DRAFT REPORT
HAZARDOUS WASTE
TANK FAILURE MODEL:
DESCRIPTION OF METHODOLOGY
-------
This page intentionally blank
-------
TABLE OF CONTENTS
CHAPTER 1 — INTRODUCTION
1.1 - Overview
1.2 - Methodology
1.3 - Report Outline
Page
1
1
2
4
CHAPTER 2 -- PRELIMINARY ANALYSES
2.1 - Introduction
2.2 - Design Characteristics of
Existing Hazardous Waste Tanks
2.3 - Storage and Treatment Processes
2.4 - EPA's Proposed Hazardous Waste
Tank Regulations
2.5 - Tank Failure Mechanisms
5
5
5
8
22
24
CHAPTER 3 — FAULT TREES
3.1 - Introduction to Fault Tree Analysis
3.2 - Selection of Fault Tree Events
3.3 - Hazardous Waste Tank Fault Trees
30
30
33
33
CHAPTER 4 — MONTE CARLO SIMULATION MODEL
4.1 - Introduction
4.2 - User Inputs
4.3 - Probability Sampling
4.4 - Fault Tree Event Probabilities
4.5 - Tank Corrosion Model
4.6 - Pipe Corrosion
4.7 - Pump and Valve Corrosion
4.8 - Erosion
4.9 - Gasket Disintegration
4.10- Hole Sizes and Locations
4.11- Leak-Rate Calculations
4.12- Leak Detection
62
62
66
83
87
117
137
152
153
154
156
161
165
CHAPTER 5 — RECOMMENDATIONS FOR ADDITIONAL RESEARCH
5.1 - Possible Modifications to the Model
5.2 - Caveats
180
180
185
BIBLIOGRAPHY
189
-------
APPENDIX A -- PROBABILITY AND RELEASE VOLUME CALCULATIONS
APPENDIX B « STATISTICAL ANALYSIS OF PACE TANK CORROSION DATA
APPENDIX C — TANK FAILURE CASE STUDIES
APPENDIX D -- SYSTEM DESIGN SPECIFICATIONS
APPENDIX E — COMPUTER CODE
-------
LIST OF TABLES
Page
Table 1. Classification and Characterization
of Existing Hazardous Waste Tanks 6
Table 2. 15 Most Common Treatment Processes
by Total Capacity 9
Table 3. 15 Most Common Treatment Processes
by Number of Tanks 10
Table 4. Tank System Failure Matrix:
External Environmental Stresses 26
Table 5. Tank System Failure Matrix:
Internal Environmental Stresses 27
Table 6. Tank System Failure Matrix:
Design, Construction, and Operation
Errors 28
Table 7. Reorganization of Failure
Mechanisms for Use in Fault Trees 34
Table 8. Fill/Discharge, Level Control, and
Emerging Shut-Off Systems 53
Table 9. Frequency of Filling a Nearly-Full
Tank for Various Tank Systems 55
Table 10. User Inputs for Hazardous Waste Tank
Failure Model 67
Table 11. Dimensions for Tanks of Various
Capacities and Construction Materials 77
Table 12. Tank Wall Thicknesses 79
Table 13. Basic Event Probabilities 89
Table 14. Effect of Tank Design on Localized
Exterior Corrosion 119
Table 15. Effect of Tank Design on Generalized
Exterior Corrosion 121
Table 16. Effect of Tank Design on Localized
Interior Corrosion 123
111
-------
List of Tables (Continued)
Page
Table 17. Effect of Tank Design on Generalized
Interior'Corrosion 124
Table 18. Cumulative Time-to-Failure Distributions
for Quarter-Inch Underground Steel Tanks 126
Table 19. Computation of SAV 127
Table 20. Coated Underground Tanks: Time-to-Failure
Distribution for Quarter-Inch Steel Tanks
Following the Failure of an Exterior Coating 132
Table 21. Effect of Pipe System Design on Localized
Exterior Corrosion 139
Table 22. Effect of Pipe System Design on Generalized
Exterior Corrosion 141
Table 23. Effect of Pipe System Design on Localized
Interior Corrosion 143
Table 24. Effect of Pipe System Design on Generalized
Interior Corrosion 144
Table 25. Erosion Rates for Tanks, Pipes, and Pumps 155
Table 26. Initial Hole Dimensions and Hole Locations
for Various Classes of Failures 157
Table 27. Soil Parameters for Underground Leaks 164
Table 28. Leak Detection Parameters 171
Table 29. Hydrogeologic Parameters for Various
Soil Types 177
Table 30. Changes Which May Be Incorporated into
Future Versions of Our Model 181
-------
LIST OF FIGURES
Page
Figure 1. Storage (flow diagram) 11
Figure 2. Cyanide Oxidation (flow diagram) 12
Figure 3. Chrome Reduction (flow diagram) 13
Figure 4. Neutralization (flow diagram) 14
Figure 5. Distillation (flow diagram) 15
Figure 6. Evaporation (flow diagram) 16
Figure 7. Precipitation (flow diagram) 17
Figure 8. Symbol Legend 18
Figure 9. Fault Tree Event Symbols 31
Figure 10. Fault Tree Logic Gates 32
Figure 11. Hazardous Waste Tanks: Basic Fault Tree 35
Figure 12. Overflows (fault tree) 36
Figure 13. Leaks and Ruptures (fault tree) 41
Figure 14. Loss of System Contents Due to
External Catastrophe (fault tree) 48
Figure 15. Spill During Filling or Discharging
(fault tree) 49
Figure 16. Secondary Containment Failure (fault tree) 50
Figure 17. Flow Chart for Simulation Model 64
Figure 18. Beta Distributions 86
Figure 19. Basic Fault Tree for a 5000-Gallon
Underground Storage Tank 95
Figure 20. Overflow for a 5000-Gallon Underground
Storage Tank (fault tree) 96
Figure 21. Leaks and Ruptures for a 5000-Gallon
Underground Storage Tank (fault tree) 100
-------
LIST OF FIGURES (Continued)
Page
Figure 22. External Catastrophes for an
Underground Storage Tank (fault tree) 107
Figure 23. Accidental Spills for an Underground
Storage Tank (fault tree) 108
Figure 24. Overflows for a 5000-Gallon Treat-
ment Tank with 4 Batches per Day and
Manual Shut-Off 111
Figure 25. Overflows for a 5000-Gallon
Treatment Tank, Continuous
Operation with Automatic Shut-Off 114
Figure 26A. The Effect of Hole Diameter on
Leak Rates in Clay 166
Figure 26B. The Effect of Hole Diameter on
Leak Rates in Silt . 167
Figure 26C. The Effect of Hole Diameter on
Leak Rates in Sand 168
Figure 260. The Effect of Hole Diameter on
Leak Rates in Gravel 169
VI
-------
1.0 INTRODUCTION
1.1 Overview
Risks to human- health and the environment from the operation of hazardous
waste tank facilities may result from air emissions, leaks from tanks and
piping, or large spills or overflows. Some losses are relatively constant
baseline releases resulting from the facility's design or normal operating
practices. Other losses are more sudden and result in short-term high-
volume releases of concentrated material. Such releases may result from
natural catastrophes or from bursting pipes or ruptured tank seams. High-
volume releases are also possible from long-term undiscovered leaks. Such
leaks may linger for years at levels just below the detection threshold,
releasing thousands of gallons of hazardous waste into the environment.
The cause of release varies from incident to incident, but may include one
or more of the following:
o normal operating discharges or air emissions from the facility;
o equipment aging or deterioration from environmental exposure;
o human error in design, construction, installation, or operation;
o system-generated stresses due to incompatibilities between waste
constituents and equipment; or
o severe environmental stresses such as fires, floods, storms, or
earthquakes.
The purpose of this study is to evaluate the frequency and severity of
various failure mechanisms for a variety of hazardous waste treatment and
storage tank systems. To accomplish this objective, we used published
sources and our own engineering analyses to develop failure scenarios
(combinations of events leading to system failure) for each tank system.
We evaluated these scenarios using fault tree techniques and a Monte Carlo
simulation model to predict the probabilities, magnitudes, and concentra-
tions of releases over a 20-year operating life.
By modelling the reliability of various tank designs, the present study
will provide information to help the Agency develop regulations for the
1
-------
management of hazardous waste tanks.. The Agency can also apply our pre-
dicted release volumes to contaminant transport models and dose-response
models in order to estimate human health risks from various tank designs.
In addition, the Agency may combine these risk estimates with design and
operating cost- data to evaluate the cost-effectiveness of various regula-
tory approaches.
1.2 Methodology
This study involved two basic techniques: fault tree analysis and Monte
Carlo simulation.
Fault tree analysis is a common engineering method for evaluating the
reliability of complex systems. The first step in such an analysis is to
select a "top" or "ultimate" failure event. In the case of hazardous waste
tanks, such an ultimate failure involves the release of hazardous waste
from the tank system. This top event is then traced backward to identify
all relevant intermediate failure events which might lead to it. These.
events are in turn traced back to their antecedents, and the analysis is
continued until no further reduction is possible or no data are available.
The resulting chains of causation are the fault trees.
After the fault trees have been designed, the next step in fault tree
analysis is to estimate the frequency and timing of each of the basic
failure events. To do this, we used a combination of engineering analysis
and published tables of average service lives or annual failure rates for
various components of a tank system. Such data, however, did not enable
us to predict with certainty the date of failure for any particular piece
of equipment. There are two reasons for this: (1) many types of failure
are intrinsically probabilistic in nature; and (2) many others are not well
understood. Therefore, it was necessary for us to assign failure probabi-
lities to most of the events, rather than deterministic dates of failure.
Consequently, the frequency and timing of the top event is also stochastic
in nature, and its probability distribution is a mathematical function of
the initiating event probabilities.
-------
Many of the probabilities used in the model involve external events, such
as hurricanes or floods and are time-invariant. Other probabilities, such
as operator errors or electronic equipment failures, are also assumed to be
time-independent, either because their time variations occur over too short
a cycle to be-of interest to the model, or because the nature of their
time-dependencies is unknown. In some cases, however, the probability of
component failure may increase with time due to such factors as material
aging or accumulated environmental stresses. These failure event probabi-
lities may show complex time-dependencies.
The fault trees developed for this study will be described in detail in
Chapter 3. These fault trees model a number of mechanisms by which tank
releases can occur. These mechanisms include:
o Overflow
o Leaks and ruptures
o Natural catastrophes
o Releases from secondary containment
o Human error
We evaluated these fault trees by using a computerized Monte Carlo simula-
tion model. During each of the modeled time periods this computer model
determines the occurrence of each of the basic failure events by drawing a
random number. Using the fault trees, the computer then determines whether
the combination of basic failure events which has occurred is sufficient to
cause a release. If a release results, the computer calculates the volume
of hazardous material that escapes to the environment by first determining
the size of the hole (often this involves the selection of one or more
additional random numbers), and then calculating the leak rate appropriate
for the hole's size and location. The model then determines the time lag
until the leak is detected, either by visual inspection, inventory short-
fall, or other more sophisticated techniques. Multiplying this time lag by
the leak rate gives the total loss volume. Under no circumstances, how-
ever, is the leak volume allowed to exceed the sum of the tank's initial
contents plus additional deliveries during the detection period.
-------
The model then replaces any tank components whose failure is detected,
increments the ages of all surviving components by one time period, and
repeats the simulation process. As a result, it generates a time series of
releases from the modeled tank. This entire process is repeated hundreds
of times, producing a new time profile for each iteration in order to esti-
mate expected failures. The result is as though several hundred tank faci-
lities of similar design were being evaluated for their performance. The
resulting distribution of release profiles can be used to determine
average, median, and extreme cases. In addition, types, dates, and fre-
quencies of failure can be compiled, as well as expected release volumes
and their standard deviations.
1.3 Report Outline
The remainder of this report will discuss in detail the methodology of the
hazardous waste tank failure model. The results will be presented in a
separate report.
Chapter 2 of this report gives background information about existing hazar-
dous waste tanks. We used this information to determine what types of
facilities to model and what types of failure scenarios to include in the
fault trees. Chapters 3 and 4 describe the fault trees and the Monte Carlo
simulation model, respectively. Chapter 5 concludes the main body of the
report by discussing the model's limitations and proposing modifications
that might increase its range of applicability.
In addition, this report contains five appendices. Appendix A details the
derivation of the probabilities and release volumes used for the fault tree
events. Appendix B contains a statistical analysis of a survey of 300 ser-
vice station tanks, while Appendix C presents case study data on 57 hazar-
dous waste tank failures. Appendix D gives technical specifications for
the modeled components and tank systems, and Appendix E lists the computer
code for the Monte Carlo model. These appendices will be more thoroughly
described in subsequent sections of this report.
-------
2.0 PRELIMINARY ANALYSES
2.1 Introduction
Before designing the fault trees, we conducted several preliminary studies
to determine what elements should be built into our fault trees and our
Monte Carlo model. These studies included:
o A determination of the design characteristics of existing
hazardous waste tanks;
o An analysis of the processes for which these tanks are used;
o A review of the relevant regulations to determine what leak
prevention and detection techniques are of the greatest interest to
EPA; and
o A review of the relevant technical literature to determine the
types of failures to be incorporated into the fault trees.
2.2 Design Characteristics of Existing Hazardous Waste Tanks
Hazardous waste tanks fall into four basic categories: storage tanks,
treatment tanks, accumulation tanks, and small quantity generator tanks.
Based on the Office of Solid Waste's RIA Tank Survey and the Small Quantity
Generator Survey, we subdivided each of these categories according to tank
construction material, whether the tanks are above-, below-, or in-ground,
and whether the tanks have open or closed tops. As a result, we identified
21 basic types of tank systems. These systems are listed in Table 1, along
with their median ages and median capacities. Within each of these cate-
gories, however, system age and tank capacities showed considerable
variation. Tank ages and capacities are treated as variables in the model.
However, for the sake of simplicity, we have assigned fixed values for
these parameters in this study.
Not all of the tank systems characterized in Table 1 were specifically
identified by the two surveys. Waste accumulation tanks, for example, were
not distinguished from storage tanks. Since the only technical difference
between storage and accumulation tanks is the length of time between pump-
-------
TABLE 1: CLASSIFICATION AND CHARACTERIZATION
OF EXISTING HAZARDOUS WASTE TANKS
Tank
Function
Treatment
Storage
Small
Quantity
Generators
Design
Configuration
Closed top,
above-ground,
cradled
Open top,
above-ground,
cradled
Open top,
above-ground,
on-grade
Open top,
in-ground
Open top,
in-ground
Closed,
above-ground,
cradled
Closed,
above-ground,
on-grade
Below-ground
Below-ground
Below-ground
In-ground,
open
In-ground,
open
Above-ground,
closed
Construction
Material
Carbon steel
Carbon steel
Carbon steel
Concrete
Stainless steel
Carbon steel
Carbon steel
Carbon steel
Fiberglass
Stainless steel
Concrete
Carbon steel
Carbon steel
Median
Age (yrs)
10
10
Median Capacity
(gallons)
2,300
2,300
60,000
3,700
3,700
5,500
210,000
7
7
7
8
8
6
4,000
4,000
4,000
2,100
2,100
200
Below-ground
Carbon steel
200
-------
TABLE 1. CLASSIFICATION AND CHARACTERIZATION
OF EXISTING HAZARDOUS WASTE. TANKS (Cont.)
Tank
Function
Design
Configuration
Accumulation Above-ground,
cradled,
closed
Above-ground,
on-grade,
closed
Below-ground
Below-ground
Below-ground
In-ground
In-ground
Material of
Construction
Carbon steel
Carbon steel
Carbon steel
Fiberglass
Stainless steel
Concrete
Carbon steel
Median
age(yrs)
21
7
7
7
8
8
Median size
(gallon)
5,500
210,000
4,000
4,000
4,000
2,100
2,100
-------
outs, we assumed that the storage tank data could also be applied to accu-
mulation tanks. Similarly, since the Small Quantity Generator Survey
provides no information on tank' construction materials or design capacity,
we made the following simplifying assumptions. Since carbon steel is the
most common construction material revealed by the RIA survey, we assumed
that this material is also used for Small Quantity Generator tanks. We
estimated the design capacities of these tanks from through-put information
provided by the Small Quantity Generator survey.
The tank systems identified in Table 1 as "Treatment Tanks" are actually
used for a wide range of treatment processes. The most common of these
processes are listed in Tables 2 and 3 by design capacity and by number of
tanks, respectively. We selected six of these processes to model,
including distillation, neutralization, cyanide oxidation, chrome reduc-
tion, evaporation, and precipitation. In general, we selected the most
common processes, but we changed some of the categories used in Tables 2
and 3. Thus, we have combined precipitation, clarification, and sedimen-
tation into a single process which we will label as "precipitation." In
addition, because they are similar to short-term storage, we have elimi-
nated blending and decanting from further consideration. (Blending is
merely a method of combining wastes for later treatment or storage;
decanting is merely a method for separating unlike wastes.)
2.3 Storage and Treatment Processes
In order to provide a visual representation of the processes for which
hazardous waste tanks are used, we have developed flow diagrams for storage
tanks and for each of the six selected treatment processes. These flow
diagrams are presented in Figures 1 through 7. The symbols used in these
diagrams are explained in Figure 8. The flow diagrams are somewhat
simplified, but they help to illustrate the major components involved in
the modeled tank systems. We used these diagrams to develop the framework
for our computer model and to identify the effects of specific equipment
failures for each of the modeled tank systems. Based on these diagrams,
the computer model tracks the hazardous wastes as they pass through dif-
ferent stages of the tank system, checking for component failures at each
location where a release might occur.
-------
TABLE 2. 15 MOST COMMON TREATMENT PROCESSES BY TOTAL CAPACITY
Treatment Process or Combination of Processes
* Decanting
Clarification, Flocculation, Flotation
Clarification, Flotation
* Chemical Precipitation, Neutralization
Activated Sludge
* Clarification
* Neutralization
Clarification, Flocculation
Chlorination, Neutralization
* Sedimentation
Flotation, Sedimentation
Thickening
* Decanting, Filtration, Sedimentation
Flotation, Sedimentation, Evaporation,
Aerobic Tank
Chemical, Reduction, Flocculation, Flotation
All other technologies
Total
Sum of Design
Capacities (Gallons)
9,930,478
7,020,000
5,901,500
4,940,320
3,138,000
2,843,927
2,742,940
2,450,000
1,501,200
1,562,154
1,347,228
1,161,674
1,100,490
880,000
750,000
12,523,459
% of Total Capacity
16.6
11.7
9.9
8.3
5.2
4.8
4.6
4.1
2.5
2.6
2.3
1.9
1.8
1.5
1.3
20.9
Number
of Tanks
57
3
3
26
5
22
124
3
4
.16
10
10
15
2
3
571
59,793,370
100%
874
This process is also included in Table 3 (most common treatment processes by number of tanks).
-------
TABLE 3. 15 MOST COMMON TREATMENT PROCESSES BY NUMBER OF TANKS
Treatment Processes or Combination of Process
* Neutralization
* Decanting
Chemical Reduction
Chemical Oxidation
Blending
* Chemical Precipitation, Neutralization
Chemical Reduction, Degradation
Chemical Precipitation
Cyanide Destruction
* Clarification
Sedimentation, Blending
* Sedimentation
Evaporation
* Decanting, Filtration, Sedimentation
Chemical Reduction, Neutralization
All other technologies
Number
of Tanks
124
57
48
44
31
26
24
23
23
22
18
16
16
15
11
376
% of Total Number of Tanks
14.2
6.5
5.5
5.0
3.5
3.0
2.7
2.6
2.6
2.5
2.1
1.8
1.8
1.7
1.3
43.0
Sum of Designs
Capacities (Gallons
2,742,840
9,930,478
113,549
204,409
512,375
4,940,320
20,640
226,001
92,016
2,843,927
385,425
1,562,154
21,115
1,100,490
87,700
35,009,931
Total 874 100% 59,793,370
* This process is also included in Table 2 (most common treatment processes by total capacity).
-------
FIGURE 1. STORAGE
Waste
Storage Tank
AL. high level alarm
LI: liquid level indicator
* Closed tank is also equipped with an overflow valve.
-------
FIGURE 2. CYANIDE OXIDATION
Sodium Hydroxide
Waste Containing
Cyanide
From Storage
AL : high level alarm
PR: flow recorder
LI :level indicator
ORP : oxidation-reduction potential unit
pH : pH meter
Chlorine
Treated Waste
To Storage
* Closed tanks are also equipped with overflow valves.
-------
FIGURE 3. CHROME REDUCTION
Sulfurlc Acid
From Storage
Untreated Waste
From Storage
Sodium Metobisulfide
Acidification Tank
AL : high level alarm
FR : flow recorder
i! LI : level indicator
ORP: oxidation-reduction potential unit
pH : pH meter
ORP)
00
Chrome
Reduction
Tank
Treated Waste
(process continues
to neutralization
and precipitation
treatment steps)
-------
FIGURE 4. NEUTRALIZATION
Neutralizing Chemical
Waste From
Storage
AL : high level alarm
FR : flow recorder
LI :level indicator
pH : pH meter
OO
.AL,
^->>
LI
oo
.AL,
^->
LI
Neutralized Waste
* Closed tanks are also equipped with overflow valves.
-------
FIGURE 5. DISTILLATION
Organic Vapor
Waste From ^—.
Storage —( V
(containing /A—A^
organics)
en
Batch
Distillation
Vessel
AL : high level alarm
LI : level indicator
SP: sampling point
Tl : temperature indicator
Condenser
a-
Receiver Vessel
Steam
To Storage
Sludge Removal From
Vessel To Storage
At End of Process
* Closed tank is also equipped with an overflow valve.
-------
FIGURE 6. EVAPORATION
Waste From Storage
AL : high level alarm
LI :level indicator
Tl : temperature indicator
Evaporator
Steam
Waste Concentrate
-> To Storage
-------
FIGURE 7. PRECIPITATION
Precipitotlon ^—. ^
Chemical —f /v^j
Feed System /A—X^
Flocculotion
Agent
Waste From
Storage
Rapid Mix Tank
AL : high level alarm
FR : flow recorder
LI:level indicator
pH. pH meter
OO
D
a a
a
Flocculotor
Treated Waste
Clarifier
Sludge To Treatment
-------
FIGURE 8. SYMBOL LEGEND
CO
OO
High Speed Mixer
Slow Speed Poddle
Valve
Pump
Vent
-------
Storage and Accumulation Tanks
These tanks (Figure 1) are the simplest tank systems. EPA defines storage
tanks as tanks that store wastes for greater than 90 days, while accumula-
tion tanks are those that store wastes for less than 90 days. A storage
tank may continuously contain some waste, but an accumulation tank must be
completely emptied at least every 90 days.
Storage and accumulation tanks consist of three basic elements: a fill and
discharge system (either using pumps or gravity-feed), piping, and the
tank itself. The tank may be above-ground, in-ground, or below-ground and
may vary in size and material of construction, (see Table 1). The pipes
may be above-ground or below-ground, and the fill/discharge system may
include such features as liquid-level indicators, high-level alarms, or
automatic shut-off controls.
Treatment Tanks
Treatment tanks differ from storage and accumulation tanks by having addi-
tional equipment and by requiring more attention during process operations
when chemicals are mixed or added. The six selected treatment processes
are diagramed in Figures 2 through 7. The following discussions present
brief explanations of each of these diagrams.
Cyanide Oxidation, Chrome Reduction, and Neutralization. These processes
are diagramed in Figures 2 through 4, respectively. These treatment tech-
nologies can be discussed together because all three involve chemical pro-
cesses designed to render the waste less hazardous. The flow diagrams are
therefore similar, with each treatment process involving a two-stage tank
system as well as the storage tanks generally used for both untreated and
treated wastes.
The first of these processes, cyanide oxidation, involves the oxidation of
free cyanide to carbon and nitrogen. (Destruction of free cyanide to
cyanates is also possible; we did not model this process, however, because
cyanates are still somewhat toxic and may in some cases require further
treatment). Several oxidizing agents are possible, but in this model we
assume chlorine is used. For this process, an alkaline environment (pH of
19
-------
at least 8.5) is required to prevent the formation of an extremely toxic
gas, cyanogen chloride.
As is shown in Figure 2, the pH adjustment and the addition of chlorine
occur as two distinct phases of treatment. In the first phase, the pH is
adjusted to the desired level; in the second phase chlorine is added to the
waste and allowed to react for 90 minutes. The treatment efficiency
approaches 100 percent, but rather than specifying any given percentage, we
have left this variable as an input parameter for the model.
In a cyanide oxidation facility, the first tank can be open or closed, but
a vent and an overflow valve must be added if the tank is closed. A mixer
blends the pH-adjusting chemical (generally sodium hydroxide) with the
hazardous waste, and a pH meter monitors the results. Other tank
accessories include a level indicator and a high-level alarm. The second
tank is always closed because of the possibility of cyanogen chloride for-
mation if the pH has been improperly controlled. Like the first tank, this
tank has a vent, an overflow valve, a mixer, a level indicator, and a high-
level alarm. An ORP (oxidation-reduction potential) meter is also used to
determine when the chlorine has fully reacted with the cyanide.
Chrome reduction (Figure 5) is similar to cyanide oxidation. As with
cyanide oxidation, the pH must first be adjusted, this time by adding
sulfuric acid until the pH is between 2 and 3. The reduction of chromium
(VI) to the less toxic chromium (III) is then carried out in the second
tank by the addition of sodium metabisulfite. The resulting chromium
(III) can later be precipitated out of the waste stream.
Both the pH adjustment tank and the reaction tank can be open or closed,
and each has the same features as the equivalent cyanide oxidation tank,
including mixers, level indicators, high-level alarms, a pH meter on tank
1, and an ORP meter on tank 2.
Neutralization alone is not regulated as a hazardous waste treatment tech-
nology. It is modeled in this study, however, because neutralization must
be used to treat the highly acidic products of the chrome reduction pro-
cess. Neutralization is therefore a necessary adjunct to this treatment
process.
20
-------
A neutralization process is a two-stage procedure for adding a dilute solu-
tion of an acid or a base to move the waste's acidity into the range of pH
6 to 8. Half of the necessary neutralizing agent is added in each stage of
the process, and the mixture is allowed to react for thirty minutes. Both
tanks in the neutralization process are equipped with mixers, pH meters,
high-level alarms, level indicators, and overflow valves (if the tanks are
closed).
Evaporation, Distillation, and Precipitation. We can also discuss
distillation, evaporation, and precipitation together because these three
treatment technologies all involve the concentration of the hazardous
constituents for recovery or further treatment. The flow diagrams for
these processes are presented in Figures 5 through 7.
Evaporation and distillation are very similar treatment methods. Both use
a heat source to volatilize and separate a portion of the waste. In eva-
poration, the solvent (usually water) is evaporated, leaving the con-
centrated hazardous waste in the evaporator. In some cases the evaporator
is an open, outdoor tank using solar energy to evaporate the solvent.
Distillation also involves volatilization, but in this process the volati-
lized fractions are the hazardous materials, which must therefore be
collected for subsequent treatment or disposal. Sometimes, multiple
distillations may be used to separate and recover the various hazardous
constituents.
Precipitation is the most complex of the three "concentration" processes.
In the first step of this process, sodium hydroxide is added to the waste
to alter the pH to the level appropriate for the particular waste being
treated. The waste is then vigorously agitated and passed to a floc-
culating tank, where a flocculating agent is added to agglomerate the
solids. Slow mixing is used at this stage to assure adequate contacting
without breaking up the floes that have developed. From the flocculating
tanks the waste flows into a clarifier. Here, the solids settle to the
bottom and are removed as a sludge. The clarified liquid is the treated
waste. Thus, precipitation involves three tanks, all of which are equipped
with level indicators and high level alarms; the first two tanks also have
mixers.
21
-------
2.4 EPA's Proposed Hazardous Waste Tank Regulations
EPA has recently proposed revised regulations for hazardous waste tanks.
These regulations would apply to existing tank facilities seeking permits,
new tank facilities, and existing tanks operating under interim status.
Slightly different requirements would apply to each of these types of faci-
lities.
The proposed permitting standards for existing tanks include the following
features:
o The tank system's structural integrity would have to be assessed by
a qualified engineer.
o For metal tanks, this assessment would have to include a deter-
mination of the type and degree of corrosion protection needed to
ensure the integrity of the system for its intended life. (This
requirement would replace the minimum shell thickness requirements
currently in force).
o The facility would be required to either install full secondary
containment or implement a groundwater monitoring program.
o Facilities that elect to use a groundwater monitoring program
instead of full secondary containment would still be required to
install partial, secondary containment for any above-ground portions
of their systems. In addition, such facilities would also need to
test the integrity of their underground components every six
months.
o Facilities that have secondary containment would be required to
maintain leak detection systems capable of detecting leaks within
24 hours.
o All tanks subject to the 90-day accumulation provisions of 40
C.F.R. §262.34 would be required to have full secondary
containment.
The proposed permitting requirements for new tank systems address similar
concerns, as do the proposed regulations applying to tanks under interim
22
-------
status. The primary differences between the regulations for new tanks and
those for existing tanks are that new tank systems would have no alter-
native to the installation of secondary containment, would be required to
install corrosion protection, and would be required to obtain expert cer-
tification of proper installation. Facilities with interim status would be
required to meet requirements similar to those applicable to existing
facilities seeking permits, except that interim status facilities would be
given six months to implement the necessary changes.
In order to assure the effectiveness of these permitting standards, EPA
proposes to revise the inspection regulations to require that structures or
devices required under the new regulations, such as corrosion protection
devices and leak detection systems, be periodically inspected. In addi-
tion, these revisions would require owners and operators to establish
schedules for assessing the integrity of above-ground and in-ground tanks
and to establish procedures for responding to leaks once they are detected.
As the preceding discussion indicates, the proposed regulations incorporate
a number of technological features. These features include:
o partial secondary containment,
o full secondary containment,
o groundwater monitoring,
o corrosion protection,
o periodic visual inspections,
o leak testing, and
o leak detection.
The purpose of our Tank Failure Model is to evaluate the effectiveness of
these options, either alone or in combination. Although it is possible to
include all of these features in a single simulation model, the ground-
water monitoring options have not been directly included in our model.
Because groundwater monitoring does not affect tank failure probabilities
or frequencies the Hazardous Waste Tank Failure Model does not simulate
these scenarios. Instead, the Agency will examine how these regularory
options influence riask using the Hazardous Waste Tank Risk Model.
23
-------
2.5 Tank Failure Mechanisms
In addition to reviewing EPA's proposed tank regulations, we also reviewed
the relevant technical literature for information on system and component
reliabilities and failure modes. This review focused on the causes, con-
sequences, and probabilities of failure, as well as on the magnitude of
release once failure occurs.
Our literature search used the following sources and data bases:
o PRA's in-house library;
o University of Minnesota libraries;
o COMPENDEX (computer search);
o National Technical Information Service (computer search); and
o Pollution Abstracts (computer search).
Based on both a manual search of more recent periodicals and the computer
searches, we obtained, reviewed, and abstracted those articles that we
deemed pertinent to this study. The Bibliography to this report lists
these sources. The PRA report titled "The Analysis of Component Failures
of Hazardous Waste Storage and Treatment Systems: Annotated Bibliography,"
(Draft, July 1984), contains the abstracts.
We also reviewed and abstracted case studies of particular failure inci-
dents. In reviewing these case studies, we were primarily interested in
determining the following:
o a description of the incident;
o the cause of the release;
o the identity of the released materials;
o the duration of the incident;
o tank design and operating characteristics;
o environmental conditions; and
o the geologic characteristics of the subgrade materials.
Appendix C summarizes these case studies.
24
-------
Using these case studies and our general literature review, we developed a
classification of the various mechanisms that could cause tank system
failures. We identified five general categories of failure mechanisms:
o stresses due to the tank's external environment;
o stresses arising from the tank's internal environment;
o design flaws;
o construction and installation errors; and
o operation or maintenance errors.
Once we had identified these mechanisms, we used vendor information and
engineering handbooks to determine the specific ways in which each mecha-
nism could contribute to the failure of various tank components. The
results of this analysis are presented in matrix form in Tables 4 through
6.
Table 4 tabulates the possible effects of external environmental stresses.
The vertical axis lists the types of stresses which may occur, while the
horizontal axis indicates which components are vulnerable to each type of
stress. The table also identifies the process by which each of these
external stresses may lead to component failure.
This table indicates that external environmental factors contributing to
failure include temperature extremes, high winds, excessive rainfall,
adverse soil conditions, earthquakes, poor air quality, power failures, and
vandalism. These stresses may result in corrosion, rupture, spills, or
overflows. The affected components may include tanks, pipes, pumps,
valves, level indicators, or process control equipment such as automatic
level controllers, overflow alarms, or emergency shut-off systems. Each
type of external stress, however, does not affect all components. Thus,
adverse soil characteristics only affect below-ground pipes or in- or
below-ground tanks, and power failures only affect pumps, valves, level
indicators and process control equipment. Some events, such as earth-
quakes, could affect any component. Since these events would affect the
entire tank system simultaneously, however, the damage to the pipes and
ancillary equipment would be unimportant compared to the damage to the tank
itself. Therefore, for such catastrophic events, Table 4 only lists damage
to the tank and ignores the incidental effects on other components.
25
-------
Table 4. TAIK SYSTEM FAILURE WTRIX: EXTERNAL BWIROtCNWL STRESSES
AFFECTED CCWONENTS
ro
en
FACTORS CONTRIBUTING TO FAILURE TYPE OF FAILURE
Above- In- Belcw- Above- Below- Process
ground ground ground ground ground Welded Level control
tanks tanks tanks Punps Valves piping Piping Flanges Gaskets Indicators eguiprefr
power failure
taiperature extremes
high winds/storms
humidity extremes
floods
adverse soil characteristics
earthquakes
adverse air quality
vandalism/unauthorized entry
other catastrophic event
overflow
explosion; cracking *
rupture; spills; over- *
turning
corrosion *
overflow; *
overturning
corrosion
rupture; overturning; *
spills
corrosion *
rupture; overflow; fire *
rupture *
*
*
Signifies an effect upon the particular component or upon its operation.
-------
Table 5. TAIK SYSTEM FAILURE WTRIX: INTERNt EWIRCW€NTAL STRESSES
AFFECTED COMPONENTS
po
FACTORS CONTRIBUTING TO FAILURE
equipment aging
pH extremes
excess amounts of
TYPE OF FAILURE
equipment failure
or malfunction:
corrosion; rupture
corrosion
abrasion;
Above-
ground
tanks
*
*
In-
ground
tanks
*
*
Below-
ground
tanks Puips
* *
* *
*
Above-
ground
Valves piping
* *
* *
* *
Below-
ground Welded Level
Piping Flanges Gaskets indicators
* * ' * *
* * * *
* * *
Process
Control
Equipment
*
suspended solids
Ignition of waste
taiperature extremes
pressure extremes
explosion, rupture, *
loss of system contents
corrosion *
rupture or collapse *
* Signifies an effect upon the particular ccnponent or upon its operation.
-------
CO
Table 6. TATK SYSTEM FAILURE WTRIX: DESIGN, CONSTRUCTION, AND OPERATION ERRORS
AFFECTED COPONENTS
FACTORS CONTRIBUTING TO FAILURE TYPE OF FAILURE
Above- In- Below- Above- Below- Process
ground ground ground ground ground Welded Level Control
tanks tanks tanks Punps Valves piping Piping Flanges Gaskets indicators Equipment
DESIGN
poor material selection
poor component selection
inadequate structural
support
CONSTRUCnON/INSTALLATICN
damage during installation
improper materials used
collapse or rupture; *
corrosion
accelerated component
aging
overturning; collapse; *
rupture
cracks; scrapes; dents *
corrosion; rupture or *
collapse
improper component installed accelerated component
aging due to excessive stress
poor subgrade preparation
CPERATIONAftlNTEWNCE
operator fails to control
process
operator deliberately
ignores safety or control
measures
improper cleaning, inspec-
tion, observation, record-
keeping, or replacement
settling; cracking;
rupture; corrosion
overflow; internal *
environmental extremes;
failure to detect
on-going release
overflow; internal *
environmental extremes;
failure to detect on-
going release
equiorient malfunction/ *
failure; failure to
detect on-going release
*
*
*
*
* Signifies an effect upon the particular ccnponent or upon its operation.
-------
Table 5 itemizes internal environmental stresses, including extremes of
temperature, pressure, and pH, and variations in the amount of suspended
solids. We have also included equipment aging in this category. These
internal factors may result in accelerated corrosion, equipment overload,
overflows, or equipment malfunctions. The specific components affected by
each factor are identified in the table.
Two of these factors, temperature extremes and pressure extremes, are
important stresses for many classes of industrial tanks, but are not par-
ticularly important for hazardous waste tanks because these tanks are
seldom operated at high temperatures or pressures. For completeness, we
have included these factors in Table 5, but we will not give them special
status in our model.
Table 6 examines design, construction, and operation errors. Such errors
include poor material selection, use of improper components, inadequate
structural support, improper process design, installation damage, use of
improper materials or components, operator error, or improper maintenance.
These errors may cause structural collapse, rupture, accelerated corrosion,
equipment malfunction, inadequate capacity, improper process control, or
failure to detect on-going releases. The specific components vulnerable to
each of these failures are identified in the table.
29
-------
3.0 FAULT TREES
3.1 Introduction to Fault Tree Analysis
Fault tree analysis is a common engineering tool for evaluating the
reliability of complex systems. The first step in such an analysis is to
identify the "top" or "ultimate" failure event to be modeled. In the pre-
sent study, the ultimate failure event is the release of hazardous
materials from the tank system. To construct our fault trees, we then
identified all of the relevant intermediate failure events which might lead
to such a failure. We then traced these events back to their antece-
dents, continuing the analysis until no further reduction was possible or
no data were available. The resulting chains of causation are the heart of
our fault trees.
In many cases, we found it useful to simplify the fault trees by combining
similar events and by eliminating very low-probability events or events
whose occurrence may always be assumed. Examples of these last two types
of events are the probability of a meteor strike or the presence of oxygen
to support an outdoor fire, respectively. In general, we have pruned
events with probabilities less than 10"^, though in a few cases we have
retained them in order to show that they were indeed considered.
Fault trees are generally depicted by a standardized set of schematic sym-
bols which represent the linkages between the basic, intermediate, and top
events. There are two principal types of fault tree symbols: event sym-
bols and logic gates. Event symbols are used to distinguish various types
of events, as well as to illustrate the connections among the different
portions of a large fault tree. The event symbols which will be used in
this report are illustrated in Figure 9.
Logic gates are used to link higher fault tree events to their precursors,
and ultimately to basic events for which probability data are available. A
fault tree may have many levels, but consecutive levels must be linked
through one of two basic types of gates: .AND. gates and.OR. gates.
Symbols for these gates are illustrated in Figure 10.
.AND and .OR. gates may have several inputs, but can only have one output.
The output event will occur only if the appropriate combination of input
30
-------
FIGURE 9. FflULT TREE EUENT SVMBOLS
Euent representations:
The rectangle identifies an euent that results from the
combination of events through the input of a logic gate.
The circle represents a basic euent that requires no
further deuelopment.
Triangles are used as transfer symbols, fl line from
the top of the triangle indicates a transfer in, and a
line from the side a transfer out.
A
The house is used as a switch to include or eliminate
parts of the fault tree that may or may not apply to
certain situations.
(Henley and Kumamoto, 1981)
31
-------
FIGURE 10. FAULT TREE LOGIC GATES
Gate Symbol
Gate Name
Causal Relation
A
AND gate
Output event occurs If
all input events occur
simultaneously.
OR gate
Output event occurs if
any one of the input
events occur.
(Henley and Kumamoto, 1981)
32
-------
events occurs. Thus, the output event from an .AND. gate only occurs when
all of the input events occur simultaneously, while the output event from
an .OR. gate occurs whenever any of the input events takes place.
3.2 Selection of Fault Tree Events
We derived the basic fault tree events by reorganizing the failure mecha-
nisms identified in Section 2.5. Some of these basic events represent com-
binations of the failure mechanisms listed in Tables 4-6; others are
elaborations of events that those tables include as single entries. For
example, the fault trees combine all causes of corrosion into two events
(internal corrosion and external corrosion) but they delineate several
distinct forms of operator error in addition to the broad categories listed
in Table 6. In all cases, we have included as much detail in the model as
is warranted by the available data. A listing of the changes that we have
made is presented in Table 7.
3.3 Hazardous Waste Tank Fault Trees
The hazardous waste tank fault trees are presented in Figures 11 through
16, using the standard symbols discussed in Section 3.1 of this report. In
these figures, we have assigned all of the basic events coded names, such
as "MOPMOE" or "813." Because we used some of the same labels in the com-
puter programs, we were required to restrict their lengths to a limited
number of characters. Since these labels are sometimes cryptic, the fault
trees also include brief translations. Further explanation of these basic
events (including derivations of their probability distributions) are pre-
sented in Appendix A; the more important events (such as tank corrosion and
pipe corrosion) will be discussed more thoroughly in Chapter 4.
We have designed the fault trees to be as general as possible, so that a
single set of trees can be used for all possible tank configurations. This
means that the trees contain component systems that are not present in all
configurations. Our computer model is designed so that these optional
branches can be switched on or off depending on the requirements of the
tank system being modeled. For optional branches connected to .AND.
gates, this is done by treating the absent component as though it is in a
33
-------
TABLE 7. REORGANIZATION OF FAILURE
MECHANISMS FOR USE IN FAULT TREES
We included the following failures in our baseline probabilities for tank or
pipe ruptures or flange leaks.
• Poor material selection
t Poor component selection
• Inadequate structural support
e Poor subgrade preparation
• Improper materials installed
• Miscellaneous external catastrophes (vehicle collision, airplane
crash, etc.)
We included variations in the following factors in our baseline corrosion model
0 Internal temperature
• External temperature
• Humidity
t Air quality
We included the following factors in our baseline estimates of ancillary equip-
ment failure rates:
o Power failure
o Equipment aging
t Poor component selection
e Damage during installation
• Improper component installed
• Poor maintenance
We pruned the following factor as extremely low-probability:
• Pump Rupture
We have made the following elaborations on the failure mechanisms listed in
Tables 4-6.
• We have divided operator errors into errors of commission and errors
of omission.
• We have divided process control equipment into several categories,
including automatic shut-down systems, level controllers, and high
level alarms.
34
-------
FIGURE 1 I. HAZARDOUS WASTE TANKS:
BASIC FAULT TREE
Release of Hazardous
Materials into the Environment
Release from the
Tank System
Secondary
Containment Failure
f
Overflow
1
Leak or
Rupture
1 1
External
Catastrophe
Spill during
filling or
discharging
35
-------
FIGURE 12A. OVERFLOWS
Tank
Overflows
Control
Error Causes
Attempted
Overfill
Tank Nearly
Full
(MOFILL)
System
Fails
to Shut
Down
Breach in Tank
or Piping
Provides Escape
Route for
Overflowing
Fluid
Level
Indicator
Failure
(MOLEVIN)
Level
Controller
Failure
(FLYCN1)
Operator
Error
(OPCOMM)
Mechanical
Failure of
Inlet Valve
(OPYLONor
OPYLOE)
Automatic
Emergency
Shutdown System
Fails
Manual
Shutdown
Failure
36
-------
FIGURE 126. OVERFLOWS (cont.)
Automatic Emergency
Shutdown System
Fails
Emergency Level
Control System
Fails
High Level
Sensor
Fails
(LEYIN2)
Emergency
Shutdown
Microprocessor
Fails
(FLVCN2)
Mechanical
Failure of
Pumps or
Valves
37
-------
FIGURE 12C. OVERFLOWS (cont.)
Manual
Shutdown
Fail ure
Fail ure to
Respond to
Alarm
High Level
Alarm
Fails
(MOALARM)
Operator
Error
Mechanical
Failure
of Pumps
or Valves
Error of
Commission
(i.e. operator
throws wrong
switch, etc.)
(OFTRCOM)
Error of
Omission
(I.e. operator
fails to act)
(OFTROM)
38
-------
FIGURE 12D. OVERFLOWS (cont.)
Mechanical
Fail urc of
Pumps or Valves
r-A
Inlet Pump and
Valve Fail
Outlet Pump or
Valve Fail3
Pump
Fails
(MOPMOEor
MORMON)
Valve
Fails
(MOVLOEor
MOVLON)
Pump
Fails
(MOPMCEor
MOPMCN)
Valve
Fails
(MOVLCEor
MOVLCN)
39
-------
FIGURE 12E. OVERFLOWS (cont.)
Breach in System
Allows Fluid to
Escape Foil owing
Overfill
O O
System
has open
top
(A210)
Fluid
Escapes
Through
Overflow
Valve or
Vent
(A211)
Outlet Pipe,
Flange, or
Gasket
Breached
(A213,
A214,or
A215)
Inlet Pipe,
Flange, or
Gasket
Breached
(A216,
A217,or
A2I8)
Vent Pipe
or Flange
Breached
(A219,
A220,or
A221)
40
-------
FIGURE 13A. LEAKS AND RUPTURES
Tank System
Develops
Leaks or Ruptures
r
1
Tank
Failure
1
^S
1
Pipe
Failure
Pump
Corrodes
Flange or
Gasket Failure
Tank
Corrodes
Tank
Ruptures
Pipe
Corrodes
Pipe
Ruptures
41
-------
FIGURE 135. LEAKS AND RUPTURES (cont.)
Tank Corrodes
Failure due
to localized
exterior
corrosion
(T1121J1125,
and Til 26)*
Failure due
to localized
interior
corrosion
(T11 23
and
Til 27)*
Failure due
to
generalized
corrosion
(T1125J1126,
and Til 27)*
*These event labels describe different aspects of the tank
corrosion model. They are explained in Appendix A.
42
-------
FIGURE 13C. LEAKS AND RUPTURES (cont.)
Tank Ruptures
Undetected Faulty
Installation
Tank Ruptures
After
Installation
(Til 24)
Tank Damaged
During or
Before
Installation
-------
FIGURE 13D. LEAKS AND RUPTURES (cont.)
Pipe Corrodes
Failure due
to localized
exterior
corrosion
(B13)*
Failure due
to localized
interior
corrosion
(813)*
Failure due
to
generalized
corrosion
(813)*
* All forms of pipe corrosion are included in Appendix A
under this one label.
44
-------
FIGURE 13E. LEAKS AND RUPTURES (cont.)
Pipe Ruptures
Undetected Faulty
Installation
Pipe Ruptures
After
Installation
Pi pe Damaged
During or
Before
Installation
-------
FIGURE 13F. LEAKS AND RUPTURES (cont.)
Pump Corrodes
Failure due
to localized
exterior
corrosion
(A2116)»
Failure due
to localized
interior
corrosion
(A2116)*
Failure due
to
generalized
corrosion
(A2116)*
* All forms of pump corrosion are included in Appendix A
under this one label.
46
-------
FIGURE 13G. LEAKS AND RUPTURES (cont.)
Flange or Gasket
Failure
Flange Leaks
Gasket Leaks
Undetected
Faulty
Installation
Weld
Develops
Leak
o o
Flange
Defective
at
Installation
(B122)
O O
Gasket
Defective
at
Installation
(LIFDEF(I,5)E)
Inspection
Error
-------
FIGURE 14. LOSS OF SYSTEM CONTENTS DUE TO
EXTERNAL CATASTROPHE
Loss of System Contents
due to External
Catastrophe
o
Vandalism
666
High Winds
(ANNUCAT(I,3» Earthquake
(ANNUCAT(I,4)>
Flooding
Ignition
of
Waste
bgOn-site
Spark
-------
FIGURE 15. SPILL DURING FILLING OR DISCHARGING
Spill during
Filling or
Discharging
0066
Strainer drain
left open after
mai ntenance
(All 111)
Pump drain
left open after
maintenance
(All 112)
Flexible
Hose
Rupture
(A1112)
Loose
Flexible
Hose
Connection
(A 1115)
49
-------
FIGURE 16. SECONDARY CONTAINMENT FAILURE
Secondary
Containment
Failure
Breach due to
Material Agi ng
Breach due to
External
Catastrophe
6666666
Asphalt Asphalt
Pad Berm
Breached Breached
(B23)
Concrete Concrete
Pad Berm
Breached Breached
(631) (B33)
Concrete
Vault
Fails
(B41)
Outer Wall
of Double-
walled Tank
Fails
-------
failed state. Since the .AND. gate will not allow failure unless all of
its branches occur simultaneously, there is no difference between elimi-
nating an absent event or treating it as though it has occurred; in either
case the .AND. gate will register failure if and only if all of the
remaining events occur simultaneously. On the other hand, absent fault
tree branches connected to .OR. gates must be treated as though they have
not occurred, for otherwise their absence would inevitably cause the .OR.
gate to register failure, a result which would not occur unless the com-
ponent system under consideration were not truly optional.
A couple of simple examples may help to clarify this process. In order to
prevent overflows, tank systems generally have emergency shut-down systems.
These may be manual or automatic, or both systems might be present at once.
Obviously, there will be no emergency shut-down failures unless all
existing shut-down systems fail. Thus, the fault tree connects the manual
and automatic systems by an .AND. gate. If the automatic system is absent,
however, failure will occur whenever the manual system fails. Treating the
absent automatic system as though 1t has already failed will ensure this
result. Similarly, if the facility were to rely solely on an automated
system, emergency shut-down failure would occur whenever the automatic
system failed. This would be the case if the missing manual back-up system
were treated as though it were always in a failed state.
As an example of the opposite case, consider the possibility of natural
catastrophe. Such catastrophes could result from floods, earthquakes,
hurricanes, or tornadoes, so these events are all connected by an .OR.
gate. All of these catastrophes, however, are not possible in every
geographic location. Thus, if the tank system is not located in a flood-
prone region, the flooding event should be deemed not to have occurred, and
a natural catastrophe will only result if one of the other events takes
place. A similar analysis applies to other failure events connected by
.OR. gates.
With this background, it 1s now possible to turn to a more detailed analy-
sis of the individual fault trees.
The basic tank failure fault tree 1s presented 1n Figure 11. This fault
tree contains the overall top event (release of hazardous wastes to the
51
-------
environment) and identifies the general mechanism by which it might occur.
As is indicated by this figure, uncontained releases may only occur if two
intermediate events occur simultaneously: a failure of the tank system
itself, and the failure (or absence) of secondary containment. Tank
releases are described in Figures 12 through 15; secondary containment
failures are described in Figure 16.
Tank System Failures
Tank system failures may be grouped into four categories: overflows, leaks
and ruptures, external catastrophies, and spills during filling or
discharge operations.
Overflows. The overflow fault trees are presented in Figures 12A through
12E. As the tank overflow fault tree (Figure 12A) shows, four events must
occur before an overflow can result: the tank must be close enough to full
that an overflow is possible; there must be a control error resulting in an
attempt to add too much fluid to the tank; there must be a failure of the
emergency shut-down system; and there must be a route by which overflowing
fluid may escape from the tank.
All four of these events must occur before any tank system can overflow,
but the manner in which they may arise varies with the sophistication of
the tank's control system, the sophistication of its emergency shut-off
system, and the manner in which it is filled and discharged. We have
therefore modeled two types of control systems (automatic and manual),
three types of emergency shut-off systems (automatic, manual, and automatic
with manual back-up), and two general types of fill/discharge processes
(discrete batches and continuous throughput). The fault trees, which apply
equally well to storage or treatment tanks, allow us to model any com-
bination of these designs, but in practice only certain designs are likely.
Table 8 presents a complete list of the level control, emergency shut-off,
and fill/discharge systems which we consider to be likely. As this table
Indicates, we have assumed that tanks with automatic level controls also
have automatic emergency shut-off controls, and that facilities with auto-
matic emergency shut-off generally maintain manual shut-off controls as
back-ups. In addition, we have assumed that continuous treatment tanks use
automatic controls, while batch treatment tanks use manual controls. We
52
-------
TABLE 8. FILL/DISCHARGE, LEVEL CONTROL, AND
EMERGENCY SHUT-OFF SYSTEMS
Type of Tank
STORAGE
F111/Discharge Process
Level Control System
Emergency Shut-Off System
Batch
Continuous
Continuous
Manual
Manual
Automatic
Manual
Manual
Automa
back up)
Ul
co
TREATMENT
Batch
Automatic
Manual
Automatic
Manual
Automatic (manual
back-up)
-------
have generally assumed that storage tanks are batch systems with manual
controls, but we have also modeled continuous storage tanks. We have
assumed that such facilities are used as settling tanks and only rely on
manual controls 1f they maintain such a large freeboard that careful level
monitoring is. unnecessary.
The first requirement for any of these tank systems to overflow 1s that the
tank be close enough to being full that an overflow 1s even possible; a
half-empty 10,000 gallon tank, for example, cannot be overflowed by the
addition of a 1,000-gallon batch. How often a potential overflow situation
arises 1s therefore a function of the system design and operating policy.
Our assumptions for the various types of tanks are listed in Table 9. In
general, we have assumed that potential overflow situations occur
constantly for continuous treatment processes (because fluid is regularly
added when the tank Is already filled to Its normal operating depth), once
per batch for batch treatment processes (because the operator 1s adding
fluid from a storage tank which we assume to have larger capacity than the
treatment tank Itself), and infrequently (once per year) for storage tanks
(because storage tanks are generally filled in comparatively small batches
and pumped-out before they get dangerously full; we make the conservative
assumption that once per year there is a fluctuation in waste-generation
rates or a failure to follow the pump-out schedule, thereby allowing the
tank to become full). Continuous storage tanks (settling tanks) are
modeled on a case-by-case basis by comparing their daily throughputs to
their normal reserve capacities.
Even if the tank is full, there must also be a control error before an
overflow can result. Such an error would occur if a malfunction in a level
Indicator causes too much fluid to be added to the tank (either in automa-
tic or manual systems), 1f an automatic level controller fails, if the
operator of a continuous system makes an error in the morning start-up
routine, if the operator of a manual system Ignores the liquid level indi-
cator and adds too much fluid, or 1f an automatic Inlet valve sticks in the
open position.
These control errors, however, will not result in an overfill unless the
emergency shut-down system falls. The most sophisticated emergency shut-
54
-------
TABLE 9. FREQUENCY OF FILLING A NEARLY-FULL TANK FOR
VARIOUS TANK SYSTEMS
Type of Tank System Frequency of Filling a Nearly Full Tank
TREATMENT TANKS
Continuous 100% of operating day
Batch Once per batch
STORAGE TANKS AND ACCUMULATION TANKS Once per year
55
-------
down systems (depicted in Figure 12B and 120), consist of a high level sen-
sor connected to a microprocessor which automatically shuts down the inlet
pump and valve. If the inlet system fails to shut down, the microprocessor
Instead adjusts the outlet pump and valve to increase the rate of out-flow.
All of these components are subject to failure. Mechanical failure of the
pumps and valves, however, will only be critical if both the inlet and
outlet pump systems fail; proper operation of either of these systems will
prevent the accumulation of excess fluid in the tank. In addition,
emergency shut-off will still occur unless both the inlet pump and the
inlet valve fail to shut down. If either of these components functions
properly, it will cut off the flow of fluid, thereby preventing the overflow.
For the outlet pump system, however, the pump is more important than the
valve; in continuous processes the valve 1s always at least partially open,
so we have assumed that a change in pumping rate will be effective even if
the valve sticks.
Automatic emergency shut-off controls are most likely to be found on con-
tinuous treatment tanks (see Table 8), but in order to make the fault trees
as general as possible, we have also modeled automatic shut-off systems for
batch processes. The only difference between automatic shut-off systems
for batch and continuous tanks lies in the outlet pump system. In batch
systems, the outlet valve will always be closed while the tank is being
filled, so it must be opened before the outlet system can be used to pump
out excess fluid. The outlet system will therefore fail if either the pump
fails to start or the valve fails to open.
Storage and accumulation tanks are also unlikely to have automatic
emergency shut-off systems, but for completeness, we have also included
such systems in the model. Since these systems are generally emptied by a
pump-out truck, there is no on-site outlet pump, and the emergency shut-off
system would only be connected to the Inlet pump and valve. A failure of
either of these components would therefore result in an emergency shut-off
failure.
Emergency shut-off systems for manual treatment and storage tanks are
depicted in Figure 12C. In these systems, an overfill will trigger a high-
level alarm, thereby summoning the operator, who will then manually shut
56
-------
off the appropriate pumps and valves. Such a manual shut-off system is
vulnerable to three types of failure: mechanical failure of the high-
level alarm, operator error, or mechanical failure of the pumps or valves.
Operator error may result from either a failure to act, or from such
improper actions as turning off the wrong pump or opening or closing the
wrong valve. Pump and valve failures will have the same effects as they do
in the corresponding automatic systems.
The final requirement for an overflow to occur is that there be a route by
which the excess fluid may escape (see Figure 12E). For some tank de-
signs, such routes always exist. Open-topped tanks, for example, need no
other overflow route, and pump-fed tanks can overflow through their vents.
Closed, gravity-fed tanks, however, are less subject to overflow, for the
model assumes that their vent pipes open at a level above the highest
possible fluid level in their fill tanks. For such tanks, an overfill can
only result in leakage if there are corrosion holes or ruptures (cracks) in
the fill pipe, the vent pipe, or the outlet pipe or valve, or if there are
faulty flanges or gaskets.
Leaks and Ruptures. Leaks and ruptures are the second major category of
system failures. Their fault trees are presented in Figures 13A through
136. Leaks are losses.due to corrosion; ruptures include both large cracks
and small weld failures. As is shown by Figure 13A, such failures may
develop in the tank, pipes, pumps, flanges, or gaskets. For all of these
components, the basic failure routes are the same: they may crack because
of component defects or due to strains caused by settling, vibration, tem-
perature changes, faulty installation, or vehicle crashes; or they may
corrode due to the combination of internal and external attack.
Some of these failure routes have been pruned from Figure 13. Pump rup-
tures, for example, have been omitted because they are extremely unlikely
(p < 10~7), and flange corrosion has been combined with the corrosion of
the tank and pipes. Similarly, although they are subject to both rupture
and corrosion, valves are not separately listed in Figure 13, but are
instead included as parts of the attached pipe segments.
Corrosion is modeled in Figures 13B (for tanks), 130 (for pipes), and 13F
(for pumps). For each of these components, these figures identify three
57
-------
basic types of failure: localized external pitting, localized internal
pitting, and the generalized corrosion of large segments of the component
wall. In many cases, several of these mechanisms may occur simultaneously,
producing more rapid failure than would result from any mechanism acting
alone. In such situations, we combine the corrosion rates, computing the
remaining wall-thicknesses for the deepest exterior pits, the deepest
interior pits, and the rest of the component's surface. When one of these
wall-thicknesses reaches zero, we assume that a leak develops. Continued
corrosion will enlarge the holes, increasing the leak rates until the loss
is detected and the component is replaced. See Chapter 4 of this report
for a more detailed discussion of the corrosion model, the hole growth
model, and the calculation of leak rates.
Ruptures are modeled in Figure 13C and 13E for tanks and pipes, respec-
tively. These fault trees are very similar. For either type of component,
ruptures may result from one of two sources: undetected installation
damage or normal operating hazards. Normal operating hazards may produce
ruptures at any time during the facility's life; installation defects will
result in immediate failures. We assume that the probability of detecting
installation defects depends on the quality of the inspection. The model
allows for four types of inspection. The most effective of these is the
combination of visual Inspection, weld testing, and tightness testing. We
assume that this will catch 95% of installation errors. Visual inspection
alone we assume to be 50% reliable, and visual inspection with weld testing
we assume to be 75% effective. The fourth option is no inspection at all,
in which case no defects will be detected. Since Inspection requirements
are one of the regulatory options being modeled, the choice of inspection
levels 1s made by parameter selection at the beginning of each simulation.
The final category of leaks and ruptures are flange and gasket failures.
These are depicted together in Figure 13G. Flange leaks are similar to
tank or pipe ruptures, resulting from improper installation or normal
operating hazards. Gaskets, however, have different failure mechanisms.
They may leak due to improper installation, but if they are properly
installed, they are subject to gradual attack by the fluid, rather than to
sudden cracking. This gradual attack is a corrosion-like process (although
the mechanism is quite different), and we have modeled it by computing an
58
-------
annual gasket-disintegration rate. This process will be discussed in
greater detail in Chapter 4, below.
External Catastrophies. External catastrophies are depicted in Figure 14.
They are all assumed to cause the sudden loss of the system's entire con-
tents, and may result from vandalism, high winds (tornadoes or hurricanes),
earthquakes, floods, on-site fires, or damage from nearby fires or explo-
sions. Not all of these events will occur for any given system design;
non-flammable wastes cannot burn, and not all geographic regions are
vulnerable to all of the other hazards. Thus, these events are controlled
by the choice of waste streams and a set of geographic variables.
External catastrophies could have been included with leaks and ruptures,
but because they are exogenous events uninfluenced by system design (except
that below-ground te|nks are safe from wind-storms and relatively safe from
nearby fires or explosions), we have modeled them separately.
The final type of tank failures are spills other than overflows during
filling and discharging. These releases, depicted in Figure 15, result
when the operator fails to close a pump or strainer drain after main-
tenance, or when a portable flexible hose ruptures or is improperly con-
nected. Which of these spill mechanisms is possible depends on the details
of'the system design. Treatment systems, for example, do not use portable
hoses for fluid transfer, nor do they use strainers. Their fill and
discharge pumps, however, are maintained annually, and there is a chance
that the operator will forget to close a pump drain afterward. This will
produce a spill the next time the pump is used. Storage and accumulation
tanks, on the other hand, are pumped out by flexible hose. . Spills are
possible if this hose ruptures or is improperly attached. In addition, the
pump-out truck carries a portable pump and strainer, which can produce a
spill 1f the tank being pumped out is the first one to be visited after
faulty pump or stainer maintenance. We have not modeled fill pumps and
strainers for such tanks, however, for these pieces of equipment, if they
even exist, are generally located at the upstream end of the tank's fill
pipe, and are more closely associated with the operator's process equipment
than they are with the storage or accumulation tank.
59
-------
Secondary Containment
Secondary-containment systems generally consist of berms, pads, or under-
ground vaults designed to retain fluid following a breach in the tank
system itself. In addition, some tanks have two closely-spaced walls, with
a liquid sensor 1n the middle. Thus, a breach in either wall will trigger
the liquid sensor, (either due to leaking waste or to infiltrating soil
moisture), allowing the owner to repair the tank before a release can
occur. A variety of secondary-containment systems are possible, but in
general, above-ground tanks employ berms and concrete or asphalt pads,
while underground systems use concrete vaults (with or without a liner) or
double-walled tanks.•
Secondary-containment systems may be complete or partial. Complete systems
encompass the entire tank system and all of its ancillary equipment.
Partial systems only contain releases from certain components. In-ground
or on-grade tank systems, for example, often have only partial secondary-
containment systems. These systems will contain above-ground releases, but
will not contain releases from the on- or below-grade portions of the tank.
We account for partial secondary-containment systems by first determining
the location of the particular primary-containment leak. Then, based on
the design of the modeled system, we determine which, if any, secondary-
containment devices are involved, and then determine whether the
appropriate component has failed. This process also allows us to specify
separate secondary-containment systems for different portions of the hazar-
dous waste facility. Thus, tanks may be placed in one secondary-
containment system, while pipes are placed in another. A pipe leak will
therefore only produce a release if the piping secondary-containment system
is breached, while a tank leak will only produce a release if the tank
secondary-containment system has failed. If pipes and tanks use separate
secondary-containment systems, the secondary-containment fault tree must be
evaluated independently for each system.
Secondary-containment failures are depicted in Figure 16. As Figure 16
indicates, there are two basic causes of secondary-containment failure:
breaches due to external catastrophe, and breaches due to internal events
such as settling, freeze/thaw action or normal material aging. External
60
-------
catastrophes which may breach secondary containment are the same as those
which may breach the tank system itself. Because these events usually
Involve serious structural damage to the entire tank facility, we have
assumed that whenever such catastrophes breach one containment system, they
also breach the other. Thus, this type of secondary-containment failure
always occurs 1n concert with the failures listed in Figure 14.
Failures due to internal events, on the other hand, are independent pro-
cesses for the tank system and the secondary-containment system. Thus,
these types of failures may occur at different times for each system. A
release to the environment will only occur if both systems are in failed
states at the same -time.
«
Conclusion
As the preceding discussions reveal, the fault trees present a flexible
general framework allowing a number of system design options. In addition,
the preceding discussions should also have revealed that evaluation of the
fault trees is not a one-time procedure. Instead, the fault trees repre-
sent a dynamic system, with various events occurring at different times and
with events being switched on and off as failures occur and are detected
and repaired. Thus, since the probability of many failure events (most
notably corrosion) depends on the age of the component under consideration,
the fault trees and leak detection systems must be continuously monitored
to determine the timing and duration of any failures that develop. It is
for this purpose that we developed the Monte Carlo Simulation Model, the
details of which will be discussed in the next chapter.
61
-------
4.0 MONTE CARLO SIMULATION MODEL
4.1 Introduction
The fault trees developed in Chapter 2 form the basis for the computerized
Monte Carlo simulation model. This model simulates each of the fault tree
events by drawing a random number to determine if that event occurs. The
computer then evaluates the fault tree logic gates to determine whether
the events that occur in month one are sufficient to cause a release. If no
release occurs, the computer determines whether inspection or scheduled
maintenance will cause any components to be replaced, advances the facility
age by one month, and draws another series of random numbers to determine
if any additional components fail during month 2. To save computer time,
however, some fault tree branches are only evaluated once per model year.
These branches represent events whose probabilities are low enough that the
possibility of multiple occurrences in any given year can be safely
Ignored. In general, we have assumed that events with annual probabilities
of less than 3% need only be evaluated annually (such events have less than
one chance in a thousand of occurring twice in any given year), while those
with higher probabilities need to be evaluated monthly. When one of the
annually-evaluated events occurs, the computer determines the exact month
of failure by the simple expedient of drawing a random number between 0 and
12. This process of repeated fault tree evaluation continues until a
failure occurs or until the entire time period to be modeled has elapsed.
When a release occurs, the computer interrupts this process to determine
the leak rate and whether or not the leak is detected in the month in which
it began. If the leak 1s detected, the computer determines the exact
detection period, calculates the total loss volume, and replaces the failed
components. If the leak is not detected, the computer carries it into the
next month, evaluates the fault trees for new leaks, increments the sizes
of existing corrosion holes (but not of ruptures), and determines which
leaks can now be detected.
The output from this procedure 1s a time series of releases, Identified by
component, starting date, ending date, total volume of loss, and method of
62
-------
detection. This time series we call the "release profile" from the
modeled tank. Once the release profile is completed, the simulation is
rerun through hundreds of iterations, generating a new release profile for
each iteration. If enough iterations are run, these release profiles
represent the spectrum of possible behavior for the modeled system, and
can be used to generate average, median, and extreme values for releases
from various components. These values can be compared for various system
designs in order to determine their relative performances.
A simplified flow chart for this entire process is presented in Figure 17.
A more complete flow chart, identifying individual computer subroutines, is
contained in Appendix E. Appendix E also contains the computer code for
the simulation model*
The flow chart in Figure 17 identifies five basic components of the simula-
tion model. In order of occurrence, these are:
• The choice of system design and the calculation of the related
system parameters;
• The evaluation of the fault trees to determine the occurrence of
stochastic events;
• The calculation of leak rates;
t The determination of detection lags; and
• The presentation of results.
The following sections will discuss the details of the first four of these
steps. Section 4.2 will list the user-chosen parameters employed by the
model and will explain the impact of these parameters on system behavior.
Section 4.3 will give a general explanation of the basic techniques used
for modeling the occurrence of stochastic events, while Section 4.4 will
list the probabilities used for each of the basic fault tree events.
Sections 4.5, 4.6, 4.7, 4.8, and 4.9 will explain in more detail the manner
in which we calculate leak rates for tank corrosion, pipe corrosion, pump
and valve corrosion, erosion, and gasket deterioration, respectively.
Section 4.10 will explain how the model determines hole sizes, and Section
4.11 will explain the calculation of leak rates. Section 4.12 will
63
-------
FIGURE 17. FLOW CHART FOR SIMULATION MODEL
>
f
SELEa SYSTEM DESIGN AND LOCATION
VARIABLES, SELECT WASTE STREAM
COMPUTE SYSTEM PARAMETERS
DEPENDENT ON THE CHOSEN VARIABLES
SET EQUIPMENT AGES TO ZERO
EVALUATE FAULT TREES FOR
SYSTEM FAILURE
DOES
SYSTEM FAILURE
OCCUR?
YES
CALCULATE LEAK RATES
FOR ALL NEW FAILURES
ARE
THERE ANY
ONGOING
LEAKS?
YES
NO
NO
INCREASE SIZE OF CORROSION HOLES.
RECALCULATE LEAK RATES.
ARE
ANY SYSTEM
FAILURES
DETECTED?
NO
YES
CALCULATE DETECTION DATE AND TOTAL
LOSS VOLUME. REPLACE COMPONENTS.
64
-------
FIGURE 17. FLOW CHART FOR SIMULATION MODEL (Continued)
INCREMENT
ITERATION
COUNTER BY
ONE MONTH
ARE
ANY OTHER
COMPONENT
FAILURES
CTED?
YES
RESTORE THESE COMPONENTS
TO "NEW STATUS
YES
STORE RELEASE PROFILE
NO
HAVE ALL
ITERATIONS BEEN
COMPLETED?
NO
CALCULATE MEAN VALUES, MEDIAN VALUES,
PERCENTILES. EXTREMES. AND STANDARD
DEVIATIONS
{PRINT RESULTS \
65
-------
conclude the chapter with an analysis of the various leak detection methods
examined by this model.
4.2 User Inputs
The Hazardous Haste Tank Failure Model is general enough to allow us to
simulate a wide range of tank systems. As a result, the model has a large
number of user-selected parameters. These parameters are listed in Table
10. That table also gives a brief description of the effect of these
parameters and lists cross references to the sections of this report
explaining these effects.
As this table Indicates, there are six general categories of user input
variables. These variables include:
• System design parameters,
• Environmental characteristics,
• Waste characteristics,
t Secondary containment characteristics,
• Leak detection system parameters, and
t Simulation control variables.
System Design Parameters.
The system design variables are used to select the storage or treatment
process to be modeled, determine construction materials and system capa-
city, select the corrosion protection features to be built into the tank,
and determine what components are above-, below-, or in-ground. These
parameters also determine whether the process is continuous or batch,
whether the control system and emergency shut-off systems are manual or
automatic, and whether the tank is open- or closed-topped. A variety of
miscellaneous variables are also included in this group, Including the
choice of welded flanges or gaskets, the choice of pump location, the
interval between pump-outs for storage or accumulation tanks, and the
66
-------
TABLE 10. USER INPUTS FOR HAZARDOUS WASTE TANK FAILURE MODEL
Variable Description
SYSTEM DESIGN
Process for which tank
1s used
Tank construction
material
Pipe construction
material
Tank capacity
Yearly throughput
Number of operating
days per year
Possible Choices
Storage or accumulation
Chrome reduction
Cyanide oxidation
Distillation
Evaporation
Neutralization
Precipitation
Carbon steel
Stainless.steel
Fiberglass
Concrete
Carbon steel
Stainless steel
Fiberglass
200-50,000 gallons
(underground tanks)
200-unlimited (above-
or In-ground tanks)
Any
100-365
Effect
Determines number of
tanks, pH of
contents, number and
location of pumps.
Determines corrosion
rate and rupture
probability.
Determines corrosion
rate and rupture
probability.
Influences tank surface
area, tank wall thick-
ness, maximum loss
volume from major
ruptures, hydraulic head
for smaller leaks.
Determines inventory
monitoring detection
threshold, maximum
yearly loss volume,
total fill/discharge time.
Influences failure pro-
babilities for pumps,
valves, and system
control equipment.
Influences annual
loss volumes from leaking
ancillary equipment.
Cross References
Section 2.3
Section 4.5
Section 4.6
Section 4.2
Section 4.2
Section 4.4
-------
TABLE 10. USER INPUTS FOR HAZARDOUS WASTE TANK FAILURE MODEL (Continued)
Variable Description
SYSTEM DESIGN (Continued)
Number of operating
hours per day
Location of tank
Tank top
Fraction of In-ground
tank that Is under-
ground
Location of pipes
Treatment efficiency
Fraction of main
constituent
Fraction of suspended
solids
Possible Choices
1-24
Above-ground (on-grade)
Above-ground (on cradles)
In-ground
Below-ground
Open
Closed
0-100*
Above-ground
Below-ground
0-100*
Any
Any
Effect
Influences failure pro-
babilities for pumps,
valves, and system
control equipment.
Influences dally loss
volumes from leaking
ancillary equipment.
Influences corrosion
rate, vulnerability to
external catastrophes,
and leak rate.
Open tanks overflow more
easily.
Influences corrosion rate
and leak rate.
Influences corrosion rate,
vulnerability to external
catastrophes, and leak rate.
Determines concentration of
hazardous constituent in
downstream piping.
Determines concentration of
hazardous constituent at
various stages of the treat-
tment or storage process.
Determines erosion rate
when fluid is in motion.
Cross References
Section 4.4
Section 4.2
Section 3.3
Section 4.5
Section 4.6
Section 2.2,
Appendix D
Section 2.2,
Appendix D
Section 4.8
-------
TABLE 10. USER INPUTS FOR HAZARDOUS WASTE TANK FAILURE MODEL (Continued)
en
vo
Variable Description
SYSTEM DESIGN (Continued)
Tank orientation
Pump location
Tank/pipe joint
construction
Emergency shut-off
controls
Operating procedures
Level Control system
Number of batches
per day (batch
systems only)
Possible Choices
Horizontal
Vertical
Above-ground
Submersible
Welded flanges
Gaskets
Manual
Automatic (manual back-up)
Automatic only
Continuous
Batch
Manual
Automatic
Any
Effect
Determines operating
pressure at various
locations.
Submersible pump failures
cannot cause releases.
Determines failure rate
and mechanism.
Affects overflow pro-
bability.
Affects overflow pro-
bability, fill/discharge
rates, and total daily
fill/discharge time.
Affects overflow pro-
bability.
Determine the number of
opportunities for
tunities for start-up
errors or overflows.
Cross References
Section 4.2
Section 4.7
Sections 4.4,
4.9
Sections 3.3,
4.4
Sections 3.3,
4.4
Sections 3.3,
4.4
Section 4.4
Number of days before
tank Is emptied
Corrosion protection
for tanks (carbon
steel only)
1-365
Interior coating
Exterior coating
Interior and exterior coatings
Cathodic protection with .
interior and/or exterior
coatings
No protection
Affects inventory
detection threshold.
Retards onset of
corrosion.
Section 4.12
Section 4.5
-------
TABLE 10. USER INPUTS FOR HAZARDOUS WASTE TANK FAILURE MODEL (Continued)
Variable Description
SYSTEM DESIGN (Continued)
Corrosion protection
for piping (carbon
steel only)
Possible Choices
Interior coating
Exterior coating
Interior and exterior coating
Cathodic protection
Cathodlc protection with
Interior and/or exterior
coatings
No protection
ENVIRONMENTAL CHARACTERISTICS
Geologic or weather-
related hazards
• Earthquake zone
• Flood plain
• Hurricane region
• Tornado region
Each of these variables
may be set to true of
false. They may be used
in any combination.
Effect
Regards onset of
corrosion.
Determines system
vulnerability to
external catas-
trophes.
Cross References
Section 4.6
Section 4.4
Soil characteristics
• pH
• Resistivity
• Presence of sulfides
• Moisture content
5.0 - 9.0
50-50,000 ohm-cm
Yes or No
Dry
Damp
Saturated
These variables all
influence leak rates
from underground leaks.
Section 4.5,
4.6
-------
TABLE 10. USER INPUTS FOR HAZARDOUS WASTE TANK FAILURE MODEL (Continued)
Variable Description
Possible Choices
ENVIRONMENTAL CHARACTERISTICS (Continued)
Backfill material
WASTE CHARACTERISTICS
PH
Density
Viscosity
Ign1tab111ty
D1ffus1v1ty 1n air
Vapor pressure
Clay
S1lt
Sand
Gravel
2 to 9
No limitations
No limitations
True or false
No limitations
No limitations
Effect
Influences leak
rate from
underground leaks,
Determines 1f
environment
1s extreme or
normal (cut-
off Is pH=3.5).
Influences leak
rate.
Influences leak
rate.
Determines 1f on-
site fires or
explosions are
possible.
Influences time
lag for detection
by vapor wells.
Influences time
lag for detection
by vapor wells.
Cross References
Section 4.11
Section 4.4
Section 4.11
Section 4.11
Section 4.4
Section 4.12
Section 4.12
-------
TABLE 10. USER INPUTS FOR HAZARDOUS WASTE TANK FAILURE MODEL (Continued)
Variable Description
SECONDARY CONTAINMENT
Tank system
Pipe system
ro
Maintenance level
for pad and vault
Thickness of asphalt
pad
Possible Choices
Concrete pad and curb
Asphalt pad and curb
Concrete vault
Synthetic Uner
Concrete vault with
synthetic liner
Double-walled tank (with
or without other secondary
containment features)
No secondary containment
Asphalt pad (with earthen
dikes or asphalt or
concrete curbs)
Concrete pad (with earthen
dikes or asphalt or
concrete curbs)
Liner (with or without
other forms of secondary
containment)
Double-walled piping (with
or without other forms of
secondary containment)
No secondary containment
Good
Poor
2 to 6 inches
Effect
As long as they
are function-
ing, secondary
containment
systems prevent
tank releases
from reaching
the environment.
As long as they
are functioning,
secondary con-
tainment systems
prevent pipe
releases from
reaching the
environment.
Determines failure
date of second-
ary containment
component.
Determines failure
date of asphalt
pad
Cross References
Section 4.4
Section 4.4
Section 4.4
Section 4.4
-------
TABLE 10. USER INPUTS FOR HAZARDOUS WASTE TANK FAILURE MODEL (Continued)
Variable Description
LEAK DETECTION SYSTEM
Possible detection
methods (may be used
1n any combination)
CO
Inspection frequency
Inventory monitoring
frequency
Inventory monitoring
detection limit
Tank Integrity testing
frequency
Possible Choices
Visual Inspection
Inventory monitoring
Tank Integrity testing
Pipe Integrity testing
Ultrasonic testing
(tanks only)
Interstitial monitoring
for tanks and/or
pipes (double-walled
or lined tanks and
pipes only).
U-tubes
Pollulert system
Pipe monitoring
Vapor wells
Liquid sensor 1n vault
No leak detection
Casual only
Weekly
Monthly
Weekly
After any specified
number of months
Any specified % of
throughput
Semi-annual
Annual
Every five years
In any specified set of
years (up to 10 years
may be specified)
Effect
Determines leak
duration.
Cross References
Section 4.12
Determines leak
duration.
Determines leak
duration.
Determines minimum
leak rate which
may be detected.
Determines leak
duration.
Section 4.12
Section 4.12
Section 4.12
Section 4.12
-------
TABLE 10. USER INPUTS FOR HAZARDOUS WASTE TANK FAILURE MODEL (Continued)
Variable Description
Possible Choices
LEAK DETECTION SYSTEM (Continued)
Pipe Integrity testing
frequency
Tank Integrity testing
limit
Pipe Integrity testing
limit
Pipe monitoring detection
limit
Ultrasonic testing
frequency
Vapor well distance
from pipes, pumps,
and tank
Vapor well detection
threshold
Frequency of U-tube
monitoring
Semi-annual
Annual
Every five years
In any specified set of
years (up to 10 years
may be specified)
Any
Any
Any
In any specified set of
years (up to 5 years
may be specified)
Any non-zero distance
Any
Weekly
Monthly
Quarterly
Annually
Effect
Determines leak.
duration.
Determines minimum
leak rate which
may be detected.
Determines minimum
leak rate which
may be detected.
Determines minimum
leak rate which
may be detected.
Determines leak
duration.
Determines lag
until detection.
Determines minimum
leak rate which may
be detected.
Determines leak
duration.
Cross References
Section 4.12
Section 4.
Section 4.12
Section 4.12
Section 4.12
Section 4.12
Section 4.12
Section 4.12
-------
TABLE 10. USER INPUTS FOR HAZARDOUS WASTE TANK FAILURE MODEL (Continued)
Variable Description Possible Choices
SIMULATION CONTROL VARIABLES
Number of Iterations Any
in
Length of simulation
period
Initial age of tank
population to be
modeled
Types of failures to be
culled from existing
tank population
1-40 years
0-39 years
Detected tank failures only
Detected tank failures plus
undetected tank failures
All tank leaks and ruptures
Effect
Larger numbers of
Iterations produce
more accurate
release profiles.
Determines duration
of simulation period.
Determines stochastic
characteristics of
existing tank systems.
Determines stochastic
characteristics of
existing tank
systems.
Cross References
Section 4.2
Section 4.2
Section 4.2
Section 4.2
-------
number of operating hours per day and operating days per week for treat-
ment tanks.
Tank Dimensions. Tank dimensions are calculated according to the formulas
presented in Table 11. These formulas are derived from the standard
geometric formulas for the column of a cylinder. In deriving these for-
mulas, we have assumed that each tank 1s 1.005 times larger than its rated
capacity. In addition, we have used a fixed height-to-diameter ratio for
each category of tanks. These height-to-diameter ratios are presented in
the last column of the table, and are derived from tank dimension data
obtained from Kirby (1979), Holzauer (1980), personal communications with
an oil refining manager, and personal observations.
«
Steel and stainless steel tanks of less than 50,000-gallons capacity are
horizontal or vertical cylinders with flat or ellipsoidal ends. These
tanks have lengths (or heights) that are twice as large as their diameters.
A 10,000-gallon tank is therefore 9.5 feet in diameter and 19 feet long. A
50,000-gallon tank is 16 feet in diameter and 32 feet long. Because the
difference between flat and ellipsoidal ends is not significant, we have
used a single formula for both shapes.
Steel and stainless steel tanks with capacities in excess of 50,000 gallons
are always vertical and are not so elongated, having length-to-diameter
ratios of 1. Thus, a 60,000-gallon tank is 22 feet in diameter and 22
feet high, while a 375,000-gallon tank is 40 feet in diameter and 40 feet
high. For strength reasons, steel tanks are seldom more than 40 feet in
height. Therefore, for tanks larger than 375,000 gallons, we have fixed
the height at 40 feet and enlarged the diameter to include the the
necessary volume.
Fiberglass tanks, on the other hand, are more elongated than even the
smallest steel tanks, having lengths that are three times greater than
their diameters. Because fiberglass is not as structurally strong as
steel, these tanks are not extremely large. Based on Kirby (1978) and
Holzauer (1980), we have chosen 30,000 gallons as a practical limit to the
size of fiberglass tanks.
76
-------
TABLE 11. DIMENSIONS FOR TANKS OF VARIOUS CAPACITIES
AND CONSTRUCTION MATERIALS
rectangular
.406(1.005 x volume)1/3
(gives both length
and height)
Tank Length or
Height (depending
Tank Capacity
Tank Material (gallons)
Steel or
Stainless Steel1*4
Fiberglass Reinforced
Plastic (FRP)
Concrete2*4
£50,000
£50,000
50,001 to 375,000
>375,000
£ 30,000
£ 30,000
any
Tank
Shape
horizontal
cylinder
vertical
cylinder
vertical
cylinder
vertical
cyl 1 nder
horizontal
cylinder
vertical
cylinder
vertical
cylinder
Tank Diameter
(feet)
.440(1.005 x
.440(1.005 x
.554(1. 005 x
.0652(1.005
.385(1.005 x
.385(1.005 x
.698(1.005 x
volume) 1/3
volume) 1/3
volume) 1/3
x volume)!/2
volume) 1/3
volume) 1/3
volume)l/3
on orientation)
(feet)
2 x
2 x
1 x
40
3 x
3 x
1/2 x
Diameter
Diameter
Diameter
feet
Diameter
Diameter
Diameter
2 x Width
(gives tank length)
Sources:
1 Holzauer (1980).
2 SCS Engineers (Estimated Cost of Compliance (1984)).
3 Kirby (1978).
4 PRA estimates based on personal observations and conversations with
oil refinery managers.
-------
Concrete tanks may be any size and may be either cylindrical or rec-
tangular. Cylindrical tanks are always vertical, with heights that are
only 50% of their diameters. Rectangular tanks are always horizontal, with
length, width, and height having ratios of 2:1:1, respectively. Unlike
steel tanks, concrete tanks may exceed 40 feet in height.
Tank Thickness. Tank wall-thicknesses are selected to give the tank the
necessary structural strength. For steel and stainless steel tanks, these
thicknesses also include a standardized corrosion allowance. Table 12 pre-
sents the standard tank wall-thicknesses for steel, stainless steel, and
concrete tanks of various capacities. For steel and stainless steel tanks,
these thicknesses range from .25" to .625". For concrete, they range from
6" to 15". We use these wall-thicknesses to calculate dates of corrosion
failure (for steel tanks) and rates of fluid seepage through the pores of
concrete tanks. These calculations will be described in Section 4.5 below.
Tank wall-thickness does not influence our estimated probability of rup-
ture, however. Instead, we assume that the tank is designed to have a suf-
ficient safety margin against normal operating stresses. Larger tanks have
stronger walls, but they also experience greater stresses. We assume that
these two factors cancel put and that tank rupture probabilities are there-
fore Independent of tank size.
Component Specifications and System Layout. The choices of tank capacity,
tank orientation, throughput, tank location, and the process for which the
tank is being used serve to specify a number of other design parameters.
These parameters include the average depth of the fluid in the tank, the
identity of the fluid contained in each tank or pipe, the number and
operating pressures of the pumps, the diameter of the pipes, and the rela-
tive elevations of pipes, fill tanks, and process or storage tanks.
These parameters Influence two important aspects of the model: they deter-
mine the operating pressure in each component, and they determine the frac-
tion of the time when each of the pipes and ancillary components
are 1n use. The operating pressures determine leak rates (see Section
4.11 below) while the periods of operation determine the fraction of the
78
-------
TABLE 12. TANK WALL THICKNESSES
Tank Material
Steel and Stainless Steel
1
Tank Capacity
(gallons)
<10,000
10,001 - 20,000
20,001 - 30,000
30,001 - 100,000
>100,000
Tank Wall Thickness
(inches)
0.25
0.31
0.38
0.50
0.625
Concrete^
<3,000 ,
3,001 - 20,000
20,001 - 50,000
>50,000
6
8
12
15
Sources:
1 Holzauer (1980).
2 SCS Engineers, Estimated Cost of Compliance 1984),
79
-------
operating day during which leakage can occur, and determine the amount of
wear and tear on pumps, valves, and other ancillary equipment.
It is impractical for the main body of this report to present the details
of the calculation of operating pressures and periods of ancillary equip-
ment operation. Because the model includes so many design options, it
allows hundreds of different combinations of operating pressures and
operating periods. The effect of each design option on these parameters is
explained in Appendix 0.
Environmental characteristics.
The model allows us;to vary environmental parameters. Some of these para-
meters Identify which geologic or weather-related hazards may threaten a
particular locale. Other environmental variables allow us to specify the
soil pH, resistivity, and moisture content at a particular site and to
determine whether or not the soil contains sulfides. These soil charac-
teristics determine the corrositivity of the soil; their effects will be
described in Section 4.5, below.
Waste Characteristics
The model also allows us to vary the physical and chemical characteristics
of the waste stream. These characteristics determine leak rates from
above- and below-ground holes, influence the detection lags for various
leak detection methods, and determine whether or not the waste is flam-
mable. The effects of these variables are listed in Table 10; more
detailed information may be obtained from the sections of this report
listed there as cross references.
80
-------
Secondary Containment and Leak Detection.
Two other classes of variables allow us to specify the design of the faci-
lity's secondary-containment and leak-detection systems. Table 10
lists the options for each of these systems, as well as the parameters
affecting their performances. These systems and the effects of the listed
parameters will be described in detail later in this report.
Simulation Control Variables
The final category of user inputs for the Monte Carlo model are the simula-
tion control variables. These four variables allow us to control the
number of iterations, set the length of the simulation period, set the ini-
tial facility age when existing tanks are being modeled, and determine the
rules for culling existing tanks that have already failed before the start
of the simulation period.
Number of Iterations. The number of iterations determines the accuracy of
the release profiles produced by the model. A large number of iterations
provides a more representative sample, and smooths out the effects of any
particularly unusual results. In addition, a large number of itera-
tions allows rare events to occur, so that the composite release profile
more closely represents the entire range of possible performances.
Generally, 500 to 1000 iterations are recommended for simple Monte Carlo
models (EPA, Liner Location Report, Appendix A, 1984). Because of budget
constraints, however, complex models such as ours are often run with 200 or
fewer iterations (EPA, Liner Location Report, Appendix A, 1984). For such
models, their lengthy time horizons effectively increase the number of
iterations by repeating major portions of the model once each simulation
period. Thus, 200 iterations of a 30-year model serve to simulate 6000
operating years, or 72,000 operating months, thus providing opportunities
for many different events to occur.
81
-------
Length of Simulation period. Our model allows us to specify any simula-
tion period between 1 and 40 years. In principal, the model could accomo-
date longer simulations, but few tank systems last that long, and there is
almost no data on the performance of those that do.
Initial Age of Tank Facility and Culling Rules. The Monte Carlo model is
capable of simulating either new or existing facilities. To simulate new
facilities, we specify an initial age of zero. To simulate existing faci-
lities we begin by specifying the age of the facilities to be modeled and
the rule to be used to cull leaking tanks from the year-zero population. A
simple example best illustrates how these two parameters work. Suppose
that we wish to model 5-year-old storage tanks over a 20-year simulation
period. For each iteration, the model first runs a 5-year simulation in
order to determine the random processes that have already occurred before
the start of the simulation period. If the tank fails within that period,
the model uses the culling rule to determine whether the iteration should
be continued. The purpose of the culling rule is to determine which types
of presently leaking tanks we wish to include in the simulation. Tanks
with detected leaks, for example, will have been replaced at least once,
and we should no longer classify them as 5-year-old tanks. Similarly, if
tightness testing is to be required as a condition for the granting of per-
mits, we may wish to also cull tanks with previously undetected tank leaks,
for they will be replaced at the time of testing. Using the options listed
ir> Table 10, we can cull only iterations which have had detected tank
failures, those which have had either detected or undetected tank failures,
or those which have had leaks or ruptures in any system component.
Iterations that are not culled before year 5 then continue through an addi-
tional 20-year simulation in order to predict their future performances.
Thus, for those iterations which are not culled, the simulation process
covers a total time period of 25 years.
We can use this technique to simulate existing tanks of any desired age,
but because of the limitations on our failure data, the total modeled time
period cannot exceed 40 years.
82
-------
4.3 Probability Sampling
Once the system parameters have been chosen, the Monte Carlo simulation
model begins to evaluate the fault trees. The basic element of this pro-
cess is the simulation of individual stochastic events by a procedure
referred to as "event sampling." Event sampling consists of the use of
computer-generated random numbers to determine whether any of the stochastic
events have occurred. There are two approaches to event sampling: binomial
sampling and time-to-failure sampling. In binomial sampling, the computer
selects a random number between 0 and 1 and compares that number to the
event's probability. If the random number is less than or equal to the pro-
bability, then the event is declared to have occurred. Otherwise, it does
not occur. In this way, the Monte Carlo model ensures that each binomial
event occurs with the probability assigned to it.
In our model, binomial sampling may occur monthly, annually, or on a per
demand basis. Monthly sampling is capable of detecting up to 12 occurrences
per year (one per month). Annual sampling, however, can detect no more than
one occurrence per year; the month of occurrence can be determined by
drawing an additional random number between 0 and 12. Annual sampling
requires less computer time because it uses at most two random numbers per
year (monthly sampling uses 12), but is less accurate because it fails to
detect repetitions of the same event during a single year. In order to
compromise between computer costs and model accuracy, we have generally used
annual sampling only when the annual probability is less than 3%. Under
these circumstances, the probability of multiple occurrences is less than
.09% (3% x 3%), which is insignificant compared to the uncertainty likely to
be inherent in the original estimate.
In addition to being annual or monthly, binomial probabilities can also be
specified on a per-demand basis. Per-demand probabilities give the likeli-
hood of failure on each occasion that a component is needed. Thus, we often
use per-demand probabilities when the component is part of an emergency
back-up system. For such systems, it is much more useful to know the proba-
bility that a component fails when it is needed than it is to know the pro-
bability that it fails during any given month or year. Furthermore, by
83
-------
using per-demand probabilities for such components, we save considerable
computer time, for then these events need only be sampled when the back-up
systems are required.
It is possible to model any stochastic event using only binomial sampling,
but time-to-failure sampling 1s more convenient for events for which cumula-
tive time-to-failure probabilities are easily computed.
A cumulative time-to-failure probability is simply the probability that the
failure event in question has occurred at or before a given time. A set of
such cumulative probabilities is a cumulative time-to-failure distribution.
An example is given In the following table:
Year Cumulative Probability
1 .05
2 .10
3 .20
4 .60
5 1.00
This distribution means that there is a 5% probability that the event has
occurred by the end of year 1, a 10* probability that it has occurred by the
end of year 2, a 20% probability that it has occurred by the end of year 3,
etc. This is equivalent to saying that there is a 5% probability the event
occurs in year 1, a 5% probability that it occurs ^n. year 2, and a 10% pro-
bability that it occurs j_n year 3. In this example, the event will occur
with certainty by the end of year 5.
In time-to-failure sampling, the computer selects a random number between 0
and 1 and determines the date of failure by comparing that number to the
cumulative probability distribution. In the above example, a random number
of .4 would mean that the event occurs during year 3.
Binomial and time-to-failure sampling provide comparable but slightly dif-
ferent Information. Binomial sampling reveals whether or not the sampled
event occurs during any given time period; the sampling process must there-
fore be repeated regularly until the event occurrs. Time-to-failure
sampling, on the other hand, need only be done once per component. The com-
84
-------
puter then remembers the date of failure, periodically compares the com-
ponent age to its failure date, and determines whether or not the component
has failed yet. Under either sampling technique, once the component
fails it remains in its failed state until the failure is detected and
repaired. At that time, the model assumes that the component is restored to
an as-new condition, and the computer resumes the sampling process with
the repaired component's age re-set to zero.
Our computer model uses time-to-failure sampling whenever a cumulative pro-
bability distribution is assigned to an event. These probability distribu-
tions fail into five basic categories:
o Normal distributions,
o Uniform distributions,
o Empirical distributions,
o Beta distributions, and
o Conditional normal distributions.
The first four of these distributions are easy to describe. The normal
distribution is usually represented by the familiar bell-shaped curve; its
cumulative distribution is mathematically specified by its mean and standard
deviation. A uniform distribution occurs when there is an equal chance of
failure for any of a range of dates; its time-to-failure distribution is
mathematically specified by the end points of that range. An empirical
distribution is a distribution similar to the hypothetical distribution used
above; its cumulative distribution is given as a series of dates and cumula-
tive probabilities. A beta distribution looks somewhat like a skewed, trun-
cated normal, with its peak shifted either to the right or the left.
Examples are depicted in Figure 18. The beta distribution is completely
specified by three values, the minimum, maximum, and mode (peak). Its
cumulative distribution can also be obtained from these values.
85
-------
FIGURE 10. BETA DISTRIBUTIONS
CD
<
CO
o
o:
a.
CO
o
Of
a.
CD
S
O.
86
-------
The final distribution used by our model is the conditional normal. This
distribution is a combination of a binomial and a normal distribution. The
binomial distribution is sampled once (in year 1) to determine whether
failure occurs. If the response is positive, the normal distribution is
then sampled -to determine when the failure takes place. A conditional nor-
mal distribution therefore combines two random processes into a single pro-
bability distribution. One process is the binomial occurrence of the
initiating event, the other is the (normal) determination of the date of
failure.
In order to refer to these distributions conveniently, we have developed a
shorthand notation for each of the five parametric distributions. These
notations, which will be used throughout the remainder of this report, are:
• p = a (binomial distribution with probability a);
• N(x,y) (normal distribution with a mean of x and a standard devia-
tion of y);
o FNU(a,b) (uniform distribution between values a and b);
• B(a,b,c) (beta distributions with minimum a, mode b, and maximum
c); and
• pN(X,y) (conditional normal with binomial probability p and normal
time-to-failure N(x,y)).
Empirical distributions will be described by a table of their cumulative
.probabilities.
4.4 Fault Tree Event Probabilities
We used a combination of engineering judgment, published failure data, and
conversations with equipment vendors to assign probability distributions to
each of the basic events in the fault trees in Chapter 2. Where possible,
we drew our probability values directly from the most reliable published
sources. In many cases, however, the available data were not directly
applicable, and had to be modified to fit the events being modeled.
Sometimes such modifications were required because failure data were not
available for the proper component; on other occasions modifications were
87
-------
required in order to adjust the published failure rates to apply to the
appropriate operating conditions.
Because of the number of events and the complexity of some of the deriva-
tions, it is impractical to discuss all of them in the main body of this
report. Instead we have listed the probabilities in Table 13, and have
presented the details of the derivations in Appendix A.
Many of the probabilities presented in Table 13 are dependent on system
design characteristics. These probabilities have therefore been included
in Table 13 as general formulas. These formulas use the following
variables as inputs:
A = the surface area of the component.
Hd = the number of operating hours in a day. For storage tanks, HH
is the number of hours required to transfer a batch of waste from
the collection tank to the storage tank. I.e., for the purposes
of formulas using H^, we only consider a storage tank to be
"operating" when it is being filled.
Hm = the number of operating days per month. For storage tanks, Hm is
the number of transfers per month. Thus, for storage tanks,
Hm = 30%.
j = the number of pump-outs per year. (This parameter only applies to
storage or accumulation tanks).
n^ = the number of batches per day. For storage tanks, n^ may be less
than 1.
T(j = the time it takes to transfer one batch into the tank (in hours).
For continuous sytems, T^ = Hj.
Tp = the time it takes to pump-out the tank (in hours). (This para-
meter only applies to storage or accumulation tanks).
The events in Table 13 are grouped into 9 categories:
t Corrosion,
• Ruptures,
• Installation damage,
• Control equipment failures,
88
-------
TABLE 13. BASIC EVENT PROBABILITIES
Type of Failure and Event Label *
CORROSION
Tanks (T1121, T1123, T1125, T1127, T1128)
Pipes (813)
Pumps (A2116)
Gaskets (B122)
Erosion (B13, A2116)
RUPTURES
Tanks (above-, below-, or in-ground)
• Steel (T1124)
t Stainless steel (T1124)
e Fiberglass (T1124)
• Concrete (B41)
e Double-walled tanks (T1124)
- inner wall
- outer wall
- conditional probability that outer
wall breach also breaches inner wall
Pipes (above- or below-ground)
e Steel (BID
• Stainless steel (BID
• Fiberglass (BID
• Double-walled pipes (B13)
- inner wall
- outer wall
- conditional probability that outer
wall breach also breaches inner wall
Flange leaks (B121)
Probability2
See Section 4.5
See Section 4.6
See Section 4.7
See Section 4.9
See Section 4.10
5.3 x 10-3/yr
5.3 x 10-3/yr
1.06 x 10-2/yr
N (35,10)
2.6 x 10-3/yr
5.3 x 10-3/yr
50%
3 x 10-3/yr
3 x ID'3 /yr
6 x 10-3/yr
1.5 x 10-3/yr
3 x 10-3/yr
50%
5 x 10-3/yr
89
-------
TABLE 13. BASIC EVENT .PROBABILITIES (Continued)
Type of Failure and Event Label
INSTALLATION DAMAGE- (or damage
during shipping)
Tank (below-, above-, or in-ground)
(LIFDEF (I,5)A)
• Steel
t Stainless steel
• Fiberglass
• Concrete
Pipe (below- or above-ground)
(LIFDEF (1,5)8 or LIFDEF (I,5)C)
t Steel
• Stainless steel
• Fiberglass
Welded flange (LIFDEF (I,5)D)
Gasket (LIFDEF (I,5)E)
CONTROL EQUIPMENT
Automatic level controller fails (FLVCNl)
Level indicator fails (MOLEVIN)
Mechanical failure of automatic inlet valve
• normal environment (pH > 4.5)3 (QPVLON)
• extreme environment (pH£4.5)3 (OPVLOE)
Tank is being filled when nearly full (MOFILL)
• Storage or accumulation tanks
• Treatment tanks
Probability2
.03/tank
.03/tank
.04/tank
.03/tank
.01/pipe
.01/pipe
.02/pipe
.02/flange
.015/gasket
.094/mo
.16/mo
- 3.4 x 10-5)H
-------
TABLE 13. BASIC EVENT.PROBABILITIES (Continued)
Type of Failure and Event Label *
EMERGENCY SHUT-OFF-EQUIPMENT
High level alarm fails (MOALARM)
High level sensor fails (LEVIN2)
Microprocessor fails (FLVCN2)
Inlet pump fails to shut off
• Normal environment (pH > 4.5)3 (MOPMON)
• Extreme environment (pH < 4.5)3 (MOPMDE)
Inlet valve sticks in open position
• Normal environment (pH > 4.5)3 (MOVLOE)
• Extreme environment (pH £ 4.5)3 (MOVLON)
Outlet pump fails to open
• Normal environment (pH > 4.5)3 (MOPMCN)
• Extreme environment (pH£4.5)3 (MOPMCE)
Outlet valve fails to open
• Normal environment (pH > 4.5)3 (MOVLCN)
• Extreme environment (pH £ 4.5)3 (MOVLLE)
HUMAN ERRORS
Failure to detect improper installation
or shipping damage (LIFDEF(I,3))
• No inspection
• Visual inspection
• Visual inspection and weld testing
t Visual inspection, weld testing,
and tightness testing
Operator throws wrong switch, etc.
in response to an alarm (OFTRCOM)
Probability2
.I/demand
.008/demand
.05/demand
7.5(Tb) x 10-7/demand
7.5(Tb) x 10-5/demand
3.4(Tb) x 10-5/demand
3.4(Tb) x 10-4/demand
2(Tb) x 10-6/demand
2(Tb) x 10-4/demand
3.4(Tb) x 10~5/demand
3.4(Tb) x 10-4/demand
1.00/demand
.50/demand
.25/demand
.05/demand
3 x 10'3/demand
91
-------
TABLE 13. BASIC EVENT PROBABILITIES (Continued)
Type of Failure and Event Label ^
HUMAN ERRORS (Continued)
Operator fails to act in response
to an alarm (OFTROM)
Operator control error causes
attempted overfill (OPCOMM)
• Batch systems
• Continuous systems
SECONDARY CONTAINMENT FAILURES
Asphalt pad cracks (B21)
£2.5" pad, no maintenance
£2.5" pad, with maintenance
>2.5" pad, no maintenance
>2.5" pad, with maintenance
Asphalt-covered berm (B21)
£2.5" thickness of asphalt,
no maintenance
£2.5" thickness of asphalt,
with maintenance
>2.5" thickness of asphalt,
no maintenance
>2.5" thickness of asphalt,
with maintenance
Concrete pad develops cracks (831)
Concrete curb develops cracks (B33)
Concrete vault develops cracks (841)
Synthetic liner fails (B51)
Probability2
3 x 10-2/demand
l-(.9!4)nb/month
.086/mo
8(2.5,8,12)
8(4,12,15)
8(4,12,15)
8(5,15,18)
8(2.5,8,12)
8(4,12,15)
8(4,12,15)
8(5,15,18)
N(30,5)
N(30,5)
N(35,10)
N(35,10)
92
-------
TABLE 13. BASIC EVENT PROBABILITIES (Continued)
Type of Failure and Event Label 1
EXTERNAL CATASTROPHES
Vandalism (ANUCAT (1,2))
Damage due to earthquake (ANUCAT (1,4))
Tornado damage (ANUCAT(I,3))
Hurricane damage (ANUCAT (1,3))
Damaging flood (ANUCAT (1,5))
Ignitable waste catches fire
Nearby fire or explosion (ANUCAT (1,7))
• above- or in-ground system
• below-ground system
ACCIDENTAL SPILLS
Strainer Drain Left Open After Maintenance
• On-site strainer (Alllll)
• Strainer on pump-out truck (Alllll)
Pump Drain Left Open After Maintenance
• On-site pump (A11112)
• Pump on pump-out truck (A11112)
Flexible hose ruptures (A1112)
Loose flexible hose connection (A1115)
Probability2
1 x 10-6/yr
8 x lO'Vyr
1.5 x 10-4/yr
1.4 x 10-2/yr
5 x 10-3/yr
1 x 10-6/yr
3 x 10-3/yr
1 x 10-3/yr
.01/mo
j) x 10-5/yr
.01/yr
5(j) x 10-6/yr
5(j)(Tp) x 10-3/yr
j x 10-2/yr
1
These labels correspond to the labels in the fault trees. They are also used
in Appendix A. That Appendix explains the derivation of each of these proba-
bilities. It also lists the sources used in these derivations.
2 The notation used for these probability distributions is explained in
Section 4.3 of this report. The variables used in these formulas are
defined in Section 4.4.
3 We have chosen a pH of 4.5 as the cut-off between normal and extreme
environments (Perry and Chilton, 1973, p. 23-4). Highly alkaline
environments will also be extreme, but the present version of our model
does not include caustic wastes.
93
-------
• Emergency shut-off failures,
• Human errors,
• Secondary containment failures,
t External catastrophes, and
t Accidental spills.
These events correspond to the basic events in the fault trees in Chapter
2. To allow easy reference to the fault trees, Table 13 includes the label
for each of the events. These labels are also useful in locating the deri-
vations of these probabilities in Appendix A.
In addition to listing the event probabilities in Table 13, we have
constructed Figures 19 through 23 to illustrate how these probabilities may
be integrated into the fault trees. Because it is impractical to incor-
porate all of the design-dependent probabilities into a single fault tree,
Figures 19 through 23 are merely an example based on a specific system
design. Furthermore, since some probabilities (particularly those
influencing corrosion) vary with component age, these sample fault trees
represent only one model year; in this example, we assume that the facility
is 10 years old.
The facility modeled in Figures 19 through 23 has the following design
characteristics:
« It is used for 180-day storage.
• The tank and piping are below-ground and are constructed of unpro-
tected carbon steel, without secondary containment.
• Filling is done in once-a-day batches by gravity feed from an off-
site collection tank. The gravity-feed system has manual level
controls and manual emergency shut-off.
• The tank is emptied using a flexible hose and a pump on the pump-
out truck. Pump-out takes 2 hours.
t The tank has a capacity of 5,000 gallons.
t There are two pipes: a 100-foot, 2"-diameter, fill pipe, and a
10-foot, 4"-diameter, pump-out pipe.
94
-------
FIGURE 19. BASIC FAULT TREE FOR A 5000-GALLQN
UNDERGROUND STORAGE TANK
.1 1 per year
Release of Hazardous
Materials into the Environment
.11 per year
Release from the
Tank System
1.00
(no such
system)
Secondary
Containment Failure
v^
\
Overflow
/Al\
(Figure 20)
1.6x 10"3/yr
1
Leak or
Rupture
/B\
1
External
Catastrophe
/C\\
(Figure 21 ) (Figure 22)
I.Ox 10"' /yr 6.1 x 10'3/yr
1
Spill during
filling or
discharging
/D1\
(Figure 23)
6.3 x 10"4/yr
95
-------
FIGURE 20A. OVERFLOWS FOR A 5000-GALLON
UNDERGROUND STORAGE TANK
Tank
Overflows
1 .4 x 1 0"4 /mo
1.7x 10~3 /yr
Control
Error Causes
Attempted
Overfill
.23 / mo.
^
(.079 /mo J
.061
/mo.
.13 / demand
Fails
Down
I 1
Tank Nearly A x^x
Fun
(MOFILL)
f .16/mo. J
Level
Indicator
Failure
(MOLEYIN)
Breach in Tank
or Piping
Provides Escape
Route for
Overflowing
Fluid
1.00
(no such
system)
.13 / demand
Level
Controller
Failure
(FLUCN1)
Operator
Error
(OPCOMM)
Mechanical
Failure of
inlet Valve
(OPVLON)
Automatic
Emergency
Shutdown System
Fails
Manual
Shutdown
Failure
96
-------
FIGURE 20B. OVERFLOWS FOR A 5000-GALLON
UNDERGROUND STORAGE TANK (cont.)
Manual
Shutdown
Fail ure
.13 per demand
.03 per demand
Failure to
Respond to
Alarm
High Level
Alarm
Fails
(MOALARM)
Operator
Error
.03 per demand
<10'4per
demand
Mechanical
Failure
of Pumps
or Valves
.003
Error of
Commission
(i.e. operator
throws wrong
switch, etc.)
(OFTRCOM)
Error of
Omission
(i.e. operator
fails to act)
(OFTROM)
97
-------
FIGURE 20C. OVERFLOWS FOR A 5000-GALLON
UNDERGROUND STORAGE TANK (cont.)
Mechanical
Fail urc of
Pumps or Valves
1 x 10 -3
per demand
1
1 x 10'5
per demand
Inlet Pump and
Valve Fail
1.00
(no such
system)
Outlet Pump or
Valve Fails
no pump in
this system
Pump
Fails
(MOPMON)
Valve
Fails
(MOVLON)
98
-------
FIGURE 20D. OVERFLOWS FOR A 5000-GALLON
UNDERGROUND STORAGE TANK (cont.)
Breach in System
Allows Fluid to
Escape Following
Overfill
System
has open
top
(A210)
0
Fluid
Escapes
Through
Overflow
Valve or
Vent
(A211)
.061 per
month
Outlet Pipe,
Flange, or
Gasket
Breached
(A213, A214,
or A215)
Inlet Pipe,
Flange, or
Gasket
Breached
(A216,
A217,or
A218)
Vent Pipe or
Flange
Breached
(A219, A220,
or A221)
99
-------
FIGURE 21 A. LEAKS AND RUPTURES FOR A 5000-GALLON
UNDERGROUND STORAGE TANK
Tank System
Develops
Leaks or Ruptures
.10 in year
10
1
Tank
Failure
i
.062 .031
Pipe
Failure
Pump
Corrodes
Flange or
Gasket Failure
Tank
Corrodes
Tank
Ruptures
.020 for fill pipe
.0053 for
discharge pipe
(in year 10)
0 (no pump)
I
Pipe
Corrodes
^N
I
Pipe
Ruptures
.005 per flange
.01 for two flanges
.003 per pipe
.006 for two
pipes
100
-------
FIGURE 2 IB. LEAKS AND RUPTURES FOR A 5000-GALLON
UNDERGROUND STORAGE TANK (cont.)
Tank Corrodes
.057 in year
10
B2\
( °46 )
Failure due
to localized
exterior
corrosion
(11121,71125,
and T! 126)
T .01 1 1
Failure due
to localized
interior
corrosion
(T1123
and
T1127)
Failure due
to
generalized
corrosion
(11125,11126,
and Til 27)
101
-------
FIGURE 21C. LEAKS AND RUPTURES FOR A 5000-GALLON
UNDERGROUND STORAGE TANK (cont.)
Tank Ruptures
5.3 x io~3
in year 10
0.0
(in year 10)
Undetected Faulty
Installation
Tank Ruptures
After
Installation
(Til 24)
Tank Damaged
During or
Before
Installation
-------
FIGURE 21D. LEAKS AND RUPTURES FOR A 5000-GALLON
UNDERGROUND STORAGE TANK (cont.)
100-Foot
Fill Pip*
Corrod»«
.020
in year 10
_A
/B4\
Fail ure due
to localized
exterior
corrosion
(B13)
Failure due
to localized
interior
corrosion
-------
FIGURE 2 IE. LEAKS AND RUPTURES FOR A 5000-GALLON
UNDERGROUND STORAGE TANK (cont.)
10-Foot
Discharge Pipe
Corrodes
5.3 x 10~3
(in year 10)
V
^
Failure due
to localized
exterior
corrosion
(813)
Failure due
to localized
interior
corrosion
(813)
Failure due
to
generalized
corrosion
(B13)
104
-------
FIGURE 21F. LEAKS AND RUPTURES FOR A 5000-GALLON
UNDERGROUND STORAGE TANK (cont.)
Pipe Ruptures
.003
in year 10
Undetected Faulty
Installation
Pipe Ruptures
After
Installation
(B11)
Pi pe Damaged
During or
Before
Installation
(UFDEF
-------
FIGURE 21G. LEAKS AND RUPTURES FOR A 5000-GALLON
UNDERGROUND STORAGE TANK (cont.)
Flange or Gasket
Failure
.005
in year 10
Flange Leaks
.005
in year 10
Gasket Leaks
0
(no gasket)
Undetected
Faulty
Installation
0
in year 10
.005
Weld
Develops
Leak
(B121)
Flange
Defective
at
Installation
(LIFDEF(I,5)D)
Inspection
Error
(LIFDEF(I,5)D)
106
-------
FIGURE 22. EXTERNAL CATASTROPHES FOR A 5000-
6ALLON UNDERGROUND STORAGE TANK
Loss of System Contents
due to External
Catastrophe
6.1
x 10'3/yr
0.0
Vandalism
107
-------
FIGURE 23.
ACCIDENTAL SPILLS FOR A 5000-GALLON
UNDERGROUND STORAGE TANK
Spill during
Filling or
Discharging
6.3 x
10'4/yr
Strainer drain
left open after
mai nte nance
(All 111)
Pump drain
left open after
maintenance
(A11112)
f .0004 J
Flexible
Hose
Rupture
(A1112)
Loose
Flexible
Hoae
Connection
(All 15)
108
-------
• The soil around the pipes has a resistivity of 2000 ohm-cm and a
pH of 5.
• The waste is flammable.
t The facility is located on a flood plain in a tornado region.
Based on these characteristics, we have computed the year-10 probabilities
for each basic event and combined these probabilities to show the pro-
babilities for intermediate and top events. In order to do this, we have
replaced all time-to-failure distributions with these year-10 failure pro-
babilities and have converted all monthly probabilities into annual
probabilities.
To calculate the probabilities for the upper events on these fault trees,
we had to take account of the presence of .AND. and .OR. gates. For events
that are connected by .AND. gates, we calculated the upper-event probabili-
ties by multiplying the initiating-event probabilities.
In the case of .OR. gates, the computation was more complex, requiring .
first the calculation of the probability that none of the events occurs,
and then the subtraction of that probability from 1 in order to obtain the
probability that one or more of the events occurred in some combination.
Thus, for two events with probabilities PI and P2, this probability is
given by [l-(l-pi)x(l-p2)]. If PI and P2, are small, this value can be
approximated by p^ + p^. This simplification is generally sufficient whe-
never the algebraic sum is less than 0.1.
Figures 19-23 present a useful graphic depiction of the way that the proba-
bilities and the fault trees relate. It must be realized, however, that
such figures necessarily simplify the Monte Carlo model's approach to
fault tree evaluation. These figures, for example, cannot allow for
multiple occurrences of those events which the Monte Carlo model samples
on a monthly basis. In addition, unlike the Monte Carlo model, such
figures cannot.account for the effects of prior failures on the year-10
failure probabilities, for these effects will vary from iteration to
iteration. Instead, these figures are based simply on the failure distri-
butions listed in Table 13, with no consideration of the possibility that a
component might fail and be replaced prior to year 10.
109
-------
With these caveats, however, Figures 19 through 23 still provide useful
insights into the Hazardous Waste Tank Failure Model. They show, for
example, that for underground storage tanks, leaks and ruptures are by far
the most likely failure mechanisms. This does not mean, though, that all
of the other failure mechanisms are unimportant; external catastrophes, for
example, may be relatively unlikely, but when they occur, they produce
large releases. Some release mechanisms, however, are comparatively unim-
portant. Accidental spills, for example are not only the least likely
release mechanism, but they are also unlikely to involve large volumes (see
Section 4.10 below). Similarly, overfills are unimportant loss mechanisms
for underground storage tanks, for such tanks are infrequently filled to
near capacity, and only have overflow routes if they are already leaking
for other reasons. Thus, even though Figure 20B indicates that manual
emergency shut-off systems have a 13% failure rate, these systems appear to
be satisfactory for underground storage tanks.
Above-ground tanks, however, are much more likely to overflow, for their
vents provide ready overflow routes. In addition, treatment tanks are also
much more vulnerable to overflow, for not only are they generally above-
ground, but they are also repeatedly filled nearly to capacity. Figure 24
therefore depicts the overflow fault tree for a batch treatment tank with
manual controls. We assume that this tank operates 8 hours per day and
processes 4 batches per day. Figure 25 depicts the overflow probabilities
for a similar tank using a continuous process and automatic controls.
These fault trees indicate that overflows are very probable for treatment
tanks with manual shut-off systems, but less frequent for systems with
automatic shut-off.
Probability calculations such as those illustrated in Figures 19 through 25
were very important to the development of our Monte Carlo model. Such
calculations gave us benchmark failure rates against which to compare the
results of the computer simulation. In addition they allowed us to deter-
mine visually which stochastic events deserved the most study.
These sensitivity analyses indicated that three failure mechanisms are par-
ticularly important: overflows, ruptures, and corrosion holes. We have
110
-------
FIGURE 24A. OVERFLOWS FOR A 5000-GALLON TREATMENT
TANK WITH 4 BATCHES PER DAY AND MANUAL SHUT-OFF
Tank
Overflows
.053 per mo.
.52 per year
Control " ~ x" ^v
Error Causes .4ipermonih (100)
Attempted V ' J
uvcr 1 1 u
H
6/mo.J f 0.0 J
Tank
\ Fi
N (MOF
I
Nearly
ill
ILL)
( .30/mo.J [ 0.0 J
1.00 13 Fails
(above-ground per demand to Shut
tank) Down
A d^
* — *
i i
pn»nrh in T»nt , j I
or Piping 1.00 .13 |
Provides Escape (no such per demand j
Route for system) i
Overflowing 1 1
Fluid A A
Level
Indicator
Failure
(MOLEYIN)
Level Operator
Controller Error
Failure (OPCOMM)
(FLVCN1)
Mechanical
Failure of
Inlet Valve
(OPYLON)
/A2\
Automatic
Emergency
Shutdown Sgstem
Fails
/A3\
Manual
Shutdown
Failure
111
-------
FIGURE 24B. OVERFLOWS FOR A 5000-GALLON TREATMENT
TANK WITH 4 BATCHES PER DAY AND MANUAL SHUT-OFF
Manual
Shutdown
Failure
.13 per demand
.03 per demand
Failure to
Respond to
Alarm
High Level
Alarm
Fails
(MOALARM)
Operator
Error
V
.03
^
-o
Mechanical
Failure
of Pumps
or Valves
Error of
Commission
(i.e. operator
throws wrong
switch, etc.)
(OFTRCOM)
Error of
Omission
(i.e. operator
fails to act)
(OFTROM)
112
-------
FIGURE 24C. OVERFLOWS FOR A 5000-GALLOW TREATMENT
TANK WITH 4 BATCHES PER DAY AND MANUAL SHUT-OFF
Mechanical
Fail ure of
Pumps or Valves
1.2x
ID"'6
6.5 x id
-12
Inlet Pump and
Valve Fail
1.8 x 10
"5
Outlet Pump or
Valve Fails
Pump
Fails
3.8x 10-7
(MOPMON)
1.7x 10
(MOYLON)
Pump
Fails
I.Ox 10"6
(MOPMCN)
1.7x 10
(MOVLCN)
113
-------
FIGURE 25A. OVERFLOWS FOR A 5000-GALLON TREATMENT
TANK CONTINUOUS OPERATION WITH AUTOMATIC SHUT-OFF
Tank
Overflows
2.3 x 10-3/mo
.027/yr
Control
Error Causes ,
Attempted
c.
K
©/^"^X
( .094 /mo)
v3/
Level Level
Indicator Controller
Failure Failure
(MOLEVIN) (FLVCN1)
Tank Nearly
>. Full
N (MOFILL)
/^"^^\ /X~"^'>\
f. 086 /mo) L0081/mo|
^~/ v_y
Operator Mechanical
Error Failure of
(OPCOMM) inlet Valve
(OPYLON)
1.00
above-ground
tank
Breach in Tanlf |
or Piping
Provides Escape -058
Route for
Overflowing I
Fluid A
/A2\
Automatic
Oiia+Am
Fails
-0075 to Shut
Down
A
AA
I
AZ
(from Fig. 24B)
Manual
Emergency Shutdown
Shutdown System Failure
Fails
114
-------
FIGURE 25D. OVERFLOWS FOR A 5000-6ALLON TREATMENT
TANK CONTINUOUS OPERATION WITH AUTOMATIC SHUT-OFF
Automatic Emergency
Shutdown System
Fails
.058
f .008 J
High Level
Sensor
Fails
(LEYIN2)
.05
Emergency Level
Control System
Fails
.05
-0
(from Fig. 24C)
Emergency
Shutdown
Microprocessor
Fails
(FLYCN2)
Mechanical
Failure of
Pumps or
Valves
115
-------
already described overflows in this section and in Chapter 3; we will
describe corrosion in Sections 4.5 through 4.9. We will discuss ruptures
in the remaining portions of this section.
Rupture probabilities are listed in Table 13 for tanks and pipes. Welded
flange leaks are also a form of rupture. In deriving our rupture probabi-
lities we have assumed that ruptures may result from a large variety of
causes, such as settling, freeze/thaw action, vehicle collision, or faulty
construction materials. Some of these factors, such as the cumulative
effects of freeze/thaw action, become increasingly important as equipment
ages; others, such as settling, become increasingly unlikely. We
assume, therefore, that these conflicting aging effects cancel out, and
that rupture probabilities are dominated by external events that are
uncorrelated to the age of the component. For this reason, we have treated
installation damage separately from ordinary ruptures, even though the phy-
sical damage from the two types of failures is likely to be similar. By
modeling these two events separately, we in essence use installation damage
to increase the probability of rupture in year 1 while still assuming that
ordinary ruptures are equally likely in any year.
Table 13 lists separate rupture probabilities for pipes and tanks
constructed of steel, stainless steel, and fiberglass. As that table
shows, we have assumed that steel and stainless steel are equally likely to
rupture; stainless steel may be resistant to corrosion, but it is not
significantly stronger than ordinary carbon steel. Based on discussions
with contractors, however, we have concluded that fiberglass is approxima-
tely twice as likely to rupture as is steel. We have therefore applied
this ratio to our rupture and installation damage probabilities for both
tanks and pipes.
Rupture mechanisms are different for above- and below-ground systems.
Above-ground ruptures are most likely to occur due to vehicle collisions,
collisions with fork lifts, freeze/thaw attack, or latent flaws in design,
fabrication, or installation. Below-ground ruptures are most likely to
result from settling, latent defects, or the driving of heavy equipment
across the site. These rupture mechanisms are different, but we have
116
-------
assumed that their combined probabilities are approximately equal for
above- and below-ground systems.
In addition, we have assumed that rupture probabilities are independent of
tank capacity-and pipe length. We make this assumption because components
are designed to accommodate the normal range of operating stresses. Thus,
design strengths should increase with tank capacity and pipe strength. We
assume that the increased design strength for larger components cancels out
the increased stresses to which they are subject, so that rupture probabi-
lities are independent of system design.
Table 13 also lists rupture probabilities for double-walled tanks and pipes
and concrete tanks. For double-walled components, we model the inner and
the outer walls separately, but we assume that there is a 50% probability
that a breach of the outer wall will also breach the inner wall. Because
the inner wall is subject to fewer stresses than is the outer wall, we
assume that a rupture is less likely to begin with the inner wall than with
the outer wall. In addition, because operating pressures in hazardous
waste tanks are generally low, we assume that only an insignificant frac-
tion of ruptures initiating with the inner wall also breach the outer wall.
Concrete tanks are also subject to rupture, though in this case, these
failures are more commonly referred to as cracks. Because the cracking of
concrete is an age-dependent process, Table 13 lists a time-to-failure
distribution rather than a binomial probability. This time-to-failure
distribution is N(35,10). We chose it based on telephone conversations
with concrete contractors and state highway officials. Our subsequent
research has indicated that this time-to-failure distribution should vary
with the design life of the tank. Thus, our failure distribution is pro-
bably an adequate approximation for the 20-year design life assumed by our
original sources, but probably results in too many failures for 30- or
40-year design lives.
4.5 Tank Corrosion Model
Our Monte Carlo model can simulate above-, below-, and in-ground tank
systems constructed of carbon steel, stainless steel, fiber-glass rein-
117
-------
forced plastic (FRP), or concrete. We can also model a variety of corro-
sion protection systems, including:
• interior coatings;
• exterior coatings;
• cathodic protection; and
• interior and/or exterior corrosion with cathodic protection.
For ease of reference, the effects of these options are summarized for four
different corrosion mechanisms in Tables 14 through 17. The following sub-
sections will discuss these mechanisms in detail.
Underground Tanks
Steel tanks. For underground steel tanks, we have distinguished four basic
corrosion mechanisms: localized exterior corrosion, generalized exterior
corrosion, localized interior corrosion, and generalized interior
corrosion.
Localized exterior corrosion is the most important of these processes.
Like the other forms of corrosion, it is an electrochemical reaction
involving a flow of current between the tank and the surrounding environ-
ment. When localized corrosion occurs, however, one or more irregularities
in the tank surface or the surrounding soil channel the normal flow of
current through a small area, accelerating the rate of corrosion. These
irregularities are called point anodes, and they may result from local
variations in soil pH, scratches in the tank wall, or stones or cinders in
contact with the tank. In theory, a properly installed tank should have no
point anodes. In practice, 70% to 85% of tanks do experience localized
corrosion. Our localized exterior corrosion model is based on exterior
corrosion data collected by the Petroleum Association for conservation of
the Canadian Environment (PACE).
The PACE data consists of a survey of 108 leaking and 192 non-leaking
underground service station tanks, giving the age of each tank and the
aggressiveness of the soil in which it is buried. This survey data can be
118
-------
TABLE 14. EFFECT OF TANK DESIGN ON
LOCALI-ZED EXTERIOR CORROSION
Tank Design
Effect on Localized Exterior
Corrosion Rate
BELOW-GROUND
Carbon Steel
Stainless steel
Fiberglass
reinforced
plastic (FRP)
Concrete
Exterior coating
Cathodic protection
Exterior coating with
cathodic protection
PACE Baseline corrosion rate, increased by (A/440)-16
to account for tank surface area variations.
Corrosion rate is 25% of the rate applicable to
below-ground carbon steel tanks.
Does not corrode. Probabilities of rupture and
installation damage are double those used for
steel.
Generalized break-up (modeled as a rupture) after
N(35,10) years. Seeps continuously.
Delays onset of localized exterior corrosion by
N(7,3) years (for all tank sizes). Localized
corrosion begins with certainty following
coating failure.
Delays onset of corrosion by m-N(10,5) years,
where m = FNU (1,3) is a stochastically deter-
mins the level of cathodic protection main-
tenance. Once cathodic protection fails, corro-
sion follows PACE baseline.
Delays onset of corrosion until both cathodic
protection and coating fail. Localized corro-
sion begins with certainty following corrosion-
protection failure.
Stray currents
There is a 10% chance of stray currents at the
site. If they exist, they will increase corro-
sion rate by a factor of x = B(l,2,4)
119
-------
TABLE 14. EFFECT OF TANK DESIGN ON LOCALIZED
EXTERIOR CORROSION (Continued)
Tank Design
Effect on Localized Exterior
Corrosion Rate
ABOVE-GROUND (on cradles)
Carbon steel
Stainless steel
Fiberglass reinforced
plastic (FRP)
Concrete
Exterior coating
Cathodic protection
Stray currents
Corrode like low-SAV underground tanks of 5% as
large a surface area.
Corrodes at 25% of the rate applicable to above-
ground carbon steel tanks.
Does not corrode. Probabilities of rupture and
installation damage are double those used for
steel.
Generalized break-up (modeled as a rupture) after
N(35,10) years. Seeps continuously.
Delays onset of corrosion by N(9,3) years (for all
tank sizes). Localized corrosion begins with
certainty following coating failure.
Does not affect above-ground tanks.
Do not affect above-ground tanks.
ABOVE-GROUND (on-grade)
Above-grade section corrodes like an above-ground
tank of similar surface area; on-grade section
corrodes like a below-ground tank of similar
surface area. We only model the below-ground
section, however, because it corrodes more
quickly.
IN-GROUND
Above-grade section corrodes like above-ground
tanks of similar surface area; below-grade
section corrodes like below-ground tanks of
similar surface area. The above- and below-
grade portions are modeled independently.
120
-------
TABLE 15. EFFECT OF TANK DESIGN ON GENERALIZED
EXTERIOR CORROSION
Tank Design
Effect on Generalized
Exterior Corrosion Rate
BELOW-GROUND
Carbon steel
Corrosion rate in mils/yr is given by:
Stainless steel
Fiberglass reinforced
plastic (FRP)
Concrete
Exterior coating
Cathodic protection
Exterior coating with
cathodic protection
Stray currents
max [1.4, . FNU (1.4,5)]
10
Corrosion rate is 25% of the rate applicable to
below-ground carbon steel tanks.
Does not corrode.
Generalized break-up (modeled as a rupture) after
N(35,10) years. Seeps continuously.
Delays onset of generalized exterior corrosion by
N(7,3) years. After coating fails, generalized
exterior corrosion is same as for a new,
uncoated tank.
Delays onset of generalized exterior corrosion
until cathodic protection system fails. (See
Table 14). Once the cathodic production system
fails, the tank corrodes like a new, unprotected
tank.
Delays onset of generalized exterior corrosion
until both cathodic protection and the coating
fail. After corrosion protection fails,
generalized exterior corrosion is the same as
for a new, unprotected tank.
Increase generalized exterior corrosion rate by
same factor as applies to localized exterior
corrosion.
121
-------
TABLE 15. EFFECT OF TANK DESIGN ON GENERALIZED
EXTERIOR CORROSION (Continued)
Tank Design
Effect on Generalized
Exterior Corrosion Rate
ABOVE-GROUND (on cradles)
Carbon steel
Stainless steel
Fiberglass reinforced
plastic (FRP)
Concrete
Exterior coating
Cathodic protection
Exterior coating with
cathodic protection
Corrodes at 1.4 mils/yr.
Corrodes at .35 mils/yr
Does not corrode.
Generalized break-up (modeled as a rupture)
N(35,10) years. Seeps continuously.
after
Delays onset of corrosion by N(9,3) years (for all
tank sizes). Following coating failure,
generalized exterior corrosion is the same as
for a new, uncoated, above-ground tank.
Delays onset of corrosion until cathodic protec-
tion system fails (see Table 14). Once the
cathodic protection system fails, the tank
corrodes like a new, unprotected tank.
Delays onset of corrosion until both cathodic
protection and coating fail. After corrosion-
protection fails, generalized exterior corrosion
is the same as for a new, unprotected tank.
Stray currents
No effect on above-ground tanks.
ABOVE-GROUND (on-grade)
Above-grade section corrodes like an above-ground
tank of similar surface area; on-grade section
corrodes like a below-ground tank of similar
surface area. We only model the below-ground
section, however, because it corrodes more
quickly.
IN-GROUND
Above-ground section corrodes like above-ground
tank; below-ground section corrodes like
below-ground tank. We only model the below-
ground section, however, because it corrodes
more quickly.
122
-------
TABLE 16. EFFECT OF TANK DESIGN ON LOCALIZED
INTERIOR CORROSION
Tank Design
Effect on Localized
Interior Corrosion Rate
BELOW-, ABOVE-, and
IN-GROUND
Carbon steel
Stainless steel
Fiberglass reinforced
plastic (FRP)
Concrete
Interior coating
Cathodic protection
Interior coating with
cathodic protection
Stray currents
Corrodes beneath fill pipe with a conditional nor-
mal distribution of ,15N(8,5) years. Tank
surface area has no effect.
Corrodes at 25% of the rate applicable to carbon
steel tanks.
Does not corrode.
Generalized break-up (modeled as a rupture) after
N(35,10) years. Seeps continuously.
Delays onset of corrosion by N(7,3) years. After
the coating fails, interior corrosion occurs at
the rate applicable to a new, uncoated tank.
Delays onset of corrosion until cathodic protec-
tion system fails (see Table 14). Once the
cathodic protection system fails, the tank
corrodes like a new, unprotected tank.
Delays onset of corrosion until both cathodic pro-
tection and coating fail. After corrosion-
protection fails, tank corrodes like a new,
unprotected tank.
Have no effect on interior corrosion.
123
-------
Tank Design
TABLE 17. EFFECT OF TANK DESIGN ON
GENERALIZED INTERIOR CORROSION
Effect on Generalized
Interior Corrosion
BELOW-, ABOVE-, or
IN-GROUND
Carbon steel
Stainless steel
Fiberglass reinforced
plastic (FRP)
Concrete
Interior coating
Cathodic protection
Interior coating with
cathodic protection
Stray currents
Corrode according to the following empirical
distribution:
Corrosion rate
Probability (mils/yr)
0.00 to .65
.65 to .90
.90 to 1.00
FNU(2,10)
FNU(10,20)
Corrodes at 25% of the rate applicable to carbon
steel.
Does not corrode.
Generalized break-up (modeled as a rupture) after
N(35,10) years. Seeps continuously.
Delays onset of corrosion by N(7,3) years. After.
coating fails, corrosion occurs at the rate
applicable to a new, uncoated tank.
Delays onset of corrosion until cathodic protec-
tion system fails (see Table 14). Once the
cathodic protection system fails, the tank
corrodes like a new, unprotected tank.
Delays onset of corrosion until both cathodic pro-
tection and coating fail. After corrosion-
protection fails, tank corrodes like a new,
unprotected tank.
Have no effect on interior corrosion.
124
-------
converted into time-to-failure distributions for tanks in aggressive,
moderate, and benign soils. The resulting distributions are presented in
Table 18. In this table, soils are classified according to soil aggressi-
veness value (SAV), which is a numerical index developed by PACE to measure
soil corrosivity. The calculation of SAV is detailed in Table 19. Further
information about the PACE data, including the derivation of the time-to-
failure distributions, is presented in Appendix A.
These time-to-failure distributions, however, are merely the starting
points for the corrosion model. These distributions apply directly only to
existing service station tanks, which at the time of the survey (1977) were
usually constructed of quarter-inch bare steel. Since hazardous waste
tanks may have other wall thicknesses, the PACE time-to-failure distribu-
tions must therefore be generalized. We accomplish this by sampling a
time-to-failure from the PACE distribution and then dividing it into .25
inches to obtain a stochastically-determined corrosion rate, which we can
then apply to tanks of thickness other than .25 inches. We then tally
annual corrosion allotments, and when remaining wall-thickness reaches
zero, the model determines that a corrosion failure has occurred.
We account for the fact that some tanks do not experience point corrosion
by assuming that those tanks which have not failed by the end of 30 years
are free of point anodes. Thus, 30.1% of the tanks in benign soils have a
localized corrosion rate of zero, as do 23.4% of those in moderate soils,
and 16.7% of those in aggressive soils. (We obtained these percentages by
subtracting the year-30 cumulative failure probabilities from 1.00.) This
does not mean that exterior corrosion does not occur in these tanks;
rather, it means that corrosion will occur by a slower mechanism. This
mechanism is generalized exterior corrosion.
Generalized exterior corrosion is a gradual loss of material over the
entire tank surface. We assume that generalized exterior corrosion occurs
at least as quickly underground as it does in air, but that except in unu-
sually aggressive soils, it alone is unlikely to cause a quarter-inch tank
to fail in less than 50 years. (Source: "Rogers Finds Leaks by Using
Statistics," Petroleum Marketer, Nov./Dec., 1982, pp. 17-19.) This means
125
-------
TABLE 18. CUMULATIVE TIME-TO-FAILURE DISTRIBUTIONS FOR
QUARTER-INCH UNDERGROUND STEEL TANKS
Cumulative Probability of Failure (%)
Benign Soil Moderate Soil Agressive Soil
Tank Age (SAV < 6) (7 < SAV < 12) (SAV > 13)
4 000
9 0 11.1 26.7
14 6.3 29.1 49.9
19 24.0 54.3 76.5
24 48.3 67.3 79.9
30 69.9 76.6 83.3
Note: the model obtains intermediate values by interpolation.
Source: PACE and Appendix A and F.
Caveat: This data applies only to 5,000 and 10,000 gallon service station
tanks. Furthermore, the PACE survey was not conducted under statisti
cally controlled methodologies, so the results may be biased. See
Appendix F for further caveats.
126
-------
Table 19. COMPUTATION OF SAV
I. BASIC CHARACTERISTICS
POINTS
• Soil Resistivity
• Soil pH
• Soil Moisture
300 - 1
1,000 - 2
2,000 - 5
5,000 - 10
10,000 - 25
>25
3 -
5 -
6.5 -
7.5 -
Saturated
Damp
Dry
<300
,000
,000
,000
,000
,000
,000
<3
5
6.5
7.5
9
>9
12
10
8
6
3
1
0
8
6
4
2
1
0
3
2
0
II. DIFFERENTIAL CHARACTERISTICS
e Soil Resistivity
(ratio of extremes)
e Soil pH
(Difference in
pH Value)
1.5 -
0 -
>!::
>1:
>1:
<1:
LO
5
3
3
3
3
1.5
3
2
1
0
2
1
0
III. SULFIDES
Positive
Negative
4
0
Source: Petroleum Association for Conservation of the Canadian Environment
(1983). 127
-------
that the generalized exterior corrosion rate lies somewhere between 1.4
mils per year (the generalized corrosion rate in an air environment
according to Ailor, 1982) and 5.0 mils per year (the rate required for a
quarter-inch tank to fail in 50 years). We assume that the corrosion
rate is uniformly distributed between these two values. In addition we
assume that -this corrosion rate varies proportionally to SAV, but that even
in the most benign soils, the generalized exterior corrosion rate cannot be
less than 1.4 mils per year. Mathematically, all of these assumptions can
be expressed in a single equation:
corrosion rate (in mil/yr) = maxCl.4, =- FNIKI.4,5)]
where 10 is the average value of SAV for all 300 of the PACE tanks, and the
notation max[ ] means the maximum of the two values in the brackets. Note
that for the average tank (SAV = 10), this distribution collapses to
FNU(1.4,5).
Because both generalized and localized exterior corrosion are electrochemi-
cal processes, they may be accelerated by stray DC currents from improperly
grounded motors or nearby electric rail lines. Based on conversations with
Warren Rogers of Warren Rogers Associates, we have concluded that there is
approximately a 10% chance that such equipment will be close enough to
interfere with any given tank system. In addition, we have concluded that
stray currents approximately double the rates of both localized and genera-
lized exterior corrosion. More specifically, we have assumed that stray
currents increase the corrosion rate by a multiplicative factor of x, where
x is a random number drawn from a beta distribution with a minimum of 1, a
mode of 2, and a maximum of 4. The resulting distribution could be termed
a "conditional beta," where the 10% binomial probability determines the
existence of stray currents and the beta distribution determines their
intensity. Since these results will apply to the entire tank facility, we
use the same value of x for all of the system's underground components,
including tanks, pipes, and ancillary equipment.
In addition to exterior corrosion, tanks are also vulnerable to interior
corrosion. This corrosion may be localized or generalized, and may result
128
-------
from a variety of causes, including materials defects, poor seam construc-
tion, accumulated grit or sludge, or acids generated by anaerobic bacteria
living near the bottom of the tank.
Data collected by the American Petroleum Institute (API) indicates that
localized interior corrosion occurs in only 15% of service station tanks.
If it occurs, localized internal corrosion is probably a more rapid process
than localized external corrosion, so we have assigned it a conditional
time-to-failure distribution of .15 N(8,5) (see Appendix A). We can obtain
an average corrosion rate by sampling this distribution and dividing the
time-to-failure into .25", as we did for localized exterior corrosion. We
can then apply this corrosion rate to tanks of any thickness. Note that
for the 85% of tanks which do not experience localized interior corrosion,
the localized internal corrosion rate is zero.
Generalized interior corrosion, however, always occurs at a non-zero rate.
According to the sources cited in Appendix A, this form of corrosion is
likely to range from 2 to 20 mils per year. Because we believe that lower
corrosion rates are the most likely, we have used this information to con-
struct the following empirical distribution of generalized interior corro-
sion rates:
Cumulative Corrosion rate
Probability (mils/yr)
0 to .65 2
.65 to .90 FNIK2, 10)
.90 to 1.00 FNUdO, 20)
All four corrosion mechanisms may act simultaneously. If this is the case,
we must combine their individual corrosion rates to determine the overall
effect. In doing this however, it is not proper to simply add all four
corrosion rates together; that would implicitly assume that localized
interior and localized exterior pits occur at the same place -- a highly
unlikely event. Furthermore, because the PACE and API data were obtained
from empirical observations rather than theoretical computations, it is
likely that our localized exterior and localized interior corrosion rates
already include their respective generalized corrosion rates.
129
-------
Thus, only certain combinations of corrosion mechanisms need to be con-
sidered. Generalized interior corrosion must be added to localized
exterior corrosion (in most cases this will have little effect on the
failure date, but in a few instances it will allow a localized exterior pit
to corrode through more quickly if the interior wall is undergoing unu-
sually rapid generalized corrosion), and generalized exterior corrosion
must be added to localized interior corrosion (accounting for those occa-
sions when an interior pit reaches a rapidly corroding exterior wall). If
there is no localized corrosion, then generalized interior and exterior
corrosion rates must be combined to determine the date at which generalized
corrosion causes a failure in a large segment of the wall.
Coated underground tanks. Tanks may be coated in an attempt to impede
corrosion by preventing corrosive materials from reaching the tank surface.
Coatings may be applied to either the interior or the exterior of the tank,
and as long as they are intact, they effectively prevent the onset of
either localized or generalized corrosion.
Coatings, however, do not last indefinitely. Instead, the sources iden-
tified in Appendix A indicate that both interior and exterior coatings fail
with a time-to-failure of N(7,3) years. When failure occurs, the coating
must be replaced, or corrosion will begin. Replacement of an interior
coating is relatively easy, but replacing an exterior coating requires that
the tank first be exhumed. Furthermore, the detection of an exterior
coating failure requires careful inspection -- also requiring that the tank
be exhumed. For these reasons, we have assumed that failed exterior
coatings will not be repaired. Since the tank will therefore begin
corroding from the outside at about the same time as the interior coating
fails, we assume that the owner will not bother to repair a failed interior
coating without also repairing the exterior coating. It is therefore rela-
tively unlikely that either interior or exterior coatings will be repaired,
and we have not included any form of coating repair or replacement in our
underground tank model.
Once an exterior coating fails, the onset of localized corrosion becomes a
certainty, for gaps in the coating provide a ready supply of point anodes.
130
-------
(Source: National Association of Corrosion Engineers, personal communica-
tion.) Thus, the time-to-failure distributions presented in Table 18 must
be rescaled so that for all three soil types the cumulative probability of
failure eventually reaches 100%. The rescaled time-to-failure distribu-
tions are presented in Table 20. For interior coatings, however, the
effect of coating gaps is less certain; for want of better data, we assume
that following a coating failure, the tank corrodes like a new, uncoated
tank.
Because large tanks are more likely to have unusually deep localized
exterior corrosion holes, tank size will influence the localized exterior
corrosion rate once an exterior coating fails. This will not be the case
for interior coatings, however, because localized interior corrosion will
generally be confined to the region beneath the fill tube. As before, we
assume that the area of this region does not vary significantly with tank
capacity.
For exterior coatings, we assume that the area correction factor is
A/AO'^, where A is the surface area of the typical service station tank
(approximately 440 square feet). The value of A to be used in this formula
is the area of the entire tank surface, not merely the area of the coating
failures. This is because the area correction factor is merely a scaling
factor which we can use simply by assuming that the area of coating failure
is proportional to the tank's surface area. We therefore never need to
know the actual area or number of coating failures.
Cathodic protection. Cathodic protection is an entirely different form of
corrosion protection. Rather than attempting to prevent corrosion by
precluding contact with corrosive materials, it imposes a reverse electri-
cal current on the protected components, inhibiting the electrochemical
reactions that cause corrosion. Cathodic protection may be used on both
the exterior and interior of the tank. Exterior cathodic-protection
systems obtain the desired current flow by using a charged electrode in the
surrounding soil; interior systems suspend an electrode in the waste. We
assume that a cathodically protected tank uses both exterior and interior
electrodes. We also assume that these electrodes are driven by the same
131
-------
TABLE 20. COATED UNDERGROUND TANKS: TIME-TO-FAILURE DISTRIBUTION
FOR QUARTER-INCH STEEL TANKS FOLLOWING THE FAILURE
OF AN EXTERIOR COATING
Cumulative Probability of Failure (%)
Tank Benign soil Moderate Soil Aggressive Soil
Age (SAV < 6) (7 < SAV < 12) (SAV > 13)
4 000
9 0 14.5 32.0
14 9.0 38.0 59.9
19 34.3 70.9 91.8
24 69.1 87.9 95.9
30 100.0 100.0 100.0
Note: the model obtains intermediate values by interpolation.
132
-------
power supply. If this power supply fails and is not repaired, cathodic
protection will fail simultaneously for both tank surfaces. Since power
supply failure is an important cause of cathodic-protection failure, we
therefore assume that these two systems always fail in tandem.
Properly installed and maintained, cathodic protection systems should pre-
vent corrosion indefinitely. They require regular monitoring, however, and
prompt repair or replacement of failed components. According to the
National Association of Corrosion Engineers, the leading cause of cathodic-
protection failure is poor maintenance. Furthermore, once localized corro-
sion has started, repair of the cathodic-protection system will be
ineffective, for it is difficult to get proper current density into the
center of an existing pit. For these reasons, we have assigned cathodic-
protection systems a time-to-failure distribution of (m)-N(10,5) where m is
a random number between 1 and 3 indicating the quality of the maintenance
effort. A value of 1 means that no maintenance is undertaken; a value of 3
indicates that the operator carefully follows the prescribed maintenance
schedule. We multiply this number by the sampled time to failure in order
to delay failure for well-maintained systems.
Once cathodic protection fails, the tank begins to corrode in the same
manner as a new, unprotected tank. If the tank has both a coating and
cathodic protection, it does not begin to corrode until both the coating
and the cathodic-protection system have failed; it then corrodes like a
coated tank whose coating has failed.
Construction materials. A third way to prevent corrosion is by construc-
tructing tank shells from fiberglass, stainless steel, or concrete, because
fiberglass and concrete do not corrode, and stainless steel corrodes at
only 25% the rate applicable to carbon steel (Peters and Timmerhaus, 1980).
The use of these materials is not without its drawbacks, however. Stain-
less steel is expensive, concrete seeps continuously and may develop
cracks (See Section 4.4), and fiberglass is twice as vulnerable to rupture
or installation damage as is carbon steel (see Section 4.4).
The seepage rate for a concrete tank is given by the following formula:
133
-------
dQ/dt = Ad + d/t)K
Mwaste
'waste
0
'2
where:
dQ/dt = the rate of leakage
A = the surface area of the tank (sides and bottom only)
d = the average fluid depth in the tank
t = the thickness of the concrete
K = the permeability of the concrete to water (2.5 x 10'9 cm/sec)
JUL^ 0 = the viscosity of water
// aste = the viscosity of the waste
^waste = the density °f tne waste
& g = the density of water
Using this equation, we find that a rectangular 10,000-gallon concrete tank
containing an aqueous waste with an average fluid depth of 6 feet will have
a seepage rate of about 90 gallons per year. This seepage rate will con-
tinue throughout the tank's operating life.
In addition to continuous seepage, concrete tanks are also subject to a
type of gradual disintegration that is often referred to as "corrosion."
(U.S. Department of the Interior, Concrete Manual, 1981). The result of
.this process, however, is generalized cracking rather than isolated corro-
sion holes, so we have included it in the time-to-failure distribution
for concrete tank ruptures (Section 4.4), rather than in this section.
Tank Size. In addition to the modifications necessary to account for
corrosion protection and the use of alternative construction materials, the
underground tank corrosion model must also be modified to account for
variations in tank size. The PACE data were obtained from service station
tanks, most of which probably had capacities of approximastely 5,000
gallons. Hazardous waste tanks, however, can range from 200 gallons to
millions of gallons. The larger a tank is, the more likely it is to deve-
lop an unusually deep corrosion pit, and the sooner will be its first
failure.
134
-------
There are no good data describing the effect of tank size on time-to-
failure. The best data source is a pipeline corrosion model developed by
Rossum. This model indicates that the deepest pit in an area of A square
feet is given by:
where
x = the depth of the deepest pit in an area of A square
feet, and
x0= the depth of the deepest pit in an area of A0 square
feet.
We can easily incorporate this equation into the PACE model. A0 is now
the surface area of a 5000-gallon service station tank (about 440 square
feet), A is the area of the hazardous waste tank under consideration, and
x0 is the localized exterior corrosion rate (which is linearly related to
the depth of the deepest pit). Therefore, the localized exterior corrosion
rate is related to the PACE baseline rate by a scaling factor of (A/A0)' .
This area correction factor applies only to localized exterior corrosion,
for that is the only type of tank corrosion which is affected by area.
Generalized exterior corrosion and generalized interior corrosion are by
definition area-independent, and the API data indicates that localized
interior corrosion is confined to the region beneath the fill tube. The
area of this region is not strongly affected by variations in the tank
capacity.
Above-ground Tanks on Cradles. Like underground tanks, above-ground tanks
are vulnerable to localized exterior, generalized exterior, localized
interior, and generalized interior corrosion. Both types of interior
corrosion will be the same for these tanks as for underground tanks, and
generalized exterior corrosion will occur at the rate appropriate for an
air environment (1.4 mil/yr).
Because the atmosphere does not contain point anodes, localized exterior
corrosion will be unlikely on most of the tank's surface. The tank's
135
-------
seams and its points of contact with its support cradles, however, provide
surface irregularities, and even in an air environment, these can serve as
point anodes (National Association of Corrosion Engineers, telephone
conversation). Thus these portions of the tank's surface are vulnerable to
localized pitting (Perry and Chilton, 1973, p. 23-3). We assume that
these vulner- able regions account for about 5% of the tank's surface.
Because air environments are probably less corrosive than most soils, we
have assumed that localized exterior corrosion at these locations is simi-
lar to localized exterior corrosion of a below-ground tank in a benign
soil. To account for the limited locales at which such corrosion is
likely, we use the (A/440)-^ adjustment factor to reduce the effective
surface area of the tank to 5% of its actual value.
If there is an exterior coating, exterior corrosion will not begin until
the coating fails. This will occur after N(9,3) years (see Appendix A).
Once the coating fails, exterior corrosion will occur with certainty at the
points of failure. Generalized exterior corrosion will occur at 1.4 mils
per year; localized exterior corrosion will occur at the rate applicable to
exterior coating failures on low-SAV underground tanks with 5% as large a
surface area.
Instead of using coatings, above-ground tank facilities may reduce corro-
sion failures by using corrosion-resistant construction materials. These
materials are modeled like their below-ground counterparts. Thus, above-
ground stainless steel tanks corrode only 25% as quickly as above-ground
carbon steel tanks, while above-ground concrete tanks are subject to the
same seepage losses and cracking problems as underground concrete tanks.
Fiberglass tanks do not corrode, but they are twice as likely to rupture as
their carbon steel counterparts.
In-ground Tanks and Qn-grade, Above-ground Tanks. In-ground tanks and on-
grade, above-ground tanks can be modeled by combining our above-ground and
below-ground corrosion models. We assume that the below- or on-grade por-
tions of such tanks corrode like below-ground tanks of similar surface
area. Their above-ground portions corrode like above-ground tanks, but
136
-------
instead of experiencing localized corrosion at their seams and points of
contact with cradles, these tanks corrode at their seams and near their
points of contact with the ground. Because above-ground corrosion is
generally a slower process than below-ground corrosion, however, we have
only modeled the on-or below-grade sections of such tanks.
Multiple-Tank Systems. If a hazardous waste facility has more than one
tank, we model each tank independently, re-sampling the probability distri-
bution for all forms of corrosion and all forms of corrosion-protection
failure. If there is a cathodic-protection system, we assume that it
includes all of the tanks. In addition, we assume that the entire
cathodic-protection system is connected to the same power supply. If this
power supply fails and is not repaired, cathodic protection will fail for
all of the tanks.
4.6 Pipe Corrosion
Like tanks, pipes are subject to four forms of corrosion: localized
exterior corrosion, generalized exterior corrosion, localized interior
corrosion, and generalized interior corrosion. Also like tanks, pipes may
or may not be coated or cathodically protected, and may be constructed of
carbon steel, stainless steel, or fiberglass. They may be above-ground or
below-ground. We model these various pipe designs similarly to the equiva-
lent tank designs, first determining the time to corrosion-protection
failure, then using time-to-failure or corrosion-rate distributions to
calculate corrosion rates for each of the corrosion mechanisms. We then
combine these corrosion rates to calculate the total effect of all of these
mechanisms on pipes of varying thicknesses.
Our pipe-corrosion model, however, has some important differences from our
tank-corrosion model. First, it assumes that the pipes from which our
baseline corrosion data were obtained have a thickness of .19 inches rather
than the .25 inches applicable to tanks. In addition, in order to take
full advantage of available data, our pipe model uses a combination of the
PACE tank-corrosion data and a pipe-corrosion formula developed by Rossum
137
-------
(1968). Thus, our pipe-corrosion model involves somewhat different time-
to-failure distributions than does our tank corrosion model.
For convenience of reference, Tables 21 through 24 summarize the effects of
pipe system design on corrosion rates for localized exterior,
generalized exterior, localized interior, and generalized interior corro-
sion, respectively. We will describe these effects in more detail in the
remainder of this section; complete derivations of the time-to-failure
distributions may be found in Appendix A.
Localized exterior corrosion. The Rossum pipe corrosion model is directly
applicable to pitting corrosion (i.e., localized exterior corrosion) of
underground, uncoated, carbon steel pipes. According to this model, the
expected number of leaks at time t is given by:
16>25 F
J t
L = A1-06 «> FtdO - pH)
-------
TABLE 21. EFFECT OF PIPE SYSTEM DESIGN ON
LOCALIZED' EXTERIOR CORROSION
Pipe System
Effect on Localized Exterior
Corrosion Rate
BELOW-GROUND
Carbon steel
Stainless steel
Fiberglass reinforced
plastic (FRP)
Exterior coating
Cathodic protection
Exterior coating with
cathodic protection
Stray currents
Time-to-failure is predicted by a stochastic
modification of a leak-prediction formula by
Rossum (1968).
Corrodes at 25% of the rate applicable to below-
ground carbon steel pipes.
Does not corrode. Probabilities of rupture and
installation damage are double those applying
to steel pipes.
Delays onset of localized exterior corrosion by
N(7,3) years. Localized corrosion begins with
certainty following coating failure.
Delays onset of corrosion until cathodic protec-
tion system fails (see Table 14). Once cathodic
protection fails, pipe corrodes like a new,
unprotected pipe.
Delays onset of corrosion until both cathodic
protection and coating fail. Localized corro-
sion begins with certainty following corrosion
protection failure.
If stray currents are present, they will have the
same effect on pipes as they do on underground
tanks.
139
-------
TABLE 21. EFFECT OF PIPE SYSTEM DESIGN ON
LOCALIZED EXTERIOR CORROSION (Continued)
Pipe System
Effect on Localized Exterior
Corrosion Rate
ABOVE-GROUND
Carbon steel
Stainless steel
Fiberglass reinforced
plastic (FRP)
Exterior coating
Cathodic protection
Stray currents
Corrodes with conditional time-to-failure distri-
bution given by:
T= .11 (A/10)-16N [l6(10/A)-16, 6.6UO/A)-16]
where T is the time to failure.
Corrodes at 25% of the rate applicable to above-
ground carbon steel pipes.
Does not corrode. Probabilities of rupture and
installation damage are double those applicable
to carbon steel.
Delays onset of corrosion by N(9,3) years (for all
pipe lengths). Localized corrosion begins with
certainty following coating failure.
Has no effect above-ground.
Have no effect above-ground.
140
-------
TABLE 22. EFFECT OF PIPE SYSTEM DESIGN ON
GENERALIZED EXTERIOR CORROSION
Pipe Design
Effect on Generalized Exterior
Corrosion Rate
BELOW-GROUND
Carbon steel
Stainless steel
Fiberglass reinforced
plastic (FRP)
Exterior coating
Cathodic protection
Exterior coating with
cathodic protection
Stray currents
Corrosion rate in mils/yr =
max |1.4, £ilL FNU(1.4,5)
fl.4, MY. FNU(1.4,5)1
I 10 J
Corrosion rate is 25% of the rate applicable to
below-ground carbon steel pipes.
Does not corrode.
Delays onset of generalized corrosion by
N(7,3) years. After coating fails, generalized
corrosion is the same as for new, uncoated
pipes.
Delays onset of corrosion until cathodic protec-
tion system fails (see Table 14). Once cathodic
protection fails, pipe corrodes like a new,
unprotected pipe.
Delays onset of generalized exterior corrosion
until both cathodic protection and the coating
fail. After corrosion-protection fails,
generalized exterior corrosion is the same as
for a new, unprotected pipe.
Will increase the generalized exterior corrosion
rate by the same factor as applies to tanks.
141
-------
TABLE 22. EFFECT OF PIPE'SYSTEM DESIGN ON
GENERALIZED EXTERIOR CORROSION (Continued)
Pipe Design
Effect on Generalized Exterior
Corrosion Rate
ABOVE-GROUND
Carbon steel
Stainless steel
Fiberglass reinforced
plastic (FRP)
Exterior coating
Cathodic protection
Stray currents
Corrodes at 1.4 mils/yr.
Corrodes at .35 mils/yr.
Does not corrode.
Delays onset of corrosion by N(9,3) years (for
all pipe lengths). Following coating failure,
generalized exterior corrosion is the same as
for a new, uncoated, above-ground pipe.
Has no effect above-ground.
Have no effect above-ground.
142
-------
TABLE 23. EFFECT OF PIPE SYSTEM DESIGN ON
LOCALIZED-INTERIOR CORROSION
Pipe System Design
Effect on Localized Interior
Corrosion Rate
BELOW- or ABOVE-GROUND
Carbon steel
Stainless steel
Fiberglass reinforced
plastic (FRP)
Interior coating
Cathodic protection
Interior coating with
cathodic protection
Stray currents
The probability of localized interior corrosion
is given by:
p = .024 (A/10)-16
The corrosion rate for pipes which experience
this form of corrosion is (A/10)-16 times the
corrosion rate obtained by sampling a time-to-
failure distribution of N(8,5) for 190-mil
pipes.
Corrodes at 25% of the rate applicable to carbon
steel pipes.
Does not corrode.
Delays the onset of corrosion by N(9,3) years.
After the coating fails, interior corrosion
occurs at the rate applicable to a new, uncoated
pipe.
Delays onset of corrosion until cathodic protec-
tion system fails (see Table 14). Once cathodic
protection fails, pipe corrodes like a new,
unprotected pipe.
Delays onset of interior corrosion until both the
cathodic-protection system and the coating fail.
After corrosion-protection failure, localized
interior corrosion is the same as for a new,
unprotected pipe.
Have no effect on interior corrosion.
143
-------
TABLE 24. EFFECT OF PIPE SYSTEM DESIGN ON
GENERALIZED INTERIOR CORROSION
Pipe System Design
Effect on Generalized
Interior Corrosion Rate
BELOW- or ABOVE-GROUND
Carbon steel
Stainless steel
Fiberglass reinforced
plastic (FRP)
Interior coating
Cathodic protection
Interior coating with
cathod.ic protection
Stray currents
Corrodes according to the following formula:
corrosion rate = (l-f)(1.4) + fry
where f is the fraction of the time the pipe is
in contact with the fluid (including a 30-minute
drying time), and r-j- is a corrosion rate sampled
from the same generalized interior corrosion dis-
tribution as is used for tanks.
Corrodes at 25% of the rate applicable to carbon
steel.
Does not corrode.
Delays onset of corrosion by N(9,3) years. After
coating fails, corrosion occurs at the rate
applicable to a new, uncoated tank.
Delays onset of corrosion until cathodic protec-
tion system fails (see Table 14). Once cathodic
protection fails, pipe corrodes like a new,
unprotected pipe.
Delays onset of interior corrosion until both the
cathodic-protection system and the coating fail.
After corrosion-protection failure, generalized
interior corrosion is the same as for a new,
unprotected pipe.
Have no effect on interior corrosion.
144
-------
Year 10
.025
.072
.0084
.001
Year 20
.51
.20
.040
.0092
Year 40
1.04
.56
.16
.08
This formula is very sensitive to soil resistivity and soil pH; doubling
the resistivity, for example, will cut the expected number of leaks in
half, while decreasing the pH from 7 to 6 will increase the expected number
of leaks by 33%. In addition, since the chemical processes underlying
corrosion vary with the amount of oxygen present, Rossum's formula is
highly dependent on soil aeration. For 100 feet of 2-inch diameter,
190-mil pipe, in a soil with a resistivity of 5000 ohm-cm and a pH of 6,
this equation gives the following values:
Expected Number of Leaks
Aeration
good
moderate
fair
poor
This model, however, merely predicts the expected number of holes. It does
not give a stochastic distribution of times to failure. We have therefore
converted it into a cumulative probability distribution by assuming that
the nth hole develops at a random time between the dates when L = n - 1 and
L = n + 1. We convert fractional values of L into probabilities to deter-
mine when during this interval the nth hole develops. Thus, at the date
when L = 1, there is a 50% probability that the first leak has occurred,
for L = 1 is half-way between L = 0 and L = 2. Similarly at L = 1.5, there
is a 75% probablity that the first leak has occurred, for 1.5 is 75% of the
way between 0 and 2. Furthermore, jjf the first leak has occurred at L =
1.5, there is a 25% chance that a second leak has also developed. There is
no chance, however, that a third leak will develop before L = 2.0.
This discussion reveals one important difference between the pipe-corrosion
model and the tank-corrosion model: the pipe-corrosion model allows for
multiple leaks, while the tank corrosion model only predicts the date at
which the first leak occurs. If suitable data can be found, future ver-
sions of the tank-corrosion model will also allow for the development of
multiple corrosion holes. 145
-------
There is another important difference between the tank- and pipe-corrosion
models. The tank-corrosion model is based on the soil's resistivity, pH,
moisture content, and sulfide content, while the pipe-corrosion model uses
the soil's resistivity, pH, and aeration instead. Thus the two models
require different parameters, and changes in the non-overlapping parameters
(moisture, sulfides, and aeration) can have significant effects on corro-
sion rates. The two models are not incompatible, however, because several
of the parameters are strongly correlated. High moisture content, for
example, is usually accompanied by relatively low resistivity and relati-
vely poor aeration. In each of our simulation runs, therefore, we have
taken care to specify a consistent set of soil characteristics.
Generalized exterior, localized interior, and generalized interior corro-
sion. Generalized exterior corrosion is very similar for pipes and tanks.
We have therefore assigned the same probability distribution to both types
of components. Because we assume that corrosion proceeds independently on
separate pieces of equipment, however, we sample this distribution indepen-
dently for each tank and each pipe. Thus, while tanks and pipes have the
same probability distributions for generalized exterior corrosion, they
need not have identical corrosion rates.
Generalized interior corrosion, however, does not have the same distribu-
tion for pipes and tanks. In pipes, fluid is seldom present, and genera-
lized interior corrosion proceeds largely from atmospheric effects. We
therefore use a corrosion rate of 1.4 mils per year (the rate appropriate
for an air environment, Ailor, 1982), with a correction factor for the
fraction of time that the pipe is in contact with the fluid. We obtain
this correction factor in two steps. First, we compute the fraction of
time when fluid is in contact with the pipe (including a 30-minute drying
time following each pipe usage). We denote this fraction as f. Then we
sample a generalized interior corrosion rate from the same distributions
that we use for the generalized interior corrosion of tanks. We denote
this corrosion rate as rr. We then combine rj and f in the following for-
mula:
146
-------
r (in mils/yr) = (l-f)(.!4) + frT
Where r is the generalized interior corrosion rate. Note that this
expression degenerates to 1.4 mils per year if f = o (i.e. if fluid is
never present).
Localized interior corrosion is a bit more difficult to model. In tanks,
the API data show that this form of corrosion is 19% as likely as localized
exterior corrosion, but tanks are always in contact with the fluid, while
pipes are usually in contact with the air. On the other hand, localized
interior corrosion appears to be strongly influenced by fluid motion. That
is why tanks that fail due to localized interior corrosion generally do so
at locations immediately below their fill tubes.
Fluid motion in tanks and in pipes only occurs during periods of fluid
transfer. For a fill pipe, these periods correspond exactly to the periods
of most significant fluid motion in the tank (because the tank experiences
significant fluid motion only during filling). For a discharge pipe, dif-
ferences in pumping rates may cause the fraction of the time during which
fluid is in motion to differ from that applicable to the fill pipe. Since
the same volume of fluid must pass through all three components, however,
we assume that these variations are unimportant, and that like tanks, fill
and discharge pipes are 19% as likely to undergo localized interior as
localized exterior corrosion.
In order to use this percentage, however, we must first reconcile a dif-
ference between the Rossum underground pipe formula and the API service
station data. According to the Rossum formula, all pipes undergo some
degree of localized corrosion. Yet according to the API data, only 15% of
service station pipes experience corrosion failure (see Appendix A for our
derivation of this percentage), first consideration, these two predictions
appear incompatible. The difference, however, is in the time period. The
API data considered tank systems with an average age of 11 years; for many
soil conditions, the Rossum formula often does not predict failure until
considerably later. Thus, within the time horizon of the API data set, the
Rossum formula does not predict 100% failure, and depending on assumptions
147
-------
about pipe length and soil characteristics, the two data sources can be
readily reconciled. For example, according to our stochastic version of
the Rossum formula, pipe segments with a surface area of 10 square feet in
a moderate-aeration soil with a resistivity of 2000 ohm-cm and a pH of 5
show an 11% 20-year failure rate. Since this is well within the range
indicated by the API data, we can use that data without introducing any
serious inconsistencies into our model.
To derive an interior corrosion model, we therefore begin with the API
data's indication that interior corrosion is 19% as common as exterior
corrosion and that 15% of service station pipes fail due to corrosion.
Since the 15% figure includes both interior and exterior corrosion
failures, this means that 2.4% of service station pipes should experience
interior corrosion failure.
This 2.4% figure, however, is valid only for pipes similar to those in ser-
vice stations. We have assumed these pipes to have an area of 10 square
feet (10 feet of 4" pipe or 20 feet of 2" pipe). Hazardous waste tank
pipes may be much longer or much shorter. Consequently, we have used the
surface-area adjustment factor that we had previously derived for tanks to
also adjust for pipe-length variations. Thus, the probability of loca-
lized interior corrosion is 0.024 (A/A0)-^, where A0 = 10 square feet.
In addition, we have assumed that like tanks, those pipes which develop
localized interior corrosion have a baseline time-to-failure distribution
of N(8,5). In order to account for the fact that longer pipes are more
likely to develop unusually deep pits, we have adjusted the corrosion rate
obtained from this distribution by (A/10)-16.
Above-ground Pipes. Above-ground pipes also experience all four forms of
corrosion. Three of these corrosion mechanisms, however, are easily
described: generalized and localized interior corrosion are the same for
above-ground pipes as they are for underground pipes, while generalized
exterior corrosion is the same for above-ground pipes as it is for above-
ground tanks (1.4 mils/yr). In order to model localized exterior corro-
sion, however, we have been forced to develop a new corrosion model, for
148
-------
the localized exterior model which we developed for underground pipes is
inapplicable above-ground.
We have used a combination of the PACE tank data and the API service sta-
tion data to develop this model. According to our underground pipe model,
15% of underground pipes fail due to corrosion. Since the probability of
interior corrosion is 2.4%, we assume that the remaining 12.6% failure
rate is due to localized exterior corrosion. Furthermore, the API data
indicates that the time-to-failure distribution for pipes which do fail
(due to either cause) is N(12,5) (see Appendix A). Although this distribu-
tion contains a mixture of internal and external corrosion failures, it
will be dominated by localized exterior corrosion failures (because they
are more common), and we can apply this distribution directly to this class
of failures. Thus, according to the API data, the time-to-failure distri-
bution for localized exterior corrosion of underground pipes is
.126N(12,5).
Above-ground pipes, however, will not follow this distribution. Instead,
based on reasoning parallel to that which we used for above-ground tanks,
we assume that above-ground pipes will corrode like pipes in low-SAV soils,
but only at the 5% of their surface areas accounted for by seams and points
of support. We must therefore adjust the API time-to-failure distribution
to account for surface area and SAV.
We adjust for surface area by applying an area adjustment factor of
(.05A/10)-16 to both the binomial probability of failure and the baseline
corrosion rate obtained from sampling the conditional time-to-failure
distribution. We correct for SAV by noting that according to the PACE
data, 77% of medium-SAV and 70% of low-SAV tanks fail by localized exterior
corrosion within 30 years. Assuming that the average pipe in the API study
was buried in. medium-SAV soil, and assuming that the effects of SAV on
underground pipes and tanks are proportional, this means that 11% of low-
SAV service station pipes should develop localized exterior corrosion
(11% = 12.6% x (70% / 77%)). Furthermore, the PACE data (see Table 19,
above) indicates that the average failure date for medium-SAV tanks
experiencing point corrosion is 16 years. The average for low-SAV tanks is
149
-------
21 years. Again assuming proportionality, this means that the time-to-
failure distribution for low-SAV service station pipes should be N(16,6.6).
Combining our SAV assumptions with our area adjustment factor, we obtain
the following conditional normal distribution for above-ground pipes:
time to failure = .1KA/10)-16 N[16(10/A)-16, 6.6(10/A)-16]
This adjustment factor applies to the time to failure, rather than the
corrosion rate. Since time to failure and corrosion rate are inversely
related, applying a factor of (10/A)-^ to the time to failure is mathema-
tically equivalent to applying a factor of (A/10)-^ to the corrosion rate.
A note on area effects. As a comparison of our pipe- and tank-corrosion
models would indicate, our use of area correction factors is different
for pipes and tanks. For pipes, we have used an area correction factor
for both the baseline probability and the baseline corrosion rate. For
tanks, we only apply it to the corrosion rates.
We have modeled pipes and tanks differently because we believe that three
factors control the onset of localized corrosion. One of these is the sur-
face area of the buried metal. The others are the corrosivity of the soil
and the care with which the component is installed. We have assumed that
surface area is an important factor for localized corrosion events with low
probabilities. In other words, we have assumed that the probability of
pipe corrosion is relatively low because a pipe is small enough that it is
relatively unlikely to experience a point anode. For tanks, however, the
baseline probabilities of localized corrosion are on the order of 70-85%.
We assume therefore, that the principal factors influencing the onset of
tank corrosion are the corrosivity of the soil and the care with which the
tank is installed. Surface area will be important, but its primary effect
will be to determine the number of point anodes and thus the depth of the
deepest pit.
We have generalized the preceding discussion to obtain the following rule
of thumb: whenever the baseline probability of a corrosion event is less
150
-------
than 50%, we assume that component surface area will influence the
probability of the onset of corrosion; whenever the baseline corrosion pro-
bability is over 50%, we assume that the component is already large enough
that surface area has little influence on probability. Since all of our
relevant baseline probabilities are either greater than 70% or less than
12%, we never had to elaborate this rule of thumb by developing a model to
deal with intermediate cases. In addition, since our area adjustment fac-
tor requires an area more than 5000 times larger than baseline to increase
a 12% probability to 50%, we did not need to modify that factor to assure
that our area adjustments do not increase the failure probability by too
much. For similar reasons, our model is insensitive to any choice of cut-
off probabilities between 25% and 70%, so it is unnecessary for us to be
precise in our determination of what value in that range is the theoreti-
cally best choice.
Corrosion protection. Pipes may be coated, cathodically protected, or
constructed of fiberglass, concrete, or stainless steel. These corrosion
protection techniques have the same effect on pipes as they have on tanks.
Fiberglass pipes are corrosion-resistent; stainless steel pipes corrode
one-fourth as rapidly as bare steel pipes; and cathodically protected pipes
do not corrode until the cathodic-protection system fails. If there is
cathodic protection for tanks, we assume that there is also cathodic pro-
tection for pipes. In addition, we assume that the pipes cathodic-
protection system uses the same power supply as the tank's. If that power
supply fails and is not repaired, cathodic protection will fail for both
tanks and pipes.
Interior and exterior coatings also have the same effect on pipes as they
do on tanks, delaying the time of failure by a time of N(7,3) years for
exterior coatings on underground pipes, or N(9,3) years for coatings
exposed primarily to an air environment (interior coatings or exterior
coatings on above-ground pipes). Once the coating fails, interior corro-
sion and generalized exterior corrosion proceeds as for new, uncoated
pipes, but localized exterior corrosion commences with certainty at the
gaps in the coating. Since the Rossum model does not incorporate this
effect even for underground pipes, we used the API and PACE data to deter-
151
-------
mine the time-to-failure distributions following coating failure. As we
discussed earlier, these distributions indicate that uncoated, medium-SAV
pipes have a conditional time-to-failure distribution of N(12,5), while
uncoated, low-SAV pipes have a conditional time-to-failure distribution of
N(16,6). We have not previously calculated a conditional time-to-failure
distribution for uncoated, high-SAV pipes, but calculations similar to
those which we used for low-SAV pipes provide a conditional time-to-failure
distribution of N(9,4).
We can apply these same time-to-failure distributions to coated pipes, for
the effect of coating failures is to assure the onset of corrosion, not to
alter its conditional time-to-failure distrubition. Therefore, following
coating failure, we assume that coated pipes corrode with certainty
according to the time-to-failure distribution appropriate for their loca-
tions. We account for variations in their lengths by multiplying the base-
line corrosion rate by (A/A0)-^ where A0 = 10 square feet, the typical
surface area of a service station pipe.
Multiple-Pipe Systems. If a hazardous waste facility has more than one
pipe, we model each pipe independently, re-sampling the probability distri-
butions for all forms of corrosion and all forms of corrosion protection
failure. If there is cathodic protection, however, we assume that the
entire cathodic-protection system will fail simultaneously. Thus, we use
the same date of failure for each pipe's cathodic-protection system. This
date of failure is also the same as the date of failure for the tank's
cathodic-protection system.
4.7 Pump and Valve Corrosion
Pumps and valves corrode similarly to short pipe segments. The effect of
pump corrosion, however, depends on whether the pump is submersible or
above-ground. Submersible pumps are located inside the tank, where even
if they corrode they cannot release fluid to the exterior environment.
Above-ground pumps, however, may be the source of releases. Corrosion of
these pumps is very similar to above-ground pipe corrosion, with a few
152
-------
minor changes to higher interior corrosion rates to account for the pump's
complex shape.. The details of our pump-corrosion model are present in
Appendix D.
It should be noted that pumps are unnecessary for underground waste storage
tanks. These tanks are generally constructed so that they will be gravity-
fed by drainage from a collection tank located at a higher elevation. They
are discharged through a flexible hose connected to a portable pump on the
pump-out truck. Thus, such systems do not contain on-site pumps, and we
have generally not included pump corrosion in our underground storage tank
simulations.
Valves are housed in short lengths of pipe that are physically distinct
from the rest of the pipe. In theory, we could model these valve segments
separately, but such an approach would needlessly complicate our model.
Instead, we have treated each valve as a portion of the pipe to which it is
attached, and have not distinguished between corrosion of the pipe and
corrosion of the valve.
4.8 Erosion
In addition to corrosion, pipes and pumps are also subject to erosion.
This process, which has effects very similar to generalized interior
corrosion, results from mechanical abrasion by suspended solids in a
flowing fluid. Wastes with low suspended solids will therefore cause
little erosion, while wastes that are high in suspended solids will be much
more erosive. Since our baseline interior tank-corrosion data were
obtained from service station tanks, we assume that this data does not
already account for erosion, for petroleum products are generally non-
erosive.
We modeled erosion by adding the erosion rate to the interior corrosion
rate. Although we did not model erosion as a localized process, we used
it to augment both the localized and the generalized interior corrosion
rates. We did this because in both cases our baseline data had applied
only to non-erosive fluids.
153
-------
The erosion rates which we used are listed in Table 25. Based on the
fraction of -suspended solids, this table distinguishes between three types
of fluids: non-erosive, moderately erosive, and highly erosive. Most of
the wastes under consideration in this study will be non-erosive, but a few
sludges may be moderately or even highly erosive. The erosion rates in
Table 25 are appropriate only if the fluid is always in motion. Thus,
these values may be applied directly to continuous treatment tanks, but for
other system the erosion rate must be multiplied by f, the fraction of the
time during which fluid motion occurs in the component under consideration.
Because fluid motion is not as rapid in tanks as it is in pipes, we have
not modeled erosion in tanks. Future versions of our model, however,
may be revised to account for turbulence beneath the fill pipe.
4.9 Gasket Disintegration
Gaskets gradually disintegrate due to the combination of chemical attack
and erosion. We have modeled gasket aging as an erosion-like process with
a baseline disintegration rate between 0 and 50 mils/year. Since we
believe that lower disintegration rates are more likely, we use the
following empirical distribution:
Gasket Disintegration
Cumulative Probability rate (mils/yr)
0.00 to 0.77 FNU(0,12.5)
0.77 to 0.83 FNU(12.5,25)
0.83 to 1.00 FNU(25,50)
Because gaskets can trap or absorb fluid, this disintegration process con-
tinues even when fluid is not present in the pipe. Therefore, we assume
that the fraction of time when fluid is present is irrelevant for this
type of failure.
Gasket disintegration may be greatly accellerated by incompatability bet-
ween the waste and the gasket (EPA, Case Study No. 4, 1984). We account
154
-------
TABLE 25. EROSION RATES FOR TANKS,
PIPES, AND PUMPS
Component
Non-erosive
fluid
(<1 ppm
solids)
Erosion rate (mils/year)
Moderately
erosive fluid
(between 1 and
10,000 ppm
solids)
Highly
erosive
fluid
(>10,000 ppm
solids)
Tanks
Pipes
Pumps
0
0
FNU(O.IO)
FNU(0,5)
FNU(0,5)
FNU(0,10)
FNU(5,10)
FNU(5,10)
FNU(10,20)
155
-------
for this possibility by multiplying our baseline disintegration rates by a
random number x sampled from FNU(1,20). If x is low, the gasket is com-
patable with the waste; if x is high, the gasket disintegrates unusually
quickly.
A gaskets fails when its thicknesses reaches zero. Since a gasket is a
flat, washer-like disk, the point of attack will be at its inside edge,
which initially will be flush with the interior surface of the pipe. The
gasket will fail when the difference between its inner and outer radii
reaches zero. For gaskets for 2" pipes, this initial difference is 1.06
inches; for gaskets for 4" pipes, it is 1.44 inches (Perry and Chilton,
1973). Thus, gaskets can fail as early as year 2, or they may last for the
entire lifetime of the facility.
4.10 Hole Sizes and Locations
Whenever a release occurs, the Monte Carlo model interrupts the fault tree
sampling process to determine the release rate from the new leak. The
first step in this procedure is to set the dimensions of the hole through
which the fluid is leaking.
Hole sizes for all relevant failure events are given in Table 26. For
most events, these hole sizes are stochastic and are determined by sampling
the distributions listed in the table. For overflows, however, hole size
is not a limiting factor in determining the loss rate. These loss rates
are instead determined by the rate at which fluid is being pumped into the
tank. Similarly, losses from external catastrophes are determined by the
volumes of fluid present in the tank at the time of the catastrophe. For
these events, therefore, Table 26 does not include hole sizes, but instead
identifies the other factors (such as tank capacity) that determine the
loss rate.
Hole size alone does not determine the leak rate. The density and visco-
sity of the waste are also important factors, as are the operating pressure
inside the failed component and the nature of the medium into which the
leak occurs. Two of these factors, density and viscosity, are determined
156
-------
TABLE 26. INITIAL HOLE DIMENSIONS AND HOLE LOCATIONS
FOR VARIOUS CLASSES OF FAILURES
en
Type of Failure (with event label)*
CORROSION HOLES
• Tanks
- Localized exterior corrosion (T1121)
- Localized interior corrosion (T1123)
- Generalized corrosion (T1127)
• Pipes
- Localized exterior corrosion (B13)
- Localized interior corrosion (B13)
- Generalized corrosion (B13)
• Pumps
- Localized exterior corrosion (A2116)
- Localized interior corrosion (A2116)
- Generalized corrosion (A2116)
Dimensions of
Hole (in inches)
Location
of Hole
diameter = B(l/64, 1/32, 1/4)
diameter = B(l/64, 1/32, 1/4)
diameter = B(l/64, 1/32, 1/4)
diameter = B(l/64, 1/32, 1/4)
width = FNU(.l, .25)
length = FNU(1, 10)
width = FNU(.l, .25)
length = FNU(1, 10)
diameter = B(l/64, 1/32, 1/4)
diameter = B(l/64, 1/32, 1/4)
diameter = B(l/64, 1/32, 1/4)
Bottom of tank
Bottom of tank
Bottom of tank
Midpoint of pipe
Midpoint of pipe
Midpoint of pipe
Pump outlet
Pump outlet
Pump outlet
-------
TABLE 26. INITIAL HOLE DIMENSIONS AND HOLE LOCATIONS
FOR VARIOUS CLASSES OF FAILURES (Continued)
en
00
Type of Failure (with event label )•
OTHER LEAKS AND RUPTURES (including
installation damage)
• Tanks (T1124)
- seam leak (75% of cases)
- major rupture (25% of cases)
• Pipes (BID
• Flanges (B121)
Dimensions of
Hole (in inches)
Location
of Hole
• Gaskets (B122)
SECONDARY CONTAINMENT BREACHES
• All secondary containment components^
width = FNU(0, 1/16)
length = FNU(0, 60)
width = FNU(0, 3)
length = FNU(3, 36)
width = FNU(1, .25)
length = FNU(1, 10)
width = FNU(0, 1/8)
length = FNU(0, 50% of flange
circumference
width = FNU(0,l/8)
length = FNU(0, 50% of gasket
circumference
Large enough to allow entire
spill volume to escape before
remedial action can be taken.
Bottom of tank
Bottom of tank
Midpoint of pipe
Varies with tank size,
location, configuration,
and process for which
tank is used. See
Appendix D.
Varies with tank size,
location, configuration,
and process for which
tank is used. See
Appendix D.
Lowest elevation in
secondary-contai nment
system, allowing the
entire spill volume
to escape.
-------
TABLE 26. INITIAL HOLE DIMENSIONS AND HOLE LOCATIONS
FOR VARIOUS CLASSES OF FAILURES (Continued)
en
10
Type of Failure (with event label)*
OTHER LOSS MECHANISMS
• External catastrophe (all
ANUCAT. events)
• Overflow through vent or over
sides of open-topped tank
(A210 or A211)
• Strainer drain left open (Alllll)
t Pump drain left open (A11112)
t Flexible hose ruptures (A1112)
• Loose flexible hose connection (A1115)
Dimensions of
Hole (in inches)
Large enough to lose entire contents
of tank.
Large enough that the overflow rate
equals the rate at which fluid is
being pumped into the system.
Large enough that the spill rate
equals the pumping rate
Large enough that the spill rate
equals the pumping rate
Leak rate = FNU(0, pumping rate)
Leak rate = FNU(0, pumping rate)
Location
of Hole
Bottom of tank
Top of tank
At location of pump
At location of pump
At midpoint of hose
At tank's pump-out port
^These labels correspond to the labels in the fault trees. They are also used in Appendix A. That Appendix
explains the derivation of these hole sizes.
a system contains two secondary containment systems (such as a vault with a synthetic liner), both must fail
before a release can occur.
-------
by the identity of the waste, and will be the same for all leak locations.
Similarly, the nature of the medium into which the leak occurs will be
determined by the choice of backfill material, and will be the same for all
underground leaks. The operating pressure at the site of the hole,
however, varies with the hole's location. Table 26 identifies the loca-
tions where we have assumed each of the possible leaks or ruptures occur.
From these location assumptions the operating pressures can be calculated
according to standard engineering formulas. These formulas are too complex
to present here, but have instead been included in Appendix A. These for-
mulas are dependent on design factors (such as average fluid depth,
pressure added by the pump, or the relative locations of tanks and pipes)
which are also too complex to present in the main body of this report.
These design details are given in Appendix D.
Most of the hole sizes listed in Table 26 are self-explanatory. Corrosion
holes and secondary-containment breaches, however, require additional
discussions.
Corrosion Holes. As Table 26 indicates, we have assumed that corrosion
holes in tanks, pumps and above-ground pipes are generally circles, ranging
in initial diameter from 1/64" to 1/4". We also use this size distribution
for exterior corrosion holes in below-ground pipes. Due to the combination
of soil corrosivity and the action of flowing fluid, however, we have
assumed that interior and generalized corrosion holes in pipes are larger
and more elongated, ranging in initial size from .1" x 1" to .25" x 10".
These hole sizes apply to new holes. With time, however, these holes will
grow larger and larger until eventually their leak rates become large
enough to be detected. We model the growth of corrosion holes by
increasing the hole's radius at the end of each model year. For localized
exterior corrosion failures, we assume that the hole continues to grow
according to localized exterior corrosion but is now subject to attack from
the inside as well. Thus, its hole growth rate is the sum of the genera-
lized exterior corrosion rate, the generalized interior corrosion rate, and
the erosion rate. We apply this growth rate to the hole's radius because
corrosion will occur simultaneously on all parts of the hole's circum-
160
-------
ference. Based on similar reasoning, we assume that localized interior
corrosion holes will grow at the sum of the localized interior corrosion
rate, the erosion rate, and the generalized exterior corrosion rate, while
generalized corrosion holes in tanks will grow at the sum of this genera-
lized exterior and generalized interior corrosion rates, plus erosion. Due
to the combination of soil corrosivity and the action of flowing fluid,
however, we assume that generalized corrosion holes will grow rapidly,
doubling in length and width each year until they are either detected and
repaired or until the entire bottom of the tank has corroded.
Secondary Containment Breaches. Secondary containment breaches are also
included in Table 26. For our present version of the model, we have
assumed that a breach in the secondary-containment system will result in
total non-containment. In practice, fluid might drain through the breach
slowly enough that an emergency clean-up could be arranged in time to pre-
vent a release of the entire volume, but we have made the conservative
assumption that this is unlikely.
4.11 Leak-Rate Calculations
Leak rate formulas depend on whether the leaking components are above-
ground or below-ground. For above-ground leaks (or leaks from underground
tanks in vaults), the leakage occurs into an air environment, and the
Bernoulli equation applies. According to this equation:
(4.1) Q = .6A(2gz)-5
where
Q = the leak rate;
.6 = a coefficient appropriate for sharp-edged orifices;
A = the area of the crack or hole;
g = the acceleration due to gravity; and
161
-------
z = the equivalent static hydraulic head (i.e., the equiva-
lent height of the fluid surface above the hole, taking
into account pressure additions due to pumps, or losses
due to friction or suction when fluid is flowing through
pipes). This is calculated according to the operating-
pressure equations in Appendix A.
For underground leaks, however, the surrounding soil or backfill material
will impede the flow of fluid, dramatically reducing the leak rate. In
these circumstances, the Bernoulli equation no longer applies.
Unfortunately, there are no textbook formulas directly applicable to losses
from underground tanks. Thus, we were forced to develop our own model for
soil impedance, basing it on published studies of packed columns and fluid
beds. The derivation of this model is contained in Appendix A. The final
equation is:
(4.2) Q = -B + (B2 - 4AO-5 (Area)
2A
where
Area = The area of the hole
1.75 (l-Em)
Em3
B = 150
Em3 2
in which
Em = void fraction of the soil particles; (i.e. Em is the ratio
of the total void space to the volume occupied by the soil
particles themselves)
r = density of the fluid;
0S = sphericity of the soil particles;
dp = average diameter of the soil particles;
162
-------
jj. = viscosity of the fluid
AP = the pressure drop between the inside of the hole and the
surrounding soil; and
gc = a conversion factor which is 1 in metric units and
32.17 in English units;
L = the distance required for leaking fluid to disperse (i.e.
for its pressure to drop to that of the surrounding soil).
Our model included four basic types of backfill: gravel, sand, silt and
clay. The relevant parameters for each of these soil types are presented
in Table 27. The basic soil parameters were readily obtainable from
hydrogeolo gic texts, but dispersion distances for underground leaks have
never been published. The figures presented in Table 27 are therefore
only estimates based on our own engineering judgement. In making these
estimates, we began by noting that for cylindrical fluid beds, the disper-
sion length is linearly related to the bed diameter (Perry and Chilton,
1973). We assumed that a similar linear relation carried over to the
conical or wedge-shaped dispersion patterns likely from corosion holes and
underground cracks, respectively. Thus, the dispersion-length figures pre-
sented in Table 27 are given as multiplicative factors of hole diameter
(for circular holes) or crack width (for elongated cracks). We further
assumed that the dispersion length will be larger for a crack than it will
be for a hole with a diameter equal to the crack's width. We made this
assumption because fluid leaking from a hole will be able to disperse in
all directions, but fluid leaking from an elongated crack will only be able
to disperse in directions perpendicular to the crack. In addition, we
noted that fine-grained materials like silt and clay offer a greater
resistance to fluid flow than do coarse-grained materials like sand and
gravel. Thus, dispersion lengths will be smaller for fine-grained
materials than they will be for coarse-grained materials. These obser-
vations are reflected in the dispersion-length coefficients listed in Table
27.
The precise arithmetic values for these coefficients were difficult to
determine. We based our choices of coefficients on our engineering
assessment of published tank failure case studies (see Appendix C for sum-
163
-------
Table 27. SOIL PARAMETERS FOR UNDERGROUND LEAKS
Parameter
DISPERSION LENGTH
• Circular holes
(diameter d)
(maximun value)
• Elongated cracks
(width w)
(maximum value)
VOID FRACTION2
PARTICLE SIZE2
SPHERICITY2
Gravel
Backfill Material
Sand
100 x d
(100cm)
100 x w
(100cm)
.50
9.4
.70
20 x d
(20cm)
40 x w
(40cm)
.53
.25
.65
J 1 1 L.
7.5 x d
(7.5cm)
10 x w
(10cm)
.75
.064
.34
nay
2 x d
(2cm)
4 x w
(4cm)
.95
.002
.075
* Cracks will have a longer dispersion length than holes because di
can only occur in directions perpendicular to the crack.
2 Source: Kunii and Levensaul (1969)
spersion
164
-------
maries of 21 of these case studies). From these case studies, we concluded
that a moderately large (1 cm) hole in a 10,000-galIon tank buried in sandy
soil should produce a leak rate of approximately 1,500 gallons per month.
This will occur (assuming 4 feet of hydraulic head) if the dispersion
length is 20.cm, i.e. if the dispersion length coefficient is 20. We then
chose other dispersion length coefficients to be consistent with both that
value and our assumptions about the effects of hole shape and soil particle
size. In addition, we have assigned maximum values to each dispersion-
length coefficient. These maximum values, which are listed in Table 27,
are the maximum lengths that our formulas would predict for hole diameters
or crack widths of 1 cm.
As equation (4.2) and Table 27 indicate, our underground leak-rate model is
quite complex, depending on several variables. The most important
variables, however, are the soil parameters and the hole size. Figures 26A
through 260 examine the effects of these parameters by plotting leak rates
versus hole sizes for a 10,000-galIon storage tank in each of the four
representative soils. These graphs show that leak rates are highest for
gravel, and lowest for clay, as would be expected. In addition, these
graphs show that despite the complexity of equation (4.2), leak rates are
almost linearly dependent on hole diameters, at least for holes greater
than 1/8 inch in diameter. This linear relation results because an
increase in hole size has two opposing effects on leak rates: it increases
leakage by increasing the hole's surface area; and it decreases the leak
rate by lengthening the dispersion distance. According to Figures 26A
through 260, the net result of these two effects is that leak rates are
almost linearly related to hole diameters.
4.12 Leak Detection
Once a leak develops, it will continue until it is detected. Detection may
occur immediately, or it may be delayed for weeks or even months. If the
leak is small enough, it may never be detected.
We have considered 9 possible leak detection options. These options, which
may be used in any combination are:
165
-------
FIGURE 26A. THE EFFECT OF HOLE DIAMETER ON LEAK
RATES IN CLAY
a:
UJ
o_
en
z
o
CD
N^^
Ul
LU
0.060-
0.050-
0.040-
0.030-
0.020-
0.010^
0.000-
0.00 0.05 0.10
I ' I ' i
0.15 0.20 0.25
1 ' T ^ I
0.30 0.35 0.40
HOLE SIZE (INCHES)
166
-------
FIGURE 26B. THE EFFECT OF HOLE DIAMETER ON LEAK
RATES IN SILT
12-,
10-
8-
UJ
Q.
cn
z
o
6-
4-
LU
2-
0.00 0.05 0.10 0.15 0.20 0.25 0.30
i ' i
0.35 0.40
HOLE SIZE (INCHES)
167
-------
LU
Q_
(D
\nff
LU
LU
FIGURE 26C. THE EFFECT OF HOLE DIAMETER ON LEAK
RATES IN SAND
14-
12-
10-
8-
6-
4-
2-
0.00 0.05 0.10 0.15 0.20 0.25 0.30 0.35 0.40
HOLE SIZE (INCHES)
168
-------
FIGURE 26D. THE EFFECT OF HOLE DIAMETER ON LEAK
RATES IN GRAVEL
D
tY.
bJ
Q.
cn
2
o
_l
_l
(D
LU
H
Qi
UJ
lOO-i
90-
80-
70-
60-
50-
40-
30-
20-
10-
1 i r i • r
0.00 0.05 0.10 0.15
l ' r ' 1 ' I ' I
0.20 0.25 0.30 0.35 0.40
HOLE SIZE (INCHES)
169
-------
Visual inspection,
Inventory monitoring,
Vapor wells,
Interstitial monitoring,
U-tubes,
Pollulert monitoring,
Continuous pipe monitoring,
Groundwater monitoring, or
Unsaturated zone monitoring.
With the exception of groundwater monitoring and unsaturated zone moni-
toring (which the Agency has decided to model using the contaminant
transport subroutines of ICF's Tank Risk Model) we have incorporated each
of these options into our Tank Failure Model. In modeling these leak
detection systems, we have been primarily concerned with three parameters:
the minimum volume of release which can be detected, the time lag until
detection occurs, and the probability that the system will fail to detect a
release which is large enough to be detectable. Table 28 presents these
parameters for each of the modeled leak detection systems. The remainder
of this section explains these systems in greater detail.
Visual Inspection. Our model permits the simulation of two types of visual
inspection. One of these is a casual "walk-around" inspection which we
assume occurs daily at all facilities. The other is a more thorough
periodic inspection, which is optional. Generally, this inspection is
carried out on a weekly or monthly basis, but the model allows us to spe-
cify any desired inspection cycle. The probability of detecting a leak
depends on the leak rate, and is different for each type of inspection. We
have assumed that casual inspection (or normal operating routine) will
always be sufficient to detect a leak larger than a slowly running faucet
(approximately 100 cm^/minute). For leaks with rates between 10 drops per
minute (approximately .5 cm^/minute) and 100 cm^/minute, we have assumed
that there is a 50% probability of detection by casual inspection. Smaller
leaks will not be detectable by this method. Periodic inspection, however,
will have a 95% chance of detecting any above-ground leak.
The time lag between the onset of a leak and its detection depends on the
size of the leak and when during the inspection cycle the leak begins. In
170
-------
TABLE 28. LEAK DETECTION PARAMETERS
Leak Detection
System
Threshold
Level
Necessary for
Detection
Time Lag
Until
Detection
Failure
Probability
VISUAL INSPECTION
t Casual
• Careful
100 c
. 5 cm-Vmi n to
100 cm3/min
<.5 cm^/min
No limit
FNU(.25,60) min
FNU(0,24) hrs
Not detectable
FNU(0,7) days
0
.50
1.00
.05
• Visual de-
tection of
overflows
• Visual de-
tection of
pump drain
or strainer
spills
• Visual de-
tection of
flexible
hose ruptures
or loose
connections
No limit
No limit
No limit
FNU(0, fill time)
FNU(0, fill time)
FNU(0, pump-out
time)
INVENTORY MONITORING
t Casual
(daily)
• Weekly, mon-
thly, or at
pump-out
Determined by
user input
(0-100% of tank
capacity).
Determined by
user input
(0-100% of tank
capacity).
FNU(0,48) hours
Depends on when
during inspection
cycle leak begins.
0
171
-------
TABLE 28. LEAK DETECTION PARAMETERS
Leak Detection
System
Threshold
Level
Necessary for
Detection
Time Lag
Until
Detection
Failure
Probability
TIGHTNESS TESTING
VAPOR WELLS
U-TUBES
POLLULERT
MONITORING
CONTINUOUS PIPE
MONITORING
INTERSTITIAL
ALARMS
LEAK DETECTORS
IN VAULTS
Determined by
user input
(generally .10
gal hr).
Determined by
user input
(250 ppm is
typical).
Conservatively
estimated as the
volume of fluid
needed to saturate
all of the soil
between the tank
bottom and the tubes,
Conservatively
estimated as the
volume of fluid
needed to saturate
all of the soil
between the tank
bottom and the
water table.
0.2 gal/hr.
no limit
no limit
FNU(0,interval
between tightness
tests).
Given by solving
Thibodeaux's
equation for t.
Depends on the
porosity at the back-
fill, depth to the
U-Tubes, soil
permeability, soil
moisture content, leak
rate, and identity of
the waste.
Depends on the
porosity at the back-
fill, depth to the
groundwater, soil
permeability, soil
moisture content, leak
rate, and identity of
the waste.
Detection is
immediate if the
alarm functions.
FNU (1,12) hrs
.10
0
.10
.10
172
-------
general, leaks detected by casual" inspection will be detected in FNU(0,24)
hours, leaks detected by weekly inspection will be detected in FNU(0,7) days,
and leaks detected by monthly inspection will be detected in FNU(0,30)
days. For leaks in excess of 100 cm^/minute, however, detection will be in
FNU(.25,60) minutes.
Visual inspection will also lead to detection of overflow or accidental
spills. Because we assume that the operator is likely to observe these
types of leaks without taking a walk-around inspection, we assign them
shorter detection periods. These detection periods are listed in Table 28.
Inventory Monitoring. Inventory monitoring programs are designed to detect
shortfalls in the amount of fluid contained in a tank by comparing the
actual volume to that which is predicted by tallying fill volumes and
discharge volumes. This type of leak detection is useful only for storage
and accumulation tanks, however, for the short time period between pump-
outs for treatment tanks (even continuous systems are emptied once a day)
means that any leaks large enough to cause a detectable inventory shortfall
would also be large enough to be immediately obvious to the operator.
In theory, the detection threshold for inventory monitoring depends on the
monitoring frequency and the care with which records are maintained. If
monitoring is carried out frequently, with accurate records, it is possible
to apply statistical techniques to detect relatively low loss rates from
product storage tanks. These techniques have not been developed for
above-, in-ground, open-topped, or hazardous waste tanks. Since there is
no reliable method for hazardous waste materials of the aforementioned tank
types, we have assumed that monitoring is carried out casually, with a much
higher detection threshold than would apply for more sophisticated inven-
tory control programs. This is the level of inventory control we expect to
find at existing hazardous waste tank facilities.
We have modeled two types of inventory monitoring. The more sophisticated
of the two is daily monitoring. This type of monitoring involves a daily
inspection of the fluid level, but requires no record-keeping or statisti-
cal analysis. The detection threshold for this type of monitoring is spe-
173
-------
cified as a percentage of tank capacity, and is set by user input. Because
of the casual nature of this type of monitoring, we recommend the use of a
fairly large detection threshold, perhaps 10-25% of tank capacity. This
threshold applies to the sum of all losses occurring between monitorings.
Thus, if a tank has two leaks, neither of which alone would be large enough
to trigger detection, their sum may nevertheless exceed the threshold
level, and both leaks would then be detected and repaired.
The second type of inventory monitoring is periodic monitoring. For this
type of monitoring, the operator periodically computes the expected volume
of waste in the tank and compares it to the actual volume. If he detects a
shortfall, he assumes that a leak has developed. The detection threshold
for this type of monitoring depends on the accuracy of the operator's
records and the care with which he measures the volume of waste contained
in the tank. For simplicity, we specify this detection threshold is a
fraction of tank capacity. This fraction is determined by user input.
Because we are assuming that this is a fairly casual type of inspection
carried out by poorly trained operators, we recommend the use of a fairly
large detection level (at least 10% of tank capacity).
The detection lag for this type of monitoring depends on when during the
inspection cycle the leak begins. If the leak begins early, there is a
higher chance that the accumulated loss volume will be large enough for
detection at the next scheduled inventory reconciliation. Otherwise, even
if the leak rate is fairly rapid, the leak may not be detected until the
following reconciliation. We account for this possibility by randomly
setting the time during the monitoring cycle when the leak develops. The
minimum detection delay is therefore zero (for a large leak developing
immediately before the inventory is reconciled), while the maximum is two
full inspection cycles (for a leak that is barely large enough to be
detected and which begins too late in the monitoring cycle to be detected
at the first inventory reconciliation). The interval between inventory
reconciliations is set by user input, and may range from one month to the
entire period between pump-outs.
174
-------
Vapor Wei Is. Vapor wells detect leaks by sensing hazardous waste vapors in
the soil near the leaking component. This detection method is appropriate
for volatile waste streams. According to Thibodeaux (1979), the con-
centration of hazardous waste vapor at an underground distance z from the
source is given by:
C * C,
1-erf
\4Dt(£/1.73)/
where
C = the concentration of the contaminant at the sensor
C0 = the concentration of the contaminant at the source (we assume
that the air there is saturated with the vapor)
z = the distance from the source to the sensor
D = the diffusivity of the contaminant in air
t = the elapsed time since the leak began
6 = the porosity of the soil
erf = the standard Gaussian error function
We obtain the time to failure by setting C equal to the detection threshold
of the vapor sensor (150 ppm for a Sensidyne detector). We then solve
Thibodeaux's equation for t, the elapsed time until the concentration at
the sensor reaches this level. This time t is the detection lag; C is the
detection threshold.
Thibodeaux's equation is based on the assumption that there is enough
liquid at the source to keep the nearby air saturated. The model checks
this assumption by calculating the radius of the smallest sphere that could
contain the vapor if the entire leak evaporated. If that sphere is not
large enough to reach the sensor, then no detection has occurred regardless
of the results of the Thibodeaux equation.
Vapor wells are not 100% effective. We assume that they have a 10% per-
demand probability of failure. If the sensor fails, the leak will continue
for 1 month, at which time we assume that the sensor will be repaired and
the leak will be detected.
175
-------
Tightness Testing. Tightness testing is capable of detecting very slow
leaks in either tanks or pipes. In theory, because tightness tests use
careful surface-level measurements to detect leaks by detecting minute
changes in fluid level, the sensitivity of this leak detection technique
should be inversely related to the size of the tank. Because the manufac-
turers claim the same detection limits for all tank sizes, however, we have
not attempted to adjust for tank size. Instead, we have left the threshold
level as a user input, so that sensitivity analyses may be performed
easily. We have also allowed the testing schedule to be determined by user
input.
Tightness testing has not been proven reliable for hazardous wastes to
achieve suggested reliability levels. As a consequence, tank facilities
may need to replace the tank fluid with water.to perform such a test. We
will assume that our tightness testing results represent the use of water,
not hazardous waste. As a result, our costs must include cleaning the tank
and possibly the installation of a manhole.
U-Tubes. U-tubes are porous tubes running beneath an underground or in-
ground tank. Usually, these tubes are located one or two feet beneath the
tank, but the the model allows us to specify any desired depth. These
tubes collect leaking waste and channel it to an underground sump where it
can be monitored at any specified interval (generally weekly or monthly).
As an alternative, U-tubes can be continuously monitored by including a
liquid sensor in the sump.
The detection lag for U-tubes is a combination of two factors: the time
lag until the waste reaches the tubes, and the time lag between the arrival
of the waste in the sump and its detection there.
The detection lag for the percolation of waste through the intervening
backfill is given by the following expression (EPA, Liner Location Report,
1984):
*~ ?R
. T [ ^ • r~7.l ' /tii/fU'i*^*'
(dQ/dt)'
176
-------
where
t = the time required for leaking waste to penetrate to the
U-tubes
z = the depth of the U-tubes beneath the tank
dQ/dt = the leak rate
= the porosity of the backfill
0 i = the moisture content of the backfill (before the spill)
K = the permeability of the soil to water
The values of K, % , and u\ for each of our four types of backfill are
listed in Table 29. For U-tubes lying beneath 1 foot of sand backfill, it
will take 32 hours for waste to reach the tubes from a 1-gal lon-per-day
leak.
Soil
Type
Gravel
Sand
Silt
Clay
TABLE 29.
Porosity
Porosity
0.25
0.35
0.35
0.5
HYDROGEOLOGIC
VARIOUS SOIL
Moisture
Content
.09
.09
.27
.30
PARAMETERS FOR
TYPES1
Permeability
(cm/sec)2»3
lxlO-2(.4N)C
lxlO-2(.6N)C
lxlO-8(.02N)C
lxlO-8(.12N)C
Residual
Saturation
1.0
1.0
1.0
1.0
Source: Fetter, (1980).
^C is an adjustment factor for viscosity and density variations:
C = ... water x specific gravity of waste
waste
where denotes viscosity
^N=l if petrochemical, otherwise N=0.
177
-------
We have conservatively estimated the detection threshold for U-tube moni-
toring as the volume required to saturate all of the soil between the tank
bottom and the U tubes. This volume is given by the following formula
(EPA, Liner Location Report, 1984):
Q = z (f )(0p)(A)
where
Q = the threshold release volume,
Op s tne residual saturation of the backfill; and
A = the cross-sectional area of the leak source
The value of Q p depends on the nature of the backfill. Representative
values of Q p are included in Table 29 for aqueous wastes and toluene. For
U-tubes located 1 foot beneath a horizontal, 10,000-gallon tank, this
detection threshold for an aqueous waste is 445 gallons.
In addition, the detection threshold for U-tube monitoring is also governed
by the sensitivity of the technique used to monitor the sump. We have
assumed that this threshold is insignificant compared to the threshold
volume required for the liquid to initially reach the U-tubes. We have
also assumed that the sump monitoring method has a near-zero failure rate.
Pollulert Monitoring. A pollulert system is a monitoring device located in
a well reaching to the water table. This monitoring system detects leaks
by sensing organic wastes floating on top of the water table. We have
modeled Pollulert systems in the same way as we have modeled U-tubes,
except that for Pollulert systems the sensor is always monitored
continuously.
Continuous Pipe Monitoring. Continuous pipe monitoring systems use
electrical sensors on the pipes to detect changes in soil conductivity
caused by leaks. They can detect leaks as small as 0.2 gal/hr (Sobotka,
1984), and we assume that they will react immediately to detectable leaks.
There are a variety of such pipe monitoring techniques, but the present
version of our model has not attempted to distinguish among them.
178
-------
Interstitial Alarms and Alarms in Vaults. Interstitial alarms are leak
sensors placed between the walls of double-walled tank's or pipes. If
either of the walls is breached, such an alarm will react immediately to
the influx of waste (for breaches of the inner wall) or soil monitor (for
breaches of the outer wall). This allows the operator to take the proper
remedial action. In many cases, no waste will have been released to the
environment because one of the walls will still be intact.
Alarms in vaults are similar, except that they are not sensitive enough to
detect infiltrating soil moisture (otherwise they would also react to
atmospheric condensation). Thus these alarms give immediate notice of
breaches in the tank, but they give no notice of breaches in secondary con-
tainment. By detecting the leak from the tank, however, they prevent the
leak from continuing undetected for long periods of time.
All types of alarms are subject to failure. Since interstitial alarms and
alarms in vaults are physically very similar to high-level alarms, we have
given them the same failure probability as we used for high-level alarms.
This probability is 10% per demand. The derivation is presented in
Appendix A under event MOALARM.
Remedial Action. Once a leak has been detected, the operator must take
action to prevent it from continuing. Generally, such action requires that
operating procedures be changed until the leak can be repaired. We have
conservatively assumed that except for overflows, accidental spills, or
external catastrophes, such remedial action requires 2 days to implement.
Overflows and spills can be remedied immediately, however, and remedial
action delays are irrelevant for external catastrophes because these events
have already resulted in the loss of the system's entire contents.
179
-------
5.0 RECOMMENDATIONS FOR ADDITIONAL RESEARCH
5.1 Possible Modifications to the Model
A complex simulation model such as ours is always open to refinements
designed to increase the accuracy with which it reflects the complexities
of the real world. Table 30 lists a number of refinements which we deem to
be worthy of further consideration. Most of these changes could be imple-
mented with very little effort. These easily implemented changes are:
• Improving our hole-size estimates for generalized exterior
corrosion holes;
• Including erosion (beneath the fill pipe) in our tank model;
o Separate modeling of the above-grade and on- or below-grade
sections of on-grade or in-ground tanks;
• Using a separate cathodic-protection system for each protected
component;
o Allowing inspection and repair of coatings on above-ground tanks;
• Including sophisticated inventory-monitoring systems as a
leak-detection option;
• Allowing the efficacy of careful visual inspections to vary with
the leak rate;
e Including ultrasonic testing as a leak prevention option; and
e Modifying our pipe-rupture model to account for variations in
pipe-length.
Other changes would require more effort, either because good data may be
difficult to locate, or because these changes would require revisions of
substantial segments of the computer code. Nevertheless, these changes are
useful enough that we recommend that at least some of them be carried out.
The details of these proposed revisions are given in Table 30, which lists
the present modeling approach, the proposed revision, and the effects of
the proposed change. It also discusses the difficulties likely to be
encountered in implementing each of these changes. These changes are:
o Modeling the possibility of multiple corrosion holes for exterior
tank corrosion;
180
-------
TABLE X. OttNZS WHICH WY BE INGCRPCRATED
INTO amjRE VERSICJ6 CF OUR MODEL
Model Element
Present
Modelino Approach
Prooosed Revision
Effect of
Prooosed Revision
Difficulty of Inplerentation
TAfK COBOSION
• Multiple localized
exterior corrosion
holes
We only model one localized
exterior corrosion hole
per failure incident.
Include the possibility
of nultiple corrosion
holes.
This would increase leak
rates.
Could be accomplished by assuring
that tank corrosion is similar to
pipe corrosion, and by applying the
appropriate elements of the Rossun
pipe corrosion model to tanks.
CO
t Multiple interior
corrosion holes
• Hole sizes for
generalized corro-
sion holes
• Erosion
• Effect of waste
pH on tank
corrosion
• In-ground tanks
and above-ground
tanks on-grade
We only model one interior
corrosion hole per
failure incident.
We use the same hole-size
distribution as we use
for localized corrosion
holes.
We do not model erosion of
tanks.
Our present corrosion rates
are derived from data
for gasoline, and there-
fore apply for normal
environments.
We only model corrosion for
the below- or on-grade
segments of these tanks.
tanks.
Include the possibility
of nultiple corrosion
holes.
Make these holes large
and rapidly growing.
Allow tanks to erode
beneath the fill pipe.
Model acidic wastes as
more corrosive.
Model the corrosion of both
of these segments.
This would increase
leak rates.
Would increase the leak
rates.
Would increase the interior
corrosion rate slightly.
Would substantially increase
interior corrosion rates
for tanks containing
acidic wastes.
Would increase the rurber of
corrosion failures for
these tanks.
Unknown
We already make this distinction for
pipes. We could easily use the
same approach for tanks.
We already model erorlon In pipes and
PUTDS. We could easily use the
same approach for tanks.
Would require additional library
research.
Requires only minor changes In the
computer code.
PIPE MO PIM5 CORROSION
• Multiple interior
corrosion holes
• Effect of waste
pH on pipe corro-
sion.
We only model one interior
corrosion hole per
failure incident.
Our present corrosion rates
are derived from data for
oasoline, and therefore
apply for normal environ-
ments.
Include the possibility
of nultiple corrosion
holes.
Increase the corrosity of
acidic wastes.
This change would Increase
leak rates.
This change would substan-
tially increase interior
corrosion rates for pipes
containing acidic wastes.
Unknown. Data might be very
difficult to locate.
Would require additional library
research.
-------
TABLE X. OWNGES WHICH WY BE INCORPORATED
INTO FUTURE VERSIOT6 OF OUR MODEL (Continued)
Model Element
Present
Modeling Approach
Proposed Revision
Effect of
Proposed Revision
Difficulty of Imalemsntation
PIPE MO PIM> CORROSION (Continued)
• Tire-to-failure dis-
tribution for
localized exterior
corrosion of under-
ground pipes
We assume that the date of
the nth failure is uni-
formly distributed between
the time when the expected
number of corrosion holes
is n-1 and when it Is n+1.
Double the probability that
the n'th hole develops at
tire t.
This would assure that the
nth corrosion hole develops
by the time predicted by
Rossum and would give the
same number of expected
releases as he predicts.
Simple.
CORROSION PROTECTION
• Cathodic protection
We presently assure that
all components of the
tank system are connect-
ed to the same cathodic-
protection systen.
CO
ro
LEAK DETECTION AM) SECONDARY CTJNTAINtNT
e Coatings on above-
ground tanks and
pipes
• Sophisticated Inven-
tory modeling
(using statistical
analysis of tine-
series data)
• Casual Inventory
monitoring
e Careful visual
inspection
We presently assure that
like underground coatings,
these coatings receive
no maintenance.
Not included in present
model.
We presently assume that
the operator wi 11 take
no action until the leak
is confirmed by two
successive days of
Shortfalls. Thus, we
use a detection lag of
FNU(24.43) hours.
We presently assure that
this method has a 90S
probability of detecting
even the smallest leak.
Use a different cathodic-
protection system for
each of the protected
components.
Model the maintenance
of such coatings.
Include it as a leak
detection option.
Eliminate the assumption
that the operator will
await confirmation.
Allow the effectiveness
of this method to depend
on the leak rate.
This would reduce the number
of components affected by
a catnodic-protection
system failure but would
increase the number of
systems subject to failure.
This would increase the
service life of above-
ground coatings.
The model would be more
flexible.
Reduces loss volume by
changing the detection
lag to FNU(0,24) hours.
In our present model, this
method is too effective
for detecting very small
leaks.
Fairly simple.
Fairly simple.
Simple—we have already modeled
this leak detection method in
another ccnputer model.
Trivial.
Trivial.
-------
00
CO
TABLE X. OWCES WHICH WY BE INCORPORATED
INTO FUTURE VERSIONS CF CUR MOOEL (Continued)
Model Element
Present
Modeling Approach
Prooosed Revision
Effect of
Proposed Revision
Difficulty of luplementation
mSCELLAfCOUS
t Ultrasonic testing
• Pipe nature
• Cracking of
concrete tanks
Not presently included in
the model.
We presently assure that
the probability of pipe
rupture is independent
of pipe length.
The distribution used in
our model was derived for
tanks with 20-year design
lives.
Include this inspection
option in the model.
Let longer pipes be more
vulnerable to rupture.
Let the time-to-failure
distribution vary.with
design life.
Would allow the inspector
to detect thin spots before
corrosion holes develop.
Would increase the pro-
bability of rupture for
long pipes and decrease
it for short pipes.
Would substantially reduce
the number of failures
for concrete tanks designed
for 30 or 40 years.
Trivial.
Simple, although it may be difficult
to obtain authoritative documenta-
tion.
Depends on level of sophistication
desired. Might require additional
library research and might be
difficult to document.
-------
Modeling the possibility of multiple interior corrosion holes for
both tanks and pipes;
Including the waste's pH as a parameter in our interior corrosion
models for pipes and tanks;
Changi-ng our time-to-failure distribution for underground localized
exterior pipe corrosion to eliminate a present bias in favor of
belated development of corrosion holes; and
Designing a more sophisticated model for the cracking of concrete
tanks.
5.2 Caveats
There are other refinements which would be useful if adequate data could be
found. Because such data are unlikely to be available, however, we have
not included these refinements in Table 30. Instead, we will discuss them
in this section as caveats.
Use of Uniform Corrosion Rates. Both our tank- and pipe-corrosion models
are based on the assumption that localized exterior corrosion holes grow
at constant rates throughout their life-spans. Thus, we have assumed that
corrosion rates are independent of pit depth. Rossum's article, however,
indicates that corrosion rates slow down as the pit surface area gets
larger and as the pit fills with scale. Thus, pits grow rapidly at first,
but slower later on. Since our corrosion rates are the averages obtained
from .25-inch tanks (or .19-inch pipes), they still correctly predict dates
of failure for pipes of these thick- nesses, but if Rossum's non-linear
model is correct, our average corrosion rates are too rapid for thicker
materials and too low for thinner materials. In addition, our attempts to
combine generalized interior corrosion with localized exterior corrosion
also result in delayed failure dates if Rossum's non-linear model is
correct. This bias occurs because generalized interior corrosion effec-
tively reduces the thickness of the component wall over the period of time
during which corrosion is occurring.
As an example, consider a .25-inch tank with a 5-mil-per-year interior
corrosion rate and an exterior corrosion time-to-failure of 25 years
(obtained by sampling the PACE corrosion data). According to our model,
184
-------
this tank will have an exterior corrosion rate of 10 mils per year, for a
combined corrosion rate of 15 mil's per year. Under our uniform corrosion-
rate assumption, failure will occur in 17 years.
Suppose, however, that the corrosion rate decreases with pit depth. A 25-
year time-ta-failure might then correspond to the following corrosion
rates:
Years Since Annual Corrosion
Onset of Corrosion Rate
1-5 15 mils/yr
6-10 12 mils/yr
11-15 10 mils/yr
16-20 8 mils/yr
21-25 5 mils/yr
If this tank is now given a 5-mil/yr interior corrosion rate, failure will
occur in year 14, somewhat earlier than the year-17 prediction obtained
from the uniform corrosion example.
It should be noted that the above example is an extreme case. It involves
both a very high interior corrosion rate and a 3-fold change in the annual
corrosion rate with pit depth. And even with these extreme effects, it
only alters the time-to-.failure by 18% from that obtained from the purely
linear approximation. This indicates that the model is fairly robust to
non-uniform corrosion rates, at least as long as the tank wall-thickness
remains at .25 inches. If the initial tank wall-thickness is substantially
altered, however, the uniform corrosion-rate predictions are not as robust.
Since non-uniformities have been observed for localized interior corrosion
(Ishikawa, et al, 1981) as well as localized exterior corrosion (Rossum,
1968), future versions of our model could be improved by exploring these
non-uniformities and incorporating them into the interior and exterior pit-
growth models. Adequate data, however, might be very difficult to locate.
Baseline Corrosion Data for Tanks. The tank corrosion time-to-failure data
is based on the PACE survey data. PACE obtained this data from three sour-
ces:
• Over a 6-month period in 1977, PACE requested its member companies
to report leak incidents.
185
-------
0 During this same time period, PACE requested the member companies
to report tank decommissionings. PACE then tested the decom-
missioned tanks for leaks.
• If one tank on a particular site was leaking or decommissioned,
PACE also tested all other tanks on the same site.
The PACE survey is therefore a combination of two non-random samples, one
of leaking tanks (and other tanks on the same site) and the other of decom-
missioned tanks (and tanks near them). The first sample is biased toward
leaking tanks; the second is biased toward tanks old enough to be decom-
missioned. In addition, the second sample is biased toward non-leaking
tanks, for in 1977, most gasoline storage tank decommissionings probably
resulted from the closing down of non-profitable service stations, or the
replacement of undersized tanks, rather than the removal of tanks that were
known to be leaking.
The net effect of these two biases is unclear. The resulting time-to-
failure distributions look reasonable, so the net bias is probably not
severe. Nevertheless, the model could be revised if an unbiased time-to-
failure survey becomes available.
Air Quality and Corrosion of Above-Ground Tanks and Pipes. Our above-
ground exterior corrosion models do not take local air quality into
account. Air quality, however, may be very poor in the vicinity of certain
process tanks, and this poor air quality could substantially increase both
the generalized and the localized exterior corrosion rates. Since our
model does not include this effect, it does not presently apply to tanks or
pipes located near process equipment which produces corrosive fumes.
Future versions of the model could be generalized to take these effects
into account if adequate data could be located.
Initial hole sizes for localized corrosion failures. We have assumed that
localized corrosion holes initially range between 1/64 and 1/4 inches in
diameter. This assumption is based on anecdotal data and personal obser-
vations. It could be improved if a better data set were available.
Corrosion hole growth rates. In our corrosion model, we have modeled
corrosion holes as circles that expand in radius as continued corrosion
186
-------
consumes the surrounding metal. -This model, presents a good approxima-
tion of the behavior of corrosion holes, but a more sophisticated approach
would be to model corrosion holes as hemispherical pits, growing at the
appropriate corrosion rate. When failure occurs, the metal around the
edges of such a hole would be very thin, and would corrode rapidly. We
could account for this by allowing the corrosion hole to continue growing
as an imaginary hemisphere, with the edges of the hole representing the
points of intersection between the hemisphere and the tank wall. The
effect of this would be to cause the corrosion hole to expand rapidly at
first, then slower and slower. The growth rate, however, would always be
somewhat higher than that predicted by our present model.
Underground leak rate model. Our underground leak rate is based on our
engineering estimates of the effects of hole diameter and backfill material
on the dispersion distance. Our estimates produce reasonable leak rates
that exhibit the anticipated sensitivites to changes in key variables, but
our estimates could be improved if our leak rate formulas were verified by
bench-scale testing.
187
-------
BIBLIOGRAPHY
188
-------
BIBLIOGRAPHY
Ailor, W.H., Atmospheric Corrosion, New York: John Wiley and Sons, 1982.
Aird, R.J., "The Application of Reliability Engineering to Process Plant
Maintenance," The Chemical Engineer, May 1980, pp. 301-305, 311.
Allocio, M.A., "Hazard Recognition for the Newcomer," National Safety News,
December 1983, pp. 76-79.
f "Guide to Durable Concrete," Journal of the American Concrete
Institute, Vol. 74, December 1977, pp. 573-609.
American Concrete Institute, Durability of Concrete, Publication SP-47, Detroit,
1975.
American Petroleum Institute, "Tank and Piping Leak Survey," Correspondence
package from F. B. Killmar, American Petroleum Institute, Washington, D.C., to
members of the Operations and Engineering Committee and Underground Leakage
Task Force, February 5, 1981.
Andow, P.K., F.P. Lees, and C.P. Murphy, "The Propagation of Faults in Process
Plants: A State of the Art Review," Institution of Chemical Engineering,
Symposium Series No. 58, 1980, pp. 225-243.
Anyakora, S.N., G.T.M. Engel, and T.P. Lees, "Some Data on the Reliability of
Instruments in the Chemical Plant Environment," The Chemical Engineer,
November 1971, pp. 396-402.
Arendt, J.S., W.R. Craig, D.J. Campbell, and D.F. Montague, "Fault Tree Analysis
of Refinery Utility Systems," 1983 Proceedings of the Annual Reliability and
Maintainability Symposium, pp. 55-60.
Baldock, P.O., "Accidental Releases of Ammonia: An Analysis of Reported
Incidents," Loss Prevention, Vol. 13, AIChE, 1980, pp. 35-42.
Bartknecht, W., "Explosion Pressure Relief," Chemical Engineering Progress,
September 1977, pp. 45-53.
Baumeister, T., E.A. Avallone, and T. Baumeister, III, Marks' Standard Handbook
for Mechanical Engineers, 8th ed., McGraw-Hill, 1978.
Berenblut, B.J., and H.B. Whitehouse, "A Method for Monitoring Process Plant
Based on a Decision Table Analysis," The Chemical Engineer, March 1977, pp.
175-181.
Beychok, M.R. "Calculate Tank Losses Easier," Hydrocarbon Processing, March
1983, pp. 71-73.
Beyers, C.K., "Failure Analysis: Tool for HPI Loss Prevention," Hydrocarbon
Processing, August 1980, pp. 155, 159-160.
189
-------
Bjorklund, I., and L.E. Janson, "Swedish Experience of the use of Thermoplastic
Pipes for Water and Sewage Transport", Proceedings of the International Con-
ference on Underground Plastic Pipe, New Orleans, La., Mar. 30 -- Apr. 1, 1981,
Publ. by ASCE, New York, NY, 1981, pp. 385-400.
Bloch, H.P., "Improve Safety and Reliability of Pumps and Drives," Hydrocarbon
Procesing, April 1977, pp. 181-182.
Bocchi, W.J., "Predicting Mechanical Reliability," 1981 Proceedings Annual
Reliability and Maintinability Symposium, pp. 33-37.
Bosich, J.F., Corrosion Prevention for Practicing Engineers, Barnes and Noble,
Inc.: New York, 1970.
Boyd, D., and J. Leotta, "Prevention: The Usage of the United State's Coast
Guard's Pollution Incident Reporting System in Program Management," Proc. of
1976 National Conference on Controls of Hazardous Material Spills, 1976, pp.
94-100.
Bradford, M., and D.G. Darrett, "Avoiding Common Mistakes in Sizing Distillation
Safety Valves," Chemical Engineering, July 9, 1984, pp. 78-84.
Bradford, S.A., "Corrosion Failure Expectancy: A Critical Examination," Mater-
ials Protection and Performance, 9(7), July 1970, pp. 13-15.
Breipohl, A.M., "A Definition of Probability for Reliability Prediction," Pro-
ceedings 1974 Annual Reliability and Maintainability Symposium, pp. 45-47.
Browning, R.L., "Analyzing Industrial Risks," Chemical Engineering, October 20,
1969, pp. 109-114.
, "Calculating Loss Exposures," Chemical Engineering, November 17,
1969, pp. 239-244.
, "Estimating Loss Probabilities," Chemical Engineering, December
15, 1969, pp. 135-138, 140.
f "Finding the Critical Path to Loss," Chemical Engineering,
January 26, 1970, pp. 119-124.
f "Human Factors in the Fault Tree," Chemical Engineering Progress,
June 1976, pp. 72-75.
t "Use a Fault Tree to Check Safeguards," Loss Prevention, Volume
12, AIChE, 1979, pp. 20-26.
Buckman, H.D., and N.C. Brady, The Nature and Properties of Soils, 7th ed.,
MacMillan Co., 1969.
Cherry, K.F., "Sacrificial Component Check Valves Prevent Disasters," Pollution
Control, December 1981, pp. 42-43.
190
-------
Cohen, Y., W.Cocchio, and D. MacKay, "laboratory Study of Liquid Phase Controlled
Volatilization Rates in Presence of Wind Waves," Environmental Science and
Technology, Vol. 12, May 1978.
Conover, W.J., Practical Nonparametric Statistics, New York: John Wiley & Sons,
1971.
Constance, J.D., "Control of Explosive or Toxic Air-Gas Mixtures," Chemical
Engineering Progress, April 19, 1971, pp. 121-124.
, "Pressure Ventilate for Explosion Protection," Chemical
Engineering, September 20, 1971, pp. 156-158.
Cooper, C.M., "What to Specify for Corrosion Allowance," Hydrocarbon Processing,
May 1972, pp. 123-125.
Craven, A.D., "Fire and Explosion Hazards Associated with the Ignition of Small
Scale Unconfined Spillages," Process Industry Hazards: Accidental Release,
Assessment, Containment and Control, 1971T
Crocker, B.B., " Preventing Hazardous Pollution During Plant Catastrophes,"
Chemical Engineering, May 4, 1970, pp. 97-102.
Dartnell, R.C., Jr., and T.A. Ventrone, "Explosion of a Para-Nitro-Meta-Cresol
Unit," Chemical Engineering Process, 67(6), pp. 58-61.
Davenport, J.A., "Prevent Vapor Cloud Explosions," Hydrocarbon Processing, March
1977, pp. 205-206, 212-213.
5 »A Survey of Vapor Cloud Incidents, "Loss Prevention, Vol. 11, AIChE,
1977, pp. 39-48
Davies, R., "Seismic Risk to Liquefied Gas Storage Plant in the United Kingdom,"
Chemical Engineering Symposium Series No. 71, 1982, pp. 245-300.
Dean, J.A., ed., Lange's Handbook of Chemistry, 12th ed., McGraw-Hill, 1979.
DePaul, D.J., Corrosion and Wear Handbook, New York: McGraw-Hill Book Co., 1957.
Dorsey, J.S., "Using Reinforced Plastics for Process Equipment," Chemical
Engineering, September 15, 1975, pp. 104-114.
y "Controlling External Underground Corrosion," Chemical
Engineering, March 5, 1984, pp. 77-84.
Drowning, R.L., "Analyzing Industrial Risks," Chemical Engineering, October 20,
1969, pp. 109-114.
t "Calculating Loss Exposures," Chemical Engineering, November 17,
1969, pp. 239-44.
, "Finding the Critical Path to Loss," Chemical Engineering. January
26, 1970, pp. 119-124.
191
-------
Eagan, H.B. Jr., J.F. Howard, A.C. Smith, and R.E. Diffenbach, "Removal of
Hazardous Fluid from the Ground Water in a Congestd Area—A Case History,"
Proceedings of 1976 National Conference on Controls of Hazardous Material
Spills, pp. 373-377.
Entropy Limited (Lincoln Massachusetts), "Review of the W. Rogers Assoc. Report
on the Statistical Analysis of Corrosion Failure, Unprotected Underground
Steel Tanks," memo from R. Christensen and R. Eilbert, May 4, 1982 (6 pages).
t "Decision-Theoretic Assessment of Rogers Model on Underground Tank
Leaking," memo from R. Christensen, May 6, 1982 (7 pages).
> Estimate of Information Content of PACE Data Base with respect to
External Corrosion of Underground Storage Tanks," memo from R. Christensen,
June 15, 1982 (7 pages).
Feld, J., Lessons from Failures of Concrete Structures, American Concrete
Institute Monograph No. 1, Detroit:American Concrete Institute, and Ames:
Iowa State University Press (published jointly), 1964.
Fetter, C.W., Jr., Applied Hydrogeology, Columbus: Charles E. Merrill
Publishing Co., 1980.
Ford, H., K.E. Bett, J. Rogan, and H.F. Gardner, "Design Criteria for Pressure
Vessels," Chemical Engineering Progress, Vol. 68, No. 11, November 1972, pp.
77-79.
Frankland, P.B., "Relief Valves... What Needs Protection?" Hydrocarbon Process-
ing, April 1978, pp. 189-191.
Gauger, R.H., and N. Holmes,."Black Start Reliability," 1984 Proceeding Annual
Reliability and Maintainability, pp. 177-180.
Ghassemi, M., Y. Kar, and F.J. Freeston, "Applicability of Commercialized Waste-
water Treatment Techniques to the Treatment of Spill-Impacted Waters," Pro-
ceedings of the 1980 NationarCgnference o.n Control of Hazardous Material
Spills,, Louisville, Ky., May 1980, pp. 65-71.
Grant, L.H., S.A. Mirza and J.G. MacGregor, "Monte Carlo Study of Strength of
Concrete Columns," Journal of the American Concrete Institute, Vol. 75, August
1978, pp. 348-358.
Green, A.E., ed., High Risk Safety Technology, New York: John Wiley and Sons,
1982.
Gustin, R.E., and D.A. Novacek, "Ammonia Storage Vent Accident," Ammonia Plant
Safety, Vol. 21, 1979, pp. 80-81.
Hale, C.C., "Refrigerated Ammonia Storage: Design and Practice," Ammonia Plant
Safety. Vol. 21, 1979, pp. 61-68.
Hammer, H.S., "Reliability Demonstration Testing Using Failure-Free Trials,"
Proceedings 1974 Annual Reliability and Maintainabilty, 1974, pp. 201-205.
192
-------
Hampson, T.R., "Chemical Leak at a Bulk-Terminals Tank Farm," Proceedings of
1J976 National Conference on Controls of Hazardous Material Spills, pp. 214-
_
Harris^, N., and P.D.T. O'Connor, "Reliability Prediction: Improving the Crystal
Ball," 1984 Proceedings Annual Reliability and Maintainability Symposium, pp.
108-113. -
Hauptmanns, U., and J. Yllera, "Fault-tree Evaluation by Monte Carlo Simula-
tion," Chemical Engineering, January 10, 1983, pp. 91-97.
Hawn, D.E., "Extreme Value Prediction of Maximum Pits on Pipelines," Materials
Performance, March 1977, pp. 29-32.
Heitner I., T. Trantmanis, and M. Morrissey, "When gas-filled vessels are
exposed to fire . . .," Hydrocarbon Processing, November 1983, pp. 263-268.
Henley, E.J., and H. Kumamoto, Reliability Engineering and Risk Assessment, New
Jersey: Prentice-Hall, Inc., 1981.
Holton, G.A., and C.C. Travis, "A Methodology for Predicting Fugitive Emissions
for Incinerator Facilities," Environmental Progress, 3(2) May 1984, pp. 116-
121.
Holzhauer, R., "Underground Liquid Fuel Storage Tanks," Plant Engineering, April
17, 1980, pp. 98-105.
Hoyle, W.C., and G.L. Melvin, "A Toxic Substance Leak in Retrospect: Prevention
and Response," Proceedings of 1976 National Conference on Controls of Hazard-
ous Material Spills, pp. 187-191.
Howard, W.B., "Hazards with Flammable Mixtures," Chemical Engineering Progress,
Vol. 66(9), September 1970, pp. 59-62.
"How to Set Up an Emergency Response System," National Safety News, November
1983, p. 37.
Hulme, B.L., and R.B. Worrell, "Algebraic Approximation of Event Tree Sequences,"
1983 Proceedings of the Annual Reliability and Maintainability Symposium, pp.
61-62.
Hwang, S.T. Toxic Emissions from Land Disposal Facilities. Environmental
Progress. 1(1) February 1982.
ICF, Inc., "RCRA Risk/Cost Policy Model Project Phase 2 Report," for U.S.
Environmental Protection Agency, Office of Solid Waste, June 15, 1982.
Illinois Legislative Investigating Commission, Landfilling of Special and
Hazardous Waste: A Report to the Illinois General Assembly, August 1981.
Ishikawa, Y., T. Ozaki, N. Hosaka, and 0. Nishida, "Corrosion Life Prediction of
Machine Components by Extreme Value Statistical Analysis," Fushoku Boshoku
Bumon linkai Shiryo, 20(3), 1981, pp. 73-77 (Japan).
193
-------
-- --, "Statistical Properties of Crevice Corrosion Behavior," Tetsu to
Hagane, Vol. 68, 1982, pp. A203-A206 (Japan).
James Jr., R., "Maintenance of Rotating Equipment: Pump Maintenance," Chemical
Engineering Progress, February 1976, pp. 35-40.
Jarvis, H.C. "Butadiene Explosion at Texas City--l," Chemical Engineering
Progress, 67(6), June 1971, pp. 41-44.
Jennings, A.L., and C.R.Gentry, "The Use of Spill Potential in the Designation
of Hazardous Substances," Control of Hazardous Material Spills, Proceedings of
1976 National Conference on Controls of Hazardous Material, pp. 44-48.
Johnson, D.M., "The Billion Gallon Tank Farm," Chemical Engineering Progress,
65(4), April 1969, pp. 41-43.
Johnston, G.O., "Probabilistic Fracture Mechanics (PFM)," in T.R. Moss, ed.,
Mechanical Reliability, Science & Technology Press, Ltd., 1980, pp. 8-34.
Joller, J.M., "Constructing Fault-Trees by Stepwise Refinements," IEEE
Transactions on Reliability, Vol. R-31, No. 4, October 1982, pp. 333-338.
Jones, J.R., "The Selection of Pumps for Filtration Duties", Filtration and
Separation, March/April, 1980, pp. 120-128.
JRB Associates, "Failure Incident Analysis: Evaluation of Storage of Failure
Points," draft prepared for U.S. Environmental Protection Agency, Office of
Solid Waste, March 1982.
Kanda, K., "Computerization of System/Product Fault Trees," Annals of Assurance
Sciences, 8th Reliability and Maintainability Conference, 1969, pp. 325-333.
Kasouf, G. and D.A. McGoye, "R/M Design for Long Term Dormant Storage," 1984
Proceedings Annual Relability and Maintainability Symposium, pp. 168-176.
Kern, R., "Pressure-Relief Valves for Process Plants," Chemical Engineering,
February 28, 1977, pp. 187-194.
Khandelwal, U.C., "For Cradle-to-Grave Protection Assign Hazardous Materials
Duty," National Safety News, July 1983, pp. 65-68.
Kiang, Y.H. and A.A. Metry, Hazardous Waste Processing Technology, Ann Arbor: Ann
Arbor Science, 1982.
Kirby, G.N., "How to Specify Fiberglass Reinforced-Plastics Equipment, "Chemical
Engineering, June 5, 1978, pp. 133-138.
Klee, A.J., The Mouse Manual, U.S. Environmental Protection Agency, Industrial
Environmental Research Laboratory, June, 1981.
Kletz, T.A., "Case Histories on Loss Prevention," Loss Prevention, Vol. 8,
AIChE, 1974, pp. 126-130.
194
-------
, "Preventing Catastrophic Accidents," Chemical Engineering, April 12,
1976, pp. 124-128.
t "Protect Pressure Vessels from Fire," Hydrocarbon Processing,
August 1977, pp. 98-102.
t» Practical Applications of Hazard Analysis," Chemical Engineering
Progress, October 1978, pp. 47-53.
t "Minimize your Product Spillage," Hydrocarbon Processing, March
1982, pp. 207-208, 210.
Koeppe, C.E., and G.C. DeLong, Weather and Climate, New York: McGraw-Hill Book
Co., 1958.
Kolodner, N.J., "Use a Fault-Tree Approach, "Hydrocarbon Processing, September
1977, pp. 303-304, 306, 308.
Kramer, W.H., "Ground-Water Pollution from Gasoline," GWMR, Spring 1982, pp.
18-22.
Kunii, D., and 0. Levenspiel, Fluidization Engineering, New York: John Wiley and
Sons, Inc., 1969.
Lafornara, J.P. and J.S. Dorrler, "The Environmental Response Team," Proceedings
of the 1980 National Conference on Control of Hazardous Material Spills,
Louisville, Ky., May 1980, pp. 476-481.
Lambert, R.G., "Low Cycle Fatigue Reliability Expressions," 1982 Proceeding
Annual Reliability and Maintainability Symposium, pp. 47-50.
Langley, G.J., S.M. Dennis, J.F. Ward, and L.P. Provost, "Analysis of SOCMI VOC
Fugitive Emission Data," EPA-600/S2-81-111, U.S. Environmental Protection
Agency, Industrial Environmental Research Laboratory, EPA-600 S2-81-111,
September 1981.
Lapp, S.A., and G.J. Powers, "Computer-Aided Synthesis of Fault Trees,"
IEEE Transactions on Reliability, April 1977, pp. 2-15.
Lawrence, W.E., and E.E. Johnson, "Design for Limiting Explosion Damage,"
Chemical Engineering, January 7, 1984, pp. 96-104.
Lawley, H.G., "Operability Studies and Hazard Analysis," Chemical Engineering
Progress, 70(4), April 1974, pp. 45-56.
t "Size up Plant Hazards This Way," Hydrocarbon Processing, April
1976, pp. 247-248, 250, 252, 256, 258, 260-61.
Lewis II, E.C., "Mud Pump Failure Analysis, Part 4 - Extrusion, The Primary
Cause of Piston Failure," Petroleum Engineer, October 1981, pp. 130-144.
Lindorff, D.E., and K. Cartwright, "Ground-Water Contamination: Problems and
Remedial Actions," Illinois Geological Survey, Environmental Geology Notes,
No. 81, 1977.
195
-------
Mackay, D., S. Paterson, and S. Nadeau, ."Calculation of the Evaporation Rate of
Volatile Liquids," Proceedings of the 1980 National Conference on Control of
Hazardous Material Spills, Louisville. Ky., May 1980, pp. 361-368.
Mann L., Or., and H. H. Bostock, "Short-range Maintenance Planning/Scheduling
Using Network Analysis," Hydrocarbon Processing, March 1983, pp. 97-101.
Martinez, E.G., "Storage Reliability with Periodic Test," 1984 Proceedings
Annual Reliability and Maintainability Syposium, pp. 181-185.
Mclntyre, D.R., "How to Prevent Stress-Corrosion Cracking in Stainless
Steels—I," Chemical Engineering, April 7, 1980, pp. 107-112.
t »HOW to Prevent Stress-Corrosion Cracking in Stainless Steels--II,"
Chemical Engineering, May 5, 1980, pp. 131-132, 134, 136.
t "Evaluating the Cost of Corrosion-Control Methods," Chemical
Engineering, April 5, 1982, pp. 127-132.
McKay, F.F., 6.R. Worrell, B.C. Thornton, and H.L. Lewis, "If an ethylene pipe
line ruptures . . .", Hydrocarbon Processing, 56(11), 1977, pp. 487.
Mclntyre, D.R., "How to Prevent Stress-Corrosion Cracking in Stainless Steels-
II," Chemical Engineering, 5 May 1980, pp. 131-132, 134, 136.
Miller, M.J., "Reliability of Fire Protection Systems," Loss Prevention, Vol. 8,
AIChE, 1974, pp. 85-90.
Moore, C.G., "Automated System Provides Corrosion Data Before Disaster,"
Pollution Engineering, June 1984, pp. 42-43.
National Association of Corrosion Engineers, Technical Practices Committee,
"Recommended Practice: Control of Internal Corrosion in Steel Pipelines and
Piping Systems," NACE Standard RP-01-75, 1975.
j "Recommended Practice: Control of External Corrosion on Metallic
Buried, Partially Buried, or Submerged Liquid Storage Systems," NACE Standard
RP-02-85, April 10, 1985.
j and American Petroleum Institute, Corrosion of Oil and Gas-Well
Equipment (1958).
National Research Council Canada, "A Case Study of Industrial Chemicals—Poly-
chlorinated Biphenyls and Chlorinated Benzenes," NRCC No. 17586, 1980.
New York State Department of Environmental Conservation, Siting Manual for
Storing Hazardous Substances: A Practical Guide for Local Officials, Albany,
1982.
t Administrative and Legal Options for Storing Hazardous Substances: A
Guide for Local Officials, Albany, 1984.
196
-------
> Recommended Practices for Underground Storage of Petroleum, Albany,
1985.
t Technology for the Storage of Hazardous Liquids: A State-of-the Art
Review, Albany, 1985.
"News in Brief: Research and Technology," Hazardous Material Intelligence
Report, August 26, 1983, pp. 3-4, 8.
Nowak, A.S., "Effect of Human Error on Structural Safety," Journal of the
American Concrete Institute, Vol. 76, September 1979, pp. 959-972.
Owens, M., R.W. Edwards, and J.W. Gibbs, "Some Reaeration Studies in Streams,"
International Journal of Air and Water Pollution, Vol. 8, 1964.
Ozog, H., "Hazard Identification, Analysis, and Control," Chemical Engineering,
February 18, 1985, pp. 161-170.
Petak, W.J., and A.A. Atkisson, National Hazard Risk Assessment and Public
Policy: Anticipating the Unexpected, New York:Springer-Verlag (1982).
Peters, M.S., and K.D. Timmerhaus, Plant Design and Economics for Chemical
Engineers, 3rd ed., McGraw-Hill, 1980.
Perry, R.H., and C.H. Chilton, eds. Chemical Engineers Handbook, 5th ed.,
McGraw-Hill, 1973.
Petersen, H.J.S., and P. Haastrup, "Fault-Tree Evaluation Shows Importance of
Testing Instruments and Controls," Chemical Engineering, November 26, 1984,
pp. 85-87.
Petroleum Association for Conservation of the Canadian Environment, "Underground
Tank Systems. Review of State of the Art and Guidelines," PACE Report No.
82-3, Ottawa (1983).
Pope-Reid Associates, "Assessment of the Technical, Environmental and Safety
Aspects of Storage of Hazardous Waste in Underground Tanks," Volume I, Draft
Report, Prepared for U.S. Environmental Protection Agency, Office of Solid
Waste, August 25, 1983.
t "Liner Location Risk Analysis Model," Draft Report, Appendix
A—Failure Analysis," St. Paul, MN, 1984.
t The Analysis of Component Failures of Hazardous Waste Storage and
Treatment Systems: Annotated Bibliography (Draft, July 1984)
Portland Cement Association (Minneapolis, Minnesota), "Concrete Systems for
Manure Handling," Bulletin #NCR-A283, undated.
Portland Cement Association (Skokie, Illinois), "Circular Concrete Tanks Without
Prestressing," Concrete Information, Bulletin #15072.01D, undated.
197
-------
, "Rectangular Concrete Tanks,"'Concrete Information, Bulletin
#15003.03D, Revised 1981.
t "Underground Concrete Tanks," Concrete Information, Bulletin
#15071.030, undated.
-, Design and Control of Concrete Mixtures, Twelfth Edition, 1979.
•, Building Movements and Joints, 1982.
Powers, G.O., and S.A. Lapp, "Computer-Aided Fault Tree Synthesis," Chemical
Engineering Progress, April 1965, pp. 89-93.
Powers, G.J., and F.C. Tompkins, Jr., "Fault Tree Synthesis for Chemical Pro-
cesses," AIChE Journal, 20(2), March 1976, pp. 376-387.
Preddy, D.L., "Guidelines for Safety and Loss Prevention," Chemical Engineering,
April 21, 1969, pp. 94-108.
Prestigiacomo, N.M., and J.H. Stokes, "Developing New API-650 Appendix H,"
Hydrocarbon Processing, May 1978, pp. 170-171.
Priestly, M.J.N. "Ambient Thermal Stresses in Circular Prestressed Concrete
Tanks," Journal of the American Concrete Institute, Vol. 73, October 1976,
pp. "
Prugh, R.W., "Application of Fault Tree Analysis," Loss Prevention, Volume 14,
AIChE, 1981, pp. 1-10.
Roberts, R.J., J.A. Cherry, and F.W. Schwartz, "A Case Study of a Chemical
Spill: Polychlorinated Biphenyls (PCB's) 1. History, Distribution, and
Surface Translocation," Water Resources Research, June 1982, pp. 525-534.
, "A Case Study of a Chemical Spill: Polychlorinated Biphenyls (PCB's)
2. Hydrological Conditions and Contaminant Migration," Water Resources
Research, June 1982, pp. 535-545.
Roebuck, A.M., and G.H. Brevoort, "Coating Work Costs and Estimating," Materials
Performance, 22(1), January 1983, pp. 43-457.
"Rogers Finds Leaks by Using Statistics," Petroleum Marketer, November/December
1982, pp. 17-20.
Rooney, J.P., "Predict Reliability of Instrumentation," Hydrocarbon Processing,
January 1983, pp. 89-92.
Rossum, J.R., "Prediction of Pitting Rates in Ferrous Metals from Soil Para-
meters," Jour. AUWA, June 1969, pp. 305-310.
Sangerhausen, C.R., "Reduce Seal Failures in Tight Hydrocarbon Service, Part 1—
Design Considerations," Hydrocarbon Processing, January 1981, pp. 111-116.
198
-------
, "Reduce Seal Failures in Tight Hydrocarbon Service, Part 2—
Commissioning Procedures," Hydrocarbon Processing, March 1981, pp. 119-122.
Sax, N., and I. Van Nostrand, Dangerous Properties of Industrial Materials, 4th I
edition, Reinhold Company, 1975, Appendix 2, pp. 268-269. //
Schillmoller, C.M.", and H.J. Althoff, "How to Avoid Failures of Stainless
Steels," Chemical Engineering, May 28, 1984, pp. 119-120, 122.
Schultz, D.W., and V.B. Parr, "Project Summary: Evaluation and Documentation of
Mechanical Reliability of Conventional Wastewater Treatment Plant Components,"
United States Environmental Protection Agency, Municipal Environmental Re-
search Laboratory, Cincinnati, EPA-600/S2-82-044, August, 1982.
Schwerdtfeger, W.J., "Laboratory Measurement of the Corrosion of Ferrous Metals
in Soils," Journal of Research of the National Bureau of Standards, 50(6), June
1953, pp. 329-336.
SCS Engineers, "Final Report: Assessment of the Technical, Environmental and
Safety Aspects of Storage of Hazardous Waste in Underground Tanks," Prepared
for U.S. Environmental Protection Agency, Office of Solid Waste, February
1984.
f "Estimated Cost of Compliance with RCRA Regulations for Underground
Tank Storage Facilities," Volume 1, Prepared for U.S. Environmental Protection
Agency, Office of Solid Waste, March 1984.
Sheppard, W.L., Jr., "Failure Analysis of Chemically Resistant Monolithic Sur-
facing," Chemical Engineering, July 23, 1984, pp. 124-125.
Shields, E., and W.J. Dessert, "Learning a Lesson from a Sulfuric Acid Tank
Failure," Pollution Engineering, December 1981, pp. 39-40.
Siegel, R.D., "Controls Developing for Fugitive Emissions," Hydrocarbon
Processing, October 1981, pp. 105-108.
Sobotka and Company, "Developing and Assessing Regulatory Options for Testing,
Monitoring, Recordkeeping and Reporting in Response to Leaking Underground
Storage Tanks," Draft Final Report, for the U.S. Environmental Protection
Agency, Office of Toxic Substances, June 1984.
Sonti, R.S., "Practical Design and Operation of Vapor-Depressuring
Systems," Chemical Engineering, January 23, 1984, pp. 66-69.
Southwest Research Institute, "Evaluation and Documentation of Mechanical
Reliability of Conventional Wastewater Treatment Plant Components," EPA 600/2-
82-044, U.S. Environmental Protection Agency, Municipal Environmental Research
Laboratory, 1982.
Sowers, G.B., and G.F. Sowers, Introductory Soil Mechanics and Foundations, 3rd
ed., New York: MacMillan, 1970.
199
-------
Stephens, T.J.R., and C.B. Livingston, "Explosion of a Chlorine Distillate
Receiver," Chemical Engineering Progress, 69(4), April 1973, pp. 45-47.
"STI-P3 Tanks," Tulsa Letter, November 1, 1983, p. 3.
Tepfers, R. and T. Kutti, "Fatigue Strength of Plain, Ordinary and Lightweight
Concrete," Journ'al of the American Concrete Institute, Vol. 76, May 1979,
pp. 635-652.
Thibault, G.T., and W.N. Elliott, "Biological Detoxification of Hazardous
Organic Chemical Spills," in Proceedings of the 1980 National Conference on
Control of Hazardous Material Spills, Louisville, Ky., May 1980, pp. 398-402.
Thibodeaux, L.J., Chemodynamics, New York: John Wiley & Sons, 1979.
Thibodeaux, L.J., D.6. Parker, H.H. Heck, and R. Dickerson, "Quantifying Organic
Emission Rates from Surface Impoundments with Micrometeorological and
Concentration Profile Measurements," presented at the annual meeting of
American Institute of Chemical Engineers, New Orleans, LA, November 8-12,
1981.
Tomsky, J., "Analysis of Variance of Reliabilities," 1983 Proceedings of the
Annual Reliability and Maintainability Symposium, pp. 63-70.
Tsujikawa, S., H. Cha, K. Hisamatsu, K, "Stochastic Theory Evaluation of the
Critical Potential and Onset Time of Crevice Corrosion in Stainless Steel,"
Tetsu to Hagane, Vol. 68, 1982, pp. A207-A210 (Japan).
"TR-9 Circular Concrete Manure Tanks," Technical Resource. ISBN 0-89373-059-9,
November 1983.
Transportation Research Board, "Durability of Drainage Pipe," National
Cooperative Highway Research Program Synthesis of Highway Practice, 1978, pp.
24-30.;
"Underground Unprotected Steel Tank Study: Statistical Analysis of Corrosion
Failures," (undated, author unknown), memo included in correspondence package
from B. Tarn, U.S. Environmental Protection Agency, Office of Solid Waste,
Economic Analysis Branch, to C. Lough, Project Director, Pope-Reid Associates,
Inc., May 14, 1984.
United States Coast Guard, Deep Water Port Inspection Methods and Procedures.
Report #CG-0-31-78 (1978).
United States Department of the Interior, Water and Power Resources Service,
Concrete Manual, A Water Resources Technical Publication, 8th Ed., 1981.
United States Environmental protection Agency, Case Studies 1-23: Remedial
Response at Hazardous Waste Sites, EPA-540/2-84-0026, March 1984.
t Control of Volatile Organic Emissions from Petroleum Liquid Storage
in External Floating Roof Tanks, EPA-450/2-78-047, OAQPS No. 1.2-116,
December 1978.
200
-------
, Proceedings Fourth Symposioum on Fugitive Emissions: Measurement
and Control, New Orleans, May 1980, EPA-600/y-8U-u4l, December 198U.
4 Summary Report: Remedial Response at Hazardous Waste Sites,
EPA-540/2-84-002a, March 1984.
t and Hazardous Materials Control Research Institute, Management of
Uncontrolled Hazardous Waste Sites, Proceedings of a national conference,
Washington, D.C., October 28-30, 1981.
United States Nuclear Regulatory Commission, Reactor Safety Study: An_
Assessment of Accident Risks j_n_ U.S. Commercial Nuclear Power Plants, (usual ly
cited as WA3F-1400), 1975, AppenHTces III and IV.
Vervalin, C.H., "Fire and Safety Information: A Description of Key Resources,"
Hydrocarbon Processing, April 1972, pp. 163-165.
t "Learn from HPI Plant Fires," Hydrocarbon Processing, December 1972,
pp. 49-53.
, "HPI Loss-Incident Case Histories," Hydrocarbon Processing, February
1978, pp. 183-184, 189-190, 195-196, 198-200.
} "How to Prevent Stress-Corrosion in Stainless Steels-I," Chemical
Engineering, April 7, 1980, pp. 107-108, 110, 112.
f "Define Loss Prevention Problems and Remedies," Hydrocarbon
Processing, December 1983, pp. 111-112, 114, 117.
Vesely, W.E., "Reliability Quantification Techniques Used in the Rasmussen
Study," Reliability and Fault Tree Analysis: Theoretical Aspects of System
Reliability and Safety Assessment, Edited by R.E. Barlow, J.B. Fussell, and
N.D. Singpurwalla, Philadelphia: Society for Industrial and Applied Mathe-
matics, 1975., pp. 775-803.
t "The Facade of Probabilistic Risk Analysis: Sophisticated
Computation Does Not Necessarily Imply Credibility," 1983 Proceeding Annual
Reliability and Maintainability Symposium, pp. 49-51.
Wafelman, H.R., and H. Buhrmann, "Maintain Safer Tank Storage," Hydrocarbon
Processing. January 1977, pp. 229-230, 232, 234-235.
Wallace, A.E., and W.P. Webb, "Cut Vessel Costs with Realistic Corrosion
Allowances," Chemical Engineering, August 24, 1981, pp. 123-126.
Warner, R.F., and A.P. Kabaila, "Monte Carlo Study of Structural Safety,"
Proceedings ASCE, Vol. 94, December 1968, pp. 2847-2859.
Warren Rogers Associates, Inc., "National and Regional Profiles of Underground
Storage Tank Characteristics," Report Submitted to the U.S. Environmental
Protection Agency in or about 1984, included in correspondence package from
D. Samuelson, Sobotka & Co., to R. Lovett, Pope-Reid Associates, received
July 25, 1985.
201
-------
, "Prediction of Leaks in Unprotected Steel Storage Tanks," included in
correspondence package from B. Tarn, U.S. Environmental Protection Agency,
Office of Solid Waste, Economic Analysis Branch, to. C. Lough, Project
Director, Pope-Reid Associates, Inc., received May 14, 1984.
t "Tank Integrity Program" (undated memo), included in correspondence
package from B. Tarn, U.S. Environmental Protection Agency, Office of Solid
Waste, Economic Analysis Branch, to C. Lough, Project Director, Pope-Reid
Associates, Inc., May 14, 1984.
Washa, G.W. and K.F. Wendt, "Fifty Year Properties of Concrete," Journal of the
American Concrete Institute, Vol. 71, January 1975, pp. 20-28.
Wells, J.E., and D.A. Lappa, "Probabilistic Culling in Fault Free Evaluation,"
1983 Proceedings Annual Reliability and Maintainability Symposium, pp. 52-54.
White, Frank M., Fluid Mechanics, McGraw-Hill, 1979.
Whittaker, K.T., and R. Goltz, "Cost Effective Management of an Abandoned
Hazardous Waste Site by a Staged Clean-up Approach," Management of
Uncontrolled Hazardous Waste Sites, 1982, p. 262.
Williams, B.E., "The Probability of Failure for Piping Systems," Failure
Prevention and Reliability, 1981 Proceedings of the Design Engineering
Technical Conference, Hartford, CT, September 20-23, 1981, Published by ASME,
New York, NY, pp. 147-150.
Wirth, G.F., "Preventing and Dealing With In-Plant Hazardous Spills," Chemical
Engineering, August 18, 1975., pp. 82-96.
Woods, H., Durability of Concrete Construction, American Concrete Institute
Monograph, No. 4, Detroit: American Concrete Institute, and Ames: Iowa State
University Press (published jointly), 1968.
Woods, P.H., and D.E. Webster, "Underground Storage Tanks: Problems,
Technology, and Trends," Pollution Engineering, July 1984, pp. 30-40.
Worrell, R.B., and B.L. Hulme, "Algebraic Approximation of Event Tree
Sequences," 1983 Proceedings of_ the Annual Reliability and Maintainability
Symposium, pp. 61-62.
Yedidiah, S., "Diagnosing Problems of Centrifugal Pumps—Part I," Chemical
Engineering, October 24, 1977, pp. 124-128.
t "Diagnosing Problems of Centrifugal Pumps—Part II," Chemical
Engineering, November 21, 1977, pp. 193-199,
t "Diagnosing Problems of Centrifugal Pumps—Part III," Chemical
Engineering, December 5, 1977, pp. 141-143.
202
------- |