Tank Car Design and Safety Trends, 118 General Conclusions and Major Recommendations, 119 Other Recommendations and Issues, 130 APPENDIX A Regulatory Process Improvements in Other Agencies 137 APPENDIX B Glossary 142 STUDY COMMITTEE BIOGRAPHICAL INFORMATION 147

EXECUTIVE SUMMARY TANK CARS ARE A COMMON TYPE OF RAILCAR, AC- counting for about one in seven cars in the North American freight car fleet. Half the approximately 210,000 tank cars in North America carry materials regulated by the U.S. Department of Transportation (DOT) and Transport Canada1 because they are flammable, corrosive, poisonous, or pose other hazards. About 1 million shipments of hazardous materials are moved by tank car annually. To ensure the safety of these shipments, considerable efforts have been made by DOT and industry to enhance both the physical tank car and the environment in which it operates. These efforts have been highly success- ful. Despite growth in traffic, only one person has died as a result of a release of hazardous materials from a tank car since 1980 compared with more than 40 fatalities during the 1970s. About 1,000 incidents of tank car releases are reported to DOT each year. Mdst are small spills and leaks, though some result in injuries, property damage, environmental contamination, and other consequences that are cause for concern. Although rare, these incidents are reminders of the need for continued vigilance by government and industry in improving tank car safety. Following investigations of several major incidents during the past decade, the National Transportation Safety Board (NTSB) has expressed concern over government and industry procedures and controls to ensure tank car safety. Some of these concerns have focused on DOT's association with industry, particularly the Tank Car Committee (TCC) of the Associa- tion of American Railroads (AAR), in instituting standards governing tank car design, construction, and maintenance. Others have focused on specific

2 ENSURING RAILROAD TANK CAR SAFETY aspects of tank car design, including the capability of existing tank cars to resist punctures and other damage during derailments and crashes. Congress requested a study of the overall process for ensuring tank car design safety and, more specifically, whether all tank cars carrying haz- ardous materials should be equipped with special safety devices, known as "head shields," to prevent tank car head (end) punctures. The approach of the National Research Council committee that conducted the study was to analyze (a) the design characteristics of tank cars and what is known about their safety performance, (b) the various government and industry pro- grams in place to ensure tank car design safety, and (c) the criteria used by DOT in assigning hazardous materials to tank cars with head protection and other design safety features. TANK CAR DESIGN AND SAFETY TRENDS There are two main tank car design types: pressure and nonpressure (Table ES-i). The latter, which are more common, are used to ship liquids, both hazardous and nonhazardous. The former are used almost exclusively for hazardous gases shipped under pressure (liquefied). They have thicker tank walls than nonpressure cars and better-protected valves and fittings. Many pressure cars also have special features to improve crashworthiness. During the 1960s and 1970s, a series of fatal tank car incidents led to the development of the protective features and devices shown in Figure ES-i. Most of the incidents involved fires and explosions from punctured or ruptured pressure cars carrying flammable gas. As a result, puncture protection devices, consisting of steel plates placed in front of the tank TABLE ES-i Estimated Number of Tank Cars in Service in North America, 1993 HAZARDOUS NONHAZARDOUS MATERIALS MATERIALS T'i'I'E OF TANK CAR SERVICE SERVICE TOTAL Nonpressure 64,057 98,585 162,642 Pressure 49,348 0 49,348 Total 113,405 98,S8S 211,990 Percentage of total 53 47 100 Nom: Specialty tank cars, of which there are fewer than 1,000, are not included in the table. Figures include both AAR and DOT class tank cars. See Table 2-4 for additional notes.

Executive Summary 3 THERMAL PROTECTION The most common thermal protection system consists of a special insulation material (A) covered by a steel jacket (B). Special tank exterior coatings are also used for thermal protection. They do not require a jacket. HEAD PROTECTION Head protection may be provided by mounting steel plates at both ends of the tank. Steel plates also may be built into the rTankead steel jacket covering the tank insulation. Tank Shell C4oupler:" DOUBLE-SHELF COUPLER Double-shelf couplers have top and bottom shelves that restrict vertical movement of the mated coupler. FIGURE ES-i Key tank car safety features. heads, were required on flammable gas cars to shield the tank ends from impacts during derailments and collisions. To prevent violent tank rup- tures caused by overheating of flammable gas cars exposed to fire, special heat-resistant tank insulation systems, known as thermal protection, were required on flammable gas cars. As an additional safeguard, special cou- pler restraint systems, known as double-shelf couplers, were required on most tank cars, including nonpressure cars. These devices, which provide more secure interlocking of tank cars with adjoining cars, help prevent collisions during coupling and tank rollover damage during derailments. The advent of these safety devices helped bring about sharp declines in tank car punctures, ruptures, and resultant fatalities. Punctures dropped

4 ENSURING RAILROAD TANK CAR SAFETY by more than 90 percent after head protection and double-shelf couplers were installed on flammable gas cars starting in the late 1970s. Tank ruptures also declined dramatically after the introduction of thermal pro- tection on, these cars. At the same time, punctures and other types of accident damage declined among tank cars not equipped with head protec- tion, indicating the importance of other safety measures, including the general use of double-shelf couplers on tank cars and improvements in the railroad operating environment. Today, approximately two-thirds of pressure cars have head protection and about half also have thermal protection. All tank cars in hazardous materials service have double-shelf couplers. Though the precise effect of these design changes on safety has not been measured, major hazardous materials releases have become rare, accounting for a small fraction of the 1,000 releases of hazardous materials from tank cars reported each year. Most releases are small spills and leaks caused by loose or malfunctioning fittings, tank defects (e.g., cracks or corrosion), or other deficiencies in the physical tank car or its securement and handling. Fewer than 10 percent of releases are caused by derailments or other accident events. Most of these accident-related releases are from damaged valves and fittings rather than from punctures. The reduction in tank punctures and ruptures has been an important reason for the decline in fatal tank car incidents during the past 15 years. The near absence of fatal incidents, however, has led to increased attention to other incident consequences. During the past decade, several tank car releases resulted in major fires and explosions, extensive property damage, and injuries to railroad workers, emergency responders, and the public. Others resulted in smoke and vapor emission and soil and water contam- ination that led to communitywide evacuations and concerns about the effects of tank car releases on the environment and public health. KEY ELEMENTS OF PROCESS TO ENSURE TANK CAR DESIGN SAFETY Various government and industry regulations, practices, and research and enforcement programs affect the design and safety of railroad tank cars. Collectively, these activities comprise the "process" for ensuring tank car design safety. Key elements of the process are shown in Figure ES-2. Setting Design Standards for Safety Through the Federal Railroad Administration (FRA) and Research and Special Programs Administration (RSPA), DOT sets minimum require-

Executive Summary S ments for the design of tank cars used in hazardous materials service. Its regulations provide design criteria, known as DOT specifications, for more than three dozen tank car types. Various designs are necessary to accom- modate differences in the physical, chemical, and hazard characteristics of the materials shipped. Although the DOT regulations cover most major aspects of tank car design, industry has a significant role in establishing many of the require- ments. Most DOT design criteria are based on standards and principles originally developed by industry. Some are broadly defined and open to industry explication. DOT assumes that industry and its standard-setting bodies have sufficient expertise and incentives to make appropriate deci- sions about most aspects of tank car design. In cases where DOT design criteria are imprecise or general, the TCC has been given authority to establish the detailed design standards and to review individual design drawings to ensure that they meet the intent of the underlying DOT criteria. The TCC, which has had a prominent role in these areas for most of the century, consists of technical representatives from railroads, ship- pers, and tank car builders. Participation by industry and the TCC is more limited when require- ments for major design safety features, such as head and thermal protec- tion, are involved. Although industry research has led to the development of many tank car safety features, DOT rules governing their use tend to be explicit and prescriptive. During rulemaking, DOT sometimes consults with the TCC on the technical feasibility of major safety features, but the resultant rules are usually specific about which tank cars must have the feature and the essential elements of its design. Ensuring Compliance with Design Standards and Good Design Practice Like other regulatory agencies responsible for the safety of transport vehicles and containers, DOT relies greatly on industry to ensure compli- ance with design standards and sound design practices. The TCC has a prominent role in this regard. The TCC reviews the construction draw- ings of tank car builders and verifies their consistency with DOT require- ments. TCC approval of drawings, required by DOT, functions as a peer review, reducing the potential for error by the builder. Various other functions of the TCC also enhance compliance with requirements and good practices. The TCC regularly updates a tank car specifications manual that converts DOT and AAR requirements into a comprehensive reference for builders and repairers. It conducts service

DOT ROLE AAR/TCC ROLE Design Standards DOT sets TCC assists in minimum design setting technical requirements for criteria and design safety I I I details Compliance with P _ _ Design Standards I TCC approves design DOT officials plans and repair and participate in TCC construction methods. activities, providing Standards manual, oversight of TCC service trials, and other approvals q IF activities enhance ---•1 Inspection and con-phance certification of completed 14 r • work by builder L J FRA periodically s shops inspects shops, Fsetsdelines railroads, and uality shippers grams Authorization and use of design types to carry hazardous materials TCC and shippers DOT assigns determine lining materials to matedalsvalves, and design types ----- other special features I Shipper ensures use of i of tank car used P Iauthorized design I - - - - - - - - FIGURE ES-2 Summary of major elements in process for ensuring tank car design safety.

Executive Summary 7 trials of new tank car components and reviews proposed methods of construction and repair. Each of these activities increases the probability that completed tank cars will meet DOT specifications. Tank car builders and repairers are ultimately responsible for ensuring that completed tank cars meet all applicable DOT requirements. After inspecting and testing the finished tank car in accordance with DOT procedures, the builder certifies compliance by submitting a certificate of construction to AAR. The TCC has taken additional steps to ensure quality construction and repair work. Under DOT authority, the TCC has established minimum qualification requirements for tank car fabrication and repair shops and has set guidelines for shops to develop quality control programs. DOT ensures compliance with design requirements primarily through the FRA railroad inspection program and by participating in TCC activ- ities. FRA has 45 hazardous materials specialists, who inspect railroads, shippers, and tank car suppliers and repairers. DOT officials regularly attend TCC meetings, enabling them to review TCC procedures and approval decisions. Participation in TCC activities is perhaps the most important means by which DOT monitors and ensures industry compli- ance with regulatory requirements. Assigning Hazardous Materials to Tank Car Designs DOT regulations list hundreds of materials as hazardous, subject to re- strictions in packaging, labeling, handling, and operations. Materials are grouped into hazard classes according to their acute safety hazards (e.g., flammable, poison) and physical state in transport (e.g., compressed gas, liquid). Each material is assigned to types of packaging, including tank car design types. According to DOT regulations, most hazardous liquids can be trans- ported in any DOT-class tank car. A notable exception is that most liquids posing poison inhalation hazards must be shipped in pressure cars because of their superior puncture resistance attributable to thicker tank walls and better-protected fittings. Hazardous gases are assigned to pressure designs on an individual basis, considering specific hazard criteria, such as vol- atility and toxicity. In general, flammable gases are assigned to pressure

8 ENSURING RAILROAD TANK CAR SAFETY cars equipped with head and thermal protection, and poison gases are assigned to head-protected cars. Most other compressed gases can be transported in pressure cars without these protective features. The assign- ment of gases to pressure cars with the highest pressure ratings—and therefore thickest tank walls and greatest puncture resistance—is normally based on the pressure level of the gas rather than its hazard characteristics, except for materials classified as poison by inhalation. In determining whether to regulate a material and assigning it to qualified packaging, DOT has traditionally considered the acute hazards (e.g., flammability, corrosivity) of the material. Changes in federal law during the past 20 years have required DOT to regulate the shipment of materials designated as "hazardous substances" by the U.S. Environmen- tal Protection Agency (EPA). Many of these materials meet DOT criteria for acute hazards (and are regulated as such). Others, however, pose environmental and public health hazards that are not formally classified as hazards by DOT. These materials are usually subject to the minimum DOT packaging restrictions, although DOT has recently proposed stronger packaging requirements for certain substances carried in tank cars that are toxic to humans and can contaminate soil and groundwater if released in large quantities. GENERAL CONCLUSIONS AND MAJOR RECOMMENDATIONS The safety record of tank cars carrying hazardous materials is good. Severe incidents are rare and likely to remain so in the future. The process for ensuring tank car safety is fundamentally sound, consisting of government and industry procedures and activities that are comparable with those used for containers and vehicles in other transport modes. DOT and industry have taken significant steps to improve the process in recent years in response to changing safety concerns and needs. In doing so, DOT has increased coordination with EPA and other federal agencies responsible for aspects of hazardous materials safety. Nevertheless, further modification of the process is warranted as public safety concerns, the environment in which tank cars operate, and the types of materials shipped by tank car continue to change. Several modifications are recommended. They are aimed primarily at ensuring that safety decisions are well supported and guided by long-range safety goals and strategies. They call for the following: Greater government and industry cooperation in anticipating future tank car safety needs and committing to specific actions to achieve them. Both government and industry have important roles in ensuring safety,

Executive Summary 9 ranging from monitoring tank car safety performance and researching safety improvements to instituting safety standards and ensuring their implementation. These roles are performed most constructively when accompanied by coordination and planning. Development of more objective and quantitative measures for assess- ing the safety performance of tank car designs and for ensuring that commodities posing the greatest risk are shipped in the safest designs. A thorough assessment of the need for using tank cars equipped with head protection and other safety features requires a strong technical under- standing of the safety performance of individual designs and the risk characteristics of the commodities shipped in them. Greater emphasis on and acknowledgment of those functions of the TCC that are most important in ensuring broad compliance with tank car design safety standards and good design and construction practices. Identi- fication and thorough understanding of the TCC's most critical functions are vital to ensuring effective TCC implementation and DOT oversight procedures. Measures to help meet these needs are recommended next. The commit- tee recognizes that DOT must consider these recommendations within the broader context of its overall hazardous materials and railroad safety programs. Competing demands in other program areas and the secondary impacts that the measures recommended could have on hazardous mate- rials safety in other transport modes were not considered in this study.2 Measures To Increase Cooperation and Planning for Safety Improvements Define Long-Term Safety Goals and Develop Plan RECOMMENDATION 1: FRA and RSPA should define tank car safety goals for the next decade or longer and develop a strategic plan prescribing actions to attain them. The plan should be developed in cooperation with industry, labor, and other interested parties to elicit their expertise and perspectives. Their commitment to specific safety goals and actions, in- cluding nongovernmental actions, should be sought. FRA and RSPA should consider the various approaches being implemented by other regu- latory agencies to enhance public dialogue and cooperation, including use of advisory panels, public workshops, and negotiated rulemaking. DOT's approach to developing tank car regulations governing safety measures is too often reactive and piecemeal. Rulemaking is seldom the

10 ENSURING RAILROAD TANK CAR SAFETY result of a long-term program for advancing safety but tends to be initiated in response to individual petitions for rule changes, legislative mandates, and major incidents. The regulatory process must be capable of respond- ing to safety developments as they arise, but an overly reactive approach can perpetuate the need for incremental and ad hoc solutions to safety problems. It can also hamper industry and government cooperation in resolving problems. There are significant advantages in encouraging industry to address safety issues through nongovernmental means. Cooperation with industry can permit faster implementation and greater flexibility in tailoring solu- tions to circumstances. The traditional rulemaking process often hinders cooperation between government and industry. Once rulemaking begins, government and industry have limited opportunity to cooperate in ad- dressing safety concerns through constructive dialogue and communica- tion. Too often as a result, industry must speculate about future regulatory developments and react within a limited time frame to agency-generated proposals. Hence, all options to address a problem may not have been considered, and the regulatory actions taken may be delayed by contention that accompanies the process. Other regulatory agencies, including the Coast Guard in dealing with tanker vessels and other ships, have taken steps to improve procedures for early and frequent public consultation during regulatory planning and development (see Chapter 5). These procedures should be reviewed by FRA and RSPA as a means of identifying ways to make the tank car regulatory process more proactive and consultative with industry. In ac- cordance with Recommendation 1, the following recommendations (2 to 5) call for specific actions to be taken to better define tank car safety goals and to achieve them. Cooperate in Long-Term Research RECOMMENDATION 2: In cooperation with industry, FRA and RSPA should develop a long-range research plan to define major research needs and programs to meet them. Consideration should be given to all areas of inquiry having significant impacts on tank car safety, from tank car design to the railroad operating environment (such as train operations, track and railcar conditions, and switching practices). Coordination with industry is critical to ensure that important research areas are not overlooked and that government and industry research activities are complementary to the extent possible. FRA conducts most DOT research related to tank car safety. It spends about 5 percent of its research budget, or $1 million per year, on tank car

Executive Summary 11 and hazardous materials research. Partly because of limited resources, FRA's research program focuses on the immediate problems of current rulemaking and enforcement. Industry has been successful in supporting long-term research, particularly to improve tank car crashworthiness. These efforts have led to many advances in tank car design safety during the past 20 years. A drawback of FRA's relatively short-term research approach is that it is not aimed at building a more thorough understanding of key problem areas and ensuring that all means of improving tank car safety are ex- plored. For instance, both government and industry research programs have focused on tank car design needs. Factors affecting tank car safety that have been investigated to a limited degree but not emphasized include aspects of tank car operations, such as tank car routing, positioning in the train, and handling. Without more sustained research in such other areas, opportunities to implement the most cost-effective solutions to safety problems may be missed. DOT can help close research gaps and build a stronger case for in- creased research funding through better coordination and planning of research with industry. Greater cooperation in this regard should reduce duplication, broaden the scope of inquiry and resources available to con- duct research, and provide greater stability in research programs necessary to make continued safety advances. Improve Tank Car Safety Data RECOMMENDATION 3: DOT should encourage improvements in the quality and compatibility of its internal hazardous materials and railroad safety data programs and those of industry. DOT should establish a safety data work group consisting of representatives from industry, government agen- cies, and other organizations that submit, maintain, and use the data. The group should be charged with finding ways to enhance accessibility, re- liability, and compatibility of government and industry data programs and identifying critical data gaps and ways to fill them. Procedures for reporting safety-related incidents and the information that such reports provide should be among the principal tools used by government and industry to monitor tank car safety, conduct research, and support the improvement of standards and practices. FRA and RSPA both collect records of railroad and hazardous materials incidents for these purposes, but shortcomings in the data programs limit the extent of their use. Whereas the data programs contain some complementary informa- tion, each program has different reporting criteria, definitions, and termi- nology, which impedes integration of records in the two data sets.

12 ENSURING RAILROAD TANK CAR SAFETY AAR and other industry groups also collect data on tank cars. The data range from tank car repair and inspection records to traffic information and accident reports. The data are informative and extensive. However, industry data programs are designed for different purposes and managed by several organizations, which limits accessibility and has resulted in some data gaps. Greater coordination between FRA and RSPA and the industry groups that collect, submit, and use data pertaining to tank cars is essential to enhancing data base compatibility, coverage, and access. Measures To Improve Criteria for Assigning Materials to Tank Car Designs Assess Safety Performance of Existing Tank Car Design Types RECOMMENDATION 4: To improve the basis for assigning hazardous mate- rials to tank car design types, DOT should use objective and explicit criteria to determine the safety performance of each design. Incident data, crash tests, accident modeling, and other quantifiable measures should be used to rate the safety performance of design types. Results from these performance assessments should be used to determine whether the current regulatory assignment of hazardous materials to design types is acceptable and whether some commodities warrant reassignment to safer cars. The inception and subsequent incremental expansion of head and ther- mal protection rules during the past 20 years illustrate some of the short- comings of the regulatory process in generating a consistent and rational method for ensuring the protection of hazardous materials. Tank car size limits were liberalized during the 1950s, permitting widespread introduc- tion of pressure cars with larger tanks for hauling low-density flammable gases. The safety implications of these changes were not fully considered until several of the new tank cars were punctured and ruptured in acci- dents. Requirements for head and thermal protection were then estab- lished for many flammable gas cars. Spurred in part by further incidents, additional rules expanding head and thermal protection to certain other classes of pressure cars were adopted during the 1980s. DOT recently proposed further extension of the requirements. Because head punctures are one of several sources of tank car release, the expansion of head protection requirements is best considered within the context of overall tank car safety needs. Such systematic consideration of safety needs requires more thorough understanding by DOT of the circumstances of tank car releases and the effectiveness of various design

Executive Summary 13 features (individually and in combination) in protecting hazardous ship- ments. It also requires a more precise and tenable system for rating tank car design performance. 'Whereas DOT routinely classifies regulated com- modities using quantifiable hazard criteria, it does not similarly classify tank car design types—which can vary significantly in key design fea- tures—using measures of safety performance. Identify and Understand All Important Hazards of Tank Car Shipments RECOMMENDATION 5: DOT should better define its scope of responsibility in ensuring the safety of tank car shipments, including those that may be harmful to the environment and public health. As a minimum, it should forge stronger ties with EPA to obtain better information on the hazards posed by tank car shipments when released in the transportation environ- ment. This information should be used to strengthen the technical criteria used to evaluate the risks posed by tank car shipments and to assess the effectiveness of the regulatory requirements in addressing these risks. DOT focuses its regulatory efforts on ensuring the safe transport of materials having acute hazards; for instance, materials that pose an imme- diate danger to human safety and property if released because of flamma- bility, corrosivity, or acute toxicity to humans. Legislation during the past 20 years has required DOT to regulate the shipment of hazardous sub- stances identified by EPA as posing environmental and public health hazards. Although many of these substances are subject to DOT regula- tions governing the types of tank cars used, the restrictions are based on the substance's acute safety hazards rather than the nonacute hazards consid- ered by EPA. Many of the criteria used by EPA in classifying hazardous substances, however, are based on concerns pertaining to land disposal and other long-term exposure situations that may not reflect release circum- stances in the transport environment. Prominent incidents in recent years have spurred DOT to take some steps to control shipments with potential environmental and public health hazards. These steps, however, have not been preceded by a clear definition of the department's mission in ensuring the safety of these shipments or the development of data and criteria for evaluating their hazards. In the absence of this information, DOT cannot be sure that its current regulatory requirements are sufficient and lacks strong guidance for making funda- mental changes to the requirements. Recommendations to improve coor- dination of DOT and EPA research, data, and regulatory programs have been made by NTSB and others, including DOT and EPA interagency task

14 ENSURING RAILROAD TANK CAR SAFETY forces. A clearer definition of DOT's scope of responsibility in ensuring the safety of shipments by tank car is an essential first step in coordinating such programs. Need for Head Protection Until the safety performance of tank car designs is assessed in a more quantifiable manner and the full range of risks associated with tank car shipments is better understood, it is not possible to determine the exact portion of the tank car fleet that should be equipped with head protection. The committee believes that head protection and other proven safety features are essential for tank cars carrying those materials with the greatest potential to harm humans and the environment if released. Nev- ertheless, the vast expansion of head protection requirements to cover all tank cars in hazardous materials service is not warranted by the informa- tion presently available. The small share of tank car releases caused by damage to tank car heads and the wide variation in the types of hazards posed by tank car shipments indicate that universal head protection re- quirements would be excessive. Better data and more thorough analyses of the overall protection provided by existing tank car design types and the risk characteristics of materials shipped by tank car, as recommended above, will provide the basis for ensuring that those materials posing the greatest hazard are shipped in the safest tank cars, including those with head protection as warranted. Measures To Ensure Effective TCC Safety Role and DOT Oversight The many functions of the AAR TCC constitute an important national service essential to ensuring tank car safety and unlikely to be provided through other means. Nevertheless, certain aspects of TCC procedures and DOT oversight warrant improvement. Clearly and Thoroughly Describe TCC Approval Authorities RECOMMENDATION 6: DOT should define the TCC's mission and scope of responsibility with respect to the approval authorities, preferably in a DOT policy statement or in a single place in the hazardous materials regulations. The rationale for the authorities, the significance of each, and the nature of DOT's oversight role should be explained.

Executive Summary iS There are more than 200 references to the TCC in the DOT regulations. These references, in addition to several DOT and AAR memoranda of understanding and legal clarifications, provide the basis for the approval authorities. A first step to improving the effectiveness of TCC procedures and DOT oversight is the development of a thorough and clear description of the approval authorities, explaining the rationale behind them, their importance, and DOT's oversight role. This description should be viewed not as a constraint on TCC's activities but as a means of revealing the most efficient and effective procedures for carrying out the approval respon- sibilities and providing DOT. oversight and participation. Effectively Implement Critical TCC Functions RECOMMENDATION 7: DOT should work with AAR to explore options to relieve the TCC of duties that may adversely affect its ability to carry out activities most critical to tank car safety. Third-party assistance—under the auspices and oversight of the TCC—and the application of new tech- nologies should be explored to free the TCC of routine responsibilities, including aspects of design plan approval, that consume much of the service time available to committee members and hamper the ability of the TCC to attract members with a range of product chemistry, engineering, and safety expertise. Differences in the safety benefits of the various approval authorities are not always reflected in the time and resources allocated to each. The many functions of the TCC and the time commitment required of committee members can hamper the ability of the committee to attract membership, reduce the efficiency and timeliness of its actions, and limit activities most important to safety. TCC members devote a large portion of their service time to routine reviews of tank car design plans. This limits the time available for other important committee activities, such as updating the tank car design manual, investigating incidents to identify potential engi- neering improvements, and exploring new materials and technologies that promise safety benefits. Define DOT Oversight Responsibilities and Procedures RECOMMENDATION 8: DOT should seek permanent liaison with the TCC to provide continued oversight and participation by FRA and RSPA officials. Liaison status should be created through formal organizational agree- ments among AAR, FRA, and RSPA. The agencies should designate staff to serve as liaison representatives and prescribe their technical qualifica- tions and the procedures they must follow in monitoring TCC activities pertaining to the approval authorities. DOT should establish procedures to

16 ENSURING RAILROAD TANK CAR SAFETY ensure that TCC actions implementing the authorities of greatest impor- tance to safety are regularly monitored by FRA and RSPA officials and reviewed by outside technical experts as necessary. Informal arrangements that now provide FRA and RSPA (as well as Transport Canada and NTSB) free access to TCC activities appear to work well. The formalization of these arrangements is likely to improve the permanence of this relationship, which has not been as open and effective in the past. DOT relies on the judgment of DOT staff who attend TCC meetings to determine which approvals are most critical to safety and to ensure that they are monitored and reviewed. Better-defined procedures for monitoring critical TCC activities will enable DOT to question or request changes in TCC actions in a more timely manner as necessary. OTHER RECOMMENDATIONS The following measures are recommended to deal with specific safety issues (more detail is given for each in Chapter 5): Ensure broad compliance with construction, maintenance, and repair standards: DOT should ensure that its enforcement efforts are directed toward areas having high potential for noncompliance and significance to safety. The adequacy of efforts to ensure compliance with tank car con- struction, maintenance, and repair requirements should be assessed. Develop a more comprehensive approach to providing grandfather exclusions: DOT should develop formal policies and guidelines governing decisions to exclude existing tank cars from compliance with major new safety requirements because of economic or technical reasons. In aiming to achieve the intended safety benefits of new requirements at the least cost, DOT should ensure that consideration is given to all implementation alternatives. Improve inspection and testing of in-service tank cars: DOT should continue to work closely with industry to identify methods for verifying the structural integrity of in-service tank cars, including nondestructive test methods to supplement or replace existing test requirements. Results from the inspections and tests should be routinely collected to monitor tank car condition, improve test and inspection methods, and enhance tank car design, maintenance, and repair standards. TANK CONTAINERS A final observation concerns changes that have been takingplace in hazardous materials transportation by rail. Compared with a decade ago,

Executive Summary 17 a larger proportion of hazardous materials traffic moved by rail is now shipped in tank containers that are also transported by truck, barge, and ship. Because the use of intermodal tanks in rail is relatively new in the United States, experience in ensuring their safety in the rail environment is limited, especially compared with more than 100 years of experience in providing tank car safety. The long history of efforts to improve tank car safety, including the need to modify tank cars with special safety devices and inspect them for structural deficiencies long after designs were in widespread use, should provide guidance to government and industry on the need for preventive safety procedures for tank containers. Tank containers are subject to international standards, though aspects of their design and maintenance are also governed by DOT and AAR standards and regulations. DOT and AAR also regulate the operation and handling of tank containers and the design and condition of the railcars that carry them. The safety performance of tank containers was not examined in this study. The study committee believes, however, that in light of their increased use for hazardous materials and the various parties responsible for regulating them, a thorough DOT review of tank container safety issues and procedures is warranted. NOTES Transport Canada is responsible for regulating tank cars based in Canada, which account for about 10 percent of the North American tank car fleet. Because U.S. and Canadian tank cars travel freely across national borders, DOT and Transport Canada have adopted similar regulatory requirements. Hence, much of the discussion in this report is applicable to Canadian tank cars and Transport Canada's role in regulating them. DOT must consider the effect of a change in regulations or policies in one mode on all modes collectively, especially if the change results in modal traffic shifts.

CHAPTER 1 Introduction FOR MORE THAN A CENTURY, RAILROAD TANK CARS HAVE transported bulk liquids and compressed (liquefied) gases in the United States and Canada. Approximately 210,000 tank cars operate in North America.1 They carry materials ranging from food products, such as vinegar and corn syrup, to fuels, fertilizers, and industrial chemicals such as liquefied petroleum gas (LPG), caustic soda, and anhydrous ammonia. Slightly more than half the tank cars in service carry materials having chemical and physical properties potentially harmful if released. About one million hazardous materials shipments are transported by tank car each year, representing about S percent of all carload shipments by rail (Bureau of Explosives 1993). Most tank cars are designed to carry liquids. These cars, known as nonpressure cars, account for about three-quarters of the tank car fleet.2 Other tank cars, known as pressure cars, are designed for liquefied gases and other materials shipped under pressure.3 Nearly all pressure cars are used to carry materials classified as hazardous by the federal government because they are flammable, poisonous, or pose other hazards related to their physical and chemical characteristics. By comparison, only about 40 percent of the nonpressure tank cars are used for shipping hazardous materials. These include liquids having corrosive, flammable, and poison hazards. The pressure and nonpressure cars have many common design features. Both have cylindrical-shaped tanks capped at the ends by ellipsoidal- or hemispheric-shaped "heads." The former are almost always constructed of steel to provide sufficient strength to contain internal pressures. The latter are usually constructed of steel, though some are made of stainless steel 18

Introduction 19 and alloys of aluminum or nickel. All tank cars have openings fitted with valves and other closures, known as fittings, used for loading, unloading, pressure relief, tank maintenance, and cargo monitoring. The tanks of many pressure and nonpressure cars are wrapped with insulating material and covered by a steel jacket to control product temperature variation during transport. Nearly all tank cars in hazardous materials service are equipped with special couplers, known as double-shelf couplers, which provide more secure attachment of tank cars to adjoining cars during a derailment or other accident. They also reduce the possibility of tank cars being struck and punctured by couplers of other railcars during car switch- ing operations. Pressure and nonpressure designs also differ in many important re- spects. Pressure car tanks have thicker walls for increased strength in containing internal pressures. Pressure cars also have better-protected fittings, which are almost always mounted under a protective housing on top of the tank, where they are less susceptible to damage in a derailment or other accident. Fittings of nonpressure cars are seldom covered by a protective housing and may be mounted on top or bottom of the tank. Many pressure cars also have special design features to improve crash- worthiness. Among the most important are head protection systems, which increase the puncture resistance of tank heads, and thermal protec- tion systems, which protect against rapid overheating and rupture of the tank when exposed to fire. About two-thirds of pressure cars have head protection, and roughly half have both head and thermal protection. Both of these safety systems were introduced during the 1970s in response to a series of accidents involving cars carrying LPG and other flammable gases that resulted in fires and explosions. By the early 1980s, federal regulations required both head and thermal protection systems on pressure cars ship- ping flammable gas. Double-shelf couplers were introduced at about the same time as an additional safeguard against accident damage. Many of the advances made in tank car design were initiated by indus- try. Since the turn of the century, railroads, shippers, and tank car suppliers have cooperated to develop standards for tank car safety. Most notably, the Tank Car Committee (TCC) of the Association of American Railroads (AAR), which consists of representatives of railroads, shippers, and tank car suppliers, assists in the development and implementation of tank car design standards. Many of the TCC's activities, including review and approval of tank car construction drawings and the qualification of tank car fabrication and repair shops, are conducted under authority of the U.S. Department of Transportation (DOT). Two DOT agencies—the Federal Railroad Administration (FRA) and Research and Special Programs Administration (RSPA)—share respon- sibility for tank car safety. RSPA, through its Office of Hazardous Mate-

20 ENSURING RAILROAD TANK CAR SAFETY rials Safety, establishes the hazardous materials regulations covering ship- ments in most transport modes and container types, including railroad tank cars. The regulations govern tank car design, construction, repair, and maintenance; handling and operations by shippers and railroads; placard- ing and labeling; and use in transporting the various types of hazardous materials. FRA assists RSPA in developing the tank car regulations and provides enforcement, research, and technical support. BACKGROUND ISSUES From 1965 to 1980, more than a dozen incidents of tank car releases that resulted in fatalities occurred in the United States. One of the earliest occurred in 1969 in Laurel, Mississippi, where 15 tank cars containing flammable gas were damaged in a derailment. Many of the heads of the tank cars were punctured, resulting in fires and explosions that killed 2 people, injured 33, and caused more than $3 million in property damage (NTSB 1978). The next year, a train derailment in Crescent City, Illinois, resulted in 66 people being injured when several flammable gas cars ruptured after being heated by fires ignited following the derailment. Several of the injured were firefighters attempting to extinguish the fires (NTSB 1978). In Houston, Texas, in 1974, two flammable gas cars travel- ing under their own momentum during car switching operations (hump yard switching) hit an empty freight car with excessive force. The two tank cars separated and the coupler of the rear car struck and punctured the lead car. Flammable gas escaping from the puncture hole formed a vapor cloud and ignited, killing 1 person and injuring more than 200 (NTSB 1978). These and other prominent incidents were instrumental in spurring the development of many tank car design improvements. They also helped point to shortcomings in emergency response operations and railroad operating conditions and practices that contributed to many of the inci- dents and their severity. By the early 1980s, many tank cars were equipped with double-shelf couplers and head andlor thermal protection systems. Railroad operating practices were also changed to reduce the potential for accidents during switching operations, and railroads and FRA embarked on major programs to improve the condition of tracks, freight cars, signals, and other rail equipment. Many local fire departments, as well as railroads and shippers, created specially trained and equipped emergency response teams capable of dealing with hazardous materials incidents, reducing the risk to responders and the public from tank car releases. Tank car-related fatalities have declined markedly since these changes were made. Whereas more than 40 persons died in the fatal tank car

Introduction 21 incidents during the 1960s and 1970s, only one death has occurred since the beginning of the 1980s. The decline in fatalities has been impressive, but tank car incidents still occur and are cause for concern. Since the early 1980s there have been more than 10,000 accidental releases of hazardous materials.4 Whereas most of these releases were small spills and leaks with minimal conse- quences—caused by loose or malfunctioning valves and other fittings— some have had more serious outcomes. A 1987 train derailment in Miamisburg, Ohio, illustrates some of these consequences. Three tank cars were damaged in the derailment; one lost product, which ignited and caused an extensive cloud of smoke. An estimated 30,000 people were forced to leave their homes and businesses and more than 500 were treated at area hospitals for respiratory complaints during the incident (NTSB 1987). Total losses exceeded $3 million, not including costs associated with the evacuation. Whereas serious incidents like the one in Miamisburg are rare, they provide vivid reminders of the potential severity of tank car incidents and the need for regular and thorough reviews of procedures for ensuring safety. Several organizations have examined aspects of this process during the past 25 years. These examinations have raised a number of issues and recommendations for changes. Actions have been taken to address most concerns, but some continue to be the subject of controversy. The most severe tank car releases during the past 25 years have been investigated by the National Transportation Safety Board (NTSB) as well as DOT. Following investigations of the accidents in Laurel, Houston, and other locations during the 1960s and 1970s, NTSB urged industry and DOT to improve pressure car designs by requiring head and thermal protection. Rules requiring these safety systems on flammable gas cars were adopted during the late 1970s and early 1980s.5 NTSB also recom- mended wider use of double-shelf couplers and changes in railroad switch- ing practices to reduce the potential for incidents during tank car handling. Rules requiring double-shelf couplers on all tank cars carrying hazardous materials and greater care in switching were phased in during the 1970s and 1980s. Following the Miamisburg incident and several other prominent inci- dents, NTSB recommended additional safety measures. In particular, it urged DOT to expand head protection requirements to cover more tank cars and types of hazardous materials. Since the last major revisions of head protection requirements during the early 1980s, NTSB has recom- mended head protection on (a) all aluminum tank cars, (b) pressure tank cars that have been excluded from head protection requirements because of their age and size, and (c) tank cars used for certain specialty products such as chlorine, high-strength acids, and extremely reactive materials.6

22 ENSURING RAILROAD TANK CAR SAFETY DOT is currently addressing most of these issues in rulemaking (Federal Register 1993a). More generally, NTSB has criticized DOT for not taking a more proac- tive approach to ensuring that hazardous materials are shipped in tank cars with sufficient safety features by developing a stronger technical basis for assigning hazardous commodities to tank car design types. To improve this basis, NTSB has recommended that DOT "evaluate present safety standards for tank cars transporting hazardous materials by using safety analysis methods to identify the unacceptable levels of risk and the degree of risk from the release of hazardous material, and then modify existing regulations to achieve an acceptable level of safety for each product/tank car combination" (NTSB 1989). DOT has begun to address this concern by sponsoring research comparing the risk of release for the most common nonpressure (DOT-lilA) and pressure car (DOT-lOS) designs (Raj and Turner 1993). Further progress, however, is likely to require more compre- hensive data collection, analysis, and testing activities. On several occasions during the past iS years, NTSB has also expressed concern about relations between DOT and industry in ensuring tank car safety. Some of the concerns have focused on the DOT's association with the AAR Tank Car Committee. During investigations of some prominent tank car accidents, including Miamisburg, NTSB discovered errors by the TCC in approving designs and repairs that did not meet DOT standards (NTSB 1985; NTSB 1987). NTSB questioned why DOT oversight and inspections did not detect these errors. It also questioned the adequacy of TCC's procedures, including its record-keeping and analysis of tank car repair records. To address these concerns, NTSB recommended that DOT explicitly define the authorities vested in the TCC and establish procedures governing their implementation, including a program for reviewing all actions taken to determine their consistency with federal requirements (NTSB 1987; NTSB 1989). It also recommended that DOT and the TCC collect better data on tank car repairs and establish standards for ensuring quality control in tank car fabrication and repair shops (NTSB 1985; NTSB 1987). In response to these recommendations, DOT conducted an audit of the TCC, which was completed in 1990 (FRA and RSPA 1990). The audit team, consisting of FRA and RSPA officials, reviewed the TCC's organiza- tion and operating procedures. Although complimentary of the overall performance of the TCC and the general concept of AAR's approval authorities, the audit team recommended several changes in the TCC's operations and procedures. These included measures to improve record- keeping, encourage wider participation by TCC members in the approval process, and improve TCC data collection and analysis activities. The audit team also reported that for several years during the 1980s DOT

Introduction 23 representatives did not participate in TCC meetings; however, the team did not make recommendations concerning this matter because participation by FRA and RSPA staff had improved considerably during the audit period. DOT has indicated satisfaction with the actions taken by TCC in response to the audit recommendations and those of NTSB. These re- sponses included development of computerized records of tank car repairs, guidelines for the development of quality control programs at tank car fabrication and repair shops, and changes in the membership structure of the TCC to ensure greater participation by members from all the repre- sented industries. NTSB has also indicated satisfaction with the responses of DOT and AAR, closing most of its recommendations regarding the TCC. One NTSB recommendation that has not been fully addressed concerns DOT's efforts to clarify the approval responsibilities of the TCC. Although the audit report provided a general review of the nature and scope of the approval authorities, it does not contain explicit and detailed explanations of the authorities as requested by NTSB. Other open NTSB recommendations include suggestions that DOT restrict the use of "grandfather" provisions that exempt some tank cars from new safety-related requirements,7 that it establish stronger require- ments for testing the structural condition of in-service tank cars (NTSB 1992), and that it consider the environmental and potential human health effects of materials when assigning them to tank cars and other types of packaging (NTSB 1991). DOT is currently addressing these concerns in rulemaking (Federal Register 1993a; Federal Register 1993b). Besides NTSB, several other bodies and organizations have examined issues pertaining to tank car safety. Congress has considered the adequacy of laws and regulations governing the shipment by tank car of materials harmful to the environment and human health. Congressional interest in this subject increased following the 1991 release of a herbicide from a tank car into the Sacramento River in California, causing extensive ecological damage and economic impacts.8 In congressional hearings, railroad labor representatives also raised concerns about the potential adverse effects of tank car releases on the long-term health and safety of rail workers.9 Some industry groups have also questioned the adequacy of regulations govern- ing the shipment of environmentally sensitive chemicals. AAR, for in- stance, has noted the high cost of cleaning up and treating spills involving these materials, many of which are subject to minimal DOT packaging restrictions (Barkan at al. 1991). During the past 5 years, the General Accounting Office (GAO) issued several reports recommending that FRA and RSPA collect better haz- ardous materials incident data, especially for use in deploying enforcement resources to high-risk aspects of hazardous materials transportation (GAO

24 ENSURING RAILROAD TANK CAR SAFETY 1989a; GAO 1989b; GAO 1990; GAO 1991a; GAO 1991b). In response to the GAO recommendations, RSPA enhanced its hazardous materials incident reporting form to collect more detailed information from carriers. In addition, FRA increased its use of incident reports, violation records, traffic data, and other statistical information in deploying hazardous materials field inspectors. STUDY SCOPE AND APPROACH Whereas several of these issues fall within the broad legislative charge for this study, their proper assessment requires the examination of many complex technical, economic, and safety matters. The committee decided to narrow the study scope to focus on areas that are of sufficient impor- tance to warrant recommendations and that could be examined with the resources and expertise available. The Hazardous Materials Transportation Uniform Safety Act (HMTUSA) calls for an examination of the tank car design process. From the outset of the study, the committee recognized that such an examination would require consideration of the overall process for ensuring tank car safety, not just the design process. The overall safety process consists of a range of government and industry activities that affect how tank cars are built and maintained, operated and handled, and authorized for use in shipping specific hazardous commodities. The committee reviewed the major elements of this process, considering the effectiveness of DOT's regulatory, research, and enforcement programs and their association with AAR and industry efforts to improve tank car safety. This review led to the identification of several strengths and weaknesses in the process, some of which led to recommendations. A unique element of the tank car design process is the role of the AAR TCC. To understand this role, the study committee spent a great deal of time examining the nature of the design approval functions and respon- sibilities of the TCC. The study committee also examined DOT's oversight responsibilities. Relatively little consideration was given to the specific procedures followed by the TCC in implementing the approval authorities. The study committee felt that appropriate implementation and oversight procedures cannot be devised or evaluated without a clear understanding of the purpose of the authorities. I-IMTUSA also requested an examination of whether head protection should be required on all tank cars that carry hazardous materials. During the study, DOT proposed new rules to further expand requirements for head protection (Federal Register 1993a). Though the study committee was aware of the ongoing rulemaking, the latest rule proposals were not

Introduction 25 published in time for committee evaluation. Nevertheless, the committee decided at the outset of the study that it could not properly assess the need for head protection on individual tank car designs and for specific types of hazardous materials. Such an assessment was deemed beyond the scope and resources of the study because of the many economic, technical, and safety implications that would need to be evaluated. Instead, the commit- tee decided to focus its efforts on reviewing the general process used by DOT in determining which tank cars warrant head protection and other safety features. Consideration was given to a few other specific safety issues. Examples include the structural testing of in-service tank cars and DOT's procedures for excluding some tank cars from design safety requirements. Although these and other issues considered were not derived from a comprehensive review of all tank car safety issues, they deal with matters that arose during the course of the study and that the committee believes are important and sufficiently understood to permit recommendations. REPORT ORGANIZATION The remainder of the report is organized into four chapters. Background information on tank car design and operations is contained in Chapter 2. In Chapter 3 the framework of regulations governing tank cars is described and tank car safety performance is reviewed, including what is known about the effectiveness of head protection systems. Government and industry activities to ensure tank car safety, ranging from regulatory activities to research, testing, and enforcement programs, are examined in Chapter 4. Included in Chapter 4 is a review of the functions of the AAR TCC and a synopsis of the approaches for approving and certifying vehicle and container designs in other transport modes. Key findings from the study and major issues that are the subject of recommen- dations are discussed in Chapter S. A glossary of terms used in the report is provided in Appendix B. NOTES AAR Universal Machine Language Equipment Register, computer run dated May 3, 1993. More detailed statistics on tank car fleet characteristics and the data sources for the figures used in this chapter are provided in Chapter 2. A small fraction of tank cars are specialty designs that are not classed as either pressure or nonpressure designs. These include the cryogenic tank cars, multi- unit tank car tanks, and seamless steel tank car tanks.

26 ENSURING RAILROAD TANK CAR SAFETY 4. See Chapter 3 for tank car release statistics. S. NTSB (1981) summarized its recommendations concerning head protection and other tank car safety measures during the 1960s and 1970s. These recommendations were the result of several NTSB accident investiga- tions and special reports during the 1980s. They are summarized in August 21, 1990, correspondence from James L. Kolstad, Chairman of NTSB, to the Dockets Branch of RSPA (Docket HM-175A, Notice No. 90-8). The recommendation is summarized in August 21, 1990, correspondence from James L. Kolstad, Chairman of NTSB, to the Dockets Branch of RSPA (Docket HM-175A, Notice No. 90-8). On July 14, 1991, a Southern Pacific train derailed above the Sacramento River. A tank car fell into the river, spilling 19,000 gal of metam sodium, a herbicide that was not listed as a hazardous material by DOT. See Hearing before the Government and Transportation Subcommittee of the Committee on Government Operations, U.S. House of Representatives, July 31, 1991 (U.S. Government Printing Office 1992). See statement of Lawrence M. Mann on behalf of the Railway Labor Execu- tives Association in Hearings before the Subcommittee on Transportation and Hazardous Materials of the Committee on Energy and Commerce, U.S. House of Representatives, November 7-8, 1989 (U.S. Government Printing Office 1992, Serial 101-113). REFERENCES ABBREVIATIONS GAO General Accounting Office FRA Federal Railroad Administration NTSB National Transportation Safety Board RSPA Research and Special Programs Administration Barkan, C., T. Glickman, and A. Harvey. 1991. Benefit-Cost Analysis of Using Type 105 Tank Cars Instead of Type 111 Tank Cars To Ship Environmentally Sensitive Chemicals. Report R-794. AAR Distribution Center, Chicago, Ill. Bureau of Explosives. 1993. Annual Report of Hazardous Materials Transported by Rail: Year 1992. Report BOE 92-1. Association of American Railroads. Washington, D.C. FRA and RSPA. 1990. A Report on Tank Cars: Federal Oversight of Design, Construction, and Repair. U.S. Department of Transportation. Federal Register. 1993a. Docket HM-175A, Notice 93-19. Oct. 8, pp. 52,574-52,596. Federal Register. 1993b. Docket HM-201. Notice 93-15. Sept. 16, pp. 48,485-48,502. GAO. 1989a. Railroad Safety: FRA Needs To Correct Deficiencies in Reporting Injuries and Accidents. Report GAQ/RCED-89-109. Washington, D.C. GAO. 1989b. Railroad Safety: DOT Should Better Manage Its Hazardous Mate- rials Inspection Program. Report GAO/RCED-90-43. Washington, D.C.

Introduction 27 GAO. 1990. Railroad Safety: New Approach Needed for Effective FRA Safety Inspection Program. Report GAO/RCED-90-194. Washington, D.C. GAO. 1991a. Railroad Safety: Weaknesses Exist in FRA's Enforcement Program. Report GAO/RCED-91-72. Washington, D.C. GAO. 199 lb. Transportation Safety: Infortation Strategy Needed for Hazardous Materials. Report GAOIIMTEC-91-50. Washington, D.C. NTSB. 1978. Safety Effectiveness Evaluation: Analysis of the Proceedings of the National Transportation Safety Board into Derailments and Hazardous Ma- terials, April 4-6, 1978. Report NTSB-SEE-78-2. Washington, D.C. NTSB. 1981. Safety Report: Status of Department of Transportation's Hazardous Materials Regulatory Program. Report NTSB-SIR-81-2. Washington, D.C. NTSB. 1985. Hazardous Materials Special Investigation Report: Hazardous Materials Release, Missouri Pacific Railroad Company's North Little Rock, Arkansas Railroad Yard, December 31, 1984. Report NTSB/SIR-85/03. Washington, D.C. NTSB. 1987. Hazardous Materials Accident Report: Hazardous Materials Release Following the Derailment of Baltimore and Ohio Railroad Company Train No. SLFR, Miamisburg, Ohio, July 8, 1986. Report NTSB/HZM-87101. Washington, D.C. NTSB. 1989. Collision and Derailment of Montana Rail Link Freight Train with Locomotive Units and Hazardous Materials Release, Helena, Montana, February 2, 1989. Report NTSB/RAT-89/05. Washington, D.C. NTSB. 1991. Safety Study: Transport of Hazardous Materials by Rail. Report NTSB/SS-91-01. Washington, D.C. NTSB. 1992. Special Investigation Report: Inspection and Testing of Railroad Tank Cars. Report NTSB/SIR-92/05. Washington, D.C. Raj, P. K., and C. K. Turner. 1993. Hazardous Materials Transportation in Tank Cars: Analysis of Risks—Part 1. Report DOTIFRAJORD-92/34. Federal Rail- road Administration, U.S. Department of Transportation.

CHAPTER 2 Tank Car Design and Use Characteristics BACKGROUND INFORMATION ON THE DESIGN AND OPER- ating characteristics of railroad tank cars is reviewed in this chapter. A brief history of key developments in tank car design is followed by a review of principal tank car design features and major design types. Information is then provided on the kinds of materials transported by tank car and the use and operational characteristics of tank cars. KEY DEVELOPMENTS IN TANK CAR DESIGN Early Designs Railroad tank cars have transported chemicals, petroleum products, and other bulk liquids and compressed gases in North America for more than a century.1 Early versions of tank cars were introduced more than 125 years ago to ship the first large quantities of crude oil produced from the petroleum fields of western Pennsylvania. Initially, the oil was shipped in wooden vats placed on railroad flat cars. Advances in design were soon made, and the vats were replaced by barrel-shaped wooden tanks mounted longitudinally on wooden car underframes. Further advances led to the use of riveted steel tanks that were more durable and resistant to leakage and could be mounted on steel beams. These advances resulted in the first true tank car. By the turn of the century more than 10,000 were in operation across North America. Most could hold 6,000 to 10,000 gal (22 710 to 37 850 Q. Though crude oil and petroleum products remained the principal cargoes, numerous other mate- 28

Tank Car Design and Use Characteristics 29 rials, including acids, alcohols, ammonia, and food products, were shipped in the growing and increasingly diverse tank car fleet. Establishment of Design Standards In the years before World War I innovations were made in tank car design to accommodate the expanding number of industrial chemicals being shipped by rail. During this period, several "high-strength" tank cars were introduced to carry more volatile petroleum-based products. These tank cars were designed with pressure relief devices and were constructed of stronger steels than their predecessors. To ensure their quality, the rail- roads, in cooperation with shippers and tank car suppliers, established formal design specifications. The specifications, initially provided as guidelines, were eventually incorporated into railroad interchange rules.2 By the 1920s more than 80 commodities were being transported in approximately 50,000 tank cars. Because a growing number of these commodities were hazardous, Congress passed legislation requiring the development of tank car safety standards by the Interstate Commerce Commission (ICC). In 19271CC worked with industry to establish a set of seven new ICC specifications (Table 2-1). Most of the ICC specifications TABLE 2-1 Specifications for Tank Cars Established by ICC in 1927 (FRA and RSPA 1990) CLASS GENERAL DESCRIPTION ICC-103 General purpose tank car with a 2 percent expansion dome and safety valves capable of holding internal pressure below 45 psi or safety vent with rupture disc set for 30 psi ICC-103A Essentially an ICC-103 tank car with a safety vent instead of a safety valve, no bottom outlet, and a 1 percent expansion dome ICC-103B Rubber-lined ICC-103A tank car with a 1 percent expansion dome, used for acid service ICC-104 A 103 tank car with 2 in. of insulation and a minimum 2 percent expansion dome ICC-104A A 104 tank car with corkboard insulation, 75-psi safety valves, tank shell of open-hearth boilerplate steel, and a minimum 2 percent expansion dome ICC-lOS Insulated pressure tank used for materials with high vapor pressures ICC-108 Wooden tank used for transporting vinegar, wine, or similar food-grade products

30 ENSURING RAILROAD TANK CAR SAFETY were based on specifications established previously by industry.3 The specifications governed tank wall thickness, construction materials, pres- sure relief systems, and various other design features. Key Technical Advances Before World War II, new specifications for heavier "pressure" cars were introduced to enable the transportation of chlorine and volatile flammable products such as liquefied petroleum gas (LPG). Most tank cars in opera- tion at the time used riveted steel tanks that were difficult to clean and had a tendency to leak through the seams, making them poorly suited for pressure service. During the 1930s major advances in welding technology eliminated the need for riveted seams. These advances were critical to the introduction of pressure tank cars. By the 1950s most of the approx- imately 150,000 tank cars in service had welded steel tanks. Another significant design change during the period was introduction of "stub sill" tank cars. Before 1950 most tanks were mounted on a contin- uous steel beam (known as a center sill) that transmitted most of the push and pull forces of the train. Stub sill cars were constructed with two unconnected sills (one attached to the bottom of each end of the tank) that made the tank the primary structural member of the tank car. The develop- ment of lighter underframes, coinciding with several other design changes—including domeless and noninsulated tanks—permitted the in- troduction of larger tank cars.4 Before the 1960s few tank cars could hold more than 10,000 gal (37 850 L) and most were less than 35 ft (10.67 m) long. By the middle of the decade many tank cars built in the new classes measured up to 80 ft (24.38 m) in length and had capacities exceeding 30,000 gal (113 550 L). Some were capable of holding more than 40,000 gal (151 400 L). The larger tank cars were especially attractive to shippers of low-density mate- rials, such as LPG and anhydrous ammonia, since significantly more product could be shipped in the larger tanks without exceeding gross weight limits. introduction of Special Safety Features In the late 1960s several safety problems emerged with the large-capacity pressure cars. These cars, sometimes called "jumbo cars," were in several accidents in which tank punctures or ruptures occurred. Concern over jumbo cars led to the introduction during the 1970s of several new safety features, including head and thermal protection systems. Limits on tank

Tank Car Design and Use Characteristics 31 size [34,500 gal (130 583 L)] and loaded car weight [263,000 lb (119 294 kg)] were also imposed, and new restraining couplers (double-shelf cou- plers) were developed to reduce the potential for tank car punctures. More discussion of these safety features is provided later in this chapter and in Chapter 3. PRINCIPAL DESIGN FEATURES With the exception of some highly specialized equipment, virtually all tank cars consist of four major design elements: the tank, its fittings and attachments, the underframe and running gear, and special safety systems (Figure 2-1). Tank The common design feature of tank cars for more than 100 years has been the cylindrical shape of the tank. The tank cylinder, or shell, is. formed by welding together several metal plates shaped into rings. The cylinder is capped at both ends with hemispheric or ellipsoidal heads.5 Tanks are usually constructed of carbon steel. About 2 percent are constructed of aluminum, nickel, or stainless steel alloys. Most tanks in nonpressure service have walls made of steel plates /16 in. (11.1 mm) thick (when other materials are used thickness is usually greater). Tanks used in pressure service are constructed from thicker steel plates (aluminum alloys are permitted for some pressure designs, but seldom used). Pressure tank walls usually range in thickness from 1/2 in. (12.7 mm) to more than 1 in. (25.4 mm), depending on test pressure, tank dimensions, and weld and steel strength characteristics. Tank heads and shells are usually the same thickness. Tank sizes vary. Because of limits on gross (loaded) car weight, the density of the lading is a key determinant of tank dimensions and carrying capacity. Medium- and high-density commodities usually are carried in tanks ranging in capacity from 7,000 to 25,000 gal (26 495 to 94 625 L). Larger tanks, which can carry up to 34,500 gal (130 583 L), are used for low-density commodities that can be shipped without exceeding gross weight limits.6 Tanks are often wrapped in fiberglass, foampr other insulating materials and covered by a steel jacket that is approximately 1/ in. (3.2 mm) thick. Insulation is essential for cargoes that need to be maintained within certain temperature ranges.7 In addition, the interiors of some tanks are lined, coated, or clad with materials to maintain cargo purity and protect the tank

Fittings Manway upler Lfl11t¼)I II I I I.J¼flS Fittings Assembly FIGURE 2-1 Principal design elements of nonpressure tank car (NTSB 1991).

Tank Car Design and Use Characteristics 33 from the corrosive or reactive effects of the cargo. Linings are made of glass and rubber and coatings usually consist of sprayed-on organic materials. Common cladding materials are lead, nickel, and stainless steel. Some tanks have heating systems mounted internally or externally to the tank walls. Steam, hot water, or heated oil is circulated through the heater coils and pipes to warm viscous or solidified materials for easier unloading. Tank interiors may be divided into compartments that allow carriage of several different commodities in smaller quantities. A few older tank cars are equipped with expansion domes on top of the tank. The purpose of the dome is to provide vacant space (outage) for cargo to expand during temperature changes. Research during the 1950s indicated that the dome was not needed when sufficient outage was provided in the tank itself. Tank Fittings and Attachments Various types of tank fittings located at openings in the tank are used for tank loading and unloading, cleaning and repair, pressure relief, and cargo monitoring (Figure 2-2). The types of fittings used and their placement on the tank depend on the characteristics of the commodity, regulatory re- quirements, and operational needs. Valves are the most common fitting. Some valves are used for loading and unloading, and others provide internal pressure relief. Loading and unloading valves may be on the top or bottom of the tank. Top valves on pressure cars are usually covered by a protective manway housing; bottom valves, used almost exclusively on nonpressure cars, are usually located at the center of the tank. Fittings used for pressure relief are placed on top of the tank. They are designed to open at predetermined pressures to reduce the stress on the tank walls caused by commodity vaporization and expan- sion. Safety vents are sometimes used instead of valves. They may consist of a frangible disc that ruptures when specific internal pressures are reached or a fusible plug that melts at threshold temperatures. The largest tank fitting is the manway, which is on top of the tank. The manway allows human and mechanical access into the tank for cleaning, inspection, loading, unloading, and repairs. It is closed with a hinged or bolted cover. Other common fittings include gauging devices, used for measuring the amount of product in the tank; thermometer wells and sampling lines, used for determining the condition of the product; and bottom sumps and washouts, used for tank emptying and cleaning. Tank attachments differ from fittings. They are normally connected to metal pads welded to the tank exterior. Examples are ladders, platforms, hand rails, brake supports, and body bolsters that cradle the tank to the underframe or stub sills (see Figures 2-1 and 2-3).

34 ENSURING RAILROAD TANK CAR SAFETY Top loading/unloading valve Bottom outlet valve Safety relief valves FIGURE 2-2 Examples of tank car valves (Union Pacific Railroad 1990). Underframe and Running Gear The tank is mounted on an underframe that rests on the running gear of the car. As discussed previously, there are two types of underframes: full- length center sills and stub sills (Figure 2-3). The center sill underframe is no longer in general use, although it is used on aluminum tank cars and tank cars designed to transport low-temperature commodities such as carbon dioxide. Tank cars built with stub sills account for more than 90 percent of the fleet. The running gear of tank cars is the same as that of most other freight cars, consisting of wheels, axles, sideframes, springs, and other standard equipment for car movement and braking. The coupling systems of tank cars, however, differ from those of most other railcars. Tank cars have special double-shelf couplers, as discussed in the next subsection.

Full-length center sill underframe Truck assembly FIGURE 2-3 Tank car underframe and running gear (Union Pacific Railroad 1990).

36 ENSURING RAILROAD TANK CAR SAFETY Safety Systems Depending on the design of the tank car and the commodity carried, U.S. Department of Transportation (DOT) regulations require certain safety features. Among them are double-shelf couplers, head and thermal protec- tion systems, pressure relief devices, and equipment to protect fittings. Double-Shelf Couplers All tank cars used in hazardous materials service have special couplers designed to remain engaged when subjected to forces that occur during switching operations and train accidents. The type of coupler used for this purpose has two steel plates or "shelves" located at the top and bottom of the coupling device (Figure 2-4). The shelves are designed to restrict the upward and downward movement of engaged couplers, providing more effective restraint and interlocking. Double-shelf couplers became a com- mon design feature in the late 1970s and early 1980s, when regulations were adopted phasing in their use on all tank cars in hazardous materials service.8 Head Protection From 1978 to 1984 regulations were changed to require head protection on most pressure cars used to carry flammable gases and certain other hazardous materials. The purpose of head protection is to make the tank heads (ends) more resistant to puncture from the couplers of other railcars, broken rails, or other objects. Head protection requirements were origi- nally established to prevent punctures during switchyard operations, when excess speed or bounce during car switching can cause couplers to override into the tank car head. DOT regulations require the bottom half of each tank head—the area most likely to be struck during yard impacts—to be able to withstand the force of a coupler striking it at a relative speed of 18 mph (29-km/hr).9 The regulations do not prescribe how this head protection performance standard must be met but permit, as an option, use of steel plates 1/2 in. (12.7 mm) thick mounted in front of the tank heads, as shown in Figure 2-5. Many older pressure cars have been equipped with the half-head protection devices. Many newer pressure cars are built with steel jacket heads that have been designed to pass DOT's 18-mph (29 knilhr) coupler impact test, qualifying them as head-protected. The term "head shield" used in the legislative charge for this study (see Chapter 1) is sometimes used to refer specifically to the half-head protec- tion device shown in Figure 2-5. In this study, the broader term "head

Tank Car Design and Use Characteristics 37 STANDARD COUPLERS AAR Type E Coupler Ier DOUBLE-SHELF COUPLERS USED ON TANK CARS Top Shelf TL A AAR Type E Top and Bottom Shelf Coupler Bottom Shelf Top Shelf and Bottom Bottom Shelf FIGURE 2-4 Standard freight car couplers and tank car double-shelf couplers (NTSB 1980). protection" is used in reference to all devices that qualify as head puncture protection according to current (1994) federal standards, including half- head and full-head protection systems. Thermal Protection Thermal protection was introduced at approximately the same time as head protection. It was developed in response to several major failures in which tanks carrying flammable gases were weakened by exposure to fire following a derailment or other accident. Resulting ruptures and explo- sions, known as BLEVEs (boiling liquid expanding vapor explosions), often occurred about 1/2 hr after the initial accident event, after emergency

Head protectior for pressure tar Skid protection device for bottom fitting of nonpressure tank car Protective housing for fittings on pressure tank car Protective housing FIGURE 2-5 Examples of tank car safety features (Union Pacific Railroad 1990).

Tank Car Design and Use Characteristics 39 responders had arrived at the scene and were near the weakened tank. The purpose of thermal protection is to retard heat flow into the tank when exposed to fire, providing emergency responders additional time to isolate the area, cool the tank, and begin to control the fire before the pressure in the tank exceeds the residual strength of the tank walls. Federal regulations do not mandate a particular thermal system, but prescribe performance standards for tank cars carrying flammable gases.10 Two main systems in use that meet these standards are a jacketed insula- tion system, consisting of a heavy blanket of mineral wool or ceramic fiber wrapped around the tank and held in place by a metal jacket; and a textured heat-resistant coating sprayed directly onto the tank exterior. The former system is more common. Both systems are combined with high- capacity safety relief valves, which vent heated product rapidly. Thermal protection systems differ significantly from conventional insu- lation systems. The latter normally are designed to limit heat transfer at ambient air temperatures and maintain lading temperatures. Conventional insulation systems often lose their effectiveness at the high temperatures generated by fire. Thermal protection systems, on the other hand, use materials that continue to retard heat flow at temperatures well above ambient levels. Pressure Relief Systems All DOT-specification tank cars have safety relief devices (usually valves) that limit pressure buildup in the tank. When pressures reach predeter- mined levels, the devices open to emit product and lower the pressure. Federal regulations prescribe pressure settings that vary according to the tank test pressure rating. These devices are sometimes used in combination with other pressure relief devices, including safety vents. Some non- pressure cars, including those used for acids and other materials with low vapor pressures, have safety vents only, partly because of the lack of durable and affordable corrosion-resistant valve materials. Protection of Tank Fittings and Attachments Because valves, other fittings, and tank attachments may be damaged in an accident, federal regulations and AAR interchange rules require the use of certain devices to protect them. On pressure cars, bottom fittings are prohibited and top fittings are located inside a reinforced housing (Figure 2-5). Nonpressure cars have less stringent requirements for protection of fittings. Bottom fittings are permitted, although DOT regulations require breakaway grooves and AAR interchange rules require skid protection

40 ENSURING RAILROAD TANK CAR SAFETY (Figure 2-5). Similar protection is not required for top fittings on non- pressure cars, because they are considered less susceptible than bottom fittings to accident damage. Protection of the tank wall from tearing or puncture by attachments is accomplished by mounting the attachments on metal pads welded to the tank wall. The pads provide a breakaway connection for the attachment, preventing damage to the tank wall. DESIGN TYPES Specification Numbers Most tank cars that carry hazardous materials must meet minimum DOT design requirements established for specific tank car classes. There are a dozen classes; each is given a three-digit number that follows the "DOT" prefix (e.g., DOT105).11 Within each of the classes are design types. The design types are identified by specification numbers. The full specification number (e.g., DOT-105J500W) indicates tank test pressure, construction material, and the presence of specific safety devices, such as head and thermal protection systems (see accompanying box for explanation of specification numbers). Materials not regulated by DOT and certain regulated materials with low hazards may be carried in non-DOT tank cars, consisting primarily of cars designed to AAR specifications.12 Because DOT and AAR specifica- tions are very similar, more than 98 percent of tank cars are designed and classified according to the DOT specifications, which permit greater flex- ibility in use (Table 2-2). Approximately 210,000 DOT-class tank cars operate in North America (Table 22).13 Nonpressure Designs Nonpressure tank cars carry most of the hazardous and nonhazardous shipments moved by tank car. The two most common are the DOT-103 and DOT-ill; the latter type is predominant, accounting for more than 9S percent of the nonpressure car fleet (Table 2-3). DOT-103 The DOT-103 is the oldest nonpressure design with tank cars still in service. Its origins date back to 1927, when the ICC began regulating tank

Tank Car Design and Use Characteristics 41 EXPLANATION OF TANK CAR DESIGN SPECIFICATION NUMBERS (General American Transportation Corporation 1991) DOT 111 A 60 AL W Welded construction Construction metal other than steel (alumi- num) Tank test pressure Insignificant unless S, 1, or J (see below) Class number Authorizing agency Authorizing Agency Tank cars that meet DOT or AAR specifications are designated with the appropriate specification number beginning with either prefix. AAR cars meet most DOT requirements and are authorized to carry some regulated commodities. Class Number Class numbers denote general categories of tank cars that have several common design and construction features. The most common tank car is the DOT-ill, which accounts for about three-quarters of the tank car fleet. The 111, which is a nonpressure design, carries most kinds of materials moved by tank car. The next most common classes are the DOT-los and DOT-112 pressure tank cars, which account for between 20 and 25 percent of tank cars in service and a higher share of tank cars used in hazardous materials service. "A," "S," "J," and "T" Identifiers The letters A, S, J, or T follow the class number of some tank car designs. Whereas A has no special significance except as a separator of the class and test pressure numbers, the other letters indicate that the car is equipped with certain protective systems. S indicates that the car is equipped with head protection. J indicates that the car is equipped with head protection and jacketed thermal protection. T indicates that the car is equipped with head protection and sprayed-on thermal protection. These designations apply mainly to the pressure tank cars, which carry most of the commodities that require the special protection. Tank Test Pressure For most tank cars, the tank test pressure is denoted in the specification designation. Test pressures are measured in pounds per square inch (psi) using test methods prescribed in the regulations. Test pressures generally range from 60 psi (except in some older cars) for general service tank cars to 600 psi for the highest test-pressure cars. The 111 s can be tested for 60 or 100 psi, although most new cars are built to the 100-psi specification. Most new 105 and 112 cars are built to specifications of 300 psi or higher.

42 ENSURING RAILROAD TANK CAR SAFETY EXPLANATION OF TANK CAR DESIGN SPECIFICATION NUMBERS (General American Transportation Corporation 1991) (continued) Construction Material The most common materials used for construction of tank cars are steel and steel alloys. The next most common material is aluminum, followed by a small number of nickel and nickel alloy tanks. When steel is not used, the alternative material is indicated in the specification number after the test pressure number (or class number if no pressure number is indicated). About 2,500 tank cars are nonsteel, of which about 2,000 are constructed of aluminum. Welded Construction The suffix W denotes a fusion-welded tank. F denotes a forge-welded tank, and X denotes a fusion-welded longitudinal tank seam and forge-welded head seams. The absence of a suffix indicates a seamless tank construction. Virtually all tank cars in operation today are fusion welded, with the exception of about 300 DOT-103 and DOT-107 tank cars. cars. The type 103 is the last tank car in operation with an expansion dome and center sill as common design features. Although revisions to the design were made as late as 1971, no new 103s are being built for economic reasons. Only about 2,500 of these tank cars remain in service. DOT-ill During the 1960s the DOT-ill replaced the DOT-103 as the predominant general-purpose tank car. The reason behind this shift was the introduction of domeless and stub sill designs, which permitted larger tanks. Nearly 160,000 type ills are in use, making up about three-quarters of the present tank car fleet. Approximately two-thirds are less than 20 years old. Over the years, numerous versions of the type ill have been introduced, varying in construction materials, tank linings, insulation, and other design features. Most type ills have tank capacities of 13,000 to 25,000 gal (49 205 to 94 625 L). Many have tank wall (head and shell) thicknesses of /16 in. (11.1 mm). The type ill is not subject to the same requirements as pressure cars concerning protection and placement of valves and other fittings. However, starting in the 1970s, AAR phased in revisions to its interchange rules to require additional protection for bottom fittings, including skid protection devices. All type 11 is constructed since 1978 have this protection and most older cars have been retrofitted.

TABLE 2-2 North American Tank Car Fleet Statistics, 1993 SPECIFICATION NONPRESSURE° PRESSURE" SPECIALTY' Tomj. PERCENTAGE OF TOTAL DOT 159,974 49,348 631 209,953 98.7 AAR 2,668 0 113 2,781 1.3 Total 162,642 49,348 744 212,734 100 Percentage of Total 76.5 23.2 <1.0 100 - Nom: The figures include approximately 20,000 tank cars based in Canada that are accepted for interchange in the United States because they meet DOT or AAR requirements. Inc1udes DOT-103, 104, and 111 and AAR-201, 203, 204, and 211. blncludes DOT-lOS, 109, 112, 114, and 120 (proposed class operating under DOT exemption). 'Includes DOT-113 and 115 and AAR-206. Does not include the DOT-106 and 110, which are not tank cars but are more appropriately described as portable tanks or cylinders. Also, does not include the DOT-107, which are tank cars with multiple permanently mounted tanks. SOURCE: AAR rail car fleet inventory data from Universal Machine Language Equipment Register (UMLER); computer run on May 4, 1993.

TABLE 2-3 North American Tank Car Fleet by DOT Specification Type and Year Built, 1993 YEAR BUILT PERCENTAGE DOT BEFORE 1964 TO 1974 TO AFTER OF TOTAL CLASS 1964 1973 1983 1983 TOTAL FLEET GENERAL DEscRIVrION OF Ciss 103 1,785 752 10 5 2,552 1.2 Steel, aluminum, nickel, or alloy steel tank with dome; some insulated 104 51 22 0 0 73 0 Insulated steel tank with dome lOS 2,222 4,726 12,178 6,744 25,870 12.3 Insulated steel tank for pressure service; some equipped with thermal and head protection 109 34 40 0 0 74 0 Aluminum tank for pressure service; some insulated 111 3,309 42,761 65,299 45,980 157,349 74.9 Steel, aluminum, or alloy steel tank without dome; some insulated 112 2,010 15,170 4,156 1,201 22,537 10.7 Noninsulated steel tank for pressure service; most equipped with head and thermal protection 113 6 83 32 0 121 0 Alloy steel tank with steel outer shell; heavily insulated to carry low-temperature commodities 114 83 609 18 20 730 0 Noninsulated steel tank for pressure service; many equipped with thermal and head protection 115 0 132 84 294 510 0 Insulated aluminum, steel, or alloy steel tank with outer shell 120 61 26 50 0 137 Q Insulated steel or aluminum tank for pressure service with optional bottom outlet Total 9,561 64,321 81,827 54,244 209,953 100 Percentage of total 4.6 30.6 39.0 25.8 100 - The 120 class has been proposed as a DOT specification but not approved. The DOT-120 tank cars currently in service operate under exemption. SOURCES: General American Transportation Corporation 1991 and AAR tank car inventory data (UMLER computer run on May 4, 1993).

Tank Car Design and Use Characteristics 45 Pressure Designs Pressure cars transport most of the compressed gases (materials maintained in a liquefied state by pressure) shipped in bulk by rail and make up about one- quarter of the tank car fleet. These cars have test pressures ranging from 100 to 600 psi (690 to 4137 kPa). About two-thirds of pressure cars have head protection, and many of these cars are equipped with thermal protection as well. Pressure cars equipped with both types of protection contain the letters J or T in their specification number (e.g., DOT-105J, DOT-i 12T). Cars with head protection only have the letter S in their specification number (e.g., DOT-i 12S). With few exceptions, pressure car fittings are on top of the tank in a protective manway cover. Two pressure designs, the DOT-105 and DOT-i 12, account for more than 95 percent of the pressure car fleet.14 DOT-i OS The type 105 is the oldest and most common pressure design. It makes up slightly more than half of the pressure car fleet and 12 percent of the total tank car fleet. Like the type 103, it dates back to the original seven tank car design specifications set by ICC in 1927. Welded versions of the type 105 were introduced during the 1930s. Throughout the 1940s and 1950s, the type 105 was the predominant pressure car. Today it remains the most popular pres- sure car, accounting for about 85 percent of new pressure cars being built. The latest revisions to the type 105 design were made during the early 1980s, when DOT required head and thermal protection on many of the lOSs. About 45 percent of the cars are now equipped with head protection. All lOSs are insulated.15 Many have low-capacity tanks that hold less than 20,000 gal (75 700 Q. These smaller cars are popular for chlorine service. Whereas many chlorine cars are not equipped with head protection, they have thick tank walls and thick insulation systems covered by steel jacket heads that enhance puncture resistance. DOT-ii2 The next most common pressure car is the DOT-i 12, introduced during the late 1950s to accommodate shipper demands for larger tanks to carry light- weight compressed gases more economically. The type 112 is a noninsulated, larger version of the type 105. Its tank capacity can range as high as 34,500 gal (130 583 Q. The first type 112s in operation were built under special ICC exemption. They immediately became popular for shipping LPG, anhydrous ammonia, and other low-density compressed gases. During the 1960s some

46 ENSURING RAILROAD TANK CAR SAFETY type 112s were designed to hold more than 40,000 gal (151 400 L), which was more than 3 times the capacity of most other pressure cars at the time. Serious accidents involving type 1 12s during the late 1960s spurred devel- opment of head and thermal protection. More than 95 percent of the 1 12s in operation today have one or both protection systems. In recent years, the type 112 has become less popular for new construction orders, accounting for fewer than 15 percent of pressure cars built since 1984. Specialized Designs Certain commodities need highly specialized tank cars because of their operational (i.e., loading and unloading) requirements and physical and chemical characteristics (e.g., low-temperature transport). Several tank car design classes have been established to accommodate these commodities. The classes are listed in the federal regulations as multiunit tank car tanks, cryogenic tank cars, and seamless steel tank car tanks. Because of the small number of specialty tank cars—totaling fewer than 1,000—they are not discussed in this report. Nevertheless, the specialty cars are subject to many of the same design and operation requirements as other tank cars, and much of the report discussion applies to them. TANK CAR USE AND OPERATIONAL CHARACTERISTICS Use in Hazardous Materials Service Tank cars carry both hazardous and nonhazardous materials. Of approx- imately 210,000 tank cars in North America, nearly 100,000 are used to transport materials not regulated by DOT, such as vegetable oil, juice, vinegar, and clay slurry. Whereas nearly all 50,000 pressure cars carry hazardous materials,16 only about 40 percent (65,000) of the nonpressure cars do (Table 2-4). About 55 percent of the North American tank car fleet, totaling almost 115,000 tank cars, are in hazardous materials service. In 1992 approximately 950,000 carloads17 of hazardous materials were shipped by tank car, a 25 percent increase in traffic since 1986 even though a larger share of hazardous materials traffic is now moved in other types of railcars and containers, including portable tanks and other intermodal con- tainers (Bureau of Explosives 1993, 1). Tank cars account for about 70 percent of hazardous materials shipments by rail, down from 80 percent in 1986 (Figure 2-6).

Tank Car Design and Use Characteristics 47 TABLE 2-4 Estimated Number of Tank Cars in Service in North America, 1993 HAzAiwous NoNI-LAzAiwous MATERIALS MATERIALS TYPE OF Teu'm Cit SERVICE SERVICE Tomi. Nonpressure 64,057- 98,585 162,642 Pressure 49,348 ob 49,348 Total 113,405 98,585 211,990 Percentage of Total 53 47 100 NcrrE: Specialty tank cars, of which there are fewer than 1,000, are not included in the table. Figures include both AAR and DOT class tank cars. Calculations are based on the assumption that 40 percent of nonpressure tank cars are dedicated to hazardous materials service, as indicated by a sample of AAR TRAIN II traffic data examined by AAR (personal communication, AAR Research and Test Department). bMsumes that all pressure tank cars are used in hazardous materials service, although a small number may be used to carry unregulated commodities: Types of Hazardous Materials Shipped by Tank Car Although tank cars carry a variety of hazardous materials, most traffic consists of a few high-volume commodities. About 90 percent of hazardous materials tank car traffic (measured in originating carloads) is generated by 125 commodities (Bureau of Explosives 1993, 8), and more than half of this traffic is generated by 10 commodities (Table 2-5). Most of these commodi- ties are either corrosive or flammable (Figure 2-7). Caustic soda, sulfuric acid, and phosphoric acid are the corrosives most frequently shipped by tank car. LPG is the most common flammable gas, and alcohols and petroleum prod- ucts account for most flammable liquid traffic (Table 2-5). An appreciable share of tank car traffic is generated by materials having other hazards. For instance, combustibles (such as diesel oil) and nonflam- mable and poison gases (such as anhydrous ammonia and chlorine) each account for about 10 percent of hazardous materials traffic by tank car. Hazardous Materials Traffic by Region Tank car traffic is heavy in regions having large petrochemical, mining, and agricultural industries. Considerable tank car traffic originates on the Gulf Coast of the United States, because of the petroleum and chemical industries in the region. Tank car traffic passes through the extensive rail systems in the Midwest and South Central states to the large port and manufacturing cities of the Northeast, California, and the Great Lakes region (Beier et al. 1991).

48 ENSURING RAILROAD TANK CAR SAFETY Carloads (thousands) 1OHp_ L01Ij 86 87 88 89 90 91 92 Year FIGURE 2-6 Annual shipments (carloads) of hazardous materials in tank cars and other types of freight cars, 1986 to 1992 (Bureau of Explosives 1992; Bureau of Explosives 1993). The types of commodities shipped by tank car can vary significantly by region. Much of the hazardous materials traffic originating from the Gulf Coast consists of petrochemicals and allied products. A large portion of traffic in the Midwest, Florida, and other agricultural regions consists of fertilizers, such as anhydrous ammonia. The Northeast and Great Lakes regions are origin and destination points for many acids and chemicals used in manufacturing and processing and for significant refinery traffic, including shipments of gasoline, home heating oil, and other petroleum products. Table 2-6 gives hazardous materials that are commonly shipped to or from regions by railroad tank car. 1.750 1,500 1,250 S.. 500 250 Tank Car Ownership and Leasing Tank cars are among the most expensive freight cars to build, operate, and maintain. The price paid for most other new freight cars (except refrig-

149,823 78,935 70,825 58,111 52,517 45,465 42,085 27,866 25,152 24.869 DOT-1OSJ, DOT-112J DOT-ill DOT-ill, AAR-21 i DOT-ill DOT-i 12S DOT-105A DOT-lu DOT-ill DOT-iOSJ, DOT-i 12J DOT-ili Flammable gas Corrosive Extreme heat (Class 9 Miscellaneous) Corrosive Nonflammable gas Poison gas Combustible liquid Flammable liquid Flammable gas Corrosive 575,648 954,000 60 Tank Car Design and Use Characteristics 49 TABLE 2-5 Top 10 Hazardous Commodities Shipped by Tank Car Type, 1992 (Bureau of Explosives 1993) PRIMARY TANK CAR CoioDITY CARLOADS' HAZARD Ciss TYPES USED LPG Sodium hydroxide (caustic soda) Molten sulfur Sulfuric acid Anhydrous ammonia Chlorine Fuel oil and diesel Methyl alcohol Vinyl chloride Phosphoric acid Total for top 10 commodities Total tank carloads of hazardous commodities Percent of total from top 10 Carloads originating in the United States and Canada. erated cars and certain other custom cars) seldom exceeds $45,000 (AAR 1992,53). Prices for new tank cars usually exceed $55,000 for nonpressure cars and $75,000 for pressure cars. Factors contributing to the higher prices include the need for high-quality and heavier construction materials, custom design features, and greater specialization and quality control during manufacturing. Tank cars also are more costly to operate than other freight cars because they usually are dedicated to specific commodities and seldom are able to carry other types of commodities as backhaul on return trips. Because of these factors, tank cars often travel empty and remain idle for long periods (seasonal shipping patterns of many commodities contribute to their spo- radic use). Also, for safety, tank cars require more careful handling during loading and unloading and special training of workers to ensure proper preparation before transportation. Finally, tank cars can be expensive to

SO ENSURING RAILROAD TANK CAR SAFETY Poison Gas Nonflammable Gas (67000) 7% (62,000) 6% Flammable Gas (190,000) 20% Flammable Liquid (188,000) 20% All Other (109,000) 11% Combustible Liquid (92,000) 10% Poison Liquid (16,000) 2% Corrosive (230,000) 24% FIGURE 2-7 Tank car traffic (originating carloads) by DOT hazard class, 1992 (Bureau of Explosives 1993, 10). maintain because of the special attention that must be paid to monitoring the condition of the tank and its safety equipment and the need for specialized servicing and repair facilities. Many of the cost factors that distinguish tank cars from other railcars were recognized by the railroad industry more than 100 years ago. During the late 19th century, when ICC began regulating railroad transportation, special provisions were established exempting tank cars from requirements that railroads make freight cars available to shippers for use in common carriage. A consequence of this exemption is that railroads own very few tank cars, even though tank cars account for about 15 percent of the total freight car fleet (Table 2-7). Nearly all tank cars are owned by shippers or leased to them by tank car leasing companies. Though some tank cars are owned by small shippers and investors, most are owned by large corporations with fleets consisting of hundreds or thousands of cars. Most of the country's largest oil and chemical com- panies have extensive private fleets or are the primary customers of tank car leasing companies. Leasing companies own more than half the North American tank car fleet. Three of the five largest leasing companies also build tank cars.

TABLE 2-6 Hazardous Materials Railroad Traffic by Region (Beier et al. 1991) PERCENT OF TOTAL ORIGINATING HAZARDOUS COMMON TYPES OF HAZARDOUS MATERIALS REGION MATERIALS MOVED BY RAIL RAILROAD TRAFFIC' Northeast/Middle Fuel oil, gasoline, sulfuric acid, 14 Atlantic chlorine, caustic soda, crude oil Southeast Caustic soda, anhydrous 16 ammonia, sulfuric acid, LPG, phosphoric acid Great Lakes! Vinyl chloride, phosphoric acid, 20 Central alcohol, LPG, anhydrous ammonia Plains/Upper Anhydrous ammonia, alcohol, 9 Midwest phosphoric acid Gulf Coast/South Caustic soda, LPG, chlorine, 30 Central vinyl chloride, phosphoric acid, molten sulfur PacifidMountain Sulfuric acid, LPG, chlorine, 11 gasoline, caustic soda, molten sulfur Carloads of hazardous materials originating in region. TABLE 2-7 Types of Freight Cars in U.S. Railcar Fleet, 1991 (AAR 1992, Si) OWNER CAR CLASS I OTHER CoIPA.r.1y CAR TYPE TOTAL RAILROAD RAILROAD OR SHIPPER Box (plain and 174,124 115,888 41,072 17,164 equipped) Hoppers (covered and 509,692 314,151 28,576 166,965 open top) Flat 125,651 76,632 5,826 43,193 Refrigerator 38,485 30,655 4,775 3,055 Gondola 139,568 87,013 14,482 38,073 Tank 189,147 1,173 40 187,934 Other 12,993 7,977 2,721 2,295 Total 1,189,660 633,489 97,492 458,679 NoTE: Figures do not include many freight cars based in Canada that are eligible for interchange service in the United States, including about 20,000 tank cars.

52 ENSURING RAILROAD TANK CAR SAFETY Leasing companies often supply hundreds of cars to a single shipper, who may find it more advantageous to lease than to own them. Lease periods usually range from 10 to 15 years, and monthly lease rates nor- mally vary between $500 and $800. Shorter lease periods are usually more expensive and less practical because of the need for special fitting configu- rations, linings, heating systems, and other custom features. Because major leasing companies own thousands of cars, they can offer shippers design types compatible with their needs. If tank cars with necessary custom features are not available in the supplier's fleet, idle tank cars may be altered or new ones may be ordered. Leasing companies benefit from having tank cars that can be readily converted from one service to another. Because tank cars are built with the expectation of 30 years or more of service life,18 both durability and versatility are key considerations in tank car design and construction. Once a tank car is delivered to the shipper, the supplier may not see it again until required retesting of the tank and its fittings is scheduled. According to some lease arrangements, maintenance and retesting are shipper responsibilities. Under these arrangements, the leasing company often does not see the car again until the lease expires. Most lease contracts give the supplier control over major tank car alterations, including those required by changes in federal regulation. Costs of alterations, however, usually are passed on to shippers through higher lease rates or direct billing of the expenses incurred. Shipper Operations As manufacturers, distributors, and users of hazardous materials—and often the operators of sizable tank car fleets—shippers are assumed to have the most knowledge of the particular hazard characteristics and regulatory requirements of their shipments. Federal regulations have traditionally made shippers responsible for ensuring that suitable and authorized pack- aging is used for their products. In addition to regulatory requirements, most shippers have compelling economic incentives to provide packaging that ensures safe containment. Large shippers may tender and receive hundreds of bulk shipments by tank car each week in their plants and distribution facilities. A single plant may have multiple loading and unloading areas and track siding on which dozens of tank cars are stationed at various stages of loading or unloading. Efficient tank car operations are often critical to the proper functioning of the plant because tank cars deliver many of the input materials from suppliers and move finished products to customers and other company facilities.

Tank Car Design and Use Characteristics 53 Various practices are followed by shippers to ensure the quality of their tank car fleets. Many large shippers operate their own tank car mainte- nance and repair shops and employ tank car engineers to help design new tank cars and periodically inspect the fabrication and repair shops used to supply and service the fleet. Some shippers have established their own criteria and procedures for tank car design, maintenance, and use that exceed DOT and industry standards; for instance, by routinely testing cars for structural integrity, using tank cars designed for higher test pressures than required, and upgrading tank cars to incorporate more safety fea- tures, such as thicker tank walls and better-protected fittings (personal communication, Chemical Manufacturers Association). In addition to ensuring the physical condition of their tank cars, ship- pers must make sure that tank cars are properly loaded and secured before each trip. In doing so, the shipper must verify that the tank is filled correctly (e.g., with sufficient expansion space and within allowable weight limits) and that valves and other components are properly secured. After loading the tank car, the shipper may check for leaks by pressurizing the tank or by leaving it on a siding for several hours before transport to ensure that fittings, gaskets, rupture discs, and other components do not leak. Federal regulations do not require the use of specific materials for many tank components such as gaskets; therefore, shippers are responsible for selecting materials that are compatible with their products. Shippers are also responsible for ensuring that tank cars readied for transport are properly marked, placarded, and accompanied by shipping papers with emergency response instructions. The shipper chooses the appropriate placard and hazard description (e.g., flammable liquid) for its product according to procedures established by DOT. All shippers of hazardous materials are required to provide a 24-hr telephone number that can be used by emergency responders to obtain information about the shipment. Many large shippers have emergency response teams that can be deployed to tank car incidents at company facilities or in transit. Because receivers of tank cars are not always familiar with the regulations, shippers may provide instructions on safe methods for unloading the tank car and properly securing and placarding it for the return trip. Railroad Operations of Tank Cars Railroads move thousands of tank cars between hundreds of different shippers and receivers each day. Because they own very few tank cars, railroads depend on shippers to provide equipment that is sound, well secured, and properly marked and placarded. Railroads are responsible for

54 ENSURING RAILROAD TANK CAR SAFETY ensuring that tank cars arrive at their destinations safely, with the cargo intact, and within a reasonable period. The movement of a tank car (or group of cars) usually begins with the placement of an order by the shipper with the local railroad or terminal operator. The order may consist of a one-time or routine pickup of one or more cars, depending on the size and nature of the shipper's operations. Large shippers often negotiate long-term contracts with railroads. Ship- ping rates are established according to the volume, distances, and types of commodities shipped. To assist in this process, railroads have developed commodity-based shipping rates for interline service that vary by ship- ment density, value, and handling requirements. Product information, billing rates, and final destination are provided on a bill of lading, which serves as a contract between the shipper and carrier. The railroad transfers information from the bill of lading into a computerized shipment record, known as a waybill, which contains hazard information accessible by the railroad in an emergency. Once an order has been placed, the tank car is moved from the shipper's siding by a local carrier. Most shipments by rail involve more than one carrier because of the long distances traveled and the need for movement of cars between sidings and branch lines to main track and trunk lines.19 Typically, tank cars pass through numerous yards and are switched several times during the trip. During portions of the trip, the tank car may be idle on yard track. The length of time depends on several factors, including train scheduling, locomotive and crew availability, and yard space. During switching operations, tank cars are sorted into groups or blocks of cars headed to similar destinations. Cars are sorted through various means. The most common is a hump yard, where trains are assembled, or classified, by moving the cars over a hump in the rail yard and allowing them to descend through switches for coupling by the force of gravity. Retarders on the tracks regulate the velocity of the car during its descent. Coupling speeds are usually slower than 5 mph (8 kmlhr). AAR has recommended that its member railroads limit coupling speeds of all placarded tank cars to 4 mph (6 km/hr) or less (AAR Circular OT-SS). Federal regulations contain few restrictions on tank car switching pro- cedures. A general restriction is that a placarded tank car cannot be in motion (under its own momentum) for switching at the same time another freight car is on the same ladder track. A narrower but more significant restriction is that cars carrying certain explosive materials and highly poisonous gases and liquids are prohibited from coupling under their own momentum at all times (49 CFR 174.83).20 Because cars are frequently switched from one train to another, federal regulations require that the train crew be notified of the position of all placarded tank cars in the train. Several factors affect the position of tank

Tank Car Design and Use Characteristics 55 cars in a train. DOT regulations prohibit placement of most placarded tank cars closer than six cars from a locomotive, except in short trains where alternative positioning is not possible. To improve train dynamics, rail- roads frequently position heavier tank cars near the front of the train. Empty or lighter cars usually are positioned in the rear. The destination of the tank car also affects its position in the train. Blocks of cars with similar transfer or drop-off points usually are positioned together. Unit trains, operating between a single origin and destination, often are composed exclusively of tank cars. These situations are most common for tank cars carrying crude oil, molten sulfur, and other raw commodities from oil fields, mines, and storage areas. Except for unit trains, railroads seldom dedicate trains to hazardous materials or tank car service. For trains carrying large amounts of highly hazardous materials [defined as S loads of poison by inhalation materials (PIH) or 20 loads consisting of a combination of PIH materials, flammable gases, or Class A explosives], AAR recommends maximum operating speeds of 50 mph (80 km/hr) and certain other operating and routing requirements (AAR Circular OT-SS). In addition, AAR recommends that railroads designate routes with heavy hazardous materials traffic (defined as routes with annual traffic consisting of 10,000 or more loads of haz- ardous materials or 4,000 or more loads of PIH materials and flammable gases) as "key" routes, subject to more stringent track inspection practices and other equipment and operating criteria (AAR Circular OT-SS). A tank car is inspected at various points during its journey. Federal regulations require that trains be inspected every 1,000 mi (1609 km). Cars are visually inspected by railroad workers at interchange and certain other intermediate points. The main focus of inspection is to verify that running equipment is in working order. Valves, fittings, and other tank components are inspected visually at ground level only, and it is not always possible for inspectors to determine whether top valves and other fittings are secure. If a problem is detected in the running gear or coupling system of a tank car during inspections or en route, the car may be removed from the train for repair. Railroads have car repair crews and sidings for this purpose. If problems are encountered that affect the tank or its fittings, the railroad will contact the shipper for instructions about unloading, movement, and repair. The railroad will not attempt a repair. The shipper may require special exemption from DOT for the car to be moved to an unloading site and one of the more than 100 AAR-certified tank car repair shops. (During emergencies involving tank cars, most major railroads have special re- sponse teams that can assist government agencies and shipper response teams in handling the incident.)

56 ENSURING RAILROAD TANK CAR SAFETY The entire tank car trip can take from a few days to more than 2 weeks. The time period will depend on the distances involved, the priority of the shipment, and the number of carriers used. After a tank car has reached its final destination, the local carrier will contact the receiver to arrange delivery. The last railroad handling the car usually keeps the waybill and is responsible for allocating charges among railroads. Reciprocal billing agreements between railroads facilitate this process. At receiver facilities, tank cars are sometimes used for temporary stor- age of commodities that are slowly unloaded. Once unloaded by the receiver,21 the tank car is usually returned to the shipper empty or with a residual amount of material in the tank. In this case, the receiver must place a Residue placard on the car for its return and provide shipping papers with the appropriate emergency response information on the residual product. On the return, the receiver functions as a shipper. KEY POINTS AND FINDINGS The numerous tank car design types vary in several key design fea- tures, including head protection and other safety systems. More than three dozen tank car design specifications are authorized by DOT for use in hazardous materials service. Most designs fall into two general categories: pressure and nonpressure cars. About three-quarters of the 210,000 tank cars operating in North America are nonpressure cars, designed to carry liquids with low vapor pressures. About one-quarter are pressure cars, designed for liquefied gases and other materials shipped under pressure. The pressure and nonpressure cars differ in several important respects. Pressure cars are made of thicker steel and alloys, which provide added strength for containing materials under high pressure and enhance punc- ture resistance. The valves and other fittings of pressure cars are also better protected than those of nonpressure cars. About half of pressure cars have special head and thermal protection systems that make them less vulner- able to puncture and rupture damage during an accident. These protective systems were adopted during the past iS years. In addition, all tank cars in hazardous materials service, including both pressure and nonpressure cars, have special coupling systems, known as double-shelf couplers, which keep cars interlocked and more stable during derailments and other accidents. Tank cars carry a wide range of materials that have different hazard characteristics. Half the tank cars in service routinely carry materials classified as hazardous by DOT, including nearly all pressure cars and about 40 percent of nonpressure cars. About one million shipments of hazardous materials are moved by these tank cars each year. Although a

Tank Car Design and Use Characteristics 57 relatively small number of commodities account for most tank car haz- ardous materials traffic, tank cars carry hundreds of commodities with numerous hazard characteristics. Tank cars account for about three- quarters of the hazardous materials traffic (measured in carloads) moved by rail, although portable tanks and other intermodal containers have increased their traffic share in recent years. Several industries have important responsibilities and incentives to ensure tank car safety. The tank car "industry" consists of tank car suppliers, shippers, and railroads. Each has played a central role in ensur- ing tank car safety for more than a century and was active in setting and enforcing tank car design standards. Tank car suppliers consist of com- panies that build tank cars and own large fleets that are leased to shippers. Shippers, comprising most major chemical and oil companies, own about one-third of the tank cars in service and lease the rest from suppliers. Given the importance of tank cars to their operations, shippers have strong incentives to ensure safe and efficient tank car service. Railroads own very few tank cars, but their operations in switching, handling, and routing tank cars are critical to safety. Like shippers, railroads are subject to statutory and regulatory requirements to ensure tank car safety and have strong economic incentives to avoid the delays, damage, and remediation costs associated with incidents. NOTES Much of the discussion and information provided in this section was derived from Heller (1970). Recommended practices for tank car design and construction were first estab- lished in 1903 by the Master Car Builders Association, which was composed of mechanical engineers from the railroads and tank car companies. The prac- tices were advanced to industry standards through incorporation into the railroad interchange rules (Heller 1970). The interchange rules, which are established by the railroads through the Association of American Railroads (AAR), govern railcar dimensions and other equipment criteria to facilitate interchange of equipment between railroads. In 1927, ICC incorporated into regulation the industry-developed design standards established by the Tank Car Committee of the American Railway Association (which later merged with other railroad industry groups to form the Association of American Railroads). Increases in tank size were made possible in large part by the elimination of tank exterior protrusions such as running boards and domes, which had previously been an important factor in limiting tank diameter because of AAR vertical and horizontal clearance restrictions. S. A relatively small number of tank cars do not have a cylindrical shape. For instance, about 5,000 pressure cars, constructed primarily during the 1960s,

58 ENSURING RAILROAD TANK CAR SAFETY were designed with expanded tank centers (with a center diameter larger than the tank's head diameters) to provide additional carrying capacity for low- density commodities. Subsequent changes in the AAR interchange rules that increased the limits on vertical and horizontal clearance made these dual- diameter design less advantagçous. As an example of the relationship between commodity density and tank capacity, consider molten sulfur and propane. The density of molten sulfur is about iS lb/gal, compared with about 4.5 lb/gal for propane. (The density of water is approximately 8 lb/gal.) A tank car with an empty weight of 59,000 lb can carry no more than 13,600 gal of molten sulfur—weighing 204,000 Ib— because of 263,000 lb gross weight limits for freight cars [59,000 + (13,600 x iS) = 263,000]. By comparison, the limiting constraint on propane ship- ments is the 34,500-gal limit on tank capacity. A 34,500-gal shipment of propane weighs only 155,250 lb, which does not exceed gross weight limits even when transported in a high-capacity tank car weighing 100,000 lb. Conventional insulation should not be confused with insulation provided for thermal protection (discussed later). Conventional insulation is not designed to withstand severe heating and fire conditions. Requirements for double-shelf couplers have been phased in since 1978, when they were required on all DOT-112 and DOT-114 pressure cars. By 1982 all pressure cars had them, and by 1989 all tank cars used in hazardous materials service were equipped. Currently, a small number of nonpressure tank cars (fewer than 4,000) used in nonhazardous service do not have double-shelf couplers. Tests by the Federal Railroad Administration (FRA), AAR, and Railway Progress Institute (RPI) in the early 1970s showed that head punctures caused by impacts in railroad classification yards generally occur at speeds above 12 mph, usually when a loaded tank car strikes a standing empty freight car, causing the empty car to jump and ram its coupler into the head of the oncoming tank car. A study by the RPI-AAR Tank Car Safety Research and Test Project of 140 tank car head punctures that occurred from 1965 to 1986 found that 82 percent of the puncture holes were located on the bottom half of the head (RPI-AAR 1989). A more recent examination of tank car incidents on mainline track (rather than switching yards) indicates that impact objects such as broken rails and broken couplers may strike the tank head, and head protection may provide some benefit in these cases as well (Coltman and Hazel 1992). The regulations require that the tank be capable of keeping metal temperatures below 8 00°F or 100 min during a pool fire or for 30 min during a torch fire. DOT has identified several systems that meet these requirements. DOT has recently proposed new regulations that would require thermal protection on tank cars used to ship "thermally reactive" materials that, if released, react violently with other materials and may decompose with explosive force (Federal Register 1993). This includes the proposed DOT-120 class, authorized for use by DOT exemption.

Tank Car Design and Use Characteristics 59 A major difference in the specifications is that AAR tank cars are not subject to full postweld heat treatment or radioscopic weld examinations. About 10 percent of these tank cars are based in Canada. With few exceptions, tank cars that meet Canadian design requirements also meet the DOT require- ments and are eligible for interchange service in the United States. Other pressure car classes include the DOT-109 and DOT-114. About 800 of these cars are in service. Another pressure car is the DOT-120, which has an insulated tank with optional bottom fittings. Fewer than 150 of these cars are in service. This refers to conventional tank insulation, not insulation provided for ther- mal protection. Tank cars usually are dedicated to the transportation of a single commodity for a long period. Conversion to other commodity service is expensive and imprac- tical in the short term because of costs associated with tank cleaning to maintain product purity and alteration of the valves, linings, and other fea- tures to accommodate each product's physical and operational needs. The figure cited represents the number of tank car loads of hazardous material that originated from shippers in the United States and Canada, as reported to AAR in its TRAIN II shipment information system. DOT rules permit the use of tank cars for up to 50 years, provided they are inspected and tested according to DOT regulations. AAR interchange rules also govern tank car and freight car service life. Nationwide there are more than 500 regional, short line, and terminal railroad companies that provide feeder service to the 13 major trunk line carriers. Class DOT-1 13 tank cars are also restricted during free switching when shipping flammable gas. Fewer than 150 of these tank cars are in service. Most tank cars are fully unloaded at a single receiver. Tank cars are seldom used for multiple deliveries. REFERENCES ABBREVIATIONS AAR Association of American Railroads FRA Federal Railroad Administration NTSB National Transportation Safety Board RPI Railway Progress Institute RSPA Research and Special Programs Administration AAR. 1992. Railroad Facts: 1992 Edition. Washington, D.C. Beier, F., R. Church, J. Frey, and P. Zebe. 1991. Flows of Selected Hazardous Materials by Rail. Report DOT-VNC-RSPA-90-1. RSPA, U.S. Department of Transportation. Bureau of Explosives. 1992. Annual Report of Hazardous Materials Transported by Rail: Year 1991. Report BOE 91-1. Association of American Railroads, Washington, D.C.

60 ENSURING RAILROAD TANK CAR SAFETY Bureau of Explosives. 1993. Annual Report of Hazardous Materials Transported by Rail: Year 1992. Report BOE 92-1. Association of American Railroads, Washington, D.C. Coltman, M., and M. Hazel. 1992. Chlorine Tank Car Puncture Resistance Eval- uation. Report DOTIFRA/ORD-92-1 1. Federal Railroad Administration, U.S. Department of Transportation. Federal Register. 1993. Docket HM-175A, Notice 93-19. Oct. 8, pp. S2,574— S2,S96. FRA and RSPA. 1990. A Report on Tank Cars: Federal Oversight of Design Construction and Repair. U.S. Department of Transportation. General American Transportation Corporation. 1991. GATX Tank Car Manual (5th edition). Chicago, Ill. Heller, F.J. 1970. Evolution of Tank Car Design Through Engineering. Presented at the 1970 Annual Petroleum Conference of the American Society of Mechan- ical Engineers, Denver, Cob., Sept. 15. NTSB. 1980. Special Investigation Report: The Accident Performance of Tank Car Safe Guards. Report NTSB-HZM-80-1. Washington, D.C. NTSB. 1991. Safety Study: Transport of Hazardous Materials by Rail. Report NTSB/SS-91/01. Washington, D.C. RPI-AAR. 1989. Analysis of Tank Cars Damaged in Accidents: 1965 Through 1986. Report RA-02-6-55. Chicago, Ill. Union Pacific Railroad. 1990. A General Guide to Tank Cars. Omaha, Nebr.

CHAPTER 3 Tank Car Regulation and Safety Performance REGULATIONS GOVERNING THE DESIGN, CONSTRUCTION, and maintenance of railroad tank cars and their use in transporting hazardous materials are reviewed in this chapter. This is followed by review of the safety record of tank cars and the safety performance of individual design types, including those equipped with head protection. TANK CAR REGULATIONS Evolution of Regulations Current regulations governing railroad tank cars have evolved from more than 100 years of congressional legislation, agency regulatory programs, and industry standard-setting activities. Since the Civil War, Congress has enacted more than 50 laws affecting the shipment of hazardous materials by tank car (NTSB 1981, 2). During this period several federal agencies have had responsibility for aspects of hazardous materials regulation, including the Interstate Commerce Com- mission (ICC), the Federal Railroad Administration (FRA), other modal agencies in the U.S. Department of Transportation (DOT), and DOT's Research and Special Programs Administration (RSPA). The regulations of the Environmental Protection Agency (EPA) also affect hazardous mate- rials transportation. For much of this century ICC regulated the shipment of hazardous materials by rail. Because of limited resources, ICC relied on industry for technical support of its hazardous materials programs. Industry standard- 61

62 ENSURING RAILROAD TANK CAR SAFETY setting bodies, such as the Bureau of Explosives (BOE) of the Association of American Railroads (AAR), played a central role in classifying materials by hazard type and setting packaging and container standards. ICC later adopted many of the standards and practices of these bodies. In the case of tank cars, ICC incorporated into regulation the design specifications devel- oped primarily by the AAR Tank Car Committee (TCC) and required tank car builders and owners to utilize the TCC to review plans for new tank car construction, proposals for new design types, and industry requests for exemptions from ICC design requirements. This prominent industry role remained largely unchanged until the 1960s, when most federal responsibility for hazardous materials trans- portation safety was transferred to the newly created Department of Transportation. To ensure that final regulatory authority rested with the government, DOT withdrew or curtailed many of the regulatory functions delegated to BOE and other industry bodies. For tank cars, DOT instituted better defined regulatory procedures for the formation of new design specifications and the approval of requests for regulatory exemptions. Whereas DOT continued to rely on the TCC for many important activities, including review of tank car construction drawings, it adopted more formal procedures for DOT authorization of new design classes and ex- emption requests. In strengthening its regulatory role, DOT faced several impediments, including the absence of a clear mission for its regulatory program. Its authority to regulate hazardous materials, like that of ICC, was based on provisions in numerous statutes. As a result, the regulatory structure developed on a product-by-product and mode-by-mode basis, causing key elements of the regulatory program to be dispersed among several modal agencies. Some of these problems were resolved by the Hazardous Materials Transportation Act of 1975 (HMTA). HMTA was the first statute to define DOT's mission in regulating hazardous materials and to provide direct lines of authority for doing so. The act authorized DOT to regulate materials that pose an "unreasonable risk to health and safety or property when transported in commerce," giving it broad authority to regulate carriers, shippers, and container manufacturers, suppliers, and repairers. To consolidate resources and provide greater uniformity in hazardous materials regulation, DOT merged its regulatory authority into one unit, the Materials Transportation Bureau (MTB), which has evolved into the Office of Hazardous Materials Safety in the Research and Special Pro- grams Administration. Meanwhile, FRA retained primary responsibility for providing enforcement, research, and technical support for the tank car regulatory program.

Tank Car Regulation and Safety Performance 63 Since passage of HMTA, DOT's responsibilities for hazardous materials safety have expanded. During the past two decades, several laws were passed requiring DOT to regulate the transport of substances and wastes classified by EPA as hazardous because of their potential to contaminate the environment and affect public health.1 The legislation caused hundreds of additional materials to be subject to DOT restriction during transporta- tion. Some of the special DOT regulatory provisions for hazardous sub- stances and wastes are discussed later in this chapter. Key Tank Car Regulations The main body of regulations governing shipment of hazardous materials by tank car is in the Code of Federal Regulations (CFR), Title 49, Parts 100 through 179. The regulations govern aspects of tank car design, construc- tion, and maintenance; operations of hazardous materials tank cars by railroads; and use of tank cars in carrying specific kinds of hazardous materials. Tank Car Design, Construction, and Maintenance As discussed in Chapter 2, most tank cars used for shipping regulated materials must be built to DOT design specifications for pressure, non- pressure, and specialty tank cars.2 Within each of these families of tank cars are several design classes (e.g., DOT-lOS and DOT-ill), each of which contains more specific design types, known as specifications (e.g., DOT-105J500W and DOT-111A100W1). Design criteria are often quite similar among the specifications in a design class. Minor variations, such as differences in tank lining type and material, may differentiate one specifi- cation from another in a design class. Examples of design criteria are given in Table 3-1. The criteria vary in detail and scope. Many are design specific; that is, they prescribe the exact materials, measurements, or fabrication processes used in constructing the tank car. Examples of design-specific requirements are minimum tank wall (shell and head) thicknesses and approved steel and alloy types. Certain other criteria are more aptly described as performance based. They define how well the tank car and its components must perform rather than the precise criteria to which they must be designed or constructed. As an example, thermal protection rules impose minimum thermal conductivity and fire resistance capacities (accompanied by test procedures to deter- mine capacity) but do not prescribe the materials, procedures, or products that must be used to provide thermal protection.

TABLE 3-1 Examples of Design Criteria for Selected DOT Tank Car Specifications (49 CFR 179.101-1) DOT SPECIFICATION 112A200W 112A340W 112A400W 112A500W 114A340W 114A400W Insulation Optional Optional Optional Optional Optional Optional Bursting pressure (psi) 500 850 1,000 1,250 850 1,000 Minimum plate thickness, shell and heads (in.) /16 11/16 11/16 11/16 11/16 11/16 Test pressure (psi) 200 340 400 500 340 400 Safety relief valves, start to discharge (psi) 150 225 300 375 225 200 Manway cover, minimum thickness (in.) 21/4 2/4 21/4 21/4 Bottom washout Prohibited Prohibited Prohibited Prohibited Optional Optional Bottom outlet Prohibited Prohibited Prohibited Prohibited Optional Optional NoTe: The purpose of this table is to illustrate the kinds of design criteria covered in the DOT specification requirements. Many criteria, special references, and footnotes are excluded.

Tank Car Regulation and Safety Performance 65 Numerous provisions in the regulations require tank car builders and component makers to obtain TCC approval of tank car construction plans, designs of valves and other fittings, and methods of repair, alteration, and conversion. These provisions are intended to provide DOT with a means of ensuring industry compliance with the regulations.3 For design-specific regulatory requirements, the committee's role is fairly straightforward. It must verify that construction drawings submitted by builders contain the elements called for in DOT regulations. In other cases, however, the TCC's role warrants greater committee evaluation and judgment. As an example, DOT regulations require that tank car valves used for loading and unload- ing be of an "approved design" made of metal not subject to rapid deterioration by the lading (49 CFR 179.100-13). "Approved design" refers to TCC approval authorization. With certain limitations, such as acceptable locations for mounting the valve, the TCC is free to approve the type of valve, the materials used to construct it, and specific design details (provided the TCC is satisfied that the valve meets the general DOT requirements for valve and lading compatibility). After construction drawings have been approved by the TCC—meaning that in the committee's expert judgment the proposed tank car meets all DOT minimums—the car may be built as a DOT-class tank car. After the car has been constructed and passed a required hydrostatic pressure test, the builder is responsible for certifying that the car meets all DOT (and AAR) requirements. In this respect, it is the builder, not the TCC, who is responsible for ensuring that individual tank cars meet DOT requirements [49 CFR 179-1(e)]. If the TCC mistakenly approves a set of plans that does not fully comply, it is the responsibility of the builder to detect the error and resubmit the corrected plans for reapproval. If the tank car (or series of tank cars) is built and placed in service before the error is detected, the owner must notify and work with DOT to determine the corrective actions to be taken. Once a tank car is in service, the regulations require periodic retesting of certain design components every 1 to 20 years. Tanks and their interior heating systems must undergo a hydrostatic pressure test. Safety relief valves must be tested for operation at their approved pressure settings.4 The frequency of required testing depends on the age and specification of the car. Tank Car Operations by Railroads The hazardous materials regulations define certain responsibilities of ship- pers and railroads in transporting, storing, and handling cars containing hazardous materials. Carriers must visually inspect cars to make sure that there are no leaks; running gear is in order, and required shipping papers

66 ENSURING RAILROAD TANK CAR SAFETY and other hazard information (e.g., placards and markings) are provided. Unless an exemption is granted by DOT, a leaking tank car cannot be moved until the car is repaired. For tank cars with minor leaks, short movements are permitted if the spill can be safely contained. Tank cars having larger leaks may be moved away from populated areas. Tank car switching procedures and positioning in the train are governed to a limited degree. Although regulations do not prescribe a maximum allowable speed for tank car coupling, they prohibit humping (switching of cars under their own momentum) of some tank cars containing highly hazardous materials (discussed in Chapter 2). For other tank cars being coupled, DOT rules state that cars should not travel at speeds greater than necessary to complete the coupling. Regulations prohibit the positioning of placarded tank cars closer than six cars from a locomotive or other occupied car. Tank cars bearing the Residue placard, indicating that they contain residual amounts of hazardous material, must be separated from a locomotive or other occupied cars by at least one nonplacarded car. Assignment of Hazardous Materials to Tank Car Design Types Assignment of materials to specific tank car design types is based in large part on DOT's hazard classification system. According to this system, each regulated material is grouped into a hazard class (or division) correspond- ing to the material's acute hazard characteristics (e.g., flammability or corrosivity) and physical state in transport (e.g., gas or liquid) (see Table 3-2). Hence, materials are assigned to tank car types on the basis of their physical characteristics, such as vapor pressure for gases, and hazard characteristics, such as flammability, corrosivity, and toxicity. Hazardous Liquids With certain exceptions, hazardous liquids are assigned to a specific haz- ard class or division (e.g., corrosive, flammable liquid) and then into one of three packing groups. Materials that meet the criteria for high hazard in their class or division—on the basis of quantifiable measures of toxicity, corrosivity, flammability, and concentration, and other attributes—are assigned to Packing Group! (PG I). Medium-hazard materials are assigned to Packing Group II (PG II), and low-hazard materials are assigned to Packing Group III (PG III). As a practical matter, most DOT-class nonpressure cars are authorized for use in transporting PG I, PG II, and PG III hazardous liquids, including the high-hazard PG I corrosives, dangerous-when-wet materials, flamma- ble liquids, oxidizers, and spontaneously combustible materials (Table 3-2).5 A significant exception is that poison liquids meeting specific criteria

TABLE 3-2 General Packaging Requirements for Hazardous Materials Shipped in Bulk by Tank Car HAZARD CLAss DIVISION NAmE OF CLASS AND DMsI0N PACKING GROUP°/HAZARD ZONE TANK CARS AUTHORIZED 1 Explosive 2.1 Flammable Gas 2.2 Nonflammable Gas 2.3 Poisonous Gas Flammable and Combustible Liquids None None None Hazard Zones A and B (gases deemed highly poisonous based on measures of human inhalation toxicity) Hazard Zones C and D (poison gases that have comparatively lower human inhalation toxicity) PG I (highly volatile liquids with low flash points and low boiling points) PG II and Ill (flammable liquids with higher flash points or higher boiling points) None Pressure cars (based on material vapor pressure and hazard characteristics); most must have head and thermal protectionb Pressure cars (based on material vapor pressure and hazard characteristics); no head or thermal protection required" Pressure cars, usually with head protectionb Pressure cars, usually with head protectionb Essentially all DOT-class tank cars PG II, essentially all DOT-class tank cars; PG III, non-DOT-class tank cars are sometimes permitted (continued on next page)

TABLE 3-2 ( HAZARD CLASS DivisioN 4.1 4.2 4.3 5.1 5.2 6.1 Flammable Solid Spontaneously Combustible Dangerous When Wet Oxidizer Organic Peroxide Poisonous Material (nongas) None PG I (pyrophoric liquids) PG II and III (less self-heating or likely to self-ignite) PG 1 (materials with high tendency for reaction and spontaneous combustion when contacting water) PG II and III (lower tendency for spontaneous combustion when contacting water) PG I (materials that yield oxygen, potentially causing or enhancing combustion with fast burn time) PG II and III (lesser oxidizing potential) None PG I Hazard Zone A nongas that is deemed poisonous by inhalation (PIH) [based on measures of vapor concentration (volatility) and toxicity] PG I Hazards Zone B and PG II and III (nongas poisons with lower volatility and vapor toxicity) None or on an individual basis Essentially all DOT-class tank cars, with special provisions PG II, essentially all DOT-class tank cars; PG III, non-DOT-class tank cars are sometimes permitted Essentially all DOT-class tank cars with special provisions PG II, essentially all DOT-class tank cars; PG III, non-DOT-class tank cars are sometimes permitted Essentially all DOT-class tank cars with special provisions Essentially all DOT- and non-DOT- class tank cars None Pressure cars, head protection usually required PG 1 and II, essentially all DOT-class tank cars; PG III, some non-DOT- class tank cars permitted NAME OF CLASS AND DIVISION PACKING GROUP°/HAZARD ZONE TANK CARS AUTHORIZED

6.2 Infectious Substance 7 Radioactive 8 Corrosive 9 Miscellaneous ORM-D None None PG I, II, and III (corrosive materials that meet prescribed skin and metal corrosivity thresholds) Other regulated materials; mostly consumer products in limited quantities not conducive to bulk transportation None None PG I and II, essentially all DOT-class tank cars; PG III, non-DOT-class tank cars permitted Essentially all DOT- and non-DOT- class tank cars permitted Seldom applicable Dual-hazard nongas that poses Essentially all DOT-class tank cars moderate hazard (not meeting hazard criteria for PIH or 4.2 or 4.3 PG I) Nom: All compressed gases must be transported in DOT-class pressure tank cars. Most PG I liquids must be transported in DOT-class tank cars, although some (including PIH) can only be transported in pressure cars. Most PG II materials can be transported in all DOT-class tank cars. PG III materials and all Class 9 (miscellaneous) materials can be carried in non-DOT-class tank cars. Dual-hazard liquids must be transported in DOT-class tank cars, and some can only be transported in DOT-class pressure cars. PG I = Packing Group I (high hazard); PG II = Packing Group II (medium hazard); PG III = Packing Group III (low hazard). b Theexpansion of head and/or thermal protection requirements to cover many of these commodities has been proposed by DOT in ongoing rulemaking (Federal Register 1993)

70 ENSURING RAILROAD TANK CAR SAFETY for vapor toxicity are classified as "poison inhalation hazards" (PIH) and are restricted to pressure cars, which have thicker tank walls and better- protected fittings than nonpressure cars. Hazardous Gases Compressed gases are treated differently than liquids. They are grouped into three hazard divisions—flammable, nonflammable, and poison—but they are not assigned to packing groups. Each is assigned to tank car designs on an individual basis. In general, shipments of gases that are nonflammable and nonpoisonous may be transported in any DOT pres- sure car with a suitable pressure rating to retain the vapor pressure. Most flammable gases and poison gases are assigned to pressure designs with both suitable pressure ratings (to retain internal vapor pressures) and special systems to provide accident protection. Nearly all flammable gases must be transported in pressure cars having head and thermal protection. Most poison gases must be transported in insulated pressure cars equipped with head protection (insulation need not be thermal quality). In the case of flammable gases, the pressure rating of the tank car authorized is dependent on the vapor pressure of the flammable gas. Poison gases (PIH) must be shipped in pressure cars with test pressures of 300 psi or greater because of the additional puncture protection provided by these thicker- walled tanks. Insulation (conventional, not thermal) is required on tank cars carrying poison gas presumably because of the additional puncture protection and heat insulation provided by these systems, although these systems are generally not regarded as safety features. Hazardous Substances A separate category of materials is defined as "hazardous substances" in the DOT regulations. These materials have been designated as hazardous by EPA because of the potential to contaminate the environment. EPA has assigned "reportable quantity" (RQ) values ranging from 1 to 5,000 lb (0.45 to 2250 kg) to each hazardous substance. When a hazardous sub- stance is released into the environment in a quantity exceeding its RQ, EPA must be notified. In many instances, DOT is required by law to regulate the transporta- tion of EPA-designated hazardous substances. When hazardous sub- stances are shipped in quantities equal to or exceeding their RQ values, they become subject to DOT restrictions. The restrictions usually require the shipment to be accompanied by emergency handling and response information. The shipments are seldom subject to DOT packaging, label- ing, and placarding requirements unless the materials also meet DOT

Tank Car Regulation and Safety Performance 71 criteria for acute hazards (e.g., flammability or corrosivity), in which case they must comply with restrictions for the applicable hazard class. DOT has recently noted the need to "consider the long-term health effects and environmental risks when authorizing packages for hazardous materials" and suggested it would address the issue more fully in future rulemaking (Federal Register 1993). TANK CAR SAFETY PERFORMANCE Tank Car Release Sources and Trends General trends in tank car safety can be measured in several ways. A commonly used measure is the annual change in the number of tank car hazardous materials releases reported to RSPA. Railroads must report to RSPA all unintended releases of hazardous materials during all phases of transportation, including loading and unloading, handling, and tempor- ary storage en route. Releases from accident events (e.g., collisions or derailments) as well as nonaccident situations (e.g., leaks from defective valve) must be reported within certain threshold criteria. Since the early 1980s, the number of releases reported to RSPA per year has varied from 700 to 1,300, with a slight upward trend since the mid-1980s (Figure 3-1). Annual variations have corresponded closely to fluctuations in tank car traffic, consistently averaging about 1 reported release per 1,000 shipments. Injuries have fluctuated between 20 and 70 per year with no clear pattern. Perhaps the most notable trend has been the sharp decline in fatal injuries from tank car releases. Only one fatality from a hazardous materials tank car release (occurring in 1987) has been reported during the past decade (Figure 3-1). The near absence of fatalities during this period is in sharp contrast to the experience of the 1970s, when fatal releases occurred during most years and resulted in more than 40 deaths altogether. Nonaccident Releases Most tank car releases are not associated with train or tank car crashes. During 1990 and 1991, only about S percent of releases recorded by RSPA were caused by damage to tank cars sustained in collisions or overturns. Nearly 75 percent were caused by loose or defective fittings. Venting of lading from safety relief devices, spills resulting from overloaded tank cars, and leaks from corrosion damage accounted for nearly 15 percent of releases (Figure 3-2).

Incidents Carloads (000) 1400 - - - 1400 1200 1200 1000 - - 1000 800 800 600 .600 400 400 - Incidents LCarIoads II II Ii II II II II II Year 82 83 84 85 86 87 88 89 90 91 Deaths 0000010000 Injuries 32 66 71 50 53 22 31 36 66 62 FIGURE 3-1 Hazardous materials releases from tank cars reported to RSPA, 1982 to 1991 (RSPA 1983-1992; BOE 1988-1992). Loose Fitting 39% All Other 8% Defective Fitting 35% I \\••''\ Collision/Overturn 4% Corrosion 2% ------ ------ Overloaded Cargo 4% Venting 7% FIGURE 3-2 Causes of tank car hazardous materials releases reported to RSPA, 1990 and 1991 (source: RSPA computer analysis).

Tank Car Regulation and Safety Performance 73 BOE also monitors tank car incidents, focusing on nonaccident releases of hazardous materials. When railroads report releases to RSPA, they send copies to BOE with additional information on release causes, conse- quences, and the types of cars involved. As a result, BOE records are more detailed than RSPA records. BOE also collects reports from Canadian railroads, making the base somewhat larger. Between 1988 and 1992, BOE recorded an average of about 1,000 nonaccident releases per year. Its tabulations of the reports from these years indicate that tank car safety vents are the most common source of release, accounting for nearly one in three (Figure 3-3). (These devices contain discs that sometimes rupture because of surges in cargo pressure during abnormal car handling and switching operations, insufficient product expansion space in the tank, or poor disc condition.6) Leaks from safety valves, manways, and other top fittings accounted for most other nonaccident releases. Releases from tank heads and shells accounted for fewer than S percent of the reports. Accident Releases FRA can monitor railroad accidents involving hazardous materials through its general rail accident data base. Railroads must report to FRA all collisions, derailments, fires, and other accident events that result in death, injury, or property damage exceeding $6,300 (in 1992). The reports indicate whether cars containing hazardous materials were involved in the Safety Vent Disc 29% Safety Valve 6% Other/Unknown 10% Head or Shell 3% Other Top Fittings 10% Bottom Fittings 14% FIGURE 3-3 Sources of nonaccident releases of hazardous materials from tank cars reported to BOE, 1988 to 1992 (BOE 1993).

74 ENSURING RAILROAD TANK CAR SAFETY accident and whether they sustained damaged and released product. The reports also provide basic information on the accident environment and circumstances, such as track type (e.g., mainline or yard), operating speed, number of cars in the train, and the position of damaged cars. They do not indicate whether the cars involved consisted of tank cars or other types of railcars hauling hazardous materials. Between 1982 and 1991 FRA received approximately 4,500 reports of accidents that involved damage to cars containing hazardous materials. About 15 percent of these accidents—or 40 to 60 per year—resulted in a release of product (Figure 3-4). Many of these accidents involved more than one car. Train derailments, collisions, and other nonyard accidents accounted for about 75 percent of these release events. Accidents in rail yards, including those occurring during switching operations, accounted for the remaining 25 percent. Comprehensive data on tank car accident damage is collected by the RPI-AAR Railroad Tank Car Safety Research and Test Project (discussed in detail in Chapter 4). The project, which was established more than 20 years ago by AAR and the Railway Progress Institute (RPI), has collected 60 50 40 30 20 10 0 Number of Releases 82 83 84 85 86 87 88 89 90 91 Year Cause of Release Ulil Other flYard Accident Derailment EZ Collision FIGURE 3-4 Number and types of rail accidents involving hazardous materials releases reported to FRA, 1982 to 1991 [source: FRA Accident Incident Bulletin (annual)].

Tank Car Regulation and Safety Performance 75 more than 35,000 records of tank cars damaged in accidents dating back to 1965.7 The records are highly detailed, indicating the number of cars involved in the accident, the type of track and train speed, tank car design type and placement in the train, the type of materials involved, the section or component of the tank car that sustained damage, and other informa- tion. The data base covers all tank cars, including those not in hazardous materials service, which account for about half the tank car fleet. An evaluation by the RPI-AAR of records from 1965 to 1986 has indicated that the most common cause of tank car accident releases is damage to fittings (Figure 3-5), which accounted for about one-third of releases during the 22-year period. The next most common cause was shell and head punctures, accounting for nearly one-third of the accident re- leases. Unfortunately, the RPI-AAR data were aggregated for the entire 22- year period; hence, more recent trends in the share of releases by source were not given (e.g., shell, bottom fittings, head). The advent of double- shelf couplers, head protection, and thermal protection since the 1970s (and other safety factors) has undoubtedly altered the trend. As discussed in more detail later in this section, pressure cars equipped with these safety devices experienced a decline of more 90 percent in puncture releases from Shell 16% Bottom Fittings Head 16% Top Fittings 23% Other/Unknown 30% Rupture 4% FIGURE 3-5 Sources of releases from tank cars damaged in accidents from 1965 to 1986 (RPI-AAR 1990). (During much of the period studied, few tank cars were equipped with double-shelf couplers or head and thermal protection systems.)

76 ENSURING RAILROAD TANK CAR SAFETY 1965-1979 to 1980-1986. In addition, the annual number of puncture and rupture releases among all tank car types (pressure and nonpressure) declined by half during the latter period. This decline suggests that punc- ture releases account for a significantly smaller share of tank car accident releases today than indicated in Figure 3-5. Summary of Release Sources and Trends Although not complete, the data discussed in the previous sections can be used to approximate the annual number of tank car releases by type, as shown in Figure 3-6. The approximation provides a rough indication of the sources of tank car releases, including head and shell punctures, although the data provided are not sufficient to compare the relative severity of each type of release. RSPA data indicate that about 1,000 tank cars release hazardous mate- rials each year (see Figure 3-1). Between 90 and 95 percent of the incidents Total Releases 1,000/year Non-Accident Releases 900 (90% of total) Sources of Release Top Fittings Manway Bottom Fittings Other Head and Shell Accident Releases 100 (10% of total) Sources of Release Top Fittings Bottom Fittings Other Head/Shell Puncture Rupture FIGURE 3-6 Approximate number of tank car hazardous materials releases per year by source of release (numbers are approximated on the basis of data presented in previous figures and tables in this chapter).

Tank Car Regulation and Safety Performance 77 are associated with nonaccident release sources, such as leaks from valves and fittings (see Figures 3-2 and 3-3). The remaining S to 10 percent of releases, involving SO to 100 tank cars, result from derailments, collisions, overturns, and other crash events as indicated by RSPA and FRA accident/ incident data (see Figures 3-2 and 34).8 Failure of tank car valves and other fittings is the primary source of nonaccident releases as well as accident releases, according to RSPA and RPI-AAR records (see Figures 3-2 and 3-5). RPI-AAR records indicate that releases from tank punctures and ruptures have declined dramatically in recent years, averaging fewer than 40 per year (including head and shell punctures and ruptures) in the entire tank car fleet during the early 1980s, the most recent period for which relevant accident data have been thor- oughly examined (RPI-AAR 1989). Tank cars in hazardous materials service account for about half of the tank car fleet, suggesting that only a small portion of these punctures and ruptures occurs among hazardous materials tank cars and that most tank car accident releases are caused by other sources. Safety Performance of Design Types Performance of Pressure and Nonpressure Designs In general, the pressure tank cars, which carry some of the most hazardous materials, are believed to be the safest designs. Pressure cars have histori- cally accounted for about 40 percent of tank car mileage (using data from 1978 to 1986) but less than 20 percent of accident releases (using data from 1965 to 1986) (Figures 3-7 and 3-8). This performance may be explained by the thicker tank walls [ 112 in. (12.7 mm) or more] and better- protected fittings of pressure cars, as well as vigilance by shippers in inspecting and securing them before transport. The safety performance of individual pressure car designs, relative to each other and the individual nonpressure designs, is not as well estab- lished. Pressure car designs vary in several features important to safety, including tank wall thickness, head protection, and thermal protection. Table 3-3 gives some of the differences between the pressure and non- pressure designs. With the exception of head protection assessments, few studies have examined the relative safety performance of each tank car design type and their design features. Performance of Tank Cars Equipped with Head Protection Spurring the introduction of head protection systems was a series of accidents during the 1960s and 1970s in which pressure cars carrying

78 ENSURING RAILROAD TANK CAR SAFETY Percent of Total for All Tank Cars 100 . .................................................... 401 20 Pressure Nonpressure Design Type Mileage Lull Releases FIGURE 3-7 Share of tank car mileage and accident releases by design type. Mileage data for 1978 to 1986 (Harvey et al. 1987); release data for 1965 to 1986 (RPI-AAR 1989). flammable gases were punctured by couplers of adjoining cars during switching operations and derailments. As discussed in Chapter 2, these accidents led to development of double-shelf couplers to improve tank car interlocking and to requirements for head protection.9 During the late 1970s and early 1980s, DOT required double-shelf couplers on all tank cars carrying hazardous materials and head protection on most pressure

Tank Car Regulation and Safety Performance 79 Annual Average Punctures/Ruptures 80. ...................................... 601 .......................... Period 1965-1 979 I::::::198o1986 _ 010 d__ __ :s] Pressure Nonpressure Total FIGURE 3-8 Average puncture and rupture releases from tank cars (including those in nonhazardous service) per year for two periods (RPI-AAR 1989). cars used for transporting flammable gas. By the early 1980s virtually all tank cars in hazardous materials service had double-shelf couplers, and more than half of pressure cars had head protection. After several years of experience with these safety devices, it has become possible to evaluate their effect. The RPI-AAR Tank Car Safety Research and Test Project has compared data on tank cars damaged in accidents

TABLE 3-3 Major Protective Features of Tank Cars by Design Specification (Design Types with More Than 150 Cars in Service) DOT DESIGN TANK WALL THICKNESS (IN.)' HEAD No BorroM THERMAL INSULATION DOUBLE-SHELF SPECIFICATION /8 OR MORE 11/16 OR MORE SHIELD FIYrINGSb SYSTEM JACKETC COUPLER 103W No No No No No Optional Yes 105A100W Yes No No Yes No Yes Yes 105A300W Yes Yes No Yes No Yes Yes 105A400W Yes Yes No Yes No Yes Yes 105A50OW Yes Yes No Yes No Yes Yes 105A600W Yes Yes No Yes No Yes Yes 105J100W Yes No Yes Yes Yes Yes Yes 105J300W Yes Yes Yes Yes Yes Yes Yes 105J400W Yes Yes Yes Yes Yes Yes Yes 105J500W Yes Yes Yes Yes Yes Yes Yes 105S300W Yes Yes Yes Yes No Yes Yes 105S50OW Yes Yes Yes Yes No Yes Yes 111A100W1 No No No No No Optional Yes 111A100W2 No No No No No Optional Yes 111A100W3 No No No No No Yes Yes 111A100W5 No No No No No Optional Yes 111A100W6 No No No No No Optional Yes

111A60ALW No/Alum. No/Alum. No No No Optional Yes 111A60ALW1 No/Alum. No/Alum. No No No Optional Yes 111A60ALW2 No/Alum. No/Alum. No No No Optional Yes 111A60W1 No No No No No Optional Yes 111A60W7 No No No No No Optional Yes 112A400W Yes Yes No Yes No Optional Yes 112J340W Yes Yes Yes Yes Yes Yes Yes 112J400W Yes Yes Yes Yes Yes Yes Yes 112S340W Yes Yes Yes Yes No No Yes 112T340W Yes Yes Yes Yes Yes No Yes 1 12T400W Yes Yes Yes Yes Yes No Yes 114A340W Yes Yes No No No Optional Yes 114J340W Yes Yes Yes No Yes Yes Yes Minimum steel plate thickness for tank shell and heads when steel of less than 65,000-psi tensile strength is used. Lower thicknesses are often permitted for steel with higher tensile strength. b Bottom outlets, washouts, and other fittings are prohibited; all top fittings are protected (most cases). Although insulation is not provided as a protective feature, it has a positive effect in providing additional tank puncture resistance, the degree to which varies according to the jacketing and insulation material used and the insulation thickness.

82 ENSURING RAILROAD TANK CAR SAFETY from 1965 to 1979 (before the use of double-shelf couplers and head protection on most pressure cars) with accident records from 1980 to 1986 (RPI-AAR 1989). Results of the comparison indicate that the expanded use of double-shelf couplers and head protection devices during the early 1980s coincided with a 91 percent reduction in the incidence of head puncture releases. Table 3-4 summarizes findings from the RPI-AAR project concerning the experience of pressure cars used to ship flammable gases and an- hydrous ammonia. From 1965 to 1979 an average of approximately nine head puncture accidents per year occurred involving tank cars used to ship these materials. From 1980 to 1986 these tank cars were involved in less than one head puncture accident per year on the average, representing a decline of approximately 90 percent. Although accurate data on changes in tank car traffic between the two periods are not available to normalize the data, the total number of tank cars in operation, including pressure cars, increased from the 1970s to the 1980s. Concurrent with the decline in head punctures were significant declines in most other types of accident releases. For instance, shell punctures among pressure cars dropped by more than half, from an average of about five per year from 1965 to 1979 to roughly two per year from 1980 to 1986. Nonpressure cars (including those not used in hazardous materials service)—some of which were equipped with double-shelf couplers shortly after 1979 but not equipped with head protection devices—experienced a SO percent decline in puncture and rupture releases (Figure 3-8). This experience suggests that factors besides head protection, especially the widespread use of double-shelf couplers and general improvements in rail safety, have had significant effects in reducing puncture incidents.10 KEY POINTS AND FINDINGS DOT establishes tank car design, construction, and maintenance standards with assistance from industry in ensuring broad compliance. The AAR TCC—composed of engineers and other technical representa- tives of tank car suppliers, shippers, and railroads—reviews and approves construction drawings, component designs, and methods of repair, alter- ation, and conversion that are proposed by builders, repairers, and ship- pers. By doing so, the TCC enhances industry compliance with DOT regulatory requirements. Tank car builders and repairers are ultimately responsible for verifying that finished tank cars meet all applicable DOT requirements, following DOT and TCC inspection and certification pro- cedures. Tank car owners and operators are responsible for ensuring that

TABLE 3-4 Accident Releases of Commodities Carried in DOT-i i2 Pressure Tank Cars Before and After Requirements for Special Protections (RPI-AAR 1989) AVERAGE AVERAGE AVERAGE HEi.D AVERAGE SHELL RUPTURES RUPTuRES PUNCI1JRE PUNCTURE FROM FROM AVERAGE COMMON TANK CAR RELEASES PER RELEASES PER IMPACT FIRE PER ANNUAL PERIOD TYPE USED YEAR YEAR PER YEAR YEAR TOTAL FLAMMABLE GAS 1965 to 1979 DOT-112A, DOT-105A 8.07 4.27 0.4 6.4 19.13 1980 to 1986 DOT-112J, DOT-105J 0.43 1.86 0.43 1.0 3.71 Percent change -94.7 -56.4 +7.5 -84.3 -80.6 ANHYDROUS AMMONIA 1965 to 1979 DOT-112A 1.33 0.8 0.33 0.07 2.53 1980 to 1986 DOT-112S 0.14 0.43 0 0.29 0.71 Percent change -89.5 -46.3 -100 +314 -71.9 FLAMMABLE GAS AND ANI-IYDROUS AMMONIA CorvIrnD 1965 to 1979 All above 9.4 5.07 0.73 6.47 21.66 1980 to 1986 All above 0.57 2.29 0.43 1.29 4.71 Percent change -93.9 -54.8 -41.1 -80.1 -78.3 Nom: DOT-i 12J and DOT-iOSJ type pressure tank cars are equipped with double-shelf couplers, head shields, and thermal protection; DOT-112S type tank cars are equipped with double-shelf couplers and head shields. The DOT-112A and DOT-105A type pressure cars are not equipped with head or thermal protection, and most such cars in operation from 1965 to 1979 were not equipped with double-shelf couplers.

84 ENSURING RAILROAD TANK CAR SAFETY in-service tank cars are periodically reinspected and retested according to DOT requirements. DOT regulates the shipment of materials with acute safety hazards, assigning them to specific design types. DOT regulates hundreds of mate- rials as hazardous because of their corrosivity, flammability, toxicity, and other acute hazard characteristics. Each material is assigned to a hazard class on the basis of these hazard characteristics and its physical state in transport (e.g., gas, liquid). The physical characteristics of the material are often key determinants of tank car assignment, which are governed by DOT hazardous materials packaging regulations. Materials with the high- est vapor pressures are usually assigned to the pressure car designs with the thickest walls and greatest puncture resistance. Poison and flammable hazards are also key determinants of packaging. Most gases with these hazards are assigned to specially protected tank cars, including those with head and thermal protection. Packaging requirements have been modified in recent years. Some highly hazardous liquids (e.g., poison liquids with inhalation hazards) have been assigned to the thicker-walled, more punc- ture-resistant pressure cars because of concern over their hazard potential (e.g, high inhalation toxicity) rather than the need to contain vapor pres- sure. Demands have also increased for DOT to consider the need for stricter packaging requirements for some materials with environmental and other nonacute hazards. Most hazardous materials releases from tank cars are leaks caused by deficiencies in tank car handling, securement, and physical condition, whereas only a small portion are caused by train derailments, collisions, and other accident events. Of the approximately 1,000 hazardous mate- rials releases from tank cars each year, about 90 percent are from tank valves and other fittings, defective tank linings, or other sources not caused by accident damage. Most accident-related releases are caused by damaged valves and fittings. Tank punctures and ruptures—often a cause of fatal tank car failures in the past—are rare. The declining incidence of tank car head and shell punctures among all types of tank cars has coincided with the advent of several safety enhancements, including double-shelf couplers and head protection sys- tems, and improvements in overall railroad safety. Analyses of accident data indicate that head punctures in pressure cars used for flammable gases dropped by more than 90 percent after such cars were equipped with head protection. The precise effect of head protection in reducing punctures is not known, however, because other safety improvements such as double- shelf couplers have reduced the potential for puncture incidents. During the 1980s, punctures declined dramatically among both pressure and nonpressure cars. The latter tank cars are not equipped with head protec-

Tank Car Regulation and Safety Performance 8S tion, indicating the importance of double-shelf couplers and other safety improvements by railroads and shippers. Experience indicates that pressure cars, as a general class, are safer than nonpressure cars, but few systematic assessments have been made of the relative safety performance of individual design types. Incident data indicate that pressure cars account for a disproportionately smaller share of hazardous materials releases than nonpressure cars. Individual pressure car designs, however, differ in key design features that are likely to affect their ability to protect cargo in an accident. Differences in protection capabilities are important in assigning hazardous materials to individual tank car design types. The relative effectiveness of tank car design types in providing safe containment of product has not been systematically as- sessed by incident data, crash tests, or other measures. NOTES Examples of major legislation are the 1976 Resource Conservation and Recov- ery Act (for the control and regulation of hazardous waste disposal) and the 1980 Comprehensive Environmental Response, Compensation, and Liability Act (for the cleanup of abandoned hazardous waste sites). The specialty tank cars consist of the multiunit, cryogenic, and seamless steel tank cars. The organization and procedures of the AAR Tank Car Committee are dis- cussed in Chapter 4. DOT has proposed rule changes (RSPA Docket HM-201) to require testing of tank car structural integrity, as discussed in Chapter 5. S. Materials may have special requirements for interior linings, coatings, fitting arrangements, and construction materials. Tank cars carrying corrosive commodities account for a disproportionate share of safety vent releases; corrosives are often carried in nonpressure tank cars equipped with non-reclosing safety vents. The records have been generated through the compilation of RSPA and FRA reports, BOE records, National Transportation Safety Board investigations, and documentation from individual shippers and railroads. This estimate is consistent with a 1993 study sponsored by FRA (Raj and Turner 1993), which estimated that 6 of every 10,000 tank cars in service sustain accident damage during a given year and lose product as a result of the damage. Because there are approximately 210,000 tank cars in service, this results in 126 such incidents. However, only about 55 percent of tank cars are in hazardous materials service, suggesting that about 70 (0.55 x 126) inci- dents involve hazardous materials releases. Subsequent experience indicates that these devices also help protect tank cars during mainline train accidents by keeping cars interlocked and more stable following derailments and by protecting tank car heads from broken couplers, rails, and other wreckage.

86 ENSURING RAILROAD TANK CAR SAFETY 10. The precise effect is not known because overall improvements in rail safety and changes in tank car population and traffic have affected the general incidence and severity of railroad accidents. REFERENCES ABBREVIATIONS AAR Association of American Railroads BOE Bureau of Explosives FRA Federal Railroad Administration NTSB National Transportation Safety Board RPI Railway Progress Institute RSPA Research and Special Programs Administration BOE. Annual 1988-1993. Report on Rail Tank Car Loads of Hazardous Materials by Commodity by Sources of Leak. Casualty Prevention Division, American Association of Railroads, Washington, D.C. Federal Register. 1993. Docket HM-175A, Notice 93-19. Oct. 8, pp. 52,574- 52,5 96. FRA. Annual. Accident Incident Bulletin. U.S. Department of Transportation. Harvey, A. E., P. C. Conlon, and T. S. Glickman. 1987. Statistical Trends in Railroad Hazardous Materials Transportation Safety: 1978 to 1986. Report R-640. Association of American Railroads, Washington, D.C. NTSB. 1981. Safety Report: Status of the Department of Transportation's Haz- ardous Materials Regulatory Program. Report NTSB/SRJ8 1/2. Washington, D.C. Raj, P. K., and C. K. Turner. 1993. Hazardous Materials Transportation in Tank Cars: Analysis of Risks—Part 1. Report DOTIFRAJORD-92/34. Federal Rail- road Administration, U.S. Department of Transportation. RPI-AAR. 1989. Analysis of Tank Cars Damaged in Accidents, 1965 Through 1986: Documentation Report. Report RA-02-6-55. Railroad Tank Car Safety Research and Test Project. Chicago, Ill. RPI-AAR. 1990. Analysis of Aluminum Tank Cars Damaged in Accidents, 1965 Through 1986. Report RA-20-1-57. Railroad Tank Car Safety Research and Test Project. Chicago, Ill. RSPA. Annual 1983-1992. Annual Report on Hazardous Materials Transporta- tion. U.S. Department of Transportation.

CHAPTER 4 Government and Industry Activities To Ensure Tank Car Safety GOVERNMENT AND INDUSTRY TANK CAR SAFETY programs and activities are reviewed in this chapter. U.S. Department of Transportation (DOT) rulemaking, enforcement, research, and data pro- grams pertaining to tank cars are discussed first. This is followed by a review of the activities of the National Transportation Safety Board (NTSB), Environmental Protection Agency (EPA), and the Canadian and Mexican governments concerning tank car safety. Industry's efforts to ensure tank car safety through the development of standards for engineering and operations, research and testing, data pro- grams, and other means are also reviewed. Much of the discussion con- cerns the functions of the Tank Car Committee (TCC) of the Association of American Railroads (AAR) as it assists DOT in instituting standards for tank car design safety. Finally, a summary of government and industry procedures for implementing design standards for other types of transport vehicles and containers is provided. GOVERNMENT ACTIVITIES DOT Two DOT agencies—the Research and Special Programs Administration (RSPA) and Federal Railroad Administration (FRA)—have prominent roles in ensuring tank car safety. As the lead DOT agency in charge of hazardous materials safety for all modes of transport, RSPA sets DOT regulations1 classifying hazardous materials, prescribing packaging, and 87

88 ENSURING RAILROAD TANK CAR SAFETY defining the requirements of shippers and carriers in handling hazardous shipments. Most of the enforcement and technical support for RSPA's hazardous materials regulations is provided by the individual modal agen- cies.2 In the case of railroad tank cars, FRA provides this support and also assists RSPA in formulating new regulations. Rulemaking and Exemption Procedures Federal regulations governing tank car engineering and operations (which are reviewed in Chapter 3) may be revised as a result of several actions. The most common are new laws requiring the revision, public petitions re- questing rule changes, and the identification of a safety concern or defi- ciency in the regulations by DOT that can be addressed by revising the regulations. The procedures employed by FRA and RSPA to formulate regulations, known as the rulemaking process, have an important effect on the cooperation between government and industry in activities to improve tank car safety. The rulemaking process involves several steps. It usually begins with the issuance of an "advance notice of proposed rulemaking," which requests comments from the public about a perceived problem. The notice may include preliminary proposals for new regulations. Most rulemaking for tank cars is initiated by FRA's Office of Safety Enforcement (Hazardous Materials Division), with the assistance and concurrence of RSPA's Office of Hazardous Materials Safety, which publishes the rulemaking notices in the Federal Register. Depending on the subject, rulemaking can involve the publication of many rulemaking notices over a period of several years. During rulemaking proceedings, FRA and RSPA officials are prohibited from public discus- sion of matters related to issues in the proceedings unless they submit memoranda to the public docket summarizing the discussions. The pri- mary avenues for public input are scheduled hearings and requests for written comments that accompany most rulemaking notices.3 In formulating a final rule, FRA and RSPA are responsible for ensuring that all important economic, safety, and technical issues have been thor- oughly evaluated. The agencies review public comments submitted in response to the rulemaking notices and may sponsor special studies or consult with outside technical experts for further guidance. Once a final rule has been developed, it is published in the Federal Register with an implementation date. FRA and RSPA also review requests for exemptions to the regulations. Emergency exemptions are sometimes requested by shippers or carriers, for instance, to transport a damaged tank car to an unloading site. In these situations, FRA and RSPA may grant the exemption immediately (in a few

Government and Industry Activities To Ensure Tank Car Safety 89 hours) if the action will not adversely affect safety. Most exemption re- quests do not involve emergencies. They usually consist of petitions for field testing of new tank car design types or components or for temporary use of a tank car that does not meet all regulatory requirements. These requests often require notice in the Federal Register accompanied by provisions for public comment. About 7S exemption requests (35 emer- gency and 40 nonemergency exemptions) concerning tank cars are re- viewed each year. If a problem is discovered that poses an urgent hazard, FRA has author- ity to bypass the regulatory process and issue an emergency order requir- ing steps to correct the problem. For instance, an emergency order may prohibit use of a particular group of tank cars if a serious design or construction deficiency is found. Because of their extraordinary nature, FRA issues emergency orders sparingly; during the past 20 years only nine have been issued that directly affect tank cars.4 Enforcement FRA is responsible for enforcing all hazardous materials regulations that pertain to railroad transportation. FRA's Office of Safety Enforcement employs 360 inspectors who work in five major enforcement areas—track, motive power and equipment, signals and train control, operating practices, and hazardous materials. Forty-five of the 360 FRA inspectors are hazardous materials specialists. In addition FRA has agreements with more than 30 states to conduct railroad inspections under federal authority. FRA hazardous materials inspectors cover shipper and receiver facili- ties, rail yards and lines, and tank car manufacturing and repair shops. They conduct about 4,000 inspections per year, selecting individual sites for inspection on the basis of a number of factors, including incident experience, traffic densities, previous inspection results, and violation rec- ords. Shipper and receiver facilities account for about 60 percent of inspec- tions, railroads for about 35 percent, and tank car manufacturing and repair shops for the remaining 5 percent (personal communication, FRA Office of Safety). During inspections of shipper and railroad facilities, inspectors examine tank cars for proper placarding and marking and review handling, loading, and unloading practices. During inspections of tank car manufacturing and repair shops, inspectors examine tank car work in progress, review worker qualification records, and examine methods used for tank car fabrication and repair. When a practice is found to be unsafe or a tank car is deemed unfit for further service, the inspector may issue an immediate notice prohibiting the practice or movement of the car until the safety deficiency is corrected.

90 ENSURING RAILROAD TANK CAR SAFETY During the past S years, FRA issued more than 3,000 penalties for violation of hazardous materials regulations by railroads, shippers, and container manufacturers and repairers.5 Among the most common viola- tions (resulting in fines typically between $2,000 and $10,000 per viola- tion) were improperly secured closures on residue tank cars (e.g., loose valve and outlet closures), improper placarding of cars or containers, and failure to provide shipping papers containing required emergency response information. Finally, FRA inspectors investigate tank car failures, and they peri- odically conduct special field investigations in support of FRA research and regulatory programs. Research FRA's Office of Research and Development (R&D) has supported tank car research for nearly 30 years. Tank car—related studies and other hazardous materials research account for about S percent of FRA's total R&D budget. Between 1990 and 1993 FRA spent $4.4 million on tank car and hazardous materials research from a total research budget of $93.6 million for the period.6 Most FRA tank car research projects support the agency's regulatory and enforcement needs, developed by R&D staff in consultation with hazardous materials specialists in the Office of Safety. Projects may also be initiated in response to NTSB recommendations or congressional man- date. Most projects, which last 2 to S years and cost between $50,000 and $300,000, are expected to yield results that can be applied to immediate safety problems and needs. Because FRA does not have in-house research capabilities, most re- search is conducted through contracts with private consultants, univer- sities, national laboratories, and DOT's Volpe National Transportation Systems Center. Tests in support of FRA tank car research have been conducted at DOT's Transportation Test Center under the management of AAR. RSPA and other federal agencies, such as the Department of Energy, occasionally join FRA in sponsoring tank car research. Technical Activities FRA and RSPA have small technical staffs responsible for a wide range of tank car design, construction, maintenance, and operational matters. They develop tank car rulemaking proposals, review requests for exemptions to regulations, manage the tank car research program, monitor tank car safety performance (by reviewing incident records and inspector reports), consult with field inspectors and legal staff to enforce the regulations, and

Government and IndustryActivities To Ensure Tank Car Safety 91 work with officials from Canada and Mexico to ensure uniformity in tank car standards. Agency technical staff also represent DOT at meetings of AAR's TCC and other industry groups. Interaction of agency personnel with industry through these activities enhances their technical knowledge of tank cars and provides a means for exchanging research, enforcement, and regula- tory information. By participating in TCC meetings, agency staff also monitor the AAR approvals. Usually, one or two representatives from RSPA and FRA attend TCC meetings on an informal basis (i.e., they are not members of the TCC or formally appointed liaisons). Data Activities Good data are critical to the tank car activities of DOT. For instance, data on tank car hazardous materials releases, inspections, and fleet condition are essential to monitoring safety trends, formulating and evaluating rulemaking proposals, deploying enforcement resources, and conducting research. Data sources available to FRA and RSPA for these purposes are dis- cussed in Chapter 3. Perhaps the most important data are statistical records of tank car incidents. This type of data is collected by DOT through RSPA's Hazardous Materials Information System and FRA's Railroad Accident/Incident Reporting System. The former is administered by RSPA's Office of Hazardous Materials Safety, and the latter by FRA's Office of Safety Analysis. Incident reports from both data bases are reviewed periodically by FRA's Office of Safety, and copies of reports are distributed to FRA regional offices to aid in inspector deployment and to identify incidents that may warrant further investigation. More discussion of tank car data uses is provided in Chapter S. NTSB NTSB is an independent federal agency charged with investigating trans- portation incidents and determining probable causes. NTSB investigates most major tank car incidents and recommends corrective measures to DOT, other government agencies, individual companies, and industry associations. Although NTSB has no enforcement or regulatory authority, it closely monitors the actions taken in response to its recommendations, submits comments to DOT on rulemaking proposals, and testifies before Congress on matters related to tank car safety.

92 ENSURING RAILROAD TANK CAR SAFETY Since its founding in 1968, NTSB has investigated more than three dozen tank car incidents, resulting in more than 75 recommendations to DOT and industry. Since the 1970s, NTSB has advocated use of head and thermal protection on tank cars and has expressed concern about DOT's performance in addressing current safety problems and anticipating future ones. Some of NTSB's concerns and recommendations are discussed in Chapter 5. EPA As the lead federal agency with responsibility for protecting the public and environment from hazardous substances and wastes, EPA has a role in ensuring hazardous materials transportation safety. The Comprehensive Environmental Response, Compensation and Liability Act requires DOT to regulate the transportation of substances deemed harmful by EPA. Although DOT has broad authority to regulate materials that are harmful to human health,8 the agency has traditionally focused its limited resources on regulation of materials having acute hazards,9 relying on EPA to pro- vide information on materials that pose chronic hazards and that can contaminate the environment if released during transportation. Some links have been forged between DOT and EPA to coordinate regulatory activities and to exchange technical information on hazardous materials. For instance, the National Response Team, headed by EPA, provides a means for DOT and EPA officials to discuss hazardous mate- rials information and planning needs and to coordinate emergency re- sponse capabilities. Usually, DOT has a secondary role in regulating materials with adverse environmental effects and relies primarily on EPA to identify and provide technical information on these materials.10 More discussion of DOT's mission in regulating materials with environmental and long-term hazards is provided in Chapter S. Canada and Mexico Because of significant petroleum and chemical traffic between the United States, Canada, and Mexico, tank cars frequently move across national borders. The need to ensure conformity in regulatory requirements and the safety of these tank cars has led to coordination of activities among transport officials in the three countries. Canada Transport Canada, the transportation agency, has jurisdiction in Canada over regulations covering tank car and hazardous materials safety. Most

Government and Industry Activities To Ensure Tank Car Safety 93 Transport Canada regulations governing tank cars duplicate the U.S. regulations. Perhaps the most significant difference is that Canada requires full head protection on tank cars when U.S. regulations permit half head protection.11 Certain other requirements concerning the use of a specific steel and types of thermal protection also differ between the two countries. In these cases, agreements have been reached between the two countries to permit tank cars to cross borders without special approval. The Canadian regulations regarding TCC approval functions are simi- lar to the U.S. regulations. Representatives from Transport Canada partici- pate in TCC activities like DOT representatives. FRA and Transport Canada communicate regularly on both a formal and an informal basis to promote uniformity in regulations. FRA works with Transport Canada on technical issues concerning tank car engineering and operations, and the two agencies routinely exchange information on inspection and enforcement. Mexico Traditionally, Mexico has had few regulations covering hazardous mate- rials. Nevertheless, tank cars that cross U.S. borders must conform to DOT regulatory requirements. In recent years, DOT and Mexican transporta- tion officials have increased efforts to exchange information on their respective requirements. DOT officials meet periodically with Mexican transportation officials, although no formal communications mechanism has been established. In addition, for several years, AAR has monitored and certified tank car fabrication and repair shops in Mexico. INDUSTRY ACTIVITIES Industry has a prominent role in ensuring tank car safety. This section contains an overview of tank car activities of AAR and other industry groups. AAR AAR and predecessor organizations have been active in promoting tank car and hazardous materials safety since the turn of the century. In addi- tion to overseeing the Tank Car Committee, AAR administers the Bureau of Explosives (BOE), which monitors and responds to tank car incidents and works with shippers to ensure proper packaging of hazadous ship- ments. For many years, AAR has been active in supporting tank car and

94 ENSURING RAILROAD TANK CAR SAFETY hazardous materials research in its Research and Test Department and through participation in interindustry research and technical activities. A chief responsibility of AAR is to institute railroad industry rules (interchange rules) that permit the free interchange of equipment between railroads. Through various committees, AAR develops and implements interchange rules affecting tank car engineering and operations. The rules are enforced by AAR and its member railroads. Under the auspices of the interchange rules, AAR has established design and engineering require- ments for tank cars not used in hazardous materials service. AAR rules also impose requirements on DOT-class tank cars, sometimes precluding the need for subsequent DOT regulations. One such case concerns the require- ment for protection of bottom outlets. AAR interchange rules require skid devices and other protection for bottom fittings of nonpressure cars. These protections, which were considered necessary by both government and industry, would likely have been adopted by DOT at a later date had industry not taken the lead. In this case, as in all cases involving the formulation of interchange rules directly affecting tank cars, the AAR Tank Car Committee played a central role in the development of the standards. TCC The TCC is one of several technical committees that deal with aspects of railroad equipment. Like most of these committees, it was established to develop common engineering standards to ensure compatibility of equip- ment used in interchange service. Over time, the TCC's mission evolved differently from that of most other AAR equipment committees. Its princi- pal function is to ensure that tank cars are engineered for safety. The best-known function of the TCC concerns its approval authorities. It also has many other functions important to tank car safety. After a brief review of the TCC's membership structure, its approval authorities and other safety-related functions are reviewed. Membership TCC is administered by the Casualty Prevention Division of AAR's Opera- tions and Maintenance Department, which is responsible for selecting TCC members and establishing membership protocol. Currently, the TCC consists of 16 members: 10 from railroads, 4 from industry associations representing shippers, 1 from the Railway Progress Institute (RPI) repre- senting tank car suppliers, and 1 from BOE. AAR has established few formal requirements governing TCC size and membership except that a majority of members, including the chair, must represent railroads.12 Candidates for membership are nominated by their

Government and Industry Activities To Ensure Tank Car Safety 95 companies or respective industry associations. Members usually have expertise in railroad operations, tank car and railcar engineering, or hazardous materials regulation and transportation. Members from ship- per companies and tank car builders are usually experts in tank car engineering. Railroad members and AAR support staff have complemen- tary expertise in railroad operations, freight car engineering, and haz- ardous materials transportation. TCC members volunteer their services to the committee. In addition to attending meetings, committee members spend much of their service time reviewing applications for design approval and working on task force technical assignments. Task force findings are reviewed for action at quar- terly TCC meetings. TCC work groups and task forces are composed primarily of engineers from outside the committee, usually representing shippers, tank car suppliers, repairers, and component makers. Approval and Certification Procedures Many DOT design requirements give tank car builders latitude, within general parameters, to choose particular construction materials, types of fittings, tank dimensions, and various other design and construction methods and features. Hence, a chief responsibility of the TCC is to aid DOT in ensuring that tank cars are designed, constructed, and repaired to meet DOT requirements. The TCC assists DOT with compliance through the review and ap- proval of (a) tank car construction drawings; (b) types of fabrication materials, valves, and other fittings and equipment used in the construc- tion of tank cars; (c) procedures for major tank car repairs, alterations, and conversions; and (d) qualification requirements for tank car construction and repair shops. In general, DOT regulations do not specify procedures that must be used by the TCC in implementing these functions. Well- defined procedures have been established by AAR and the TCC over the past 50 years. Design Plan Approval. Before a tank car or series of identical tank cars can be classified in a DOT specification, the manufacturer must submit construction drawings to the TCC for review and approval to ensure that they meet DOT requirements for the specification as well as applicable AAR rules (Figure 4-1). In seeking approval the builder may request either a committee vote or a precedent approval administered by AAR staff. Precedent approvals are permitted when a similar design type has previ- ously been approved by the TCC during the past S years.13 In a typical year, the TCC grants about 300 design approvals, about a third of which are approved on the basis of precedent. When a committee vote is required,

Tank car builder applies by sending construction drawings to AAR Tank Car Committee AARITCC cI Wa + ' I m I I I I Tank Car Committee member 0 distribution and review DOT requirements checked AAR requirements checked AAR Certificate of construction New car construction FIGURE 4-1 Tank car design plan approval process (NTSB 1987).

Government and Industry Activities To Ensure Tank Car Safety 97 each committee member receives copies of the construction drawings and supporting evidence submitted by the builder (e.g., test results). TCC members individually review the drawings and applications to determine compliance with DOT and AAR requirements. To assist builders in designing complying tank cars, the TCC developed a manual of standards and recommended practices, known as the AAR Specifications for Tank Cars (AAR 1992).14 The manual is a compilation of tank car design, construction, and repair criteria and practices deemed by AAR (and by DOT through regulatory reference to the manual) to meet all DOT and AAR requirements. The manual also describes procedures that must be followed in securing TCC approval. The TCC examines the design drawings and supporting evidence in light of the criteria and practices found in the specifications manual and DOT regulations. If the TCC concludes that the design meets all relevant requirements, as well as good design practices, a vote of approval may be rendered. TCC design plan approvals require a majority vote of the members with no negative votes. The review and approval process, usually handled through correspondence, takes about 60 days. Before the finished tank car can be placed in service under the DOT specification, the builder must certify that the car conforms to DOT requirements. The design approval application form, when signed by the builder, serves as the certificate of construction, copies of which are provided to AAR and the tank car owner (DOT may receive copies upon request). Approval of Tank Car Fittings, Construction Materials, and Other Equipment. In numerous sections of the hazardous materials regula- tions, the TCC is charged with approving specific types of tank car valves, fittings, construction materials, and products used on tank cars to ensure that they meet DOT criteria. Manufacturers can apply for approval of their products by submitting the design drawings, test results, and other evi- dence of compliance with DOT requirements. Sometimes the TCC grants conditional approval, provided the product undergoes surveillance and evaluation in service trials. Under these circumstances, owners or users of the affected tank cars must report on the performance of the component for a period,15 after which it is considered by the TCC for final approval. Conditional approvals and service trials are authorized only when the TCC believes that the product meets all applicable DOT requirements. If the TCC is not confident that a product meets all DOT standards, DOT must grant an exemption for the product to undergo service trials. About five service trials are requested by the TCC each year. Approval of Procedures for Tank Car Repair, Alteration, and Con- version. When a proposed repair, alteration, or conversion of a tank car

98 ENSURING RAILROAD TANK CAR SAFETY would use materials or procedures that have not previously been approved by the TCC, the builder or repairer must obtain TCC approval. This process is similar to that for construction of a new tank car. Drawings of the repair, alteration, or conversion must be submitted to the TCC with other information on the procedures. About 75 applications for repair, alteration, or conversion are reviewed by the TCC each year. When repairs, alterations, or conversions are made using previously approved materials and procedures, prior TCC approval is not required; however, the responsible shop must submit a report to AAR indicating the nature of the work.16 The AAR specifications manual lists common re- pair, alteration, and conversion methods that have been approved by the TCC (AAR 1992). Certification of Tank Car Fabrication and Repair Shops. Although DOT regulations do not explicitly define the responsibility of the TCC in certifying tank car fabrication and repair shops, the regulations require TCC approval of certain aspects of shop qualification. For instance, shop welders and welding procedures must be approved by the TCC (49 CFR 179.100-9). AAR has established a process for shop certification. Shops seeking certification must submit an application to AAR and the TCC. The application must describe the equipment used by the shop, welding pro- cedures, welder qualification records, and information on the quality control program of the shop (which also must be certified by the AAR's Quality Assurance Committee). After review of the application, AAR appoints a task force to inspect the facility and recommend action to the TCC. Initial certifications are condi- tional until a BOE representative inspects tank car work performed by the facility. Recertification is required every 6 years,17 and BOE inspectors usually conduct shop audits annually. More than 100 certified shops are listed in the AAR tank car specifications manual, mostly for repair work (AAR 1992). Other TCC Functions In addition to the approval and certification functions discussed, the TCC performs several other services in ensuring tank car safety. Among them are the following: Serve as clearinghouse for tank car improvements: A major benefit of the TCC is to provide a means for different segments of industry and government to exchange information on engineering and operational problems encountered in the field. It also provides a means for government and industry representatives to broaden their knowledge about tank car

Government and Industry Activities To Ensure Tank Car Safety 99 design, use, and operations, as well as emerging technologies and innova- tions. Revise AAR tank car specifications manual: The TCC is responsible for modifying the procedures, standards, and guidelines in the AAR tank car specifications manual. To aid in this, work groups rev?ew and recom- mend changes to specific chapters and technical appendices. Because the specifications manual is a principal reference document used in tank car engineering, this TCC function is essential for ensuring an accurate and up- to-date manual. Review tank car incidents: With assistance from its Accident Review Working Group, the TCC evaluates selected tank car incidents to assess the performance of the tank car in the accident environment. The working group considers reports from BOE, DOT, and NTSB to understand inci- dent causes and to identify means for preventing recurrence. Advise on research: The TCC receives periodic updates on the results of studies by the RPI-AAR Tank Car Safety Project, BOE, DOT, and the AAR Research and Test Department. Researchers also consult with the TCC to identify prospective research topics and to discuss options for addressing engineering needs identified through research. Investigate new technologies and procedures: The TCC occasionally asks its work groups to explore new technologies and procedures that may apply to tank cars and that must be considered for incorporation into DOT specifications or AAR recommended practices. For instance, a TCC work group recently examined alternative methods for structural testing of in- service tank cars. Keep records and collect data: In implementing its approval authori- ties, the TCC collects and reviews numerous records and reports. These documents, including certificates of construction, test results, and repair reports, contain information on the condition and use of tank cars. In accordance with DOT recommendations, the TCC recently adopted re- quirements for repair shops to report structural repairs of tank cars (not caused by accident damage), for use by AAR in identifying deficiencies in the tank car fleet. Assist DOT and industry with special safety programs: The TCC assists DOT, AAR, and the tank car industry in development of special tank car inspection and repair programs. For instance, over the past S years, the TCC worked with FRA, shippers, and tank car owners to identify and repair certain pressure cars (dual-diameter designs) that ex- hibited fatigue cracks. The TCC also recently assisted AAR and RPI in the development of an industrywide program to find cracks in stub sill tank cars. During the 1970s, the TCC assisted FRA in establishing programs to retrofit thousands of pressure tank cars with head and thermal protection systems.

100 ENSURING RAILROAD TANK CAR SAFETY BOE BOE, an organizational unit of AAR, was created by the railroads in 1907 to set standards for shipping explosives and other dangerous materials.18 During ICC's tenure in charge of hazardous materials regulation, BOE served as the agency's technical arm by classifying hazardous materials, testing packaging, and investigating major incidents. BOE's role in many of these areas has diminished over the past 25 years, but it still provides services to industry and government. Although it no longer operates testing facilities, BOE continues to collect information on hazardous materials and disseminate it to shippers, carriers, and emer- gency responders. The bureau employs a network of inspectors, who conduct site visits and audits of railroads, shippers, and tank car suppliers to ensure compliance with the DOT and AAR requirements. BOE inspec- tors also assist railroads and communities in responding to hazardous materials incidents and sometimes conduct follow-up investigations of tank car failures to determine causes. BOE also collects and evaluates hazardous materials incident data (see Chapter 3). When railroads report incidents to RSPA and FRA, they send copies to BOE, which maintains its own incident data base. BOE supple- ments the records with information gathered from railroads and its own incident investigations. BOE staff periodically analyze these data to deter- mine incident trends and to publish annual reports tabulating the data. BOE incident records are used by AAR research staff in conducting tank car and hazardous materials safety studies. Finally, a BOE representative serves as a member of the TCC. In this capacity, BOE provides input to the TCC from its inspector audits, inci- dent investigations, and data activities. AAR Research and Test Department AAR maintains a Research and Test Department with more than 300 employees in laboratories and offices in Washington, D.C., Pueblo, Colo- rado, and Chicago, Illinois. During the past 25 years, the department has conducted numerous studies to improve tank car engineering and opera- tions. Since 1970 it hasprovided funding and policy guidance to the RH- AAR Railroad Tank Car Safety Research and Test Project (discussed later). During the 1970s, AAR's research focused on improving the crash- worthiness of tank cars and improving railroad operations to reduce the frequency and severity of tank car incidents. More recently, AAR re- searchers have been developing quantitative risk assessment techniques to identify tank car/product assignments, routes, and railroad and shipper

Government and Industry Activities To Ensure Tank Car Safety 101 operating procedures that minimize the risk of shipping hazardous mate- rials by rail. For more than a dozen years, the Research and Test Department has managed DOT's Transportation Test Center in Pueblo, Colorado. The center, which receives some of its funding from FRA and other DOT agencies, can conduct full-scale equipment tests and has been used often by industry and government to test tank car designs, materials, and compo- nents. Other AAR Data Activities AAR's Transportation Division maintains two data bases that are valuable for monitoring the tank car fleet and traffic flow. The first is the Universal Machine Language Equipment Register (UMLER), which contains com- puterized records of all tank cars in service in North America. The second is the TRAIN II shipment information system, which provides status information on tank car shipments. UMLER and TRAIN II data can be used to derive the number of tank cars in service by age and design type and to examine tank car usage by commodity and car design type. Shipper Associations Several industry associations representing shippers have a strong interest in tank car engineering and operations. The Chemical Manufacturers Association (CMA) is the major industry group representing chemical makers, suppliers, and distributors. A CMA representative (from a mem- ber company) serves on the TCC, and other representatives from CMA- member companies are active on TCC task forces and working groups. Through its own committees, CMA monitors and responds to DOT rulemaking initiatives and promotes shipper practices to enhance tank car safety and productivity. Various other shipper associations serve similar functions, including the Chlorine Institute, American Petroleum Institute, Sulphur Institute, Fertilizer Institute, Compressed Gas Association, and National Propane Gas Association. Representatives from most of these associations have served on the TCC. RPI RPI is the major trade association for suppliers of railroad equipment and other products, including tank car builders and leasing companies. RPI's Committee on Tank Cars—which consists of representatives from the five

102 ENSURING RAILROAD TANK CAR SAFETY major tank car suppliers—advises the RPI representative who serves on the TCC. In cooperation with AAR, RPI provides funding for the RPI-AAR Railroad Tank Car Safety Research and Test Project, which has made significant contributions to tank car crashworthiness during the past two decades. Cooperative Industry Activities Several cooperative programs besides the TCC have been established by industry to improve tank car safety. RPI-AAR Railroad Tank Car Safety Research and Test Project Since 1970 RPI and AAR have cosponsored the RPI-AAR Railroad Tank Car Safety Research and Test Project. The purpose of the project, initiated following several fatal tank car crashes in the late 1960s, is to identify and understand the causes of tank car punctures and ruptures in accidents and to develop engineering solutions. As discussed in Chapters 2 and 3, results of this continuing project, combined with findings from DOT and other industry research, have led to the development and introduction of several devices to improve tank car crashworthiness, including double-shelf cou- plers and head and thermal protection systems. From the outset, the absence of data necessary to evaluate the causes of tank car failures was evident. RPI-AAR researchers initiated a program to gather and evaluate records of tank cars damaged in accidents. As dis- cussed in Chapter 3, this program has resulted in an extensive and detailed data base of more than 35,000 records of tank cars damaged over 30 years. Interindustty Rail Safety Task Force Industry associations periodically form interindustry task forces to address common problems or concerns. Since 1988, AAR, CMA, and RPI have participated in an interindustry task force to identify ways to improve the safety of hazardous shipments by rail through a combination of improve- ments in tank car engineering and operations. Through various working groups of shippers, carriers, and tank car suppliers, the task force has examined four areas: railroad operating practices and conditions, shipper practices, emergency response information, and risk management. These efforts led to AAR recommendations for railroads to maintain certain track standards on routes with heavy hazardous materials traffic and for trains carrying high quantities of very hazardous materials to use

Government and Industry Activities To Ensure Tank Car Safety 103 recommended operating practices. They also led to recommendations for better employee training in handling hazardous materials and for inspect- ing loaded tank cars to ensure that they are well secured. In an ongoing project, the task force is developing a computer model to analyze factors affecting risk associated with transporting hazardous materials by tank car, including route characteristics (e.g., track type and populations exposed), tank car features, and commodity hazards. The model should assist railroads and shippers in identifying low-risk transportation options.19 DESIGN APPROVAL AND CERTIFICATION OF OTHER VEHICLE AND CONTAINER TYPES As a means of determining which aspects of the process for approving and certifying tank car designs are unique, it is helpful to consider the approval and certification procedures used in other transport modes for other types of vehicles and containers. Tank Trucks (Cargo Tanks) Although design and engineering criteria for tank trucks (referred to as "cargo tanks" in the regulations) are set by RSPA and the Federal Highway Administration (FI-IWA), each tank truck manufacturer is responsible for ensuring that its tanks are designed according to federal requirements. Tank truck manufacturers must have their design plans reviewed by a "design-certifying" engineer meeting DOT qualification requirements. The engineer, who may be an employee of the manufacturer, must provide the manufacturer with written certification that the tank design meets all applicable DOT requirements (NTSB 1992, 33). A DOT-qualified inspector, who again may be an employee of the manufacturer, must examine and certify the finished tank truck. Certi- fication records are retained by the manufacturer, who also must pro- vide written certification to the owner that all DOT requirements have been met. Tank truck manufacturers and repairers must register with RSPA and FI-IWA. As a prerequisite for registration, the manufacturer must be certi- fied by the American Society of Mechanical Engineers (ASME), which maintains minimum qualification requirements for tank and boiler makers (through its National Boiler and Pressure Vessel Code). Each tank truck manufacturer must hire an ASME-authorized inspection agency, such as the National Board of Boiler and Pressure Vessel Inspectors, to audit the

104 ENSURING RAILROAD TANK CAR SAFETY shop facility for compliance with ASME standards. ASME requires shop recertification reviews every 3 years. FH'WA's Office of Motor Carriers (OMC) is responsible for enforcing the regulations that apply to tank trucks. OMC inspectors examine tank truck terminals, shipping facilities, and manufacturing and repair shops. They also periodically examine the records of tank truck manufacturers to confirm that design and construction certification procedures are followed. Tank Vessels Tankers must satisfy several design requirements for safety and pollution prevention. Safety standards are developed through the International Mar- itime Organization (IMO) of the United Nations. IMO conventions estab- lish general design and construction principles governing ship strength, stability, safety features, and fire protection. The conventions are ratified by participating nations and implemented through domestic legislation and regulations. In the United States the Coast Guard is responsible for implementing and enforcing the standards.20 Tank vessel design plans are subject to Coast Guard review and ap- proval, but the Coast Guard has delegated much of this responsibility to the American Bureau of Shipping (ABS). ABS is one of several worldwide "classification societies" that consist of nonprofit groups of shipowners, builders, naval architects, and insurers. The societies establish rules gov- erning ship structural integrity, construction materials, design of structural elements, and maintenance and inspection procedures. Many ABS rules have been codified into federal regulation by the Coast Guard. Shipbuilders must submit designs to the classification society for review and approval and allow inspections by the society during and after ship construction. Once a tank vessel is in service, the Coast Guard is responsible for ensuring that it is maintained to appropriate standards. The Coast Guard inspects U.S.-flag ships every 2 years and has authority to inspect foreign- flag ships operating in U.S. waters. As a practical matter, the Coast Guard relies on shipowners and classification societies for thorough examina- tions. To maintain its "class" status, a ship must be inspected annually by the classification society to ensure compliance with certain maintenance standards, and it must undergo thorough structural inspections by the society every S years. Intermodal Tank Containers Intermodal tank containers carry many of the same materials as railroad tank cars but in smaller quantities [6,000 gal (22 800 L) or less]. Because

Government and Industry Activities To Ensure Tank Car Safety lOS they cross national borders and may be transported by ship, truck, and rail, in the United States regulations governing their design and construction are established and enforced principally by RSPA (rather than individual modal agencies), in concert with international standards. Manufacturers of intermodal tanks must apply for approval of the tank design plan by one of a dozen "approval agencies" designated by RSPA. Most of the major classification societies (such as ABS) are authorized approval agencies. The approval agencies review design plans submitted by container owners or manufacturers to ensure that designs comply with DOT requirements and international standards. DOT regulations pre- scribe the process that must be followed by the approval agency in conduct- ing the review and certification. After approving the design, the approval agency provides the manufacturer with a certificate, and the tank is marked with the agency's identification numbers. AAR's interchange rules also govern acceptability of intermodal tank containers used in rail transportation. Tank container owners must certify to AAR that their tanks are designed and manufactured to certain specifi- cations and that a prototype tank container has been impact tested accord- ing to AAR requirements. According to AAR statistics, there has been a significant increase in railroad shipments of hazardous materials by inter- modal tank containers during the past 10 years. These containers account for an appreciable share (10 percent or more) of railroad hazardous materials traffic (BOE 1992). Because use of intermodal tank containers in rail transportation is a relatively new phenomenon, AAR and FRA pro- cedures to ensure their design and construction safety are not as estab- lished as those developed for tank cars. Aircraft The Federal Aviation Administration (FAA) establishes regulations and standards that must be met by manufacturers of aircraft to ensure air- worthiness. FAA is more directly involved in design approval and construc- tion certification than are corresponding agencies in the modes previously discussed. Aircraft differ in many important respects from tank cars and the other vehicles and containers discussed in this section; for instance, they do not carry large quantities of hazardous materials, are used pre- dominantly for passenger transport, and are far more complicated and costly to build, maintain, and operate. A review of the design approval and certification process for aircraft, however, is illuminating because it provides an example of a well-established and highly scrutinized safety process.

106 ENSURING RAILROAD TANK CAR SAFETY Aircraft design approval begins when FAA receives an application from the manufacturer requesting a design "type" certificate. Manufacturers of large aircraft initiate the process several years before construction begins, submitting thousands of design drawings, test results, and engineering reports to FAA. Because FAA staff cannot review all of the detailed docu- mentation, senior engineers from the manufacturer are selected by FAA to work with agency staff as FAA "designated engineering representatives," who are under oath to abide by all FAA requirements. Whereas FAA staff review and approve most major elements of the design and testing methods used to ensure design integrity, manufacturer designees review design details and test results to certify compliance with FAA requirements. This self-certification occurs in an environment in which technically qualified FAA staff work closely with the designees. Before constructing a type-certified aircraft, the manufacturer must obtain a production certificate from FAA. Before a production certificate is granted, a team of FAA engineers reviews the manufacturing plans and quality control program to ensure that they meet the requirements of the type certificate and FAA quality control standards. During construction, FAA designates key manufacturer personnel as inspectors, known as "des- ignated manufacturing inspection representatives." These designees report to. FAA inspectors assigned to the facility and certify on behalf of FAA (by issuing an airworthiness certificate) that the completed aircraft conforms to the approved design. Summary Comparison of Approval and Certification Procedures Common to all these approval and certification procedures is strong industry participation (Table 4-1). This participation is critical, because most regulatory agencies are unable to maintain expertise that comes from day-to-day involvement in highly specialized areas. By enlisting private- sector participation in the approval and certification process, the regu- latory agencies use the technical expertise of industry while ensuring objectivity through varying degrees of governmental oversight. Perhaps the most extensive private-sector involvement occurs in the design ap- proval and construction certification process for aircraft, the safety of which is the subject of profound public concern and government scrutiny. Tank car design plan approval is most similar, in general approach, to the process for tank vessels. The role of the TCC is similar to thatof the classification societies that approve tank vessel design plans for the Coast Guard. The role of the classification societies is more extensive, because they also conduct compliance reviews and construction inspections. With

Government and Industry Activities To Ensure Tank Car Safety 107 tank cars, certification of the completed car is the responsibility of the tank car builder rather than the TCC. The design approval process for cargo tanks and intermodal tank containers, which resemble tank cars more closely in cost and design complexity, also have similarities with the approval process for tank cars. The regulatory agencies do not directly approve design and construction plans for any of these modes, but require certified inspectors or approval agencies to do so. Tank truck construction plans are approved by DOT- certified engineer hired by the manufacturer, whereas plans for intermodal tank containers are approved by third-party certification agencies quali- fied by DOT. In reviewing and approving design plans for tank cars, the TCC provides a similar third-party assessment. Of the three approval agents, DOT is the most active in monitoring the functions of the TCC. One major aspect of the approval and certification process in which tank cars receive the least government oversight is the inspection and certification of completed work. 'Whereas DOT-certified agents must in- spect and certify finished work of tank container and tank truck manufac- turers, there are no requirements for government-certified agents to inspect completed tank cars. KEY POINTS AND FINDINGS Tank car standards are instituted by both DOT and industry, al- though there are no formal mechanisms in place to foster government and industry cooperation in planning long-term safety improvements. Two DOT agencies, FRA and RSPA, share responsibility for regulating tank car design, use, and operations. Changes in DOT regulations are most often the result of legislative mandates, industry petitions, recommendations by NTSB, and concerns arising from prominent incidents. Industry has his- torically provided DOT with critical research assistance in the develop- ment of major safety improvements, including head protection and dou- ble-shelf couplers. Such assistance is hampered, however, by the DOT rulemaking process, which discourages RSPA and FRA staff from actively working with industry to resolve problems through continuing dialogue and cooperative actions. Both government and industry conduct research to improve tank car safety, the former focusing on specific problems and the latter support- ing more long-term research into broader safety areas. FRA spends about S percent of its annual research budget, or about $1 million per year, on tank car and hazardous materials safety research. Most projects are designed to produce results with application to current regulatory and enforcement needs. FRA seldom engages in long-term research. Industry has been more

TABLE 4-1 Summary of Approval and Certification Processes for Tank Cars and Other Vehicles and Containers CARGO TANK (TANK INTERMODAL TANK COMMERCIAL TANK CAR TRUCK) CONTAINER TANK VESSEL AIRCRAFT Principal regulatory responsibility Review and approval of design plans for regulatory compliance Inspection and certification of completed work RSPA promulgates rules; FRA assists in their formulation and enforces them AAR TCC approves plans for design and construction under DOT authorization. FRA and RSPA staff attend TCC sessions but do not participate in approvals Builder inspects and certifies completed tank car and RSPA promulgates rules; FHWA assists in their development and enforces them DOT-certified design engineer approves design plans and certifies compliance with DOT regulations. Certified engineer may be an employee of the tank truck manufacturer. DOT-certified inspection engineer reviews RSPA promulgates rules and enforces manufacturer and shipper compliance. Modal agencies assist with enforcement in their respective modes Design and construction plans are approved by a DOT-registered international approval agency Coast Guard promulgates regulations to conform to international conventions and U.S. law Plans for design and construction are approved by a private class society (ABS) authorized by the Coast Guard FAA establishes aircraft design, construction, and airworthiness standards FAA designates manufacturer representatives to review and certify design details. FAA engineers supervise the designees and approve the design certificate FAA designates manufacturer representatives to DOT-registered ABS and other class international societies inspect approval agencies vessel during and

Certification of construction and repair facilities sends AAR the certificate of construction Builder/repairer must be certified by AAR ICC and AAR Quality Assurance Committee. Qualification requirements govern work force, equipment, and shop procedures. AAR inspectors audit shops annually. Recertification is required every 6 years (3 years for quality assurance and certifies finished tank truck. Certified engineer may be an employee of the manufacturer Manufacturers and repairers must register with DOT. Registrants must be certified by ASME, which reviews qualification of employees, procedures, and facilities. Recertification is required every 3 years inspect and certify finished work Manufacturers and repairers in United States must register with DOT after construction and grant class certificate No single set of shop requirements or certifications. Class societies have established their own qualification requirements review and certify work during and after construction. FAA engineers supervise the designees and approve production certificate FAA inspectors periodically visit production facilities and sometimes remain on site during production to verify compliance with quality control program

110 ENSURING RAILROAD TANK CAR SAFETY active in this regard, most notably in sustaining data programs in support of research to improve tank car crashworthiness. FRA and industry some- times collaborate in conducting individual tank car research and test projects. Regulatory compliance is enhanced by both government and industry programs, including FRA inspections and many functions of the TCC. A principal means by which DOT aims to enhance regulatory compliance is through FRA's inspection and enforcement programs. FRA employs 45 hazardous materials specialists, who conduct about 4,000 inspection per year at railroad, shipper, and tank car fabrication and repair facilities. MOst of the inspection resources are devoted to examining railroad and shipper operations, whereas few inspections are conducted at tank car manufacturing and repair facilities. In the latter case, the TCC has an important role in enhancing compliance through its various review and approval procedures. By reviewing construction drawings, component designs, and methods of repair, conversion, and alteration, the TCC in- creases the chances that fabrication and repair work will be performed in accordance with regulatory requirements and safe practices. Tank car builders and repairers ultimately inspect and certify their completed work, although TCC shop certification requirements, periodic audits by BOE, and new AAR certification requirements for quality control are aimed at reducing the potential for errors. The TCC provides various other services important to tank car safety besides its approval functions. Among the other essential functions of the TCC are its regular revision of the AAR tank car specifications manual (which serves as a reference for complying designs, methods, and prac- tices), certification of tank car fabrication and repair shops, and reviews of new technologies, accident records, and research projects. These activities, coupled with the TCC's approval functions, cannot be administered solely by the volunteer committee members and AAR staff, and therefore active service by other industry representatives on TCC work groups and task forces is essential. A significant benefit of the TCC is that it provides a regular forum for representatives of industry and government to discuss and consider solutions to tank car engineering and operational problems. Whereas FRA and RSPA officials have not been formally appointed as committee members or liaisons, they have routinely participated in TCC meetings and activities during recent years. Approval and certification of designs by industry and nongovernmen- tal bodies is common for other transport vehicles and hazardous materials containers. The central role of industry in approving and certifying tank cars is comparable with industry's role in approving and certifying other transport vehicles and containers. Federal agencies that regulate tank trucks, tanker ships, aircraft, and intermodal tank containers all rely on

Government and Industry Activities To Ensure Tank Car Safety 111 the assistance of private-sector and nongovernmental bodies to review construction drawings, certify completed work, and qualify construction and repair shops. Most regulatory agencies cannot maintain the technical staff and resources necessary to perform these functions. By enlisting outside assistance, regulatory agencies are able to draw on the technical expertise and resources of industry while ensuring objectivity through varying levels of government oversight and control. The degree of oversight and involvement of RSPA and FRA in the tank car design and approval process compares favorably with that of federal agencies regulating other containers and vehicles and in some cases is superior. For instance, in regulating intermodal tank containers, which carry many of the same products as tank cars, RSPA, FRA, and the other modal agencies do not have comparable access to an industry technical committee that provides regular opportunities to keep abreast of current design, maintenance, and operational issues. NOTES The Coast Guard is responsible for hazardous materials regulations pertaining to ship and barge transportation. RSPA enforcement programs are geared primarily toward ensuring compli- ance with requirements for nonbulk packaging (e.g., drums, cylinders, and boxes), which is used in several modes. The modal agencies provide enforce- ment and technical support for nonbulk shipments within their transport modes, as well as bulk shipments and packaging (e.g., cargo tanks and tank cars), which tend to be mode specific. If FRA and RSPA staff discuss matters related to rulemaking with outside parties, the nature of the discussion and the parties involved must be docu- mented in the rulemaking docket and efforts must be made to seek other viewpoints on the subject matter. The most recent orders directly affecting tank cars were Emergency Orders 16 and 17. Emergency Order 16, issued in 1991, required the inspection of 2,300 dual-diameter tank cars to determine the presence of cracks in the tank welds. Emergency Order 17, issued in 1992, requires the examination of stub-sill assembly and attachment welds on more than 150,000 tank cars during a 7-year period. S. Most of these violations involved tank cars (RSPA 1988-1993). In 1993 FRA spent $1.1 million on tank car and hazardous materials research from a total research budget of $25.2 million (personal communication, FRA Office of Research and Development). In a number of statutes Congress has designated EPA as the primary agency responsible for the regulation of hazardous substances. The statutes include the Federal Water Pollution Control Act, the Clean Water Act, the Clean Air Act, the Toxic Substances Control Act, and the Comprehensive Environmental Response, Compensation and Liability Act of 1980 (CERCLA), as amended

112 ENSURING RAILROAD TANK CAR SAFETY by the Superfund Amendments and Reauthorization Act of 1986. CERCLA requires that the materials listed as hazardous because of these statutes be regulated as hazardous materials under the Hazardous Materials Transporta- tion Act. Hence, when EPA designates a material as hazardous according to one of these acts, DOT must issue a rule designating the material as hazardous (see Chapter 3 for discussion of DOT's regulations of "hazardous sub- stances"). The Hazardous Materials Transportation Safety Act of 1975 (HMTA) gives DOT authority to regulate the transportation of materials that are hazardous to human safety and health. HMTA differentiates between materials that pose acute and long-term health hazards. For an overview of federal agency responsibilities in the regulation of haz- ardous materials, see Report of the National Response Team Task Force on Federal Hazardous Materials (National Response Team 1992). For more information on the DOT/EPA role in regulating hazardous sub- stances, see statements and testimonies of Don R. Clay, Assistant Administra- tor, Office of Solid Waste and Emergency Response, EPA, and Alan I. Roberts, Associate Administrator for Hazardous Materials Safety, RSPA, in Hearings before the Government Activities and Transportation Subcommittee of the Committee on Government Operations, U.S. House of Representatives, July 31, 1991. See Chapters 2 and 3 for discussion of head protection systems. In the recent past a shipper representative sometimes served as chairman, although AAR rules have been changed to require a railroad member to serve as chairman. The chairman serves a 2-year term and is usually appointed on the basis of seniority with the TCC. The applicant must refer to previously approved plans when requesting a precedent approval. Reference may be made to one or more plans of tank cars with similar overall designs or specific design features that are similar to the design feature in the proposed design. Among the items in the manual are a series of technical appendices covering the requirements for the design, testing, and approval of tank valves and fittings; certification of facilities; tank car marking; tank cleaning and lining; materials specifications; appurtenances; welding; and repairs and alterations. The evaluation usually includes a tear-down inspection of a certain number of the devices. An example of an alteration is the removal of a bottom outlet valve. Certification of each shop's quality assurance program is required every 3 years, and the program is subject to annual audits. BOE was originally known as the Bureau for the Safe Transportation of Explosive and Other Dangerous Articles. As conceived, the model will be made available to shippers and railroads for use on personal computers (personal communication, AAR Research and Test Department). The United States has ratified all major international maritime conventions affecting tank vessels, although some U.S. requirements are more stringent than the international standards.

Government and Industry Activities To Ensure Tank Car Safety 113 REFERENCES ABBREVIATIONS AAR Association of American Railroads BOE Bureau of Explosives NTSB National Transportation Safety Board RSPA Research and Special Programs Administration AAR. 1992. Manual of Standards and Recommended Practices Section C—Part III: Specification for Tank Cars, Specification M-1 002. Operations and Main- tenance Department, Washington, D.C. BOE. 1992. Report on Rail Tank Car Loads of Hazardous Materials by Commod- ity by Sources of Leak for the Year 1991. Report BOE/9 1-2. Casualty Preven- tion Division, Association of American Railroads, Washington, D.C. National Response Team. 1992. Report of the National Response Team Task Force on Federal Control of Hazardous Materials. U.S. Environmental Protection Agency. NTSB. 1987. Hazardous Materials Accident Report: Hazardous Materials Release Following the Derailment of Baltimore and Ohio Railroad Train No. SLFR, Miamisburg, Ohio, July 8, 1986. Report NTSB/HZM-87/01. Washington, D.C. NTSB. 1992. Special Investigation Report: Cargo Tank Rollover Protection. Re- port NTSB/SIR-92/01. Washington, D.C. RSPA. 1988-1993. Penalty Actions Taken by the Department of Transportation for Violations of the Hazardous Materials Regulations. Annual Report of the Association Administrator for Hazardous Materials Safety. U.S. Department of Transportation.

CHAPTER S Summary of Findings, Key Issues, and Recommendations THE KEY ELEMENTS OF THE PROCESS FOR ENSURING TANK car design safety are summarized in this chapter. This is followed by a general assessment of the safety record of tank cars and the effectiveness of the process for ensuring safety. Particular aspects of the process warranting improvement are then discussed and measures to address them are recom- mended. The discussion draws on findings from the previous chapters as well as findings and recommendations from reports of the U.S. Depart- ment of Transportation (DOT), National Transportation Safety Board (NTSB), General Accounting Office (GAO), and others. SUMMARY OF PROCESS FOR ENSURING TANK CAR DESIGN SAFETY Various government and industry regulations, practices, and research and enforcement programs affecting the design and safety of railroad tank cars were described in the previous chapters. Collectively, these activities com- prise the "process" for ensuring tank car design safety. Critical elements of this process are outlined in Figure S-i and summarized in this section. Setting Design Standards DOT sets minimum requirements for the design of tank cars that can be used in hazardous materials service. The regulations list design criteria for 114

DOT ROLE AAR/TCC ROLE Design Standards DOT sets TCC assists in minimum design setting technical requirements for criteria and design safety I I I details ____________ Compliance with _________ Design Standards T TCC approves design DOT officials plans and repair and participate in TCC construction methods. activities, providing Standards manual, oversight of TCC servce trials, and other approvals 14 IF activities enhance ---pect--- a-nd corçliance certification of completed It • work by builder FRA periodically alifies shops inspects shops, Fands guidelines railroads, and op quality shippers l programs Authorization and use of design types to carry hazardous materials TCC and shippers DOT assigns determine lining materials to matenalsbvalves, and design types ------- other special features I Shipper ensures use of i of tank car used ,I authorized design I --------_J FIGURE 5-1 Summary of major elements in process for ensuring tank car design safety.

116 ENSURING RAILROAD TANK CAR SAFETY more than three dozen tank car types. Except for some specialized tank cars, most designs are one of two general types: pressure or nonpressure. Design variations within each group are necessary to accommodate differ- ences in the physical, chemical, and hazard characteristics of the numerous materials shipped by tank car. For instance, thicker tank walls are neces- sary to contain materials shipped under pressure, tank linings are required for corrosive and reactive materials, and specialized safety features, such as ihermal protection, are required for materials posing special hazard concerns. In general, industry and its standard-setting bodies have sufficient expertise and incentives to make appropriate determinations about design. DOT sets minimum requirements for many aspects of tank car design, but industry has a prominent supporting role, especially in establishing de- tailed design criteria. Most DOT design requirements are based on stan- dards and principles originally developed by industry. Where DOT design requirements are defined broadly, such as rules requiring valves and other fittings to be constructed of materials "compatible with the lading," industry sets the detailed specifications (e.g., whether to use a 1-in, or 2-in. valve) that aid tank car builders and repairers in complying. The Tank Car Committee (TCC) of the Association of American Railroads (AAR) has the most critical role in this regard, establishing detailed design criteria, eva!- uating components, and approving the construction plans for new tank cars to verify their compliance with DOT minimum requirements. Industry's role, and that of the TCC, is more limited in cases where major tank car safety features are concerned. Whereas industry research has been instrumental in the development of many important design safety features, and DOT has often sought advice from the TCC on the technical feasibility of specific safety features, DOT regulations are usually highly specific in prescribing the design, use, and qualification of the major safety features. Ensuring Compliance with Safety Standards and Good Practices Like other regulatory agencies responsible for the safety of transport vehicles and containers, the Federal Railroad Administration (FRA) and the Research and Special Programs Administration (RSPA) rely to a signifi- cant degree on industry to ensure general compliance with minimum design standards and good practices. The TCC has a central role in this regard. The TCC reviews the construction drawings of tank car builders and verifies their consistency

Summary of Findings, Key Issues, and Recommendations 117 with DOT requirements. TCC approval of construction plans, required by DOT, functions as a peer review, reducing the potential for error through expert appraisal. Various other functions of the TCC also enhance compli- ance with requirements and good practices. The TCC regularly updates a tank car specifications manual that converts DOT and AAR requirements into a comprehensive reference source for tank car builders and repairers. It conducts service trials of new tank car components and reviews pro- posed methods of construction and repair, providing greater assurance that completed tank cars will meet specification requirements. Tank car builders and repairers are ultimately responsible for ensur- ing that completed tank cars meet all applicable requirements. After in- specting and pressure testing the finished tank car according to DOT procedures, the builder certifies compliance by submitting a signed con- struction certificate to AAR. The TCC has taken additional steps to ensure quality construction and repair work. Under DOT authority, it has estab- lished minimum qualification requirements for tank car fabrication and repair shops and has set guidelines for the development of shop quality control programs. DOT ensures compliance with design safety regulations through FRA's railroad inspection program and staff participation in and oversight of TCC activities. FRA has 45 hazardous materials field specialists who inspect railroad, shipper, and tank car supplier facilities. They conduct about 4,000 inspections per year, including about 200 at the more than 100 tank car fabrication and repair shops. RSPA and FRA officials regu- larly attend TCC meetings. Because of the many important functions of the TCC, active participation by DOT staff in committee activities is perhaps the most effective means by which DOT monitors and ensures industry compliance with the regulatory requirements. Assigning Hazardous Materials to Appropriate Tank Car Designs DOT regulations list hundreds of materials as hazardous, subject to re- strictions in packaging, labeling, handling, and operations. Materials are grouped into hazard classes for regulation according to their acute safety hazards (e.g., flammable, poison) and physical state in transport (e.g., compressed gas, liquid). In the case of hazardous liquids, DOT has estab- lished certain quantifiable criteria (e.g., measures of corrosivity, flamma- bility) for determining which materials in hazard classes are the most dangerous and require the strongest packaging. DOT permits most haz- ardous liquids to be transported in any DOT-class tank car, provided it has

118 ENSURING RAILROAD TANK CAR SAFETY the necessary lining, construction materials, and other design features that ensure lading compatibility. The most significant exception is that some poison liquids with high vapor toxicity (deemed poison by inhalation) must be shipped in the stronger pressure design tank cars. In this case, the thicker tank walls of the pressure cars are considered a puncture resistance feature rather than a means of retaining high internal pressure. Hazardous gases are assigned to pressure cars by DOT on an individual basis. To aid in this determination, the regulations provide specific criteria for assessing hazard characteristics such as volatility and toxicity. In general, flammable gases are assigned to pressure designs equipped with head and thermal protection, whereas many poison gases are assigned to head-protected cars. Most other gases are subject to fewer restrictions on the types of pressure cars that can be used. For the most part, they are restricted to designs that can accommodate their pressure requirements (i.e., that have sufficient test pressure ratings) and that are constructed of compatible materials. In regulating hazardous materials and assigning them to tank cars and other packaging, DOT has focused on acute safety hazards such as flam- mability and corrosivity. Congress, however, has increasingly required DOT to regulate materials that do not necessarily pose acute safety haz- ards. The U.S. Environmental Protection Agency (EPA) has designated certain materials as "hazardous substances" that DOT is required by law to regulate in transportation. Many of these materials do not meet DOT criteria for acute hazards but pose environmental hazards that have not been a traditional concern of DOT. Whereas DOT has established certain restrictions on the shipment of hazardous substances, including require- ments for labeling and emergency information in shipping papers, the use of specific tank car design types is not prescribed (unless the substance coincidentally poses one of the acute hazards defined by DOT). DOT has recently indicated that more information on the environmental and non- acute hazards of materials in the transport environment is needed and that strengthened packaging for some of these materials may ultimately be required. TANK CAR DESIGN AND SAFETY TRENDS Improvements in tank car design, operations, and general railroad safety during the past 20 years have led to a marked decline in fatal tank car incidents. Only one person has died as a result of a hazardous materials release from a tank car since 1980. By comparison, more than 40 fatalities occurred during the 1970s. Many were caused by fires and explosions of

Summary of Findings, Key Issues, and Recommendations 119 tank cars damaged in train derailments, collisions in switching yards, and other accidents. Most tank car releases consist of small spills and leaks occurring under nonaccident circumstances. Of the approximately 1,000 reported releases of hazardous materials from tank cars each year, between 90 and 95 percent are caused by failures of valves and other fittings, defective tank linings, and other deficiencies not associated with derailments, collision, or other accident events. These releases are usually small and have few reported consequences. Of the remaining 10 percent of incidents that are accident-related, most are caused by damage to valves and other fittings. Punctures of tank heads and shells accounted for about one-third of accident-related releases during the 1960s and 1970s, including many of the fatal incidents. Such incidents have declined dramatically since the 1970s, and now account for a much smaller share of tank car releases. Accident records indicate that head punctures declined by more than 90 percent in pressure cars equipped with head protection starting in the late the 1970s. The precise effect of head protection in reducing punctures, however, is not known because double-shelf couplers, thermal protection, and an improved railroad operating environment have contributed to the safety improvements. During the past iS years, puncture incidents de- clined dramatically among tank cars not equipped with head protection, indicating the importance of these other factors. Though less frequent than in the past, tank car incidents still occur with serious consequences, including injuries, community evacuations, and ex- tensive emergency response activities. In some cases, these incidents have involved materials having hazards not traditionally regulated by DOT but that have generated considerable public concern about potential effects on the environment and public health. Concerns over these incidents reflect changes in public perceptions of risk and, to a certain degree, changes in the types of materials shipped by tank car. These concerns have caused DOT and industry to broaden tank car safety considerations. GENERAL CONCLUSIONS AND MAJOR RECOMMENDATIONS The safety record of tank cars carrying hazardous materials is good. Severe incidents are rare and likely to remain so in the future. The process for ensuring tank car safety is fundamentally sound, consisting of government and industry procedures and activities that are comparable with those used for containers and vehicles in other transport modes. DOT and industry have taken steps to improve the process in recent years in response to

120 ENSURING RAILROAD TANK CAR SAFETY changing safety concerns and needs. Nevertheless, further modifications of the process are warranted, as public safety concerns, the environment in which tank cars operate, and the types of materials shipped by tank car continue to change. Several modifications are recommended. They are aimed primarily at ensuring that safety decisions are well supported and guided by long-range safety goals and strategies. They call for the following: Greater government and industry cooperation in anticipating future tank car safety needs and committing to specific actions to achieve them. Both government and industry have important roles in ensuring safety, ranging from monitoring tank car safety performance and researching improvements to instituting safety standards and ensuring their implemen- tation. These roles are performed most constructively when accompanied by coordination and planning. Development of more objective and quantitative measures for assess- ing the safety performance of tank car designs and for ensuring that commodities posing the greatest risk are shipped in the safest designs. A thorough assessment of the need for using tank cars equipped with head protection and other safety features requires a strong technical under- standing of the safety performance of individual designs and the risk characteristics of the various commodities shipped in them. Greater emphasis on and acknowledgment of those functions of the TCC that are most important in ensuring compliance with tank car design standards and good design and construction practices. A better under- standing of the TCC's most critical functions is vital to ensuring effective TCC implementation and DOT oversight procedures. Measures to help meet these needs are recommended next. The commit- tee recognizes that DOT must consider the importance and implications of the measures within the broader context of its overall hazardous materials and railroad safety programs. Demands in other program areas and the secondary impacts that the measures recommended could have on haz- ardous materials safety in other transport modes were not considered in this study.1 Measures To Increase Cooperation and Planning for Safety Improvements Define Long-Term Safety Goals and Develop Plan RECOMMENDATION 1: FRA and RSPA should define tank car safety goals for the next decade or longer and develop a strategic plan prescribing

Summary of Findings, Key Issues, and Recommendations 121 actions to attain them. The plan should be developed in cooperation with industry, labor, and other interested parties to elicit their expertise and perspectives. Their commitment to specific safety goals and actions, in- cluding nongovernmental actions, should be sought. FRA and RSPA should consider the various approaches being implemented by other regu- latory agencies to enhance public dialogue and cooperation, including the use of advisory panels, public workshops, and negotiated rulemaking. DOT's approach to developing tank car regulations is frequently reac- tive and piecemeal, because rulemaking tends to be initiated in response to individual petitions for rule changes, legislative mandates, NTSB recom- mendations, or the aftermath of major incidents. There are disadvantages in not having a more strategic approach. A short-term approach can also lead to solving problems on a case-by-case basis rather than anticipating and preventing them. This can perpetuate the need for piecemeal solutions. Development of head protection rules over 20 years illustrates the shortcomings of a reactive regulatory program. Liberalization of railcar size limits during the 1950s and 1960s permitted widespread introduction of pressure tank cars designed with significantly larger tank capacities for hauling lightweight gases and other low-density commodities. The safety effect of these changes was unknown until a series of incidents involving punctured pressure cars containing flammable gas. To address the prob- lem, head protection requirements were established for most flammable gas pressure cars. Additional rules were adopted expanding head protec- tion requirements to cover other classes of hazardous materials and pres- sure cars. More recently, DOT has proposed rule changes to extend head protection to additional commodities and tank cars (Federal Register 1993 a). NTSB, which criticized DOT for the way head and thermal protection rules were adopted during the 1970s (NTSB 1980; NTSB 1981), has advocated a more systematic approach for assigning hazardous commodi- ties to tank cars equipped with head protection and other safety features. It has recommended that DOT assess the risks associated with each hazardous commodity and the relative protection provided by each tank car design type.2 NTSB believes that this approach will provide a more comprehensive and objective means of revising the commodity/tank car assignments and reduce the need to revise regulations in the aftermath of incidents. A reactive regulatory program also can hamper the cooperation es- sential to providing the best combination of governmental and non- governmental measures to resolve safety problems. Industry has been instrumental in advancing tank car safety measures through railroad interchange rules, other standards and recommended practices, interin- dustry agreements, and other means. Cooperation with industry can per- mit faster implementation and greater flexibility in tailoring solutions to

122 ENSURING RAILROAD TANK CAR SAFETY circumstances. Unfortunately, the method by which regulations are devel- oped can hinder cooperation between DOT and industry. The rulemaking process tends to be rigid in procedure and not well suited to stimulating dialogue with industry and the public. Once rulemaking begins, there are limited opportunities for government and industry communication (re- stricted mainly to the notice-and-comment process) because of stringent interpretations of administrative procedures. Industry has expressed con- cern that without opportunities to consult DOT early in the process, unencumbered by the strict time and communication constraints of rulemaking, it must speculate on future regulatory directions and react to agency-generated proposals.3 According to the 1993 National Performance Review by the Vice Presi- dent, these problems are common to many regulatory agencies (Gore 1993). The DOT Performance Review, conducted concurrently with the National Performance Review, concluded that regulatory agencies often emphasize procedures to conduct rulemaking fairly but that strict interpre- tations of rules governing public contact can impede access to information necessary for timely and effective rulemaking.4 Other federal agencies have attempted to make regulatory programs more consultative with the public. The Coast Guard recently conducted an internal review of its regulatory process for tankers and other vessels to find ways to make it more responsive and timely (U.S. Coast Guard 1993). The Coast Guard surveyed procedures of other regulatory agencies and held public meetings to provide opportunities for interested parties to suggest ways to improve the agency's regulatory process. The Coast Guard is developing procedures to improve public consultation at the conceptual stage of rulemaking through the expanded use of public meetings and federal advisory committees (which include industry representation) to gather information, discuss safety issues, and develop proposed rules (personal communication, leader of Coast Guard Regulatory Process Quality Action Team). These efforts are also aimed at fulfilling the recom- mendations of the National Performance Review, which call for more public awareness and participation in rulemaking, more "anticipatory" regulatory planning by agencies, and more consensus-based rulemaking (Gore 1993). Recommendations from the National Performance Review, the DOT Performance Review, and the Coast Guard study are summarized in Appendix A. Cooperate in Long-Term Research RECOMMENDATION 2: In cooperation with industry, FRA and RSPA should develop a long-range research plan to define major research needs and programs to meet them. Consideration should be given to all areas of inquiry having significant impacts on tank car safety, from tank car design

Summary of Findings, Key Issues, and Recommendations 123 to the railroad operating environment (such as train operations, track and railcar conditions, and switching practices). Coordination with industry is critical to ensure that important research areas are not overlooked and that government and industry research activities are complementary to the extent possible. FRA conducts most government research related to tank car safety. It spends about 5 percent of its annual research budget, or $1 million, on tank car and hazardous materials research. In part because of limited resources, FRA's tank car research program tends to focus on immediate problems and is shaped by current rulemaking and enforcement needs. Although FRA research has contributed many tank car safety improve- ments during the past 30 years, the short-term emphasis of its research program is not well suited to building an understanding of fundamental safety questions or to solving persistent problems. These require a broader scope of inquiry and sustained research over a longer period. Industry has been successful in supporting long-term research. For nearly 25 years, the RPI-AAR Railroad Tank Car Safety Research and Test Project has sponsored dozens of studies and has assembled a data base containing comprehensive records of thousand of tank cars damaged in accidents. These efforts have enhanced understanding of tank car accident performance and resulted in numerous advances in tank car crashworthi- ness and design safety over the past two decades. Long-term research and supporting data programs are important to providing continued advances in tank car safety. However, long-term and comprehensive research, as exemplified by the 20-year RPI-AAR Railroad Tank Car Research and Test Project, has not been provided in many areas that may present opportunities for further safety improvement such as tank car operations (including the routing, positioning in the train, and handling of tank cars). Better coordination of government and industry research and development is essential to filling these gaps and sustaining research in critical areas. In certain cases DOT and industry are working together to research safety improvements. Examples are joint DOT and industry activities to identify suitable inspection and test methods for tank car structural condi- tion (Federal Register 1993b). The DOT Performance Review, which notes that stringent interpretations of rulemaking procedures have often hin- dered such cooperation, calls for more collaborative research of this type among regulatory agencies, industry, and public interest groups (Petrie et al. 1993). Improve Tank Car Safety Data RECOMMENDATION 3: DOT should encourage improvements in the quality and compatibility of its internal hazardous materials and railroad safety

124 ENSURING RAILROAD TANK CAR SAFETY data programs and those of industry. DOT should establish a safety data work group consisting of representatives of industry, government agencies, and other organizations that submit, maintain, and use the data. The group should be charged with finding ways to enhance accessibility, re- liability, and compatibility of government and industry data programs and identifying critical data gaps and ways to fill them. Procedures for reporting safety-related incidents and the indications of trends that such reports provide should be among the principal tools used by government and industry to evaluate and improve tank car safety. FRA and RSPA both collect data for this purpose. RSPA requires railroads to report all hazardous materials releases. FRA requires railroads to report information on train crashes, derailments, and other accidents and to identify those involving hazardous shipments. The two data bases contain information that can be complementary if integrated, ranging from the contents and design characteristics of the tank car (RSPA) to accident causes and operating circumstances (FRA). Access to this information is valuable for monitoring tank car safety performance and supporting research, but shortcomings in the two data bases limit the extent of their use. In particular, the data are not as compatible as they could be. Each agency has varying reporting criteria, definitions, and terminology, which impedes the integration into a more comprehensive and cohesive set of records. For instance, there are no common record identifiers (e.g., case numbers) in the two data bases, which makes it difficult to match data base records to obtain more com- plete information on the incident and verify the accuracy of the informa- tion reported. Many shortcomings stem from differences in the purposes for which the two data bases were originally designed. The RSPA data base is designed to cover hazardous materials transportation releases in all modes of transport (under both accident and nonaccident circumstances), whereas the FRA data base is designed to monitor general rail safety. Advances in data collection and management systems (e.g., use of personal computers and modems) since the advent of the FRA and RSPA data programs are likely to provide opportunities for improved data coordination, assimilation, and access. AAR and other industry groups also collect a wide variety of data on tank cars, ranging from repairs and inspections to traffic and incidents. Because railroads and others who submit the information work closely with industry groups that collect and use it, completeness and reliability are enhanced. This capability has enabled industry to gather detailed records that have been instrumental in developing many safety improve- ments. FRA and RSPA depend on industry data; however, the proprietary

Summary of Findings, Key Issues, and Recommendations 125 nature of the information and the difficulties of obtaining data from several sources with varying formats, definitions, and data management systems can impede access. Poor coordination of data programs has resulted in data gaps. For instance, records are available on tank cars damaged in accidents, but less information is available on tank cars involved but not damaged in acci- dents. Such information would be used to examine the effect of railroad operations on the frequency and severity of train derailments and other accidents that involve tank cars. Reliable information on consequences of tank car failures (e.g., injuries and property losses) is limited. This infor- mation is essential for examining the costs and benefits of measures to improve safety. The availability and quality of these data depend on the capabilities and diligence of railroads submitting incident reports. As a practical matter, railroads are seldom in a good position to provide complete information on incident consequences, which can range from environmental contamination to costly emergency response. GAO has reported that most railroads do not have a system in place to ensure accurate and timely reporting (GAO 1989). Most incident reports are based on initial investigations by railroad employees and are not updated to reflect data on injuries, property damage, and other information re- ceived later. An understanding of the limitations on those submitting the information is critical to the development of data programs that contain reliable information. Among the data improvements that are needed and would be made possible by improved data program coordination are the following: More consistent reporting requirements and terminology; The filling of gaps in data coverage to provide information that permits evaluation of all major factors affecting tank car safety; and Increased access to data bases through better links between the small number of parties that collect, use, and submit the data. Measures To Improve Criteria for Assigning Materials to Tank Car Designs Assess Safety Performance of Existing Tank Car Design Types RECOMMENDATION 4: To improve the basis for assigning hazardous mate- rials to tank car design types, DOT should use objective and explicit criteria to determine the safety performance of each design. Incident data,

126 ENSURING RAILROAD TANK CAR SAFETY crash tests, accident modeling, and other quantifiable measures should be used to rate the safety performance of design types. Results from these performance assessments should be used to determine whether the current regulatory assignment of hazardous materials to design types is acceptable and whether some commodities warrant reassignment to safer cars. The incremental steps that have characterized changes in tank car safety requirements have resulted in tank car design types that vary in the degree of protection they provide. Because this variation is not well understood— since few systematic assessments have been made of the relative safety performance of each of the more than 20 major tank car design types5—it is difficult to determine whether the most hazardous commodities are shipped in the safest designs. Whereas DOT routinely assesses the hazard levels of commodities—classifying them by hazard type and level—it does not similarly assess the level of safety provided by individual tank car designs. For instance, DOT does not have a technical basis for determining the additional crash protection afforded materials shipped in tank cars with thicker tank walls and insulation. In some cases, such as poison inhalation hazard (PIH) gases, DOT requires use of pressure cars with insulation, although the extra protection provided by this design feature is not known. Tank wall thickness is considered a protective feature (providing greater puncture resistance) in the case of PIH gases, which must be transported in designs with test pressures of 300-psi or greater (irrespective of material vapor pressure). Tank walls of 300-psi test pressure designs are 1/8 in. thicker than the walls of designs with lower test pressures. Flammable gases, on the other hand, are not subject to this restriction and can be transported in pressure cars with lower test pressures (commensurate with the material's vapor pres- sure) as long as they are equipped with head and thermal protection.6 In the absence of more complete information on the safety performance of individual design types, DOT must sometimes reassign commodities to safer designs (or expand requirements for safety features) following acci- dents or other safety problems that emerge. The reactive and incremental adoption of safety requirements can result in measures that are not neces- sarily the most effective means of improving safety. For instance, whereas further changes in head protection requirements may be warranted, pre- vious changes have not always been considered within the context of overall tank car safety needs, including the need to address sources of tank car release that are more common or have greater consequences than head punctures. Such systematic consideration of safety needs requires a more complete understanding by DOT of the circumstances of tank car releases and the effectiveness of various design features (individually and in combi-

Summary of Findings, Key Issues, and Recommendations 127 nation) in protecting hazardous shipments. It also requires a more precise and tenable system for rating tank car design performance. Whereas DOT routinely classifies regulated commodities using quantifiable hazard crite- ria, it does not similarly classify tank car design types according to mea- sures of safety performance. Identify and Understand All Important Hazards of Tank Car Shipments RECOMMENDATION 5: DOT should better define its scope of responsibility in ensuring the safety of tank car shipments, including those harmful to the environment and public health. As a minimum, it should forge stronger ties with EPA to obtain better information on the hazards posed by tank car shipments released in the transportation environment. This information should be used to strengthen the technical criteria used to evaluate the risks posed by tank car shipments and to assess the effectiveness of the regula- tory requirements in addressing these risks. NTSB has recommended that DOT consider each material's potential for environmental contamination and public health effects when authoriz- ing the use of tank car design types (NTSB 1991). AAR also has identified certain materials that it believes warrant improved packaging because of the potential for soil and water contamination and the high costs incurred by railroads in cleaning and remediating spills as required by EPA (Barkan et al. 1991). Prominent tank car incidents—including a 1991 release of 19,000 gal (72,200 L) of herbicide into the Sacramento River that received extensive public and congressional attention7—have spurred DOT to take further steps to regulate shipments with environmental and public health effects. In recent rulemaking, DOT has proposed new restrictions on packaging of certain materials banned from land disposal by EPA and indicated that it will take steps to determine the environmental hazards of other materials (Federal Register 1993a). These steps, however, have not been preceded by a clear definition of the department's mission in ensuring the safety of shipments with environ- mental hazards or by the development of criteria and data for evaluating the hazards. Whereas legislation requires DOT to regulate the shipment of hazardous substances identified by EPA as posing environmental and public health hazards, many of the criteria used by EPA in classifying hazardous substances are based on hazards associated with land disposal and other long-term exposure situations that may not reflect release cir- cumstances in the transport environment.

128 ENSURING RAILROAD TANK CAR SAFETY The degree of coordination between EPA and DOT, as well as other federal agencies charged with aspects of hazardous materials control, was recently evaluated by an interagency task force. The task force reported wide variations in criteria used to regulate hazardous materials and poor links between agencies for coordinating technical, research, and data activities (National Response Team 1992). The study committee believes that coordination between DOT and EPA is essential to providing the information needed to properly address environmental concerns, and that as a critical step in doing so DOT needs to clearly define its scope of responsibility in this area. Need for Head Protection Until the safety performance of tank car designs is assessed in a more quantifiable manner and the full range of risks associated with tank car shipments is better understood, it is not possible to determine the exact portion of the tank car fleet that should be equipped with head protection. The committee believes that head protection and other proven safety features are essential for tank cars carrying those materials with the greatest potential to harm humans and the environment if released. Nev- ertheless, the vast expansion of head protection requirements to cover all tank cars in hazardous materials service is not warranted by the informa- tion presently available. The small share of tank car releases caused by damage to tank car heads and the wide variation in the type of hazards posed by tank car shipments indicate that universal head protection re- quirements would be excessive. Better data and more thorough analyses of the overall protection provided by existing tank car design types and the risk characteristics of materials shipped by tank car, as recommended above, will provide the basis for ensuring that those materials posing the greatest danger are shipped in the safest tank cars, including those with head protection as necessary. Measures To Ensure Effective TCC Safety Role and DOT Oversight The many functions of the TCC constitute an important national service essential to improving tank car safety and unlikely to be provided through other means. Nevertheless, after attending TCC meetings, reviewing NTSB and DOT evaluations of TCC procedures, and discussing issues with industry and government representatives, the study committee con- cluded that certain aspects of TCC procedures and DOT oversight warrant adjustment.

Summary of Findings, Key Issues, and Recommendations 129 Clearly and Thoroughly Describe TCC Approval Authorities RECOMMENDATION 6: DOT should define the TCC's mission and scope of responsibility with respect to the approval authorities, preferably in a DOT policy statement or in a single place in the hazardous materials regulations. The rationale for the authorities, the significance of each, and the nature of DOT's oversight role should be explained. There are more than 200 references to the TCC in the DOT regulations. These references, in addition to several DOT and AAR memoranda of understanding and legal clarifications, provide the basis for the approval authorities. A first step in improving the effectiveness of TCC procedures and DOT oversight is the development of a thorough and clear description of the authorities, explaining the rationale behind them, their importance, and DOT's oversight role. This description should be viewed not as a constraint on TCC's activities and actions but as a means of revealing the most efficient and effective procedures for carrying out design approval and ensuring effective DOT oversight and participation. Effectively Implement Critical TCC Functions RECOMMENDATION 7: DOT should work with AAR to explore options to relieve the TCC of duties that may adversely affect its ability to carry out activities most critical to tank car safety. Third-party assistance—under the auspices and oversight of the TCC—and the application of new tech- nologies should be explored to free the TCC of routine responsibilities, including aspects of design plan approval, that consume much of the service time available to committee members and hamper the ability of the TCC to attract members with a range of product chemistry, engineering, and safety expertise. Differences in safety effects of the various approval authorities are not always reflected in the time and resources allocated to each. For instance, TCC members devote a large portion of their time to routine reviews of tank car design plans. According to AAR staff, this often requires 4 hr or more each week per committee member, which limits the time available for other important committee activities, such as updating the tank car design manual, investigating incidents to identify potential engineering improve- ments, and exploring new materials and technologies that may provide future safety benefits.8 The resources and time required for TCC activities hamper the ability of the TCC to attract membership and can reduce the TCC's efficiency. Tasks

130 ENSURING RAILROAD TANK CAR SAFETY of subcommittees and work groups often take several years to complete. Design plan approvals can be delayed by several weeks, which is costly to tank car suppliers and shippers. Because of a shortage of industry represen- tatives able to commit the necessary time, AAR has recently encountered difficulties filling TCC membership vacancies in certain shipper-related industries that can contribute important expertise and perspectives on tank car use and operations (personal communication with AAR staff). Because the number of regulated products shipped by tank car has grown, diverse product expertise on the TCC is essential. Define DOT Oversight Responsibilities and Procedures RECOMMENDATION 8: DOT should seek permanent liaison with the TCC to provide continued oversight and participation by FRA and RSPA officials. Liaison status should be created through formal organizational agree- ments among AAR, FRA, and RSPA. The agencies should designate staff to serve as liaison representatives and prescribe their technical qualifica- tions and the procedures they must follow in monitoring TCC activities pertaining to the approval authorities. DOT should establish procedures to ensure that TCC actions implementing the authorities of greatest impor- tance to safety are regularly monitored by FRA and RSPA officials and reviewed by outside technical experts as necessary. Informal arrangements that now provide FRA and RSPA (as well as Transport Canada and NTSB) free access to TCC activities appear to work well. The formalization of these arrangements is likely to improve the permanence of this relationship, which has not been as open and effective in the past. DOT relies on the judgment of DOT staff who attend TCC meetings to determine approval authorities that are most critical to safety and to ensure that they are monitored and reviewed. Better-defined pro- cedures for monitoring critical TCC activities will enable DOT to question or request changes in TCC actions in a more timely manner as necessary. According to a 1990 DOT audit of the TCC, federal oversight seriously deteriorated during the 1970s and 1980s as DOT "lost sight of the nature of the delegation" (FRA and RSPA 1990). Given the importance of DOT participation in TCC activities, concerted efforts should be made to guar- antee continued access and cooperation. OTHER RECOMMENDATIONS AND ISSUES A comprehensive inquiry into all tank car safety issues was beyond the scope of the study. The following recommendations address specific issues

Summary of Findings, Ke.y Issues, and Recommendations 131 that were sufficiently well defined for consideration and that the committee believes merit further action. Ensure Broad Compliance with Construction, Maintenance, and Repair Standards RECOMMENDATION 9: To ensure the most effective use of its limited en- forcement capabilities, FRA should identify tank car regulatory areas that have high potential for noncompliance and significance to safety. FRA should determine whether current enforcement efforts adequately address these areas, especially those affecting the quality of tank car construction, maintenance, and repair work, which currently account for a small portion of enforcement activity. Under current practice, all plans for new tank car construction, alter- ation, and major repair must be approved by the TCC to ensure that they meet applicable DOT design requirements. Final inspection and certifica- tion of completed work are primarily the responsibilities of tank car builders and repairers. NTSB has questioned whether builders and repairers are always able to provide a fair assessment of their work, especially when misunderstanding or misinterpretation of requirements prevents recognition of an error during self-inspection. NTSB recommended that DOT establish quality control requirements for tank car construction and repair shops (NTSB 1985; NTSB 1987). In its 1990 audit of the TCC, DOT identified irregu- larities in shop record keeping that supported reevaluation of the self- inspection and certification processes (FRA and RSPA 1990). In response to these concerns, DOT proposed new rules requiring quality assurance programs at facilities that build and repair tank cars (Federal Register 1993b). AAR has set guidelines for quality assurance pro- grams verifying the use of correct design drawings, construction methods, record keeping systems, and qualified personnel and equipment.9 The study committee believes that quality assurance programs should be mandated for tank car builders and repairers and that FRA's enforce- ment activities should be complementary to these efforts. Only S percent of FRA hazardous materials inspections are devoted to tank car construction and repair facilities. Given the potential for varying quality of work among the more than 100 shops engaged in tank car repair and construction, FRA must ensure that enforcement efforts are designed to monitor the effective- ness of quality assurance programs.

132 ENSURING RAILROAD TANK CAR SAFETY Develop a Comprehensive Approach To Providing Grandfather Exclusions RECOMMENDATION 10: FRA and RSPA should develop formal policies and guidelines governing decisions to exclude—for economic or technical rea- sons—existing tank cars from compliance with requirements for major new safety features and modifications. Consideration should be given to providing limits on the time period of the exclusion, restrictions on the use of excluded tank cars in hazardous materials service, and other options aimed at ensuring that the intended safety benefits of the new requirement are achieved at the least cost. DOT sometimes indefinitely relieves tank cars from new or revised safety requirements by allowing them to remain in service without mod- ification. The purpose of these exclusions, known as "grandfather provi- sions," is to encourage the continued development of safety improvements by industry and to lessen the economic impact on shippers and tank car suppliers, who must make long-term decisions without knowledge of future regulatory changes. Exclusions may also be granted when it is prohibitively costly or technically infeasible to modify the tank car with the new safety feature. These exclusions are generally not accompanied by restrictions on the subsequent use of the grandfathered tank car (for instance, by limiting the types of commodities carried or the routes traveled). Some grandfather provisions affect few tank cars. Nevertheless, the concept of grandfather provisions has come under scrutiny. NTSB has expressed concern that the net safety effects of grandfather provisions are seldom assessed on the basis of explicit safety criteria. It has recommended that DOT "stop permitting tank cars that fail to meet current minimum safety requirements to be used to transport dangerous materials under grandfather clauses" and "establish a specific date by which all tank cars would have to comply with the new requirements" (correspondence from NTSB Chairman James Kolstadt to RSPA Docket Branch, Aug. 21, 1990, in response to RSPA Docket HM-175A). In rulemaking proposals that would expand the use of head protection, thermal protection, and certain other tank car safety features, DOT has proposed the use of delayed (5- to 10-year) compliance periods for existing tank cars. 'Whether the use of delayed compliance periods represents a general change in policy that will apply to the implementation of future changes in safety requirements is not clear, because the economic, techni- cal, and safety considerations of future rule changes will likely differ. Nevertheless, the framework for evaluating the best means of implement- ing new requirements should be consistent and comprehensive, ensuring

Summary of Findings, Key Issues, and Recommendations 133 that thorough and explicit consideration is given to all plausible implemen- tation alternatives (e.g., delayed compliance periods and handling or rout- ing restrictions) and their relative cost and safety effects. inspection and Testing of In-Service Tank Cars RECOMMENDATION 11: FRA and RSPA should ensure prompt establish- ment of requirements to verify the structural integrity of in-service tank cars by continuing to work with industry to establish new test and inspec- tion methods, including nondestructive test methods to supplement or replace existing hydrostatic test requirements. Once the new inspections and tests are implemented, the results should be routinely collected for use in monitoring tank car condition, refining test and inspection methods, and enhancing tank car design, maintenance, and repair standards. There are no requirements that tank cars in service be tested regularly for structural integrity. The only federal testing requirement is a periodic hydrostatic (water pressure) test, which does not detect many structural deficiencies. This requirement was originally instituted to detect leaks in riveted steel tanks, which are no longer in use. The condition of tank cars in service has become an issue during the past 10 years, after several failures of tank cars caused by cracks that had not been detected by inspection and testing.'° Concerns about tank car struc- tural deficiencies have led to a massive program to inspect more than three- quarters of the tank fleet, as well as occasional smaller programs to inspect certain tank car designs.11 NTSB recommended development of new schedules and techniques for testing the structural condition of in-service tank cars (NTSB 1992). In response, DOT proposed that nondestructive testing techniques replace current periodic hydrostatic pressure tests (Federal Register 1993b). FRA and RSPA are working with industry to evaluate techniques for this purpose. The study committee believes that the results of these tests will provide an opportunity to identify problem areas (which may be correctable at the design stage) and to determine the efficacy of repair and maintenance practices. Efforts should be made well in advance of imple- mentation to ensure that inspection and test requirements enable collection and monitoring of results by DOT and industry. Tank Containers A final observation concerns recent changes in railroad hazardous mate- rials transportation. Compared with a decade ago, a much larger portion

134 ENSURING RAILROAD TANK CAR SAFETY of hazardous materials traffic moved by rail is shipped in tank containers that are also portable by truck, barge, and ship. These intermodal con- tainers are usually loaded on railroad flatcars and contain many of the same commodities as tank cars, although in smaller quantities [6,000 gal (22 800 L) or less]. Because widespread movement of intermodal tanks by rail is new in the United States, experience in ensuring their safety in the railroad environ- ment is limited, especially compared with the more than 100 years of experience in providing tank car safety. The long history of efforts to improve tank car safety should provide guidance to government and industry on the need for preventive safety for tank containers. The design, construction, and maintenance of tank containers are sub- ject to international standards, although aspects are governed by DOT and AAR standards and regulations. In addition, DOT and AAR regulate tank container operations and handling and the design and condition of the railcars on which they are carried. The safety performance of tank con- tainers was not examined in this study. However, the committee believes that, in light of their increased use for hazardous materials and the various parties responsible for ensuring their safety, a comprehensive assessment of tank container safety issues and procedures is warranted. NOTES DOT must consider the effect of changing regulations or policies in one mode on all modes collectively, especially if the change results in traffic shifts between modes. NTSB recommendation R-89-80 (NTSB 1989): "DOT should evaluate pres- ent safety standards for tank cars transporting hazardous materials by using safety analysis methods to identify unacceptable levels of risk from the release of hazardous materials, and then modify existing regulations to achieve an acceptable level of safety for each product/tank car combination." These concerns have been raised most recently in written comments to open rulemaking to improve the crashworthiness of tank cars. Background pro- vided in the notices for the rulemaking lists more than a dozen NTSB recom- mendations, incidents, and other events that precipitated the proposals. It does not indicate how industry and the public were consulted to better understand and prioritize the safety problems addressed and the corrective measures proposed in the initiative developed by RSPA and FRA staff (Federal Register 1990; Federal Register 1993a). The notice-and-comment provisions and procedures for ex parte contact during rulemaking are governed by the Administrative Procedures Act. The DOT component of the National Performance Review notes that adherence to ex parte communication rules, which require submission of summary mem- oranda of public contacts to the rulemaking docket, can impede open dialogue

Summary of Findings, Key Issues, and Recommendations 135 between agency staff and the public during rulemaking, and sometimes before the initiation of rulemaking activity (Petrie et al. 1993). According to AAR fleet statistics, 21 tank car design specification types have more than 500 cars in service (AAR Universal Machine Language Equipment Register, June 1993). As an example, LPG with 150-psi vapor pressure can be transported in a 200-psi test pressure tank car equipped with head and thermal protection. These cars (e.g., a DOT-I 12J200 pressure car) must have tank walls that are at least /16 in. thick. By comparison, higher test pressure designs (such as the DOT-112J340), which are required for LPG with vapor pressure exceeding 150 psi, must have tank walls that are at least /16 in. thick. The difference in thickness, required to ensure pressure containment, is likely to affect puncture resistance. On July 14, 1991, cars in a Southern Pacific train derailed above the Sacra- mento River. A DOT-ill tank car fell into the rocky river bed, spilling 19,000 gal of metam sodium, a herbicide not listed as a hazardous material subject to DOT requirements. In testimony before Congress, California officials re- ported substantial ecological contamination and economic costs resulting from the spill (Hearing Before the Government and Transportation Subcom- mittee of the Committee of Government Operations, U.S. House of Represen- tatives, July 31, 1991). As an example of the time commitment, a railroad member of the TCC reported spending 3 to 4 hr per application for new construction, of which there are 150 to 200 per year. Most reviews are done in the evenings and on weekends. AAR Specifications for Quality Assurance, M-1 003. Currently, all tank car facilities that perform welding on the tank must have an AAR approved quality assurance program to be certified by AAR (personal communication with AAR staff). For example, NTSB and FRA investigations determined that a major tank car failure in Dragon, Mississippi, was the result of cracks in the tank that had not been detected by previous inspections. A follow-up inspection of other tank cars of the same design (dual-diameter 125-ton pressure tank cars) by FRA found similar cracks, even though many of the cars had recently been tested and inspected in accordance with regulatory requirements (NTSB 1992). More than 150,000 stub sill tank cars are being inspected over a 7-year period to check for cracks in stub sill underframes and welds. FRA and industry recently completed inspections of several thousand dual-diameter pressure cars. REFERENCES ABBREVIATIONS FRA Federal Railroad Administration GAO General Accounting Office NTSB National Transportation Safety Board RSPA Research and Special Programs Administration

136 ENSURING RAILROAD TANK CAR SAFETY Barkan, C., T. Glickman, and A. Harvey. 1991. Benefit-Cost Analysis of Using Type 105 Tank Cars Instead of Type 111 Tank Cars To Ship Environmentally Sensitive Chemicals. Report R-794. AAR Distribution Center, Chicago, Ill. Federal Register. 1990. Docket HM-175A, Notice 90-8. May iS, pp. 20,242-20,245. Federal Register. 1993a. Docket HM-175A, Notice 93-19. Oct. 8, pp. 52,574-52,596. Federal Register. 1993b. Docket HM-201, Notice 93-15. Sept. 16, pp. 48,485-48,502. FRA and RSPA. 1990. A Report on Tank Cars: Federal Oversight of Design, Construction, and Repair. U.S. Department of Transportation. GAO. 1989. Railroad Safety: FRA Needs To Correct Deficiencies in Reporting Injuries and Accidents. Report GAO/RCED-89-109. Washington, D.C. Gore, A. 1993. From Red Tape to Results: Creating a Government that Works Better and Costs Less. Report of the National Performance Review, Washing- ton, D.C., Sept. 7. National Response Team. 1992. Report of the National Response Team Task Force on Federal Control of Hazardous Materials. U.S. Environmental Protection Agency. NTSB. 1980. Special Investigation Report: The Accident Performance of Tank Car Safeguards. Report NTSB-HZM-80-1. Washington, D.C. NTSB. 1981. Safety Report: Status of Department of Transportation's Hazardous Materials Regulatory Program. Report NTSB-SIR-8 1-2. Washington, D.C. NTSB. 1985. Hazardous Materials Special Investigation Report: Hazardous Mate- rials Release, Missouri Pacific Railroad Company's North Little Rock, Ar- kansas Railroad Yard, December 31, 1984. Report NTSB/SIR-85103. Wash- ington, D.C. NTSB. 1987. Hazardous Materials Accident Report: Hazardous Materials Release Following the Derailment of Baltimore and Ohio Railroad Company Train No. SLFR, Miamisburg, Ohio, July 8, 1986. Report NTSBIHZM.87/01. Washington, D.C. NTSB. 1989. Collision and Derailment of Montana Rail Link Freight Train with Locomotive Units and Hazardous Materials Release, Helena, Montana, February 2, 1989. Report NTSB/RAT-89105. Washington, D.C. NTSB. 1991. Safety Study: Transport of Hazardous Materials by Rail. Report NTSB/SS-91-01. Washington, D.C. NTSB. 1992. Special Investigation Report: Inspection and Testing of Railroad Tank Cars. Report NTSB/SIR-92105. Washington, D.C. Petrie, J., P. Murray, M. Perel, and D. Daniels. 1993. DOT Performance Review: Report of the Rulemaking Team. U.S. Department of Transportation, Aug. U.S. Coast Guard. 1993. Quality Action Team Report to the Commandant on the Coast Guard Regulatory Process. U.S. Department of Transportation.

APPENDIX A Regulatory Process Improvements in Other Agencies ON SEPTEMBER 7, 1993, VICE PRESIDENT Ai. GoRE presented the findings of the National Performance Review, a 6-month study to identify measures to improve the effectiveness and efficiency of federal government services and programs. Several findings and recom- mendations of the study concerned improvements needed in regulatory systems (Gore 1993, Appendix Q. In the context of the National Perfor- mance Review, Secretary Federico Peña commissioned a U.S. Department of Transportation (DOT) Performance Review that included an assessment of agency rulemaking effectiveness (Petrie et al. 1993, 19-21). In addition, the U.S. Coast Guard initiated a review of its regulatory process that included a survey of procedures in other federal agencies (U.S. Coast Guard 1993). Some of the findings and recommendations of these studies are summarized in this appendix. NATIONAL PERFORMANCE REVIEW: SELECTED RECOMMENDATIONS FOR IMPROVING REGULATORY SYSTEMS The following recommendations are contained in the Regulatory Systems section of Appendix C of the National Performance Review report. Create an interagency regulatory coordinating group to share infor- mation and coordinate approaches to regulatory issues. Encourage agencies to use negotiated rulemaking more frequently in developing new rules. 137

138 ENSURING RAILROAD TANK CAR SAFETY Use information technology and other techniques to increase oppor- tunities for early, frequent, and interactive public participation during the rulemaking process and to increase program evaluation efforts. Streamline internal agency rulemaking procedures. Use "direct final" rulemaking for noncontroversial :ules and expedite treatment of rulemak- ing petitions. Increase the use of alternative means of dispute resolution. Rank the seriousness of environmental, health, or safety risks and develop anticipatory approaches to regulatory problems. Create science advisory boards for regulatory agencies that depend heavily on scientific information and judgments. DOT PERFORMANCE REVIEW: SELECTED RECOMMENDATIONS FROM RULEMAKING TEAM The following are some of the recommendations of the team charged with reviewing the rulemaking process as part of the DOT performance review: Before it even begins a rulemaking, DOT should carefully consider more flexible, nonregulatory ways to solve the problem. If rulemaking is appropriate, DOT should expand the use of innovative, ad hoc devices such as negotiated rulemaking. DOT should move away from "one-size-fits-all" rulemaking. Each agency should identify the categories of rules it issues (e.g., administrative rules, procedural rules, technical industry standards, routine actions, non- controversial amendments, costly rules, politically sensitive rules, and burden-relieving rules) and determine whether thresholds, layers, waivers, or self-certification, both within the agency and as a regulatory solution, would serve the same ends. The secretary should encourage collaborative research with regulated industries or public-interest groups during pre-rulemaking stages and urge each departmental agency to initiate one such project as a pilot effort. There is no statutory prohibition on such research now, but there is a perception that such cooperation is frowned upon by the legal staff. The secretary should specify criteria for developing cooperative programs and should identify mechanisms (e.g., agreements and consortia) that agencies can use to formalize the joint research. Each significant rulemaking should contain a communications plan that describes the strategy for publicizing the regulatory action and obtain- ing comments on all the issues that need to be considered before a final decision. The plan should include a brief account of the main issues that responders can help address, a list of interested parties inside and outside

Regulatory Process Improvements in Other Agencies 139 federal and state governments, a description of the communications media to use for soliciting comments from these parties (e.g., mail, Federal Register, press releases, computer bulletin boards, and public meetings), and a recommendation of the comment period required to give respon- dents time to provide input. The Office of General Counsel should compare its guidelines on ex parte contact with those of other government agencies to determine whether a more relaxed approach is feasible and revise the guidelines as appropriate. DOT should improve public participation through public-safety in- quiries with regulated parties, environmental groups, and the public to discuss current issues and potential problems and gather preliminary information. Greater use should be made of advisory committees that may generate industry-drafted and industry-supported proposals. (This is an opportunity for resource-constrained agencies to take advantage of cur- rent or planned industry research. Economic information could be solic- ited from the industry and public at this point so that the agency better appreciates potential costs before it commits itself to the proposal.) Rulemaking matrices should be routinely developed to determine which rulemakings would provide the biggest "bang for the buck." Eco- nomic evaluations discussing alternatives in some detail prepared at this point highlight the actual options available to an agency. Realistic dead- lines for rulemaking, with adverse consequences for failure to meet them, are essential to take advantage of the enthusiasm that infects the beginning of a project. If rulemaking is an appropriate response to a problem, timeliness is critical. DOT should coordinate better with other federal agencies, especially with other agencies that regulate the particular industry, and with state and local governments. A departmentwide regulatory information system should be estab- lished to ensure timely rulemaking and enforce deadlines. Public access to limited parts of the system could be used to advertise status and could free rule writers and reviewers to read and respond to comments. Existing rules should be periodically reviewed to determine effective- ness. COAST GUARD REVIEW OF THE REGULATORY PROCESS In August 1993 the Coast Guard chief of staff commissioned a team to review the Coast Guard's regulatory process and recommend areas for

140 ENSURING RAILROAD TANK CAR SAFETY improvement. There was concern that the process was neither timely nor responsive to the public. The team took a number of actions to review the process, including a public meeting (announced in the Federal Register 1993) and a survey of other federal agencies, to identify potential measures to improve Coast Guard rulemaking. The report of the team was issued in October 1993. The survey indicated that other agencies have adopted alternative pro- cedures for development of regulations. The following are examples: The Nuclear Regulatory Commission uses "participatory" pro- cedures for some rulemaking activities by holding public workshops throughout the country. The workshops are designed to maximize public discussion and input before rulemaking begins. The Federal Aviation Administration (FAA) uses an advisory commit- tee to recommend certain regulatory changes. In these instances FAA identifies the problems that need to be resolved. The advisory committee, established according to the Federal Advisory Committee Act, negotiates the regulatory changes. The committee sometimes produces a complete rulemaking package and presents it to FAA for consideration. The team's review of the Coast Guard's regulatory process indicated that public perceptions of lack of responsiveness and timeliness were justified. To address these problems, the team recommended several mea- sures, including the following: Careful consideration should be given to the desired goal and options (including nonregulatory alternatives) before commencing a rulemaking. Public meetings and notices should be used to solicit comments before drafting a rulemaking work plan. Existing Coast Guard advisory committees (consisting of private- sector members) should be routinely asked to provide information and assistance in early rulemaking stages. Work plans that identify the applicability of the proposed rule, alter- natives considered, and a tentative approach should be developed for all rules. Measures of efficiency in developing rules, including time required, should be maintained and used to evaluate the process. The recommendations in the Coast Guard report have been transmitted to the Coast Guard commandant. Policies and procedures are currently being altered to implement all of the recommendations (personal commu- nication, leader of Coast Guard Quality Action Team).

Regulatory Process Improvements in Other Agencies 141 REFERENCES Federal Register. 1993. Notice of public meeting. CGD-052. Aug. 24, p. 44,731. Gore, A. 1993. From Red Tape to Results: Creating a Government that Works Better and Costs Less. Report of the National Performance Review, Washing- ton, D.C., Sept. 7. Petrie, J., P. Murray, M. Perel, and D. Daniels. 1993. DOT Performance Review: Report of the Rulemaking Team. U.S. Department of Transportation. Aug. U.S. Coast Guard. 1993. Quality Action Team Report to the Commandant on the Coast Guard Regulatory Process. U.S. Department of Transportation.

APPENDIX B Glossary This appendix explains several key terms used in the report. TANK CAR DESIGN TERMS Attachments: Handrails, ladders, body bolsters, and other components connected to pads welded to the tank exterior. Double-shelf couplers: Coupling devices equipped with top and bottom shelves to restrict vertical movement of the tank car during switching and to prevent decoupling of the car in the event of a derailment. All tank cars in hazardous materials service are equipped with these devices, which were introduced during the 1970s. Fittings: Openings in the tank are closed by fittings, including valves, vents, and other devices used for tank loading, unloading, pressure relief, maintenance, and cargo monitoring. Fittings on nonpressure cars may be located on top or bottom of the tank. Fittings on pressure cars are always located on top of the tank under a protective housing. Head protection: Steel plates mounted in front of both ends (heads) of the tank, often built into the tank outer jacket. The devices, which are provided on about half the pressure cars in service, help protect against head punctures during coupling, derailments, and other crashes. Tank: Most tank car tanks are cylindrical in shape, capped at both ends by ellipsoidal-shaped heads. The tank sidewalls are known as the shell. Some tank are insulated, have interior linings, exterior heating systems, and other specialized features. Steel is the most common 142

Glossary 143 construction material, although some tanks are made of aluminum and nickel alloys and stainless steel. Tank capacities range from less than 10,000 gal to 34,500 gal. Tank jacketing: Thin steel exterior cover over the tank that is used to protect and hold insulation in place. Thermal protection: Special insulation or exterior coatings that retard heat transfer into the tank when exposed to fire. They prevent rapid overheating and rupturing of the tank, giving time to emergency responders to isolate the area and take measures to cool the tank and extinguish the fire. Cars containing flammable gases cars are equipped with this protection. GOVERNMENTAL AND REGULATORY TERMS Approval authorities: Authorities vested in the Association of American Railroads or its Tank Car Committee by the U.S. Department of Transportation (DOT) through regulatory reference. They consist primarily of responsibilities to ensure industry compliance with DOT requirements through review and approval of construction plans, major repair and alteration methods, and tank construction and repair facilities. Certificate of construction: Certificate signed by tank car builder follow- ing inspection of newly constructed tank car, verifying compliance with DOT and AAR requirements. The certificate, which is provided to AAR and the tank car owner, must be revised when the tank car is altered or converted to a different design specification. Environmental Protection Agency (EPA): Federal agency charged with regulating materials that are harmful to the environment and human health. EPA designates those materials regulated by DOT as "haz- ardous substances" in transportation. EPA's designation criteria for these substances differ from the criteria used by DOT in regulating "hazardous materials." Federal Railroad Administration (FRA): DOT agency charged with en- suring railroad safety. Through its Office of Safety, Hazardous Mate- rials Division, FRA assists DOT's Research and Special Programs Administration (RSPA) in the formulation of rules governing tank car design, maintenance, and operations, and takes the lead in providing enforcement, research, and technical support for the regulatory program. Grandfather provisions: As used in this report, the term refers to provi- sions in regulations that exclude tank cars built before a specified date from major new safety requirements. A purpose of these exclusions is

144 ENSURING RAILROAD TANK CAR SAFETY to encourage continued development by industry of new safety im- provements and to avoid imposing severe economic burdens on tank car owners and operators by requiring modification or replacement of existing tank cars not equipped with the new safety feature. Hazard classes and divisions: DOT system for classifying materials ac- cording to physical and hazard characteristics. There are more than a dozen hazard classes and divisions, ranging from explosives and radioactives to flammable gases, poison gases, and miscellaneous. Materials are assigned to hazard classes and divisions according to measures of corrosivity, flammability, toxicity, and other acute haz- ard characteristics. Hazardous materials: Materials designated by DOT as hazardous in transportation because they pose an element of risk to health, safety, and property when transported in commerce. Materials are cate- gorized into hazard classes and divisions and subject to regulations governing their packaging, labeling, and handling in transportation. Hazardous Materials Transportation Act (HMTA): The 1975 act that first defined comprehensively the role of DOT in regulating the safety of hazardous materials in transportation. HMTA authorized DOT to regulate materials that pose "an unreasonable risk to health and safety or property when transported in commerce." Hazardous Materials Transportation Uniform Safety Act (HMTUSA): The 1990 federal legislation that reauthorized and amended the 1975 HMTA. Section 21 of HMTUSA calls for a study of the tank car design process (see Preface). Hazardous substances: Materials designated by EPA as hazardous ac- cording to criteria developed in accordance with statutory require- ments governing pollutants and contaminants of air, land, and water. DOT is required by law to regulate hazardous substances, although not necessarily in the same manner as hazardous materials. Haz- ardous substances shipped in amounts equal to or greater than their EPA-designated reportable quantity (RQ) values are regulated by DOT. Interstate Commerce Commission (ICC): Federal agency responsible for ensuring tank car and hazardous materials safety from the 1920s to the 1960s, when DOT acquired the responsibility. Only a few tank cars in operation today are marked with ICC design specifications. National Transportation Safety Board (NTSB): Independent federal agency responsible for investigating and determining probable causes of transportation accidents. NTSB has been active in investigating tank car failures and in recommending changes in tank car design and operations to DOT and industry since the 1960s.

Glossary 145 Placards and labels: DOT requires shippers to communicate the hazards of their shipments by affixing appropriate diamond-shaped signs (placards) and labels with identifiers and symbols of hazards on containers and packages. Reportable quantity (RQ): Threshold amount of hazardous substance that must be reported to EPA if spilled or disposed of. DOT uses the RQ value as a determinant of when a shipment of a hazardous substance is sufficiently large to warrant regulation in transport. RQ thresholds range from 5,000 lb for the least harmful substances to 1 lb for the most harmful substances according to EPA criteria. Research and Special Programs Administration (RSPA): DOT agency responsible for ensuring the safety of hazardous materials shipments. Through its Office of Hazardous Materials Safety, RSPA promulgates hazardous materials regulations covering most modes of transport. RSPA works closely with FRA in instituting regulations governing tank car design, maintenance, and operations. Rulemaking: Process by which most federal agencies produce regula- tions. The Federal Administrative Procedures Act (APA) states guide- lines for rulemaking, including requirements for publishing notices of proposed rulemaking in the Federal Register and providing oppor- tunities for public comment and petitions for rule changes. Agency interpretation and implementation of APA provisions for communica- tion between regulatory agencies and the public during rulemaking may vary. Transport Canada: National agency that sets tank car and hazardous materials regulations in Canada. Transport Canada and DOT work closely to reduce differences in Canadian and U.S. regulations. Repre- sentatives from Transport Canada attend AAR Tank Car Committee meetings. INDUSTRY TERMS Association of American Railroads (AAR): National association repre- senting major and regional railroads operating in the United States and Canada. AAR has many standing technical committees that assist in the development and implementation of railroad interchange rules. AAR Tank Car Committee (TCC): AAR standing technical committee that is composed of representatives of railroads, shippers, and tank cars suppliers. The TCC assists in the development and implementa- tion of DOT and industry standards governing tank car design, main- tenance, and operation. Among its many duties (some of which are authorized by DOT) the TCC approves tank car construction plans,

146 ENSURING RAILROAD TANK CAR SAFETY valves and other components, methods of repair and alteration, and construction and repair facilities. Interchange rules: Rules governing railcar dimensions and other design features. They are established by AAR to facilitate the free inter- change of equipment between railroads. AAR interchange rules gov- ern aspects of tank car design and include design specifications for AAR-class tank cars used primarily in unregulated (nonhazardous materials) service. Shippers: Chemical manufacturers, petroleum companies, and other shippers of bulk liquids and gases operate most railroad tank cars. More than one-third of tank cars in the United States and Canada are owned by shippers, whereas most of the remainder are leased to shippers. Representatives from several shipper trade associations serve on the AAR Tank Car Committee and its work groups. Tank car suppliers/builders: Most tank cars are owned by companies that build or lease tank cars to shippers. The five largest leasing companies own more than half of the tank cars operated in the United States and Canada. A representative of the Railway Progress Institute, the major trade association for tank car suppliers, serves on the AAR Tank Car Committee.

STUDY COMMITTEE BIOGRAPHICAL INFORMATION Herbert H. Richardson, Chairman, is Director of the Texas Transportation Institute and Associate Vice Chancellor for Engineering, Texas A&M University System. He received his bachelor's, master's, and doctoral degrees in mechanical engineering from the Massachusetts Institute of Technology (MIT). He served previously as Chancellor and Deputy Chan- cellor for Engineering of the Texas A&M University System and Dean of Engineering at Texas A&M University. Before joining Texas A&M in 1984, he was Professor Emeritus and Associate Dean of Engineering at MIT. From 1970 to 1972 he was Chief Scientist in the U.S. Department of Transportation. Dr. Richardson is a member of the National Academy of Engineering (NAE) and has served on numerous NAE and National Re- search Council (NRC) committees. He has served as Chairman of the TRB Executive Committee, Co-chairman of the TRB Committee for the Study of Geometric Design Standards for Highway Improvements, and Chair- man of the TRB Committee on MagLev. He has also served on the Council of the NAE and the NRC Governing Board. During his career he has received numerous awards and honors, including Honorable Member of the American Society of Mechanical Engineers, receiving the society's Centennial Medallion in 1980 and Rufus Oldenberg Medal in 1984. Robert G. Loewy, Vice Chairman, is Director of the School of Aerospace Engineering of the Georgia Institute of Technology. He holds a bachelor's degree from Rensselaer Polytechnic Institute (RPI), a master's degree from MIT, and a Ph.D. in engineering mechanics from the University of Pennsyl- vania. From 1978 to 1993 he was Institute Professor and from 1982 Director of the Rotorcraft Technology Center in RPI's School of Engineer- 147

148 ENSURING RAILROAD TANK CAR SAFETY ing, where he previously served as Provost and Vice President of Academic Affairs. He began his academic career at the University of Rochester, where he was Professor of Mechanical and Aerospace Sciences, Dean of the College of Engineering and Applied Sciences, and Director of the Space Science Center. He was Chief Scientist in the Department of the Air Force while on leave from the university and, concurrently with his academic positions, served on the Aviation Science Advisory Group of the U.S. Army, on the aircraft panel of the President's Science Advisory Council, and as chairman of the National Aeronautics and Space Administration's Aero- nautical Advisory Committee and the Air Force Scientific Advisory Board. Dr. Loewy is a member of the NAE and recently served on the NRC Committee on Tank Vessel Design. Edward J. Bentz, Jr., is President of E.J. Bentz and Associates. He received his bachelor's degree from RPI and his master's and Ph.D. degrees in physics from Yale University. Before forming the consulting group E.J. Bentz and Associates, which specializes in energy, environmental, and transportation projects, he served in several governmental positions. Dur- ing 1979 and 1980 he was Executive Director of the U.S. National Alcohol Fuels Commission. From 1977 to 1979 he was Director for Impact Anal- ysis for the U.S. National Transportation Policy Study Commission. From 1974 to 1977 he was Senior Policy Analyst and Project Director in the Office of Planning and Evaluation of the Environmental Protection Agency (EPA). While at EPA he was assigned to the State Department, serving as Special Assistant to the Assistant Secretary of State. He also served as staff member of the U.S. Senate Committee on Commerce and Transportation. Dr. Bentz has previously served on TRB's Committee on Transportation and Energy. Lawrence W. Bierlein is a partner in the law firm Swidler and Berlin, Chartered. He received his bachelor's degree from Johns Hopkins Univer- sity and his J.D. from the University of Pennsylvania. Before joining Swidler and Berlin, he was a partner in the law firm Shaw, Pittman, Potts, and Trowbridge. He has served in the Office of General Counsel of the U.S. Department of Transportation (DOT), assisting in the development and enforcement of rules governing the transport of hazardous materials, including packaging requirements. Mr. Bierlein is author of the Red Book on Transportation of Hazardous Materials and writes regularly on this subject for several trade publications. He served on the TRB Committee on Hazardous Materials Transportation and the NRC Steering Committee for the Conference To Develop a National Strategy for the Transportation of Hazardous Materials.

Study Committee Biographical In formation 149 George P. Binns is Senior Director of Equipment Design Engineering for the National Railroad Passenger Corporation (Amtrak). He is licensed in Kansas as a professional engineer. At Amtrak he is responsible for the development of railway passenger car specifications. From 1989 to 1992 he was Manager for Mechanical Systems for the Atchison, Topeka, and Sante Fe Railway Company, responsible for drafting freight car specifica- tions. From 1979 to 1988 he was Engineering Assistant, supervising the acquisition of new equipment and modifications of existing equipment. Mr. Binns served on the Association of American Railroads (AAR) Tank Car Committee from 1979 to 1990, serving one term as Chairman. Leigh B. Boske is Professor of Economics at the LBJ School of Public Affairs, University of Texas. He holds bachelor's and doctoral degrees in economics from the University of Pittsburgh. He is currently on a leave of absence to serve as Policy Advisor to the Texas Transportation Commis- sion, which oversees the Texas Department of Transportation. He was a Senior Staff Economist for the National Transportation Policy Study Com- mission during 1977 and 1978. From 1975 to 1977 he was Chief of Economic and Environmental Analysis in the Wisconsin Department of Transportation and was Supervisor of Economic Studies from 1973 to 1975. His primary areas of research are transportation policy and govern- ment regulation. He is acting director of the Center for the Study of Human Resources at the University of Texas and is a member of the Texas Energy Policy Partnership. He has served on TRB's Committee on Surface Trans- portation Regulation, Committee on the State Role in Railroad Transpor- tation, and Special Task Fbrce on the Transportation and Logistics of Energy Materials. Thomas H. Dalrymple is Director of Product Development for Tank Cars at Trinity Industries and is responsible for the design and development of railroad tank cars and their components. He received his bachelor's and master's degrees in mechanical engineering from The Ohio State Univer- sity. From 1984 to 1991 he was Chief Engineer of Union Tank Car Company, in charge of the Manufacturing Engineering, Welding Engineer- ing, and Metallurgy departments. From 1981 to 1984 he was General Manager of Design and Development Engineering for General American Transportation Corporation. From 1966 to 1981 he held various positions at the Marion Power Shovel Company, including Senior Engineer, Engi- neering Supervisor, and Manager of Development Engineering. Mr. Dalrymple is active in the Railway Progress Institute, which represents tank car suppliers.

150 ENSURING RAILROAD TANK CAR SAFETY Lemoine V. Dickinson, Jr., is Senior Associate at Failure Analysis Associ- ates. He received his bachelor's, master's, and doctoral degrees in civil engineering from the University of Maryland. Before joining Failure Anal- ysis Associates in 1990, he served as a Member of the National Transporta- tion Safety Board (NTSB), and he was previously Special Assistant to the NTSB Vice Chairman. He has held several other positions, including Special Assistant to the Deputy Secretary of the Department of Transpor- tation, Senior Policy Analyst with the Congressional Office of Technology Assessment, and Research Engineer in The MITRE Corporation. Dr. Dickinson has been an instructor at the Catholic University of America and is a member of the Institute of Transportation Engineers and the American Society of Civil Engineers. He has served on TRB's Graduate Research Award Selection Panel for Aviation. Theodore S. Glickman is a Senior Fellow in the Center for Risk Manage- ment at Resources for the Future. He received his bachelor's from the State University of New York at Stony Brook and his doctoral degree in opera- tions research from The Johns Hopkins University. Before joining Re- sources for the Future, he was Associate Dean of Engineering at Johns Hopkins, and prior to that he was Professor of Industrial Engineering and Operations Research at Virginia Polytechnic Institute. He also has served as Project Manager in the National Transportation Research Division of DOT, analyzing safety issues for the Federal Railroad Administration concerning hazardous materials train routing and derailment risks. He was previously Associate Professor in the School of Management, Boston University. Dr. Glickman has authored numerous papers and reports on hazardous materials transportation safety and risk assessment. He is a member of TRB's Environmental Analysis and Transportation Supply Analysis Committee and has chaired several TRB conferences and workshops. Milton R. Johnson is Senior Engineering Advisor at the lIT Research Institute (IITRI), directing projects in railroad engineering. He holds a bachelor's degree from Northwestern University, a master's degree from Stanford University, and a doctoral degree in mechanical engineering from Northwestern University. He was previously an Assistant Research Direc- tor of IITRI, serving in this capacity from 1969 to 1974. From 1957 to 1969 he was Senior Technical Advisor in the Research Division of General American Transportation Corporation. At IITRI, Dr. Johnson has man- aged numerous research projects sponsored by the Federal Railroad Administration and AAR, including projects concerning the design and structural integrity of tank cars.

Study Committee Biographical In formation 151 Henry B. Lewin is General Vice President and National Legislative Repre- sentative of the Brotherhood of Railway Carmen Division of the Inter- national Transportation Communications Union. In this position he is responsible for overseeing union investigations of railcar derailments and potential violations of federal safety regulations. He began his career on the RF&P Railroad in 1972, becoming a journeyman carman in 1976, responsible for the repair of railcars, fabrication of car components, in- spection of cars at interchanges, and removal of derailed cars. Before being elected General Vice President in 1988, he was a local union official for more than 10 years. Mr. Lewin has assisted in the development of labor training programs for the AFL-CIO's George Meany Labor Studies Center and the preparation of testimony in public hearings before NTSB and Congress. John P. Provinski is a Senior Engineering Consultant in the Materials and Logistics Department of E.I. DuPont De Nemours & Co. He holds a bachelor's degree in mechanical engineering from the University of Cincin- nati and is a registered Professional Engineer in the state of Delaware. He began his career with DuPont in 1965 and has been in the Materials and Logistics Department since 1976. In his current position he is responsible for new railcar design specifications, specializing in product containment and car maintenance. He has served on the Ad Hoc Rail Equipment and Tank Car 2000 work groups of the Chemical Manufacturers Association. He also served on the Tank Car Subcommittee of the Storage and Trans- port Committee of the Chlorine Institute and the Appendix A/D Working Group of the AAR Tank Car Committee. Phani K. Raj is President of Technology and Management Systems, Inc. He holds several degrees in mechanical engineering (a bachelor's degree from Bangalore University, a master's degree from Indian Institute of Science, and a doctoral degree from Harvard University) and an MBA from North- eastern University. Dr. Raj has more than 24 years of experience in con- ducting research studies, designing and analyzing data from field tests of hazardous materials behavior, and developing mathematical models and computer codes. He has managed more than 100 projects assessing safety and risk issues related to the handling, storage, and transportation of hazardous materials. Currently, he is assessing safety and training issues related to the use of alternative fuels in transportation vehicles. He has provided consulting and research services to government and industry. He is currently developing a risk-analysis-based approach to determining the compatibility between rail tank cars and materials transported in them for the Federal Railroad Administration. Dr. Raj is a member of the TRB Committee on Transportation of Hazardous Materials and is a past mem-

152 ENSURING RAILROAD TANK CAR SAFETY ber of the National Fire Protection Association's LPG Committee and the Editorial Board of the Journal of Hazardous Materials. He has held the post of visiting lecturer at MIT and was an invited speaker at the von Karman Institute in Brussels. Deborah K. Shaver is Vice President of ICF Incorporated. She received her bachelor's and master's degrees from Creighton University. Before joining ICF, she was Manager of Environmental Services for the Bureau of Explo- sives of the Association of American Railroads, providing on-scene assis- tance for railroad spills of hazardous materials. She has directed numerous projects for the U.S. Air Force, the Department of Energy, the Environmen- tal Protection Agency, and state and local governments to improve routing of hazardous materials shipments, determine environmental and safety effects of hazardous materials in transportation and storage, and improve emergency response training and preparedness for hazardous materials incidents. Ms. Shaver, a certified hazardous materials engineer at the Masters level, has served as Chair of American Society for Testing and Materials Committee F-20 on Oil and Hazardous Substances Spill Control Systems, is a Member of the Board of Directors of the Academy of Hazardous Materials Managers, and serves on the Academy National Recertification Board. J. Reed Welker is Professor of Chemical Engineering at the University of Arkansas. He received his bachelor's and master's degrees from the Univer- sity of Idaho and his doctoral degree in chemical engineering from the University of Oklahoma. From 1977 to 1983 he was President of Applied Technology Corporation in Norman, Oklahoma. From 1965 to 1977 he was Vice President and Project Director for University Engineers, Inc., and Associate Director of the Flame Dynamics Laboratory at the University of Oklahoma Research Institute. From 1961 to 1963 he was Group Leader and Section Chief of the Oil Recovery Corporation, Norman, Oklahoma. His areas of expertise are liquid gas technology, fire behavior, risk analysis, and fire control and extinguishing techniques for hazardous chemicals and cargoes. He is a member of the American Institute of Chemical Engineers, the American Chemical Society, and the American Gas Association. He has served on NRC panels, including the National Materials Advisory Board's Panel on Hazard Evaluation Criteria, Panel on Equivalent Safety Concept, Panel on Risk Analysis for Marine Transport of Hazardous Materials, and Committee on Studies of Hazardous Substances.

The Transportation Research Board is a unit of the National Research Council, which serves the National Academy of Sciences and the National Academy of Engineering. The Board's purpose is to stimulate research concerning the nature and performance of transportation systems, to disseminate the information produced by the research, and to encourage the application of appropriate research findings. The Board's program is carried Out by more than 330 committees, task forces, and panels composed of more than 3,900 administrators, engineers, social scientists, attorneys, educators, and others concerned with transportation; they serve without compensation. The program is supported by state transportation and highway departments, the modal administrations of the U.S. Department of Transportation, and other organizations and individuals interested in the development of transportation. The National Academy of Sciences is a private, nonprofit, self-perpetuating society of distinguished scholars engaged in scientific and engineering research, dedicated to the fur- therance of science and technology and to their use for the general welfare. Upon the authority of the charter granted to it by the Congress in 1863, the Academy has a mandate that requires itto advise the federal government on scientific and technical matters. Dr. Bruce M. Alberts is president of the National Academy of Sciences. The National Academy of Engineering was established in 1964, under the charter of the National Academy of Sciences, as a parallel organization of outstanding engineers. It is autonomous in its administration and in the selection of its members, sharing with the National Academy of Sciences the responsibility for advising the federal government. The National Academy of Engineering also sponsors engineering programs aimed at meeting national needs, encourages education and research, and recognizes the superior achievements of engineers. Dr. Robert M. White is president of the National Academy of Engineering. The Institute of Medicine was established in 1970 by the National Academy of Sciences to secure the services of eminent members of appropriate professions in the examination of policy matters pertaining to the health of the public. The Institute acts under the respon- sibility given to the National Academy of Sciences by its congressional charter to be an adviser to the federal government and, upon its own initiative, to identify issues of medical care, research, and education. Dr. Kenneth I. Shine is president of the Institute of Medicine. The National Research Council was organized by the National Academy of Sciences in 1916 to associate the broad community of science and technology with the Academy's purpose of furthering knowledge and advising the federal government. Functioning in accor- dance with general policies determined by the Academy, the Council has become the principal operating agency of both the National Academy of Sciences and the National Academy of Engineering in providing services to the government, the public, and the scientific and engineering communities. The Council is administered jointly by both the Academies and the Institute of Medicine. Dr. Bruce M. Alberts and Dr. Robert M. White are chairman and vice chairman, respectively, of the National Research Council.

> Lc 00 F. 64 ISBN 0-309-05518-0 1 Z National Academy Press