CBR-Spill RISK: Model to Calculate Crude-by-Rail Probabilities and Spill Volumes

A series of well-publicized US and Canadian crude-by-rail (CBR) accidents during 2013 and 2014 brought forward the issue of CBR risk (Table 1). Several additional accidents with spillage then occurred in 2015 into 2016. Most recently, a CBR spill occurred in Mosier, Oregon. The occurrence of these accidents in apparent rapid succession when there had been no publicized oil rail accidents in previous years heightened concerns about continuously increasing risks of CBR transport, especially in the aftermath of the July 2013 Lac-Mégantic accident in Quebec which resulted in 47 fatalities (TSB Canada 2014). Even incidents involving smaller spill volumes, especially those that involved fire, have created apprehension about CBR traffic through populated areas.

Transport of oil by rail is not an entirely new practice. During the 1980s into the 2000s, railroads transported about 4.4 million barrels (bbl) of oil annually (Etkin et al. 2015a). The majority was refined petroleum (e.g., diesel fuel) rather than crude. On average, annual rail transport involved about 15.4 million bbl-miles of crude and 360 million bbl-miles of refined products, for a total of 375.4 million bbl-miles. This transport generally occurred with isolated tank cars in mixed-manifest freight trains. Between 2005 and 2015, there was an 84-fold increase in oil transport by rail. The dramatic change has occurred through the use of key trains and unit trains. Key trains contain at least 20 oil tank cars; unit trains exclusively carry 80 to 120 oil tank cars. In 2005, there was one 20-car key train operating in the US daily. By 2012, there were seven daily unit trains. By 2014, this had increased to more than 14 daily unit trains, though since 2014, numbers have decreased somewhat due to economic factors. With increased oil transport by rail, there have been more opportunities for spills. Historical US oil spillage volumes are in Figure 1. The data in Figure 1 are from ERC’s spill databases, which are aggregated from a number of federal, state, and industry databases. At the same time, the average annual oil spillage per amount transported by rail has decreased by 93% since the 1990s and by 82% since the 2000s (Figure 2). [The data in Figure 2 are based on ERC spill data and transport data from US Energy Information Administration.] However, with the nature of the crude being transported – heavier Canadian oil sands and highly flammable Bakken crude from North Dakota – there is great concern about spill events and their impacts.

For predicting future CBR spills, a series of probabilities are involved. First, there is the probability of an accident (primarily derailment, but also collisions and other types), then, the probability that the accident involves tank cars rather than just locomotives. Spill volume depends on the probability distribution of tank car numbers involved, probability of release, and volume probability distributions. The CBR-SpillRISK model incorporates these probabilities into a fault-tree analysis applied with a Monte Carlo simulation to encompass distributions of values and uncertainties.

Because of a paucity of data on CBR spill incidents, freight trains were used as a proxy for CBR unit trains. The basic approach of analyzing accidents and cargo release probabilities has been applied in several other studies (Etkin et al. 2015a, 2015b; Saat et al. 2014; Saat and Barkan 2006). Forty-five years of Federal Railroad Administration (FRA) freight train accident data were used to determine frequency of rail accidents, numbers of cars derailed per accident, and probability of spillage from tank cars in an accident. The FRA accident data included numbers of rail cars derailed in accidents regardless of cause. “Derailment” is the primary classification of most accidents. However, even accidents that have a different primary classification, such as collision or highway-rail crossing accident, may have cars that derail. Since derailment of cars, regardless of the cause of the derailment, can cause damage to tank cars so that their contents are released, numbers of derailed cars were considered in the analysis.

Five basic types of accidents were included in the analyses – derailments, collisions, fire-explosion events, highway-rail accidents, and miscellaneous events. (The fire/explosion category include fires, violent ruptures, or detonations occurring as primary events, but not accidents in which spills ignite or explode secondarily.) This analysis uses the term rail “accidents” in keeping with industry terminology. A total of 59,379 accidents occurring on main line track during 1975 through 2015 were analyzed. Accidents analyzed include derailments, collisions, highway-rail crossing accidents, and other events that resulted in damages to trains, rails, systems, or personnel. In this vain, the term “accident” is used to denote an event that is unplanned, but results in consequences of concern. Applying the term “accident” to a rail event does not imply that the event was unavoidable or could not have been prevented in some manner. The accident could be caused by human error, faulty equipment, weather, and other factors.

A brief analysis of accident rates from loaded and unloaded freight trains was conducted to determine if there was a significant difference (Table 2). (Note that only accidents in which there were reported to have been hazmat cars, a total of 9,707 incidents were included in this analysis.) Assuming that there are roughly an equal number of loaded and empty trains, an accident is about twice as likely with a loaded train. There is a higher accident probability with a loaded train for all accident types except for highway-rail crossing accidents. Overall probability data for accidents by type are in Table 3. These probabilities were then apportioned by loaded and empty trains as per Table 2, with the results shown in Table 4 for loaded trains that would be carrying crude oil cargo. Data in Tables 2 – 4 are ERC analyses of relevant subsets of FRA data.

The calculated probabilities of rail accidents were based on historical data that may not be completely relevant for future CBR operations for a number of reasons. CBR unit trains are operated differently from other freight trains with respect to maximum speed and other factors. CBR unit trains act differently from other freight trains with respect to lateral stability. Operators have made and plan capital improvements on rail lines. And, most importantly, a number of safety improvements have been, or will be, in place due to federal and state regulations.

Safety measures, especially positive train control (PTC), track upgrades, and wayside detectors, would work together in the prevention of rail accidents, as some have been already, to reduce accidents relative to historical rates. The reduction factors of PTC, track upgrades, and wayside detectors, are not truly independent from one another. For this reason the reduction rates cannot be simply added together as an additive reduction factor. The adjustments to accident probability for CBR transport that were considered in this analysis are summarized in Table 5.

The factor that has been attributed with the greatest potential reduction in accidents is PTC, which is estimated to prevent anywhere from two to 80% of accidents. Wayside detectors work together with PTC to prevent accidents. The wayside detectors provide information to the PTC system so that trains can be stopped or controlled to prevent an accident when irregularities are detected. For this reason, wayside detectors have not been separately added in to the adjustment factor. Their benefit is assumed to be largely related to the way in which they interact with the PTC system. Likewise, track upgrades include, to some extent, the installation of wayside detectors and other components of PTC. Some aspects of track upgrades from FRA Class 3 to 4 involve replacing, repositioning, shoring up, and repairing track to allow for safer operation of trains at greater speeds. If one assumes that track upgrades, which are largely already in place in many locations, form the baseline of adjustment factors (75% reduction factor applied to historical rates), additional benefits of PTC may increase that only slightly. Any accidents not already prevented by track upgrades may be prevented by full implementation of PTC (with wayside detectors). If track upgrades, even without fully-implemented PTC, are indeed at least half effective, a minimum effectiveness of 37.5% can be assumed.

The factor that can reasonably be considered independent is enhanced braking, which may have a minimal (0.007%) to 3.7% reduction in accidents. This is an aspect of the train itself rather than track infrastructure and overall operating system. Electronically-controlled pneumatic (ECP) braking was considered an additive factor in this analysis. On the other hand, the greater lengths of the CBR trains (100 to 120 cars) have been shown to increase the likelihood of an accident over more typical 80-car freight trains. For the 100-car train, the probability of accidents is estimated to increase by 12.4%; for the 120-car trains, the probability is estimated to increase by 24.7%. These increases in accidents somewhat counteract the reductions realized by the various safety measures. The final adjustment factors for rail accidents are in Table 6.

Rail accidents involving hazmat tank cars, such as those used to transport crude oil, do not necessarily result in the release or spillage of any hazardous materials. The next phase of the probability analysis involved determining the release probability in the event of an accident involving CBR tank cars. To determine the probability of a release from tank cars, an analysis of 3,589 rail accidents involving loaded tank cars was conducted with the results shown in Table 7.

There were 11,352 hazmat cars damaged or derailed with 2,418 releasing material. In 66.2% of accidents involving hazmat cars, there was no release from damaged or derailed cars. The spillage/release probability depends on the type of accident and the time period.

The probability that there would be spillage in the event of a rail accident needs to be adjusted for the particular circumstances of current and future CBR transport since tank car release probabilities are based on historical data with older tank car designs.

Hazardous material release accidents decreased significantly between 1980 and 1993 with earlier improvements, and then remained relatively steady until another drop in 2008 (Barkan 2008a; Barkan et al. 2013). Overall there has been a 90% decrease in spillage with improvements in tank car safety design, as well a substantial reduction in accidents. Much of this reduction in spillage may be attributable to the reduction in accidents. The reduction depends on the specific time period analyzed. An analysis on data from 1985 –2004 showed an 85% reduction in the release rate and a 44% decrease in the accident rate (Barkan 2008a).

A significant emphasis has been placed on reducing the likelihood of spillage from CBR trains with the implementation of safer tank car designs, emphasizing an increase in wall thickness (Barkan 2008a; Hughes et al. 1998). The effectiveness of the new tank car designs were estimated by Pipeline and Hazardous Materials Safety Administration (PHMSA), as in Table 8. In another analysis, the conditional probabilities of release were found to be as in Table 9. Estimated reductions in release probabilities from the newer design tank cars are in Table 10.

Barkan et al. (2015) estimated average release probability for tank cars that meet DOT-117 specifications to be 85% compared with current non-jacketed DOT-111 car. The enhanced design is also expected to considerably reduce the likelihood of secondary failures caused by fire. Thermal protection systems on tank cars limit heat flux to the tanks when exposed to fire, reducing the likelihood of product release. Train speed also affects the probability that a derailment will result in tank car spillage (Kawprasert and Barkan 2010; Liu et al. 2014). At slower speeds, fewer cars would be expected to release material. Table 11 summarizes spill probability adjustments applied in the CBR spill probability analysis.

When a rail accident occurs in transit, there are varying numbers of cars that may be involved. An analysis of the numbers of freight cars involved in derailments and other accidents was conducted. Based on the national FRA accident data (Etkin et al. 2015b), the probability distributions of number of cars and percentage of total cars were developed, as in Table 12. Speed is also an important factor in determining number of cars that derail in an accident (Anderson and Barkan 2005). For this reason operating speeds are being limited on CBR transits.

When a tank car is breached, the entire contents may not necessarily be released to the environment. The amount released depends specifically on the size of the puncture or tear in the tank, its location, the orientation of the car (upright, at an angle or on its side or end), the volume of fluid in the tank, as well as the characteristics of the fluid (e.g., its viscosity and pour point) at the prevailing environmental conditions (primarily air temperature).

Treichel et al. (2006) found that in one-third of cases, only 5% of the tank car contents is released, and that in one-third of cases, 80 to 100% is released. The remaining one-third releases between 5 and 80%. Saat and Barkan (2005) combined conditional probability of release with percentage release. The analyses indicated that the conditional probability of release (i.e., spillage in the event of derailment) was 0.117, and that 62% of the tank capacity would be lost, respectively. Multiplying these values together netted a 7.25% average tank capacity release risk for tank-caused accidents. With an average tank capacity for DOT-111 cars of 717.7 bbl, this would mean an average release risk per derailment of 52 bbl. Liu et al. (2014) assumed a Poisson binomial probability distribution of the number of tank cars that would release material with a mean of 1.83 cars.

The percentage of release from individual tank cars and the numbers of tank cars involved, in combination with the amount of oil contained in each tank car, will determine the total amount of oil released to the environment. The actual volume of crude oil in each tank car may vary depending on: oil type and density; tank capacity based on model design; degree to which each tank car is filled (to allow for air space); and total weight limit allowed per car (gross rail load). The tank capacity is not necessarily the amount of crude that would in practice be contained in an individual car, because there is a maximum total gross weight (empty tank car plus cargo) allowed. The gross rail load (GRL) is set by regulations at 131.5 tons and for heavy axle load at 143 tons. This weight limit exists regardless of the commodity carried. Typically, the nominal capacity (tare weight) of a tank car is about 33 tons, which allows for 110 tons of cargo. The volume depends on the density of the commodity. In the case of Bakken crude (°API 43.67), 110 tons is the equivalent of 776.8 bbl. However, this exceeds the tank capacity. A fully-loaded DOT-117 or CPC-1232 tank car filled to a 675.5-barrel capacity weighs 70.6 tons. Regardless of tank capacity, cars of crude oil are generally loaded to allow for air space so the oil can expand with temperature differences during transport. Older tank cars (unjacketed DOT-111) generally are loaded with 690 barrels of Bakken crude. For newer DOT-117 tank cars, the expected loading volume is 650 barrels. This takes into account a 4% expansion space.

The analyses of rail accidents and spills, as well as the various CBR adjustments all informed the inputs for the final spill probability modeling in CBR-SpillRISK. The basic fault-trees were solved with Monte Carlo simulations. This allowed for distributions of values and uncertainties to be incorporated into the analysis rather than solely static values. The calculations were made in accident and spill frequencies per train-mile. Adjustments to accident and release probability are summarized in Figure 3.

Rail accident-related inputs into CBR-SpillRISK model are in Table 13. Pre-adjustment accident rates are the highest and lowest rates for 1995–2015. Accident numbers per million train-miles were apportioned into accidents with loaded and empty trains based on Table 2.

Since accident rates are on a per train-mile basis, CBR accident numbers for the US needed to be calculated from estimated national CBR train-miles. (In an assessment for a particular project, train-miles can be varied based on the numbers of trains expected.) With no definitive data on nationwide CBR train-miles, it was assumed that of the approximately 600 million annual freight train-miles, 3% could be apportioned to CBR traffic (based on CBR as part of overall freight transported by rail). With an estimated 18 million train-miles for CBR traffic, “low” and “high” accident estimates in Table 14 are based on low and high adjusted accident probabilities in Table 13. It was estimated that there may be 2.9 to 16.8 accidents per year with loaded CBR trains, or the equivalent of a loaded CBR accident once every one to four months. Note that these accidents would not necessarily result in spillage.

Tank car release (spill) probability inputs into the CBR-SpillRISK model are in Table 15. Release probabilities were based on Table 7 for 1985–2015, with adjustments based on Table 11. The expected frequencies of spills (of any volume) are in Table 16. The end result is that there would be expected to be 0.1 to 2.6 crude spills – or one spill every three months to nine years – from loaded CBR trains annually on a national basis. The higher estimate of spill frequency is based on more “pessimistic” assumptions about the effectiveness or installation of the various safety measures designed to reduce accidents and releases from CBR trains. The vast majority of accident reduction measures has already been implemented, or will be in place in the next year or two, though the universal availability of the safest tank cars is still in question. The frequencies of spills in Table 16 assume 18 million train-miles for CBR traffic nationally, as is currently the case. If CBR traffic were to further decrease or to increase again, based on economic factors that drive this traffic, expected spill frequencies would change. To project spill rates for future traffic, the spill frequencies per million train-miles are provided in Table 17.

The second part of the CBR-SpillRISK modeling involved deriving the probability distribution of potential spill volumes (CBR-SpillRISK-V). Assuming that a spill occurs, the volume can range from very small up to a much larger, or potentially worst-case, discharge. For a loaded CBR unit train, the maximum spillage is based on the number of tank cars and the volume to which each tank car is loaded. Tank car volumes depend on design and maximum weight load allowed. Volume of the weight load will depend on the oil type and its density. Actual load varies from 650 to 675.5 bbl. The model, CBR-SpillRISK-V, was based on:

where, N_total = total number tank cars; P_involvment =% tank cars involved in accident; Volume_car = volume content of tank car; and %Outflow = percentage of release of tank car contents.

Each variable has an associated value distribution. 500,000 Monte Carlo simulations of CBR-SpillRISK-V were run for each accident type based on criteria in Table 18. The estimate for the expected CBR spill volume probability distribution for loaded trains is described in Table 19. Each spill frequency value needed to be apportioned to the distribution of spill volumes.

The estimate of annual probabilities and return periods for spills of different volumes for loaded CBR trains are in Table 20. With the average annual spill frequency of 0.11 to 2.6 for loaded CBR trains nationally, there is a 10% chance that the spill would involve 20,000 bbl or more. This means that annually, there is a 0.01 to 0.26 probability of a 20,000 bbl or larger crude oil spill from a loaded CBR train. The expected recurrence interval or return period of such a spill scenario is 4 to 89 years. Note that the largest US CBR spill to date is roughly half the size of the 90^th percentile volume. The Lac-Mégantic spill in Quebec approached the 95^th to 99^th percentile spill volume, though there are a large number of reasons that this type of incident is much less likely in the US, especially with planned and existing mitigation measures in place.