Feasibility Study for Highway Hazardous Materials Bulk Package Accident Performance Data Collection (2013)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

55 S e c t i o n 3 The second objective of HMCRP Project 07, to identify pos- sible methodologies for systematic collection of the necessary performance data, was achieved through a literature review, consideration of existing accident and hazardous materials data collection processes, and examination of accident sever- ity thresholds. Industry surveys and interviews were used to identify preferable methodologies, and the most favorable methodology was explored through the development and implementation of a pilot study. Strategies previously employed to collect data on various aspects of hazardous materials transportation were reviewed. The review includes literature that evaluates several existing databases and accident data collection processes that could either be modified to collect cargo tank and portable tank performance data or that could be emulated by this project’s proposed database. Accident definitions used by several different databases were reviewed for relevance in assessing highway bulk pack- age accident performance. Unintentional releases were distin- guished from intentional releases (i.e., criminal acts resulting in a release), and non-release events were distinguished from release events. The accident damage database proposed in this report will focus on collecting data on unintentional, accident- caused damage regardless of whether a release occurred. In addition, severity thresholds for inclusion or exclusion in existing databases were reviewed. The effect of specific sever- ity threshold levels on the total number of accidents recorded in a database is illustrated using data from an existing acci- dent database and the implications of different threshold levels are discussed. Finally, a basis is provided for defining the possible range of accidents to be included in the data col- lection program. Industry interviews and surveys also collected opinions on the systematic collection of the necessary performance data. Three dichotomies are used in the survey: (1) voluntary versus mandatory data reporting, (2) an extension of Form DOT F 5800.1 versus a new program, and (3) a government-sponsored versus industry-sponsored program. A preliminary set of pos- sible data collection protocols based on each approach were developed and prioritized based on their pros, cons, and ease of implementation. Four options are prioritized and further examined to address questions such as how data will be col- lected, where they will be housed, who will collect them, and how confidential data will be protected. One of these data collection approaches, the possible imple- mentation of a government-sponsored extension of Form DOT F 5800.1, with mandatory participation, was refined into a system with details about the elements of the data set to be collected. These elements are identified and grouped according to logical associations. Implementation considerations are then discussed. These include electronic data collection tools that offer logical response options based on previous responses, a possible prototype database management system, and security access control considerations. Based on this approach, methodologies for collecting and analyzing the performance data were explored through the development and implementation of a pilot study. The pur- poses of the pilot study were to evaluate the quality of data expected from such a data collection process, identify improve- ments to the data collection system itself, demonstrate the types of analyses that could be facilitated by the database, and esti- mate the period of time required to collect incident data suf- ficient to support reliable statistical analyses. The pilot data collection tool was designed to enable bulk package accident damage information to be collected accurately and with mini- mal difficulty for pilot study participants. Due to a low level of participation in the pilot study, an alternative method for gathering bulk package accident per- formance information was developed to supplement the accident reports gathered using the data collection tool. The pilot study added bulk package accident performance infor- mation from a manual review of NTSB reports and infor- mation gathered from multiple sources, including PHMSA HMIRS reports, FMCSA MCMIS reports, and news articles. Data Collection Methodologies

56 This process enabled identification of several improvements to the pilot data collection tool and generated a total of 50 acci- dent records with varying degrees of completeness, particularly regarding bulk package design, the extent of the damage, and the dimensions of the breach. The data collected as part of the pilot study were also used to estimate the amount of time for such a system to yield statistically significant accident performance measures. This was accomplished by comparing population-wide accident and release rates to minimum sample size requirements. The minimum sample size requirements were developed using a subset of pilot study accident records correspond- ing to hazardous materials transported in MC 306 or DOT 406 containers. Two conditions were used to establish mini- mum sample sizes: (1) a sufficient number of accident records to minimize Type I errors (where insignificant variables appear to have a significant effect) and Type II errors (where signifi- cant variables appear not to have an effect on the probability of a release) and (2) at least 10 events for each variable included in the regression equations. Literature Review Data collection strategies previously employed to analyze various aspects of hazardous materials transportation were evaluated for relevance to this project. There are several exist- ing databases and accident data collection processes that could either be modified to collect cargo tank performance data or that could be emulated by this project’s proposed database. The following studies provided an introduction to a variety of databases that will be examined in further detail. HMCRP Report 1: Hazardous Materials Transportation Inci- dent Data for Root Cause Analysis (Battelle Memorial Institute 2009) examines multiple existing databases including MCMIS, HMIRS, FARS, TIFA, LTCCS, the Railroad Accident/Incident Reporting System (RAIRS), and Marine Information for Safety and Law Enforcement (MISLE). Each of these databases was evaluated for the potential to perform a root cause analysis. In addition to providing an overview of the data collection pro- cess, the report discusses thresholds for exclusion/inclusion, examines accuracy and completeness of the data, and deter- mines the degree of interconnectivity with other databases. National Automotive Sampling System (NASS) General Estimates System (GES) Analytical User’s Manual 1999–2008 (NHTSA 2010) discusses the purpose and design of the NHTSA GES database. The document describes the GES sample design process, provides a summary of the imputation process used, and documents the variable names and associated codes con- tained in the database. Databases and Needs for Risk Assessment of Hazardous Materials Shipments by Trucks (Hobeika and Kim 1993) evalu- ates 12 hazardous material truck databases in terms of reliability and their associated risk assessment problems. While there are databases providing exposure (referent/denominator) infor- mation, this information is not usually obtained for a par- ticular accident/crash incident. The dichotomy between crash databases and exposure databases, according to Hobeika and Kim (1993), reduces the reliability of hazardous material trans- portation risk analyses. Hobeika and Kim (1993) assert that the 12 databases analyzed in the paper lack sufficient information pertaining to incidents, exposure, or consequences needed to perform risk analysis. The paper discusses reporting require- ments, compares national hazardous material statistics to state hazardous material statistics, and provides a brief discussion on the merits of using geographic information systems (GIS) and automatic vehicle identification (AVI) for the purposes of data collection. Accident Definitions In general, release incidents involving bulk packages in tran- sit can be classified as caused by an accident or non-accident. Accidents are the result of unintentional application of external forces, including a crash between vehicles or impact with sta- tionary objects, while non-accidents are due to causes such as improperly secured or defective valves, fittings and tank, and venting of non-atmospheric gases from safety-relief devices. Typically, non-accident-caused releases are more frequent than accident-caused releases (Barkan and Pasternak 1999) but have less severe consequences than accident-caused releases. An accident damage database should contribute to trans- portation safety by enabling risk analyses to include the conditional probability of release given that a bulk package is involved in an accident. The analysis of data on uninten- tional, accident-caused releases will enable better-informed decisions regarding bulk tank design, accident protection technology, and operational strategies. On the other hand, there are a number of potentially useful security strategies that could be examined by recording intentional release events (i.e., criminal acts resulting in a release). However, the recording of intentional release events may require some different data that could affect the effectiveness and cost of the overall data collection process. Therefore, the proposed accident damage database will focus on collecting data from unintentional, accident-caused damage. In order to estimate the conditional probability of release for bulk packages and their various design elements, detailed data on the nature of damages suffered by packages involved in accidents are necessary. Of particular importance relative to current highway accident databases is that data are needed on crashes involving hazardous material bulk packages, whether or not some or all of the contents leaked in accidents. This is an area where the existing Form DOT F 5800.1 already col- lects various details of damaged packages when a release has

57 occurred or the damages to the bulk package cost more than $500. However, the current process does not record informa- tion in sufficient detail to address some of the pertinent ques- tions concerning bulk package performance. Furthermore, in terms of assessing portable and cargo tank performance, accidents in which a tank was involved but not damaged should be distinguished from accidents in which the tank did suffer damage, whether or not a release occurred. A similar distinction exists in the RSI-AAR tank car database with regard to recording derailed cars versus derailed cars that suffered damage to the tank or appurtenances. The for- mer is an estimator of exposure of the vehicle to accidents whereas the latter is an estimate of the exposure of the tank itself to damaging events. The implications of setting an accident severity threshold beyond which accidents should be recorded were examined using data from PHMSA’s HMIRS. All en route or in transit incidents or accidents concerning cargo tanks, cylinders, or intermodal tanks between January 1, 2005, and May 1, 2010, yielded a total of 2,074 records involving cargo tanks that resulted in more than $500 in damage. These records were used to calculate the cumulative percentage of reported inci- dents with respect to the total cost of each event. The incident costs reported in Form DOT F 5800.1 ranged between $0 and $2,285,000, with 90% of the accidents incurring a cost less than $203,500 and 50% of the accidents incurring a cost less than $9,000 (see Figure 14). The relationship illustrated is more sensitive in the lower range of incident costs and indi- cates that higher severity cost thresholds lead to a lower num- ber of recorded incidents. By definition, low severity accidents are limited in the extent of damage incurred, rarely involve a release, and therefore pose little risk. The lower the threshold, the more accidents need to be recorded. The result is greater cost and time expended to collect the data, and a higher cost to maintain the database. Data on lower consequence accidents may be of less value in terms of the objectives of a database. On the other hand, lower consequence accidents may provide useful predictive information for lower frequency, higher consequence events. Furthermore, the larger sample size combined with the more rapid accumulation of data will enable more statistical power and enable inferences to be made sooner, especially in the early years of a new database. Consequently, there is a tradeoff to be considered in establishing thresholds. From a technical standpoint, standardized reporting criteria are important to understand because they provide a baseline rate upon which to base consistent risk estimates. Reporting Thresholds of Existing Data Collection Strategies Existing accident and hazardous materials data collection processes were reviewed for their ability to be adapted to eval- uate cargo tank and portable tank performance in highway accidents. These existing programs include PHMSA’s HMIRS, FMCSA’s MCMIS, UMTRI’s TIFA, and NHTSA’s NASS GES. Additionally, several existing data collection processes used for a comparable purpose in other modes were examined. These include the RSI-AAR TCAD, the U.S. DOT/FRA’s RAIRS, and the U.S. Coast Guard’s MISLE. Most similar accident database systems have some type of criteria that determine whether or not an event should be reported (for example, damage cost or quantity released). Furthermore, in some databases, there are tiered thresholds, 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% 0 25 50 75 10 0 12 5 15 0 17 5 20 0 22 5 25 0 27 5 30 0 32 5 C um ul at iv e P er ce n ta ge o f R ec or de d In ci de nt s Total Incident Cost ($ thousands) Figure 14. Cumulative percentages of reported incidents by total cost.

58 in which incidents of greater magnitude have more detailed reporting requirements. Reporting thresholds have both prac- tical and analytical implications for the resultant database, and these should be understood when developing a new database. This section summarizes accident definitions and accident severity thresholds for inclusion or exclusion in existing acci- dent databases as discussed in HMCRP Report 1: Hazardous Materials Transportation Incident Data for Root Cause Analysis (Battelle Memorial Institute 2009). Additionally, the informa- tion recording process for each dataset is described. Motor Carrier Management Information System (MCMIS) MCMIS data collection starts with the local police compil- ing and submitting police accident reports to the appropriate state agency. From here, reports involving accidents that meet MCMIS criteria are also reported to FMCSA via an electronic filing system or manually using a Web interface. FMCSA then records the information in the MCMIS crash database, which contains four major files—Registration, Crash, Inspection, and Company Safety Profile. The most pertinent and relevant to this project is the Crash file. The MCMIS Crash file is intended to record all serious crashes of trucks and buses involved in commerce. A crash is considered serious if there is • A fatality. • An injury requiring immediate medical attention away from the accident location. • A vehicle that had to be towed from the accident location due to disabling damage. Hazardous Materials Incident Reporting System (HMIRS) Under 49 CFR 171.16, all road, rail, water, or air hazardous material carriers must submit a Form DOT F 5800.1 within 30 days of a reportable incident that falls under the following criteria: • The National Response Center (NRC) is notified due to – An injury or fatality directly resulting from hazardous material exposure, an evacuation of more than an hour, a major artery road closed for more than an hour, or change of an operational flight pattern or aircraft routine. – A fire, breakage, or spillage involving radioactive materials. – A fire, breakage, or spillage involving infectious materials. – A marine pollutant release. – A situation that poses a continuous danger to life at the accident location. • An unintentional hazardous material release or discharge of such materials occurs. • An undeclared hazardous material is discovered. • Any structural damage to the lading retention system or damage that requires repair to a system intended to protect the lading system of a hazardous material cargo tank with a minimum capacity of 1,000 gallons (even if there was no release) occurs. For clarity, PHMSA’s incident reporting guidelines provide the following examples of bulk package damage that require reporting (PHMSA 2004): • Outlet valve damage affecting seating and requiring replacement. • Lading retention system damage, including damage to charged outlet lines that could have resulted in loss of contents. • Damage requiring professional inspection or recertification. • Damage requiring repair due to compromised integrity. A reportable incident can occur whenever a carrier is involved: during loading/unloading, in transit, or in tempo- rary storage en route to final destination. For each incident, the cost of damages must be provided if total damage exceeds $500. The resulting database contains incident reports per- taining to non-accident-caused as well as accident-caused hazardous material releases and near misses. Corrections and updates must be filed within a year of an incident by submitting Form DOT F 5800.1 again and check- ing the “A supplemental (follow-up) report” box on the form. Filing methods available include XML submissions, online Form DOT F 5800.1 reporting application, PDF attachment in email, and FAX. PHMSA performs newspaper searches and compares the list of incidents reported to NRC to identify unreported incidents. Carriers who fail to report incidents within the specified timeframe are notified by phone. Trucks Involved in Fatal Accidents (TIFA) The Center for National Truck and Bus Statistics at UMTRI manages the TIFA database. It is a subset of FARS focusing on all medium and heavy trucks with greater than 10,000-lb gross vehicle weight rating (GVWR) and expanded with sup- plemental survey data. NHTSA has a contract with an agency in each state to pro- vide information on fatal crashes using standard FARS forms. FARS analysts are state employees who attend formal training programs and receive on-the-job training. A supplemental phone survey is performed by the Center for National Truck and Bus Statistics at UMTRI to complete the TIFA database record for each accident.

59 TIFA has the same accident definitions and reporting crite- ria as FARS. Specifically, a crash is included if there is • A fatality that occurs as a result of a crash. • A fatality that occurs within 30 days of a crash. • One motor vehicle in transport on a public road. National Automotive Sampling System (NASS) General Estimates System (GES) Maintained by NHTSA, GES is populated by data obtained from a nationally representative probability sample of police- reported crashes (NHTSA 2010). After selection of the police jurisdictions, the GES data collector organizes a select sub- sample of police accident reports into six strata depending upon vehicle type, injury severity, and vehicle tow status. A systematic sample of crashes is then selected based on dif- ferent sampling ratios. Of particular interest to this study is Group 2, NASS crashes involving at least one medium or heavy truck in which a vehicle was towed due to damage or at least one person involved had an injury requiring medical treatment. Large Truck Crash Causation Study (LTCCS) FMCSA and NHTSA jointly undertook the LTCCS as a one- time initiative to compile a nationally representative sample of nearly 1,000 injury and fatal crashes involving large trucks that occurred between April 2001 and December 2003. Each crash involved at least one large truck with a GVWR greater than 10,000 lb and one fatality or serious injury, where a seri- ous injury is either an incapacitating or non-incapacitating but evident injury. RSI-AAR Tank Car Accident Database (TCAD) The RSI-AAR TCAD provides an example of how a data- base designed for container performance could be structured, maintained, and operated. Compared to other accident data- bases, the RSI-AAR TCAD records more details about the parts of tank cars that failed in release accidents, but it also records data on accidents involving tank cars without a release, includ- ing certain details of the damage suffered in these accidents. This information provides denominator data that can be used to calculate a conditional probability of release statistic for specific designs of tank cars damaged in accidents. HMCRP Project 07 focused on methodologies to implement a program that would collect the same type of information as the RSI- AAR TCAD; however, there are a number of operational and institutional differences between the highway transport and rail industries that make such an implementation challenging. These differences are discussed in Appendix C. As part of the RSI-AAR Railroad Tank Car Safety Research and Test Project, the TCAD is maintained by an independent contractor working for the project sponsors, RSI and AAR. Since 1970, data have been gathered and compiled from a variety of sources with the goal of recording accident circum- stances, mechanical and design characteristics of each tank car involved in the accident, and details on the damage suf- fered by the tank cars during the accident. Accident informa- tion sources for the RSI-AAR project include the FRA RAIRS, railroads, tank car owners, news clip service and Associated Press articles, weekly accident summaries prepared by the University of Illinois based on Chemtrec reports, and govern- ment agencies’ accident investigation reports. The contractor is responsible for gathering information from all these differ- ent sources, merging the information, resolving conflicting information, and pursuing missing data. Detailed damage data are usually provided by repair shops. Information on the design parameters of each car come from the rail industry’s Universal Machine Language Equipment Register (UMLER), which is a registry of nearly all North American rolling stock that contains extensive information on individual tank cars’ design parameters. Additional design information is pro- vided by the tank car certificates of construction that must be completed for every tank car and updated when significant changes to a car are made throughout the course of its ser- vice life. The contractor is responsible for entering all relevant information into the database and ensuring its accuracy and integrity. For quality assurance (QA), quarterly reports are published for project director and project sponsor review. Since its formation in 1970, more than 45,000 records of damaged tank cars and more than 29,000 accidents have been recorded in the database. This extensive database enables robust statistical analyses of the performance of the principal tank car components and development of quantitative answers to a variety of questions (CCPS 1995, Barkan and Pasternak 1999). The most basic questions include the following: • What is the percentage of tank cars involved in accidents that released some or all of their contents? • What is the safety performance of tank car transport of hazardous materials? • How do different tank car specifications perform in accidents? • How has tank car safety performance improved over time? Meanwhile, more complex questions include the following: • What is the likelihood of release from a particular compo- nent and what is the expected quantity of release from a particular component? • How does the performance of a particular component dif- fer with the incorporation of various design features?

60 • How effective are different design changes at improving safety? • How has tank car safety improved as a result of some change in design or operation? • What is the cost-effectiveness of various design changes? In general, the database enables • Quantitative understanding of the relative performance of different tank car designs in various accident circumstances. • The ability to assess the risk of transporting various haz- ardous materials using a particular tank specification or a particular tank component. • Estimation of the potential benefit of incorporating a particular safety measure or changing a particular design element. • Combined with financial information, identification of the most efficient risk reduction measures. Railroad Accident/Incident Reporting System (RAIRS) The U.S. DOT’s FRA requires that all railroad accidents in which damage to track and equipment exceeds a specified monetary threshold be reported to RAIRS. The threshold is adjusted periodically for inflation and, in 2011, was $9,400. Compliance with RAIRS reporting requirements appears to be quite high and RAIRS plays an important role in the rail industry’s ability to monitor its performance and measure safety trends in general, as well as understand the circum- stances of accidents involving tank cars in particular. Besides providing basic information about the circumstances of an accident, RAIRS has an extensive set of detailed accident cause codes that enable understanding of the relationship between accident cause and various outcomes, including tank car per- formance. RAIRS data frequently form the principal basis for understanding the circumstances of accidents involving tank cars reported in the RSI-AAR TCAD. Marine Information for Safety and Law Enforcement (MISLE) The U.S. Coast Guard maintains the MISLE system to sup- port their Marine Safety and Operations Programs. As part of the system, the Marine Casualty and Pollution Database con- tains data related to marine casualty investigations reportable under 46 CFR 4.03 and pollution investigations reportable under 33 CFR 153.203. The database contains information collected by U.S. Coast Guard personnel concerning vessel and waterfront facility accidents and marine pollution incidents throughout the United States and its territories. Limitations of Existing Databases Insufficient Denominator Data Perhaps the biggest limitation of the existing accident data- bases for package performance studies to estimate the condi- tional probability of release for bulk packages is insufficient understanding of the denominator data. In other words, how often are packages exposed to various accident conditions in which they might fail? Detailed damage information is needed for packages in accidents whether or not a release took place. Since 2005, the restructured HMIRS has required report- ing of non-release accidents if they involve a cargo tank with a minimum 10,000-gallon capacity and the lading retention system is damaged. These are classified as Type C records, as opposed to Type A for release incidents and Type B for undeclared hazardous material shipment. HMCRP Report 1 (Battelle Memorial Institute 2009) suggests that there may be significant underreporting of Type C records, based on com- parisons between HMIRS and MCMIS and TIFA. Substantial improvement to HMIRS for package performance statistical studies would be achieved if Type C record underreport- ing could be reduced or eliminated. Underreporting could be reduced by cross-checking accident records in HMIRS with (1) records of hazardous material fatal accidents in TIFA, (2) records of rollover accidents involving cargo tanks in MCMIS, and (3) information on repaired cargo tanks retrieved by auditing hazardous-material-authorized repair shops. Periodic audits would increase the number of incidents being reported and result in better statistical analyses. Accident Underreporting Underreporting is a term that describes the discrepancy between the total number of reportable incidents and the number of incidents actually reported. In HMCRP Report 1, Battelle Memorial Institute (2009) sought to “bound the prob- able HMIRS reporting rate” by comparing HMIRS reports resulting in a fatality with FARS records involving vehicles transporting bulk quantities of hazardous materials. Bulk hazardous materials accidents resulting in a fatality were found to be reported between 26.9% and 59.7% of the time. Since Form DOT F 5800.1 is only required to be filed if a fatality is related to the release of hazardous materials, the FARS data comparison is not a direct indication of under- reporting. To further quantify the amount of underreporting for all crashes resulting in damage to the lading retention sys- tem, PHMSA HMIRS records between March 1, 2011, and September 30, 2011, were matched to FMCSA MCMIS crash files and a news article data set primarily using location date and description of events. During this period, the PHMSA HMIRS database contained 123 reports of accidents, 98 of

61 This corresponds to an accident rate of 132 per month, of which 34 result in a release. Since not all of the FMCSA MCMIS records are of acci- dents that resulted in damage to the lading retention system, the combined data set serves to identify the limits of under- reporting. The lower bound considers only those FMCSA accidents in which a release occurred (all release accidents are required to be reported to PHMSA). Of the 278 records in which damage to the bulk package is confirmed, 155 acci- dents were not reported to PHMSA. This corresponds to an underreporting rate of 56%. The upper bound considers all FMCSA crash data involving a hazardous materials bulk package even though reporting all of these accidents may not be required. Of these 924 accidents, 801 are not reported to PHMSA. If all 924 accidents resulted in damage to the bulk package, the underreporting rate would be 87%. Therefore, between 13% and 44% of accidents in which a bulk package was damaged are reported to PHMSA. Poor Quality of Reported Information The reports submitted to PHMSA HMIRS have varying degrees of completeness and response consistency. Battelle’s analysis of the HMIRS data showed that “some obvious Q/A checks are not being performed” (Battelle Memorial Institute 2009). A brief analysis of the accidents reported to PHMSA from January 1, 2006, to June 4, 2011, was undertaken to identify the percentage of accident reports that result in poor quality data (see Table 36). A total of 1,176 incidents were reported. Of these, the type of bulk container was identified for 997 incidents (85%). A description of what failed was identified for 961 incidents (82%). Reporting rates for bulk package design parameters such as package capacity, pack- age amount, material of construction, design pressure, shell thickness, and head thickness range between 67% and 45%. Finally, a comparison of the number of reported incidents satisfying PHMSA’s classification of a serious bulk release was compared to the number of incidents for which dam- ages over $500 are reported. This analysis indicated that the cost of damages was incorrectly reported for at least 38 seri- ous bulk releases (3%). Data checking and greater reporting compliance would result in better estimates of conditional probability of release. Industry Experience Several interviews were conducted with individuals hav- ing intimate knowledge of existing databases such as HMIRS, MCMIS, and TCAD. These interviews were conducted to deter- mine potential challenges with data collection, understand how the data are analyzed, and gain insights into how the data could be used to enhance the industry’s safety performance. which resulted in lading loss. FMCSA MCMIS crash files contained 754 reports, 95 of which resulted in lading loss. It should be noted that not all 754 accidents resulted in damage to the lading retention system; however, at least 95 records (those resulting in lading loss) correspond to accidents in which the bulk package was damaged. The news article data- set was developed using news-source reported crashes iden- tified through Google News Alert service. It included fields for date, time, location, state, a description of what events occurred and the consequences of those events, whether the bulk package overturned, and whether a release occurred. Between March 1, 2011, and September 30, 2011, 127 haz- ardous materials bulk package accidents were identified in news sources. Of these 127 accidents, 103 resulted in lading loss. The combined dataset consisted of 924 accidents (see Figure 15) of which 236 resulted in a release (see Figure 16). Figure 15. Venn diagram of hazardous materials accidents. Figure 16. Venn diagram of hazardous materials releases.

62 In contrast with their ability to determine standard industry injury and fatality rates, PHMSA is unable to determine base- line rates for tank damage and hazardous material spills. Fur- thermore, based on their experience with the HMIRS, PHMSA identified the following future potential challenges: • Reconciling differences between and performing analyses on combined data from old and new versions of data- reporting forms. • The difficulty handling free-form answers when transferring accident reports from paper to digital format. • Cleansing data so that new reports match previously sub- mitted reports (again this typically arises with the presence of free-form answers). FMCSA’s Hazardous Materials Division Interview In the interview with a representative of FMCSA the fol- lowing three sources were identified that will enable cargo tank exposure estimates: • The Motor Carrier Identification Report (Application for U.S. DOT Number) (MCS-150) currently collects infor- mation, including the annual number of miles traveled, from 60,000 carriers who transport some quantity of haz- ardous materials. • The Combined Motor Carrier Identification Report and Hazardous Materials Permit Application (MCS-150B) also collects information, including the annual number of miles traveled, from motor carriers who transport certain types of hazardous materials requiring a safety permit. Note that those carriers who have registered with the MCS-150B are a subset of all carriers transporting hazardous materials as some hazardous materials are not part of the Hazardous PHMSA’s Hazardous Intelligence Portal (HIP) Designers Interview The Hazardous Intelligence Portal (HIP) is PHMSA’s cur- rent effort to provide a platform to collect and share hazardous material intelligence from several groups representing differ- ent transport modes within the U.S. Department of Transpor- tation. HIP currently collects data from 15 sources, and it is anticipated that additional sources will be incorporated into the portal in the future. This effort was undertaken to orga- nize a dashboard-type view of key data regarding the multi- modal transportation of hazardous materials by company, enable comprehensive queries of data from multiple sources, and improve the prioritization and efficiency of inspections by regulatory agencies. As part of this effort, HIP designers have worked closely with HMIRS data to update Form DOT F 5800.1. The main focus in updating Form DOT F 5800.1 is to improve data quality through both increasing data governance (only allow- ing acceptable answers) and replacing most free-form ques- tions with drop-down list selection, yes/no, and check box answers. HIP designers indicate that the main limitations for using the PHMSA data for risk assessment include the following: • Insufficient commodity flow data to provide cargo tank exposure estimates [for which the incorporation of radio frequency identification (RFID) tags on cargo tanks may be a solution]. • Incorrect and incomplete damage reporting. • Inability to correct for this inconsistent reporting because PHMSA does not investigate cargo tank (highway) accidents. • Significant underreporting of accidents with no follow-up to ensure accidents have been reported after initial notifica- tion has been provided. Field Number of Incidents Percentage of Total Number of Incidents Total Number of Reported Incidents 1,176 – Container Specification/Non-Specification Container 997 85% What Failed 961 82% Package Capacity 745 63% Package Amount 709 60% Material of Construction 784 67% Design Pressure 623 53% Shell Thickness 543 46% Head Thickness 528 45% Note: “—“ indicates this value is not applicable. Table 36. Critical fields percentage reported for incidents in PHMSA HMIRS from January 1, 2006, to June 4, 2011.

63 This has resulted in more pragmatic, effective, and fact-based regulatory proposals. Approaches to Data Collection The following three dichotomies were considered to facili- tate decisions regarding the different approaches for develop- ment of an accident database: • Voluntary versus mandatory data reporting. • An extension of Form DOT F 5800.1 versus a new program. • Government-sponsored versus industry-sponsored program. Voluntary versus Mandatory Data Reporting Voluntary Data Reporting In a voluntary data-reporting approach, companies trans- porting hazardous material(s) would decide whether or not to participate in the data-reporting process. There could be guidelines or incentives, but the decision to participate would be strictly voluntary. By its nature, voluntary report- ing results in self-selection, which might introduce some biases into the resulting data set that could be difficult to account for during data analysis. Voluntary reporting may be successful if incident information cannot be traced back to the individual or company because concerns about possible repercussions regarding the accident would be minimized. Individuals or companies submitting voluntary reports would need to recognize sufficient value from participation in the program. If the program was augmented by incentives such as an improved federal safety rating, the perceived value of participation might be enhanced. A successful voluntary program—in which there was substantial stakeholder par- ticipation, with a large number of high-quality reports— could offset the uncertainty related to the self-selection bias. Furthermore, a successful program might result in greater accuracy in the submitted data because of the vested interest of the contributors. Mandatory Data Reporting Mandatory data reporting would involve a statutory or regu- latory mandate requiring that certain information be reported to an organization that would compile and manage the data- base. Since the approach is mandatory, the vested interest of individual contributors may be lower; therefore, efforts to ensure compliance would be required. Providing incentives would encourage contributors to increase data accuracy and improve compliance. A successful mandatory program would have near 100% reporting with high accuracy, resulting in a bias-free analysis. Materials Safety Permit program. For example, transport- ing liquid propane gas containing less than 85% methane does not require a safety permit. • FMCSA’s Unified Registration System (URS) will replace the MCS databases and, in addition to the annual number of miles traveled, will include the quantity and type (type and specification number) of cargo tanks that a motor car- rier uses. However, only carriers who transport cargo tank trailers and cargo tank motor vehicles will be required to list the quantity and type of tank. Carriers who transport portable tanks will not be required to identify the quantity and type of portable tanks they transport. In the interview, the possibility of local law enforcement officers providing much of the information needed for an accident damage database was also considered. Unfortunately there are not enough individuals with the appropriate training and expertise to reliably enter accurate and consistent accident damage information in a report. For example, although there are approximately 33,000 police jurisdictions across the United States, only 7,500 to 10,000 state level motor carrier inspec- tors are trained through the motor carrier safety assistance program. Furthermore, additional training would be required to obtain basic hazardous materials bulk package knowledge, and even fewer individuals have been trained to conduct post- crash root cause analysis. Inspectors are typically not allowed to provide comments beyond their level of training; therefore, many would not be permitted to inspect the package. Conse- quently, the data required for an accident damage database would not be recorded unless a supplemental report was ini- tiated. On the other hand, basic police reports may indicate that a cargo tank was involved and, if so, would include carrier information. Thus, police report data could be used to iden- tify those carriers who have had incidents and are required to submit Form DOT F 5800.1. RSI-AAR TCAD Feedback Since 1970, the RSI-AAR TCAD has been periodically eval- uated for its effectiveness in aiding the industry in achieving various improvements in the safety of hazardous materials transportation by rail. The rail industry associations that spon- sor that database indicate a savings of at least 11 times the cost of the implementation since inception. Periodic cost-benefit analyses have consistently indicated positive returns on invest- ment in terms of improved safety and business operations. Furthermore, this industry-managed database has contributed to a greater degree of trust in the industry and contributed to consensus in regulatory proposal development. Regulators have been provided with analyses using data recorded in the TCAD to assess the need for and nature of new regulations.

64 only collects information related to accident damage and not accident identification information such as date, time, loca- tion (of accident), and carrier/shipper information. Further- more, a new program may have more flexibility in terms of adding or removing information fields in the future. Government versus Industry Sponsored Government Sponsored In a government-sponsored program, either agency staff or a contractor would develop and manage the database. Such a program could be subjected to Freedom of Information Act requirements and may be less flexible and thus harder to make changes to, but it would have the stability and resources of a government program. Industry Sponsored In an industry-sponsored approach, data would be collected and housed by an industry association, a consortium of indus- try associations, or by a contracted private firm, research orga- nization, or university. Industry would decide how to respond to requests for data analyses, including requests from govern- ment agencies. An industry group or consortium could hire a contractor to collect, compile, and analyze additional informa- tion from different sources such as police accident reports. Since this approach relies on industry funding, the value of such a database would need to be accepted by the majority of potential industry participants. Such an approach may result in greater potential anonymity because procedures and policies can be implemented to protect the information against the improper use of data and analyses in ways that harm contributors. Industry Opinion In addition to the surveys conducted to determine what information different stakeholders believe would be most useful in an accident damage database, stakeholder prefer- ences regarding database development, structure, and func- tionality were surveyed. Due to the potential differences in the use of bulk package accident performance data, five surveys—targeting package manufacturers, carriers, shippers, repair facilities, and researchers/government organizations— were developed. Questions were tailored to each survey group to maximize collection of industry-sector-specific informa- tion. Copies of the surveys and an explanation of their devel- opment can be found in Appendix A. Database Structure Preferences The survey respondents were asked to identify whether the proposed accident database should be mandatory or voluntary, Extended Form DOT F 5800.1 versus New Program An Extension of Form DOT F 5800.1 Form DOT F 5800.1 records approximately 70% of the information identified as necessary to evaluate bulk pack- age accident performance and estimate component-specific conditional probability of release. In order to increase the amount of information necessary to calculate bulk package performance that is available from Form DOT F 5800.1, the following additional data fields would need to be added: • Bottom accident damage protection. • Rollover accident damage protection. • Presence of jacket. • Jacket material. • Jacket thickness. • Insulation type. • Type of damage (replaces “Type of Failure” in Form DOT F 5800.1). • Whether the type of damage sustained resulted in failure. • Damage location (on the bulk package). • Damaged components (replaces “What Failed” in Form DOT F 5800.1). • Whether the damage sustained by the component resulted in failure. In order to calculate various conditional probabilities, these new data fields would also need to be linked to crash reports in PHMSA’s HMIRS database. An extension of Form DOT F 5800.1 may be desirable as it would minimize the additional burden on individuals and companies required to file reports. However, this option does not address carrier and shipper concerns about data confidentiality and the improper use of data and analyses in ways that could harm contributors. These concerns might influence the degree of candor in reporting. One possibility that may enable the collection of additional data while maintaining the current level of reporting is the development of a possible “no-fault” appendix form, specific to the highway mode. This form could be used to collect addi- tional data to describe the results of a root cause analysis and the tank damage observed as a result of crashes. Using the “no-fault” form would protect against improper use of data and analyses that could harm contributors. New Program In contrast to an extension of Form DOT F 5800.1, a new program could be set up to independently collect all the infor- mation necessary to compute the conditional probability of release. The anonymity of reporting could be preserved if the new program is not linked to PHMSA’s HMIRS database and

65 Manufacturers The manufacturers who replied to the survey indicated that liability considerations and, to a lesser extent, confiden- tiality and paperwork are of greatest concern when consider- ing participation in a voluntary program. As a result, while two manufacturers indicated they would be willing to partici- pate in such a voluntary effort, one indicated that it probably would not. Repair Facilities Six of the repair facilities indicated that they would, or most likely would, be willing to provide data to populate a volun- tary program while only one indicated that it probably would not participate in a voluntary program. The concerns iden- tified by repair facilities are primarily the amount of paper- work accompanying such an effort followed by confidentiality, liability considerations, and cost. Carriers Of the 29 carriers who responded to the survey, 26 (90%) indicated that they would, or most likely would, be willing to sponsored by industry or government, and whether a new process/database should be built on existing programs (i.e., adding fields to Form DOT F 5800.1 and increasing report- ing compliance). Opinions varied within industry groups concerning the preferred database approaches; however, the reasons for choosing one approach over another tended to be similar across stakeholder groups, regardless of the preferred approach. In general, the respondents who may be responsible for pro- viding accident and bulk package information tend to prefer a voluntary, industry-sponsored reporting approach while indi- viduals using the reports for analyses tend to prefer a man- datory, government-sponsored approach (see Figures 17 and 18 and Tables 37 and 38). When comparing the possibility of building off of an existing database and designing a new data- base approach, most respondents favored the former option (see Figure 19 and Table 39). Anticipated Voluntary Program Participation Overall, the survey respondents believe that there would be little participation in a voluntary database if one were to be adopted. This contrasted with respondents’ replies regarding whether they would participate in such an effort. 17% 25% 33% 41% 75% 83% 75% 67% 59% 25% 0% 20% 40% 60% 80% 100% Shippers Repair Facilities Manufacturers Carriers Researchers Preference (%) Mandatory Voluntary Figure 17. Survey respondent preferences for mandatory versus voluntary bulk package accident performance data collection program. 25% 65% 67% 86% 100% 75% 35% 33% 14% 0% 20% 40% 60% 80% 100% Researchers Carriers Manufacturers Shippers Repair Facilities Preference (%) Industry-Sponsored Government-Sponsored Figure 18. Survey respondent preferences for industry- versus government-sponsored bulk package accident performance data collection program. Main Concerns Mandatory Approach Voluntary Approach • Increased workload justification/fairness • Fear of legal liability leads to unreported incidents if not mandatory • Small sample sizes from which to draw conclusions if reporting is not mandatory • Increased workload with little perceived benefit • Fear of legal liability leads to underreporting • Small sample size for particular cargo tank type • Time lag between crash and report submittal Table 37. Main concerns expressed by survey respondents regarding mandatory and voluntary bulk package accident performance data collection program.

66 Main Concerns Industry-Sponsored Approach Government-Sponsored Approach • Industry has the expertise (knowledge/experience) to correctly interpret the data • Industry will be better able to keep the program on track • The industry is overregulated as it is, but has good self-regulation • Increased ability to change what is being reported • Industry-sponsored approaches lead to more homogeneous samples • Government is better equipped to keep the program on track and deal with enforcement issues (if mandatory approach is also adopted) • Government is better able to absorb costs of maintaining such a database • Government has the expertise (knowledge/ experience) to correctly interpret the data • Data will be available for researchers to analyze Table 38. Main concerns expressed by survey respondents regarding industry- and government-sponsored bulk package accident performance data collection program. 24% 25% 33% 38% 60% 76% 75% 67% 62% 40% 0% 20% 40% 60% 80% 100% Carriers Researchers Manufacturers Repair Facilities Shippers Preference (%) New Build off Existing Figure 19. Survey respondent preferences for new bulk package accident performance data collection program versus accident performance data collection built off of existing program. Main Concerns New Bulk Package Data Collection Program Built Off Existing Program • Maintain familiarity with reporting • Reduce amount of information reported • Newer reporting technology leads to a better understanding of events and better quality data • Quicker enactment • Ability to improve efficiency and simplify reporting • Reduce redundant reporting Table 39. Main concerns expressed by survey respondents regarding new bulk package accident performance data collection program and accident performance data collection built off of existing program.

67 • Option G: Industry-sponsored extension of Form DOT F 5800.1 with voluntary participation. • Option H: Industry-sponsored new database with man- datory participation. • Option I: Industry-sponsored new database with voluntary participation. Based on the survey results, Option G, an industry-sponsored extension of Form DOT F 5800.1 with voluntary participa- tion, was considered the most desirable by respondents. How- ever, Option B, a government-sponsored extension of Form DOT F 5800.1 requiring mandatory participation, is regarded as the best option to develop useful statistics within a suitable timeline. Both of these options are discussed further in the following section, together with the option to improve com- pliance with existing Form DOT F 5800.1 (Option A). Since these three options are based on extending Form DOT F 5800.1, a fourth option, Option D, a government-sponsored new database requiring mandatory participation, is also dis- cussed. These four options were critically examined to iden- tify the approach that was used in a pilot study. A preliminary prioritization of the approaches was devel- oped based on each approach’s pros and cons, taking into consideration the following five procedural issues: • Who would collect data. • How data would be collected. • Where it would be housed. • How privileged data would be protected. • Ease of implementation. Option A: Improved Compliance with Existing Form DOT F 5800.1 with Damage Reporting Modifications During the stakeholder interview process, Form DOT F 5800.1 was often identified by individuals and organizations as suitable for developing conditional probability of release and other useful statistical estimates. This would require the following: • Failure descriptions would be modified to include damage descriptions regardless of whether or not a release occurred. • Compliance would be increased in two areas: reporting that an accident had occurred and accurately reporting package design and accident characteristics. As mentioned in Section 2, Form DOT F 5800.1 collects approximately 70% of the information identified as essential for estimating conditional probability of release. The modi- fication of fields to record the damage type and identify the components damaged, regardless of whether or not a release provide data to populate a voluntary program. However, this positive response is from carriers who chose to participate in the survey. Consequently, the responses to this question may be skewed in favor of participation in another voluntary effort. Figure 20 shows the carriers’ greatest concerns with participation in a voluntary program. Shippers Of the seven shippers who responded to the survey, six (85%) indicated that they would, or most likely would, be will- ing to provide data to populate a voluntary program. How- ever, this positive response is from individuals who chose to participate in the survey. Consequently, the responses to this question may be skewed in favor of participation in another voluntary effort. The primary concerns identified by shippers are confidentiality, paperwork, and liability. Data Collection Process Options Combining the three dichotomous choices and the pos- sible option to improve compliance with the existing Form DOT F 5800.1 results in the following nine options: • Option A: Improved compliance with existing Form DOT F 5800.1 with damage reporting modifications. • Option B: Government-sponsored extension of Form DOT F 5800.1 with mandatory participation. • Option C: Government-sponsored extension of Form DOT F 5800.1 with voluntary participation. • Option D: Government-sponsored new database with mandatory participation. • Option E: Government-sponsored new database with vol- untary participation. • Option F: Industry-sponsored extension of Form DOT F 5800.1 with mandatory participation. Figure 20. Carrier concerns with participating in a voluntary program.

68 • Whether the type of damage sustained resulted in failure. • Damage location (on the tank). • Damaged components (replaces “What Failed” in Form DOT F 5800.1). • Whether the damage sustained by the component resulted in failure. Extending Form DOT F 5800.1 to include these additional variables would result in the ability to determine a reasonable estimate of the component-specific conditional probability of release combined with strategies to increase package per- formance in the event of an accident. In terms of the five procedural issues listed above, Option B can be described as follows: • Who Would Collect Data. Since most of the necessary information is collected in Form DOT F 5800.1, the most logical entity to collect the additional data is PHMSA; however, any government agency capable of making the reporting of accident data mandatory could also collect the additional accident data as long as the PHMSA report number was referenced in the extension database. • How Data Would Be Collected. The data would be sub- mitted to the government agency through an extended ver- sion of Form DOT F 5800.1 or a supplementary form. • Where Data Would Be Housed. The data would be housed in an updated version of the HMIRS database or a database that references the corresponding HMIRS report number. • How Privileged Data Would Be Protected. Since the option is an extension of Form DOT F 5800.1, the addi- tional data collected, similar to the data now stored in the HMIRS, would be subject to current Freedom of Informa- tion laws and would therefore not be protected, unless a “no-fault” provision is being used. • Ease of Implementation. Modifying the current Form DOT F 5800.1 to include the proposed fields would require an amendment to the current laws governing compliance. Therefore, this option may be difficult to implement because the process to change or establish new regulations must fol- low the procedures outlined in the Administrative Proce- dure Act. Option D: Government-Sponsored New Database That Is Independent of Form DOT F 5800.1 with Mandatory Participation This option focuses on methods to reduce the risk that data from a government-sponsored program would be used in a manner detrimental to database contributors. Reducing this risk could be achieved by using a “no-fault” system to report information regarding incidents and associated bulk con- tainer damage. In this system, access would be restricted, and occurred, would enable a general estimate of the conditional probability of release. However, the HMIRS (the database of accident reports submitted through Form DOT F 5800.1) is currently incomplete due to underreporting and the poor quality of reported information. In terms of the five procedural issues listed above, Option A can be described as follows: • Who Would Collect Data. PHMSA would continue to col- lect the accident data. • How Data Would Be Collected. The data would continue to be collected using Form DOT F 5800.1. • Where Data Would Be Housed. The data would be housed in PHMSA’s HMIRS database. • How Privileged Data Would Be Protected. The data fields in Form DOT F 5800.1 are non-privileged; therefore, pro- tection is not currently provided. • Ease of Implementation. PHMSA is currently working on updating the data-reporting process to improve data qual- ity (e.g., the responses would be selected from a drop-down list as opposed to a free-form data entry field). Addition- ally, PHMSA is working with other DOT organizations to facilitate incident identification, thereby ensuring greater compliance (reduce underreporting). Additionally, com- pliance officers may be employed to ensure greater report- ing compliance. Modifying the form to ask for damage type and identifica- tion of damaged components may be more difficult and time consuming to implement. It may require a formal notice, review, and comment process as described in the Adminis- trative Procedure Act. The previous change to Form DOT F 5800.1 took over 2 years to complete. Option B: Government-Sponsored Extension of Form DOT F 5800.1 with Mandatory Participation In addition to the information already collected using Form DOT F 5800.1 and the damage reporting modifica- tions discussed as part of Option A, the following variables, at a minimum, are identified as essential to estimating cargo tank performance: • Bottom accident damage protection. • Rollover accident damage protection. • Presence of jacket. • Jacket material. • Jacket thickness. • Insulation type. • Type of damage (replaces “Type of Failure” in Form DOT F 5800.1).

69 Option G: Industry-Sponsored Extension of Form DOT F 5800.1 with Voluntary Participation This option involves referencing records collected by PHMSA’s HMIRS and requesting data not included in Form DOT F 5800.1 that are required for determining cargo tank performance and estimating the component-specific condi- tional probability of release. This database would be devel- oped and maintained by a private sector organization or consortium of organizations on behalf of the carriers, ship- pers, and/or manufacturers of bulk packages transport- ing hazardous materials. There are two variations on this database that could be considered. In the first variation, the entire database would be consolidated. Carriers and/or ship- pers transporting hazardous materials would provide both accident damage information and package design informa- tion for all reportable incidents. Package design informa- tion would be limited to name plate and specification plate information as well as external visual information. The sec- ond variation would involve development of a separate data- base that contains package design parameters for all bulk packages. The advantage of this approach would be that the collection of more detailed information would be feasible. Accident data would be recorded using the extended Form DOT F 5800.1 as described above, but physical parameter data for the bulk packages involved would come from a sec- ond database. The ISO tank container information may be available from the UMLER provided they are all registered in that database. In this approach, the success of the acci- dent damage database would depend upon widespread par- ticipation in the package design parameter database. • Who Would Collect Data and How It Would Be Collected. In the first approach, a private sector organization would collect the accident damage information through an online or paper form. The process would require track- ing and follow-up that would take multiple months to complete, as different data sources became available. The data collection process would need to be standardized by employing consistent definitions and criteria. Using an online form would enhance data quality and result in more reliable statistical development in a shorter timeframe. In the second approach, package design information for all major models of cargo tanks would be collected initially and then kept up-to-date on an ongoing basis. Accident damage information would be collected from the carri- ers using the extended Form DOT F 5800.1 along with the vehicle identification number (VIN) of the tank involved. This VIN would be used to identify the appropriate pack- age design record from the tank characteristics database during data analyses. individual or company names and other details of the acci- dent that would enable identification of the parties involved would not be recorded. With this method, compliance with report submission would need to be addressed to ensure par- ticipation. Furthermore, the quality of data provided would need to be checked to encourage complete and consistent reporting. In terms of the five procedural issues listed above, Option D can be described as follows: • Who Would Collect Data. This option calls for mandatory data reporting by industry. A government agency would be required to carry out the compliance checks to ensure that reports are being submitted for all crashes in which the lading retention system is damaged. • How Data Would Be Collected. To ensure confidential, mandatory reporting, an electronic form could be cre- ated that would provide the necessary quality checks for complete and consistent reporting. This could be achieved by providing options from which a respondent selects the most appropriate response and limiting the number of free-form answers. Furthermore, the new program would include a method for conducting compliance checks to ensure the reporting of all highway incidents involving the bulk transportation of hazardous material and resulting in damage to the lading retention system. • Where Data Would Be Housed. There are multiple options for how the data could be stored. In a confidential report- ing system, the data would be vetted for completeness and consistency prior to submittal of the incident report. Fur- thermore, there may be no possibility of correcting sub- mitted reports. Therefore, the “no-fault” factual data could be added to the database and made available to the public upon receipt of the report. • How Privileged Data Would Be Protected. Many details of an accident that enable the identification of the parties involved (e.g., individual or company name and date and location of the accident) are not required for estimating cargo tank performance and developing component-specific conditional probability of release. With a new data base, focused solely on data fields that enable the development of cargo tank performance estimates, an anonymous report- ing system could be developed. The data collected would be available to the public per the current Freedom of Informa- tion laws; however, anonymity could be maintained due to the large number of bulk hazardous material incidents that occur per month (approximately 132 per month). • Ease of Implementation. Since this option requires estab- lishing new regulations, according to the procedures outlined in the Administrative Procedure Act, the implementation might require a lead-time of 2 or more years. The database would also be less flexible for subsequent modifications.

70 adjusted to add, subtract, or modify fields as the need arises. However, not all respondents will have reliable, convenient Internet access, so a paper-based system will also be needed. For these cases, a printable version of the data entry form should be made available. Selected Data Collection Process for Further Implementation The four approaches to data collection—Option A: Improved compliance with existing Form DOT F 5800.1 with damage reporting modifications, Option B: Government-sponsored extension of Form DOT F 5800.1 requiring mandatory partici- pation, Option D: Government-sponsored new database that is independent of Form DOT F 5800.1 with mandatory partici- pation, and Option G: Industry-sponsored extension of Form DOT F 5800.1 with voluntary participation—were presented to the HM 07 project panel. The panel members were asked to evaluate the four options based on the following criteria (see Appendix D): • Primary evaluation tools for HM 07: – Ease of implementation. – Program utility. • Criteria required for success: – Participant acceptance. – Preservation of anonymity/confidentiality. – Participation in program/compliance. – Accuracy and completeness of the reports. – Container type representation. • Cost/benefit criteria: – Value of program realized by sponsors. – Cost of program. • Long-term capability criteria: – Stability/longevity of program. – Ability to expand program to evaluate other factors affecting hazardous materials release. Using the evaluation criteria above, the panel suggested undertaking a more detailed consideration of the feasibility and efficiency of Option B: Government-sponsored exten- sion of Form DOT F 5800.1 with mandatory participation. This represents a logical option that would incorporate some means to compel participation. It is possible and preferable that participation be compelled through an industry-based agreement. The details of the possible implementation of Option B with a Level 4 degree of data refinement (as defined in Appen- dix D), plus fields describing the extent of damage and pack- age breach, as discussed in Section 2, are examined here in further detail. The information to be collected for the database • Where Data Would Be Housed. The accident damage data in both approaches would be housed with a private sector organization. The first approach would store basic package design information along with the accident dam- age database, while the second approach calls for a separate database. • How Privileged Data Would Be Protected. Potential mea- sures to protect any sensitive or proprietary information include using a flexible submittal deadline, limiting access to the database, controlling use of the information, approv- ing all analysis of the information, and controlling the analysis distribution. A flexible submittal deadline involves allowing for information to be updated or submitted after potential litigation has been completed. The system would need to allow for updates to the initially submitted report. Time-based reminders may be beneficial as they encourage contributors to complete the initial report once litigation has finished. Access to information in the database could be limited to information provided by the requestor. For example, an individual company would only be able to view its own submitted accident reports. Only individuals employed by or authorized by the organization would have access to the entire database and only under strictly con- trolled terms of confidentiality. An oversight panel selected by the sponsoring organization would strictly control use of the database and the specifications for any analyses to be commissioned. When using this database users would be required to – Redact information superfluous to determining bulk package performance when combining information in the HMIRS and the extension information. – Only present information in aggregate. – Submit to oversight panel review and approval of all proposed analyses. Finally, completed analyses would be reviewed and approved by the panel who would also decide on distribu- tion of results of each study. • Ease of Implementation. Option G depends upon the will- ingness of industry organizations to host such a database, encourage their members to participate in such an effort, issue appropriate access to companies and consultants, and bear the associated costs. One benefit of such a system is that alterations to the data collected (such as adding or subtracting data fields) may be implemented within a short timeframe. PHMSA staff members are currently updating their data- reporting system to incorporate more multiple choice options and pull-down menus, rather than free-form individual answers. This will improve consistency and probably the reli- ability and completeness of reporting as well. Such capabil- ity is best supported by an online program that can be easily

71 package performance database (see Table 40). At a minimum, the bulk package performance database should include a link to the Form DOT F 5800.1 report, a report submittal time- stamp to track participation, and a variable to record whether the information submitted was verified. General Package Design Characteristics Several general highway bulk package design characteris- tics are already available in the existing Form DOT F 5800.1 records (see Table 41). These include the following: • The response to Question 24 identifies the type of bulk package. • The response to Question 26a identifies the specification of the bulk package. • The response to Question 27 identifies the number of com- partments in the package. • The response to Question 28 identifies the package’s gen- eral material type. These general bulk package design characteristics could be imported from PHMSA’s HMIRS into the highway bulk package performance database. Additionally, the bulk package performance database should indicate whether a cargo tank is mounted on a trailer or on a chassis (see Table 42) and whether or not the bulk package is jacketed. Compartment-Specific Design Characteristics Individuals reporting a bulk package accident using Form DOT F 5800.1 are instructed to identify the capacity of the package in Question 27 and working pressure, shell thickness, head thickness, and type of valve or device (if it failed) in Question 28. However, for packages with multiple com- partments, not all of the compartments would be damaged or compromised in an accident. Therefore, the specific design characteristics for each compartment in the pack- age should be collected (see Table 43). This information can be found on the specification plate associated with each compartment. is identified and grouped according to logical associations. A review is also conducted of the following: • Implementation considerations, such as offering logical response options based on previous responses; • A possible prototype database management system includ- ing an appropriate schema for storing recorded accident and incident data; and • Security access control considerations. Collection of Data A new addendum to Form DOT F 5800.1, for the purposes of evaluating highway bulk package performance, would be used to collect information in the following categories: • Administrative variables. • General package design characteristics. • Compartment-specific design characteristics. • Commodity information. • Damage information. • Accident information. The specific data for these categories are discussed in subse- quent sections. PHMSA’s HMIRS includes much of the pack- age design, commodity, and accident information needed for evaluating package performance. Additionally, for those inci- dents that have resulted in a release, the database also includes identification of components that failed. These variables could be imported into the bulk package performance database for incidents in which the bulk package consists of a single con- tainer. However, the underreporting and data quality issues in PHMSA’s HMIRS need to be addressed prior to use in the addendum. The bulk package performance database would be focused solely on highway bulk package performance. Therefore, it would not contain information for other modes. Fur- thermore, in the data set created by information gathered through the addendum, a single report might contain infor- mation corresponding to more than one commodity if an incident involves a multi-compartment bulk package. This differs from the current HMIRS which contains a report for each commodity transported by the bulk package at the time of the accident. Finally, the database created by information gathered through the addendum would include bulk tank capacity and commodity quantity by compartment instead of commodity type. Administrative Variables As with the existing databases, administrative variables would be necessary to properly track information in the bulk Variable Possible Responses PHMSA Incident ID Numerical Value Report Time-stamp Date and Time Quality Check Verified Not Verified Table 40. Administrative variables.

Variable Possible Responses Packaging Type Cargo Tank Portable Tank General Material Type Aluminum Stainless Steel Carbon Steel Composite Materials Combination Cargo Tank Specification Cargo Tank Portable Tank DOT 406 MC 306 DOT 407 MC 407 DOT 412 MC 312 MC 331 MC 338 Asphalt Cargo Tank Compressed Gas Tube Trailer Other T1 T2 T3 T4 T5 T6 T7 T8 T9 T10 T11 T12 T13 T14 T15 T16 T17 T18 T19 T20 T21 T22 T50 T75 DOT Specification 51 DOT Specification 56 DOT Specification 57 DOT Specification 60 IM 101 – IMO Type 1 IM 102 – IMO Type 2 IMO Type 5 Cryogenic Tank Container – IMO Type 7 Tube Module Other Number of Compartments Cargo Tank Portable Tank 1 2 3 4 5 6 N/A Table 41. General package design characteristics available from existing Form DOT F 5800.1 fields.

73 Damage Information The accurate recording of damage information is neces- sary to develop bulk package statistical performance met- rics, regardless of whether the damage resulted in the release of lading. When responding to Question 25 in Form DOT F 5800.1, the individual currently identifies which component failed, how it failed, and the cause of the failure. However, damage information for incidents that did not result in a release and information concerning the location of the fail- ure are not recorded in the current Form DOT F 5800.1. Thus, the bulk package performance database should record the general location of the damage (see Table 48). To assist with the selection of the appropriate damage location, illus- trations could be provided—such as those shown in Fig- ures 21, 22, and 23. For each location where damage was sustained, the damaged components should be recorded (see Table 49). For the purposes of increasing the quality of the information collected, the possible responses should be tailored so that only a logical list of components is avail- able for selection. For each damaged component, the type, dimensions, and whether the damage resulted in a release of lading should be indicated (see Table 50). Finally, if the damage resulted in a release of lading, the amount of lading To ensure data quality, the available responses for material thickness (see Table 44) could be provided for various general material types. Additionally, the available responses for working pressure (see Table 45) could be provided for some specifications. Commodity Information Commodity information from Form DOT F 5800.1 can be imported from PHMSA’s HMIRS (see Table 46) if there is only one compartment. In Question 16, the individual reporting the accident identifies the hazard class and divi- sion. In Question 17, the material’s identification number is reported. The material’s packing group is reported as part of Question 18. Finally, the amount of hazardous material in the package is reported as part of Question 27. It is impor- tant to note that the accident data collection system presented here calls for commodity information to be provided for each compartment. Thus, a package that contains more than one type of commodity will have only one record in the general accident data set. Furthermore, providing logical responses from which the reporter must choose will improve the quality of the record. Variable Possible Responses Mounting Trailer Mounted Truck Mounted Jacketed Yes No Cargo Tank Portable Tank Other Spec CT Text-entered N/A Other Spec PT N/A Text-entered Table 42. Other general package design characteristics. Variable Possible Responses Tank Capacity Text-entered numerical value Tank Capacity Units of Measure GCF (Gas—Cubic Foot) LGA (Liquid—Gallon) Head Material (as listed on spec. plate) Text-entered Shell Material (as listed on spec. plate) Text-entered Front Head Thickness See Table 44 Rear Head Thickness See Table 44 Top Shell Thickness See Table 44 Side Shell Thickness See Table 44 Bottom Shell Thickness See Table 44 Working Pressure See Table 45 Table 43. Compartment-specific package design characteristics.

74 Material Thickness Range (Inches) Corresponding Gauges Aluminum 0.100 inches to 0.500 inches 10 gauge (0.102 inches) 9 gauge (0.114 inches) 8 gauge (0.129 inches) 7 gauge (0.144 inches) 6 gauge (0.162 inches) 5 gauge (0.182 inches) 4 gauge (0.204 inches) 3 gauge (0.229 inches) 2 gauge (0.258 inches) 1 gauge (0.289 inches) 0 gauge (0.325 inches) 00 gauge (0.365 inches) 000 gauge (0.410 inches) 0000 gauge (0.460 inches) Stainless Steel 0.100 inches to 0.500 inches 12 gauge (0.109 inches) 11 gauge (0.125 inches) 10 gauge (0.141 inches) 9 gauge (0.156 inches) 8 gauge (0.172 inches) 7 gauge (0.187 inches) 6 gauge (0.203 inches) 5 gauge (0.219 inches) 4 gauge (0.234 inches) 3 gauge (0.250 inches) 2 gauge (0.266 inches) 1 gauge (0.281 inches) 0 gauge (0.312 inches) 00 gauge (0.344 inches) 000 gauge (0.375 inches) 0000 gauge (0.406 inches) 00000 gauge (0.437 inches) 000000 gauge (0.469 inches) Carbon Steel 0.100 inches to 0.240 inches 12 gauge (0.105 inches) 11 gauge (0.120 inches) 10 gauge (0.134 inches) 9 gauge (0.149 inches) 8 gauge (0.164 inches) 7 gauge (0.179 inches) 6 gauge (0.194 inches) 5 gauge (0.209 inches) 4 gauge (0.224 inches) 3 gauge (0.239 inches) Composite Materials 0.100 inches to 0.500 inches N/A Combination 0.100 inches to 0.500 inches N/A Table 44. Material thickness response options. and the dimensions of the breach should be recorded (see Table 51). However, if multiple components release lading, the quantity lost from each of the leaking components may be difficult to ascertain. Accident Information Basic accident information is currently recorded on Form DOT F 5800.1. Question 37 requests the estimated speed of the bulk package prior to impact and whether the vehicle overturned. A bulk package performance database should also record whether an object struck the bulk package or the bulk package struck an object, the type of object, and the object’s speed (if appropriate) (see Table 52). Technical Implementation Considerations A modern data collection system could take advantage of the capabilities offered by information technologies and systems to improve the quality of reported data and the

75 Specification Pressure Range DOT 406 or MC 306 2.65–2.99 psig 3.00–3.49 psig 3.50–4.00 psig DOT 407 or MC 307 25–29 psig 30–34 psig 35–40 psig DOT 412 or MC 312 5–9 psig 10–14 psig 15–19 psig 20–25 psig MC 331 100–199 psig 200–299 psig 300–399 psig 400–500 psig MC 338 23.5–99 psig 100–199 psig 200–299 psig 300–399 psig 400–500 psig All Others Text-entered numerical value (in psig) Table 45. Working pressure response options. Variable Possible Responses Hazardous Class Class 1—Explosives Class 2—Gases Class 3—Flammable Liquids (and Combustible Liquids) Class 4—Flammable Solids, Spontaneously Combustible Materials, etc. Class 5—Oxidizing Substances and Organic Peroxides Class 6—Toxic Substances and Infectious Substances Class 7—Radioactive Materials Class 8—Corrosive Substances Class 9—Miscellaneous Hazardous Materials/Products, Substances or Organisms Non-Hazardous Hazardous Division See Table 47 Packaging Group I II III Hazardous Material Identification Number NA or UN plus a text-entered numerical value consisting of four digits Packaged Amount Text-entered numerical value Packaged Amount Unit of Measure GCF LGA Table 46. Commodity information. ease of reporting. For the bulk package performance data- base proposed here, appropriate technical capabilities may include dynamically adjusting the availability of questions and responses based on logic and previous responses, providing a text-based area for special cases, and performing automatic quality checks as much as possible. Logical Presentation of Questions and Responses The reporting form can be designed to offer logical choices by dynamically adjusting which fields are displayed based on responses to earlier questions. This would improve responders’ efficiency and reduce errors. The following fields are candidates for such a dynamic form: • Any field collecting text-entered information correspond- ing to “Other” responses could be hidden if “Other” is not selected. • A question asking whether the package is truck or trailer mounted can be hidden if “Portable Tank” is selected as the bulk package type. • Compartment-specific bulk package design questions can be hidden for all compartments greater than that selected. • Questions regarding a commodity’s hazardous divi- sion could be hidden until the hazardous class has been selected. • Diagrams and questions corresponding to the damaged area could dynamically reflect the type of bulk package involved in the accident. At a minimum, damaged areas are recommended to be based on selections of “Portable Tank,” “Cargo Tank,” and “Truck Mounted,” or “Cargo Tank” and “Trailer Mounted.” A fuller implementation of this concept may designate damaged areas based on the bulk package specification and number of compart- ments, in addition to how the bulk package was mounted (if appropriate).

Hazardous Class Possible Responses Class 1—Explosives Division 1.1—Explosives with a Mass Explosion Hazard Division 1.2—Explosives with a Projection Hazard Division 1.3—Explosives with Predominantly a Fire Hazard Division 1.4—Explosives with No Significant Blast Hazard Division 1.5—Very Insensitive Explosives with a Mass Explosion Hazard Division 1.6—Extremely Insensitive Articles Class 2—Gases Division 2.1—Flammable Gases Division 2.2—Non-Flammable, Non-Toxic Gases Division 2.3—Toxic Gases Class 4—Flammable Solids, Spontaneously Combustible Materials, etc. Division 4.1—Flammable Solids Division 4.2—Spontaneously Combustible Materials Division 4.3—Water-Reactive Substances/Dangerous When Wet Materials Class 5—Oxidizing Substances and Organic Peroxides Division 5.1—Oxidizing Substances Division 5.2—Organic Peroxides Class 6—Toxic Substances and Infectious Substances Division 6.1—Toxic Substances Division 6.2—Infectious Substances Table 47. Possible responses for hazardous division. Possible Responses Cargo Tank (see Figures 21 and 22) Portable Tank (see Figure 23) 1 - Front Head Damage Below Centerline 2 - Front Head Damage on Centerline 3 - Front Head Damage Above Centerline 4 - Front Head Destroyed 5 - Rear Head Damage Below Centerline 6 - Rear Head Damage on Centerline 7 - Rear Head Damage Above Centerline 8 - Rear Head Destroyed 9 - Bottom Front Driver-Side Damage 10 - Bottom Middle Driver-Side Damage 11 - Bottom Rear Driver-Side Damage 12 - Top Front Driver-Side Damage 13 - Top Middle Driver-Side Damage 14 - Top Rear Driver-Side Damage 15 - Bottom Front Passenger-Side Damage 16 - Bottom Middle Passenger-Side Damage 17 - Bottom Rear Passenger-Side Damage 18 - Top Front Passenger-Side Damage 19 - Top Middle Passenger-Side Damage 20 - Top Rear Passenger-Side Damage 21 - Damage to Piping and/or Undercarriage Below the Tank 1 - Head Damage Below Centerline 2 - Head Damage on Centerline 3 - Head Damage Above Centerline 4 - Head Destroyed 5 - Shell Destroyed 6 - Damage at Either End on Bottom Half of Tank 7 - Damage at Center on Bottom Half of Tank 8 - Damage at Either End on Top Half of Tank 9 - Damage at Center on Top Half of Tank 10 - Damage in Vicinity of Sump Table 48. Damage locations. Figure 21. Example illustration of damage locations for a trailer-mounted cargo tank. Figure 22. Example illustration of damage locations for a truck-mounted cargo tank.

77 Possible Responses Cargo Tank Portable Tank Tank Head Tank Shell Air Inlet Bolts and Nuts Bottom Outlet Valve Check Valve Cover Discharge Valve or Coupling Excess Flow Valve Fill Hole Flange Frangible Disc Fusible Pressure Relief Device or Element Gasket Gauging Device Heater Coil High Level Sensor Hose Hose Adaptor or Coupling Inlet (Loading) Valve Lifting Lug Liner Liquid Line Liquid Valve Loading or Unloading Lines Locking Bar Manway or Dome Cover Mounting Studs O-Ring or Seals Piping or Fittings Shear Section Pressure Relief Valve or Device—Non-Reclosing Pressure Relief Valve or Device—Reclosing Remote Control Device Sample Line Sump Thermometer Well Threaded Connection Vacuum Relief Valve Valve Body Valve Seat Valve Spring Valve Stem Vapor Valve Vent Washout Weld or Seam Other Tank Head Tank Shell Bolts and Nuts Bottom Outlet Valve Check Valve Chime Closure (e.g., Cap, Top, or Plug) Cover Frangible Disc Fusible Pressure Relief Device or Element Gasket Gauging Device Hose Inlet (Loading) Valve Lifting Lug Liner Loading or Unloading Lines Manway or Dome Cover Outer Frame Piping or Fittings Pressure Relief Valve or Device—Reclosing Threaded Connection Vacuum Relief Valve Weld or Seam Other Table 49. Component damaged. Figure 23. Example illustration of damage locations for a portable tank. • Identification of components damaged within a damaged area could be hidden until that part of the bulk package is selected. • Questions concerning the damage type, its dimensions, and whether or not a release occurred could be hidden until a particular component is selected. • Questions concerning the amount released and the dimen- sions of the breach could be hidden until a release had been verified. • Questions concerning the speed of the object impacting the bulk package could be hidden until a type of object with the ability to move has been selected.

78 Variable Possible Responses Damage Type Abraded Bent Burst or Ruptured Cracked Crushed Failed to Operate Gouged or Cut Leaked Punctured Ripped or Torn Structural Torn Off or Damaged Vented Unknown Other Damage Width Text-entered Numerical Value Damage Width Units of Measure Inches Feet Damage Height Text-entered Numerical Value Damage Height Units of Measure Inches Feet Damage Depth Text-entered Numerical Value Damage Depth Units of Measure Inches Feet Whether Damage Resulted in a Release Yes No Table 50. Damage information collected for each component damaged. Variable Possible Responses Amount Released Text-entered Numerical Value Amount Released Units of Measure GCF (Gas—Cubic Foot) LGA (Liquid—Gallon) Breach Width Text-entered Numerical Value Breach Width Units of Measure Inches Feet Breach Height Text-entered Numerical Value Breach Height Units of Measure Inches Feet Table 51. Information collected for each component resulting in release. Logical Responses and Quality Checks Presenting logical responses based on previous responses reduces the time and effort it takes to fill out a report and improves data quality. This can be achieved by making the selection of responses accessible using drop-down menus and/ or check box or radio button graphical user interfaces. How- ever, where it is possible that not all of the responses have been provided, an “Other” field should be available and followed by a field in which text can be entered. Additionally, whether or not responses are adjusted dynam- ically, a series of quality checks should be conducted upon submission of the report to ensure that the responses are congruent. Variables influencing responses include the following: • Packaging type (cargo tank or portable tank) influences which specifications will populate the responses for the vari- able “Tank Specification” and whether the number of com- partments within the bulk package can be greater than one. • General material type—whether aluminum, stainless steel, carbon steel, composite materials, combination, or other— causes the responses for head and shell materials and their associated thicknesses to be populated. • Tank specification, itself a subsidiary of “packaging type,” should adjust the available ranges of working pressure from which the reporter can choose. Furthermore, the commod- ity information for each tank type should be reflected in the available responses for the commodity-related variables. • Hazard class and division, packaging group, and hazard- ous material identification number influence each other. The ideal form would allow the reporter to respond to the variable of their choice and adjust the available responses for the remaining variables accordingly. • Tank capacity bounds the packaged amount. • Packaged amount bounds the amount released. • The damaged component selected limits the damage type and dimensions (including damage width, height, and depth). • The damage dimensions restrict the dimensions of the breach. • If the bulk package was struck by an object, that object must not be stationary. Prototype Database Management System A prototype database management system was developed using Microsoft Access to provide a framework in which to record accident data. This basic framework illustrates a meth- odology for storing information collected as part of the pilot study; however, it requires further enhancement to enable data collection by the online form to be mapped directly to the database management system. Schema for Storing Recorded Data The envisioned schema for storing recorded data consists of six tables (see Figure 24): • Administrative variables. • General design characteristics. • Compartment-specific package design characteristics. • Compartment-specific commodity information. • Basic accident information. • Damage information.

Variable Possible Responses Vehicle Speed Prior to Crash • 0–4 mph • 5–9 mph • 10–14 mph • 15–19 mph • 20–24 mph • 25–29 mph • 30–34 mph • 35–39 mph • 40–44 mph • 45–49 mph • 50–54 mph • 55–59 mph • 60–64 mph • 65–69 mph • 70–74 mph • 75–79 mph • 80 mph or greater How Vehicle Speed Was Established • Obtained from Vehicle Data Recorders • Estimated Based on Speed Limit • Driver Estimated • Other Overturned • Yes • No Whether the Bulk Package Was Struck by or Struck an Object • An Object Struck the Bulk Package • The Bulk Package Struck an Object Impacting Object Object Struck the Bulk Package Bulk Package Struck an Object • Passenger Vehicle • Heavy Vehicle • Other • Passenger Vehicle • Heavy Vehicle • Roadway • Ground • Concrete Barrier • Guard Rail • Lighting Pole • Other Speed of Impacting Object Prior to Crash Passenger Vehicle or Heavy Vehicle Other Objects • 0–4 mph • 5–9 mph N/A • 10–14 mph • 15–19 mph • 20–24 mph • 25–29 mph • 30–34 mph • 35–39 mph • 40–44 mph • 45–49 mph • 50–54 mph • 55–59 mph • 60–64 mph • 65–69 mph • 70–74 mph • 75–79 mph • 80 mph or greater How the Impacting Object Speed Was Established • Obtained from Vehicle Data Recorders • Estimated Based on Speed Limit • Driver Estimated • Other N/A Table 52. Accident information.

80 In this database schema, each cargo tank involved in an accident is assigned a separate incident identification num- ber. Due to the nature of the data collected in the Adminis- trative Variables, General Design Characteristics, and Basic Accident Information tables, one record corresponding to each reported accident is expected. Should this methodol- ogy be incorporated into the Form DOT F 5800.1 reporting system, these data sets could be combined directly with the existing HMIRS. The number of records in the Compartment-Specific Pack- age Design Characteristics and Compartment-Specific Com- modity Information tables corresponds to the number of compartments for each recorded incident. For error checking and analysis purposes, these two data sets should also be linked using the compartment number. It is proposed that damage information be stored in such a way that there may be multiple listings of a particular dam- age location because multiple components within that area may be damaged. The number of records in this data set will be the product of the number of reported accidents (repre- sented by the number of unique PHMSA Incident IDs), the number of areas damaged on the cargo tank, and the num- ber of components damaged. Caution should be exercised in the interpretation of the responses stored in this data set as Figure 24. Prototype database management system.

81 an incident resulting in a release will also contain records of non-release damage. Security Access Controls The implementation of this prototype database manage- ment system may require, at a minimum, three levels of access: administrator access, reporter access, and public access. Administrator access would enable database owners to provide access to other users, create back-ups of the data sets, imple- ment data quality checks, correct errors, track the number of views the data set generates, and link to data sets generated by other organizations. By necessity, this level of access should have the greatest amount of security. Reporter access is granted to those individuals or companies who will be required to sub- mit a report. Access can be granted on a per-accident basis or to all bulk package transporters. Distinguishing between reporters and the general public ensures that data validity will be maintained. Finally, public access is the most general type of access. Currently, PHMSA allows free access to its data via an online form. An alternate approach is to provide access through a third party, similar to the approach employed by FMCSA. Prior to the implementation of such a database, there should be careful consideration of the level of public accessibility. The decision about whether to share raw or processed data with the pub- lic should be weighted with possible confidentiality concerns. Additionally, if automatic data checks are not implemented, it may be desirable to institute a manual quality check prior to making the data publicly available. To ensure that individuals (1) are allowed to access the system, (2) access the system from an appropriate connec- tion, (3) have permission to utilize the data/system in a par- ticular manner, and (4) generate an activity log should data security become a concern, security access controls should be incorporated. Access to the system is typically ensured using a login identification coupled with a password. This is particularly important for administrator access to pre- vent actions such as deleting or maliciously altering col- lected data. Administrative access may also be restricted to within a company firewall to maintain data integrity. The same requirement is not anticipated to be necessary for reporter or public access; however, limiting access to within the United States may be considered. Granting permissions to utilize the data/system in a particular manner is necessary to ensure that the database is used appropriately. Therefore, the general public should be restricted to reading database contents and viewing a directory of the database contents. Reporters should have limited authorization to create new reports or update existing reports that they have previously submitted. Another method to ensure that the database is used appropriately is to generate an activity log. The activ- ity log should include the time and date of changes to the data set as well as who initiated the changes and what was changed. Thus, should accidental changes occur, they can be undone and progress tracking can be accomplished. Activity logs can also be used to count the number of views or down- loads of the accident damage data and gather information concerning the individuals accessing the public documents, thus enabling administrators to determine how best to present the data. Pilot Study The potential collection of this bulk package accident dam- age data was explored using a pilot study. The purpose of the pilot study was to evaluate the quality of data expected from such a data collection system, to identify improvements to the data collection system itself, to demonstrate the types of analyses that could be facilitated by the database, and to estimate the period of time required to collect incident data sufficient to support reasonable statistical analyses. To achieve these goals, an online pilot data collection tool was developed (see Appendix E). Invitations to participate in the pilot study were sent to NTTC members, Dow Chemi- cal Company carriers, and individuals who had submitted Form DOT F 5800.1 corresponding to highway bulk package accident. Each pilot study participant was asked to provide one or two reports concerning accidents that may or may not have resulted in the release of hazardous materials. They were informed that recording non-release incidents was as impor- tant as recording incidents in which there was a hazardous materials release. Non-release accident information enables identification of accident scenarios during which certain materials and components do not fail. On the other hand, the recording of accident information for an incident that resulted in a release enables identification of accident scenarios during which tank components fail. Due to a low level of participation in the pilot study, an alternative method for gathering bulk package accident performance information was employed to supplement the number of accident reports gathered by the data collection tool. This alternative method consisted of a manual review of NTSB reports and information gathered from multiple sources including PHMSA HMIRS reports, FMCSA MCMIS reports, and news articles. Pilot Data Collection Tool The online data collection tool was developed using a combination of Hypertext Markup Language (HTML), Cas- cading Style Sheets (CSS), PHP, and JavaScript. The data col- lection tool incorporated several dynamic features but was not designed to automatically perform quality checks. Instead,

82 like clarification concerning the available responses, they should refer to the tab marked “Pilot Test Supplemental Infor- mation.” If the information was not there, they were requested to leave a comment so that this information could be provided in the future. Finally, participants were informed that because this was a pilot study, quality checks had not been built into the data collection tool. Therefore, participants were asked to take measures to ensure that they had responded cor- rectly. Participants were also asked to provide their contact information so that clarification could be obtained should an unexpected result be received. They were once again informed that all contact information provided would remain confidential and be removed from the data set containing the results of the pilot study after the information had been corroborated. Data Collection Pages The pilot data collection tool consisted of the following four sections (see Appendix E): • Bulk package design information. For cargo tanks, this section recorded information that was visually detected or listed on the cargo tank name plate. To clarify what information was requested, an example name plate was included. For portable tanks, this section recorded infor- mation that was found either visually, stamped on the tank’s head or a separate placard, or provided as part of the container specifications. • Basic commodity information. This section recorded information found in shipping papers associated with the commodity transported at the time of the accident. • Bulk container damage information. This section recorded information on the damaged area(s) and components, as well as the type of damage incurred in the accident and the amount of lading lost. Several dynamic form features were used, including the following: – Displaying the appropriate damage location image for a portable tank, a trailer-mounted cargo tank, or a truck- mounted cargo tank, depending on the package type selected. – Not displaying questions associated with undamaged components. – Not displaying questions associated with damage type and subsequent fields until the damage location had been selected. – Not displaying damage dimensions and questions concerning a release until the damage type had been selected. – Not displaying bulk package breach dimension questions until a release had been verified. quality checks were conducted manually. Participants were encouraged to provide contact information (with the stipula- tion that all contact information would remain confidential) so that they could be contacted if manual quality checks revealed a need for additional information. Additionally, participants were assured that the contact information provided would only be used to verify responses to the pilot study and not for any purpose beyond the pilot study. The pilot data collection tool was designed to enable bulk package accident damage information to be collected accu- rately and with minimal difficulty for pilot study participants. However, the project team envisions the incorporation of several additional features in a fully implemented system. To identify useful features, participants were also asked to share their ideas on how to improve the collection process through a series of comment boxes. Pilot Data Collection Tool Launch Site All invitations to participate in the pilot study directed the participant to a website that introduced the project and provided information about the types of information to be requested as part of the pilot study. (Screenshots of the sec- tions of the pilot study data collection tool that are discussed here and below can be seen in Appendix E.) From the web- site’s home page, participants could access the pilot data col- lection tool to submit a report. Pilot Data Collection Tool Instructions Upon accessing the pilot data collection tool, participants were instructed to forgo using their browser’s “back,” “for- ward,” or “refresh” commands prior to submitting the report. This was necessary because the data collection tool was not sophisticated enough to prevent a resetting of the form when the browser refreshed a page, thereby causing their responses to be erased (see Appendix E). The participant was then directed to the instruction page for the data collection tool (see Appendix E). The participant was again reminded not to leave the page or refresh their browser prior to submitting their information because doing so would cause the information entered to be lost. They were informed that the submit button could be found on the “Accident Information” tab, once the type of bulk package was identified. To start, the participant was asked to identify the type of bulk package. Once the type of bulk package was identified, additional fields appeared that were specific to the type of package selected. After completing the fields specific to the package type, the participant was asked to proceed to the “Bulk Package Information” tab. The instructions also informed participants that if they were unsure what information was being requested or would

83 • Basic accident information. This section recorded infor- mation concerning the object impacting the bulk package, speeds of the vehicle(s) involved in the accident (when applicable), and whether the bulk package rolled over. Note that the pilot data collection tool did not display location-specific components. Supplemental Information To further clarify what information was being requested, a supplemental information page was included in the pilot data collection tool. The intention was to provide responses to ques- tions or comments that previous participants had included in the comments fields. Initially, however, the only supplemental information provided was the example specification plates for a cargo tank or portable tank, corresponding to the type of bulk package initially identified (see Appendix E). Pilot Study Report Generation The pilot study was designed to collect accident dam- age information that was volunteered by bulk package owners; however, despite extensive efforts to reach out to multiple individuals, the level of participation was unsat- isfactory. Therefore, the project team employed alternative methodologies to generate pilot study data and populate the database. Accident reports from the NTSB along with information gathered from sources including PHMSA HMIRS reports, FMCSA MCMIS reports, and news articles were used. Pilot Study Reports Using Information from NTSB Accident Investigations Reports from several accidents investigated by NTSB contain some information concerning the bulk packages involved— specifically, commodity information and basic accident infor- mation. The reports do not contain release quantity or design information. Detailed damage information, if not included in the report text, was described based on a manual review of photographs included in the reports. The reports included in the pilot study are the following: • Highway Accident Report, Largo, Maryland—September 6, 1985. • Hazardous Materials Accident Brief for Accident No. DCA-09-FZ-001 (2009). • NTSB Report—Collision of Tractor/Cargo Tank Semi- trailer and Passenger Vehicle and Subsequent Fire, Yonkers, New York—October 9, 1997. • Overturn of a Tractor-Semitrailer (Cargo Tank) with the Release of Automotive Gasoline and Fire, Carmichael, California—Feb 13, 1991. • Rollover of a Truck-Tractor and Cargo Tank Semitrailer Carrying Liquefied Petroleum Gas and Subsequent Fire, Indianapolis, Indiana—October 22, 2009. • Propane Truck Collision with Bridge Column and Fire, White Plains, New York—July 27, 1994. Pilot Study Reports Using Information from Multiple Sources Information from multiple sources was used to develop reports of sample accidents occurring between March and October 2011. Selected accidents were reported to PHMSA, and photographs of the extent of damage to the bulk packages were collected through news articles. Additionally, FMCSA reports were used to supplement basic accident information. Between March and October 2011, a total of 68 accidents reported to PHMSA were also found in news articles (links to the news articles are included in Appendix F). Photos and other footage of the bulk package involved in the accident vary with respect to how well they illustrate damage to the bulk package. Therefore, not all damage to the bulk package could be determined using the photos and descriptions gathered. In general, only the most severe damage type was identified in descriptions of the accident. Additionally, in several instances, the approximate location of the damage or breach was esti- mated based on the final position of the bulk package. Some accident reports provided insufficient information from which to generate a pilot study report. In all, 44 reports were gener- ated from a combination of PHMSA HMIRS, news articles, and FMCSA MCMIS information. However, these reports typically do not contain compartment-specific information with the exception of bulk packages that consisted of only one compartment. Therefore, compartment-specific design and release information was not included in the pilot study report. Improvements to the Pilot Data Collection Tool Through the collection of accident reports, the following improvements to the pilot data collection tool were identified: • Enable use of browser navigational tools so that data entered by a user is “saved” if the user accidently uses the browser’s “back,” “forward,” or “refresh” buttons. • Include “Quenched and Tempered Steel” as an option in the general material type. • Adjust thickness ranges to include up to 0.5 inches for all material types.

84 – Non-collision, downhill runaway. – Non-collision, cargo loss or shift. – Non-collision, explosion or fire. – Non-collision, separation of units. – Non-collision, cross median/centerline. – Non-collision, equipment failure (brake failure, blown tires, etc.). – Non-collision, other. – Non-collision, unknown. – Collision involving pedestrian. – Collision involving motor vehicle in transport. – Collision involving parked motor vehicle. – Collision involving train. – Collision involving pedalcycle. – Collision involving animal. – Collision involving fixed object. – Collision with work zone maintenance equipment. – Collision with other moveable object. – Collision with an unknown moveable object. – Other. Conclusion A number of potential data collection process options were evaluated, and a more detailed consideration of the feasibility and efficiency of Option B: Government-sponsored exten- sion of Form DOT F 5800.1 with mandatory participation was explored through the development and implementation of a pilot study. The main purposes of the pilot study were to evaluate the quality of data expected from such a data collec- tion process, and identify improvements to the data collec- tion system itself. • Include a mechanism that automatically fills in responses if the design parameters are the same for all compartments within the cargo tank. • Enable the commodity fields to be automatically filled in once sufficient information is gathered in one field (i.e., if the commodity’s hazardous material identification number is filled in, the hazardous class and division number and packaging group should automatically populate the appro- priate fields). • Dynamically list relevant bulk package components within the area impacted. This will simplify reporting and increase the accuracy of the reports. • Enable more than one type of damage to be selected for each component. • Include fire as a damage type. Vehicles involved in acci- dents can also be exposed to fire, which may cause the temperature in the immediate vicinity of the bulk pack- age to increase beyond the melting point of bulk pack- age components. Should a vehicle fire be sufficiently hot, bulk packaging may melt and result in a release although the bulk package may have escaped damage in the initial accident. • Utilize FMCSA’s accident event descriptions together with an event order. This would eliminate the need for indicat- ing whether the bulk package struck or was struck by an object and replace the identification of the object impacting/ impacted by the bulk package. Include the angle of colli- sion if involved in a collision with a moveable object. Event IDs provided in FMCSA correspond to the following types of events: – Non-collision, ran off road. – Non-collision, jackknife. – Non-collision, overturn (rollover).