MH Systems Inc: Technology

Technical Paper

THE SOCIETY OF NAVAL ARCHITECTS AND MARINE ENGINEERS
New York Metropolitan Section 601 Pavonia Avenue, Jersey City, NJ 07306

Paper presented at the 1994 Ship Operations, Management and Economics Symposium at the U.S. Merchant Marine Academy. Kings Point, NY. May 12, 1994

Roger G. Brow, Visitor Techmatics, Inc., Arlington, VA
Mo Husain, Visitor
Charles Quirmbach, Visitor MH Systems, Inc., Del Mar, CA

This paper provides a brief review of the background and purpose of the Oil Pollution Act of 1990, with emphasis on Title IV, Subtitle A, Prevention. This section of the legislation has reached the rulemaking stage, and comments are being accumulated. [1]

The proposed rulemaking fails to define in specific quantitative terms what the oil spill prevention systems covered by the legislation will have to accomplish in order to be approved for service. The review of candidate systems attaches subjective descriptions to each but offers no guidance as to how they can be modified to merit approval. Only two approaches, the double-hull and a system of reduced cargo loading, will be allowed. Others seeking approval, including innovative concepts as yet undiscovered, cannot be evaluated impartially because there is no objective basis for evaluation.

There are suggested approaches under which effectiveness scenarios and probabilistic evaluation criteria can be developed as a basis for evaluating candidate systems in quantitative terms.

The American Underpressure System, one of the numerous systems discussed in the proposed rulemaking, is described in some detail. It was identified in the Regulatory Impact Analysis commissioned by the Coast Guard as the most cost-effective approach to the tanker oil spill problem which OPA 90 seeks to eliminate. The concept discussed uses a sub-atmospheric pressure above the cargo as a means of reducing or preventing loss of cargo due to accidental rupture of a tanker hull. The concept uses active underpressure control in the inerted ullage space of the cargo tank. The principal design features of the American Underpressure System are discussed.

Oil released to the environment due to all kinds of tanker accidents, including collision, grounding, fire and explosion, structural failure and terrorist attack accounts for about twelve percent of total pollution. The remainder is due largely to leakage, faulty equipment and procedural error. Losses attributable to grounding and collision, the primary focus of this paper, account for only about three percent of the total. When grounding and collision events occur, however, the effects are concentrated in a limited area and within a limited time period, and can be devastating to the affected environment. Figure 1 and Table I show selected statistics of oil spillage and accident statistics [2].

The grounding of the EXXON VALDEZ is the most recent major incident in U.S. waters. Despite its widespread effects in the immediate area, its unprecedented cleanup cost and its extensive and dramatic press coverage, it is only the tenth largest spill in the historical record. Even more catastrophic events can be expected unless appropriate preventive measures are taken. These measures include both improved design of ships and shipboard equipment and more effective operational procedures.

The United States Congress has been considering oil spill legislation for fifteen years or more. These investigations led to the passage of the Oil Pollution Act of 1990 (OPA 90), a comprehensive law which addresses the key engineering, operational and legal issues involved in oil spill prevention. Similar efforts have been undertaken at the international level under the auspices of the International Maritime Organization.

OPA 90 defines objectives and establishes a framework within which detailed implementation can take place. That implementation is now being carried out. The potential social benefits to be achieved are high; the potential social costs are high, too. The detailed implementation of OPA 90 will determine both benefits and costs and will have far-reaching effects on our petroleum-based economy. Inevitably, a major redirection of this kind gives rise to conflicting views. In the present case, environmental concern demands that the designated system and procedures shall be effective in preventing cargo loss; regulatory officials must have regulations that can be conveniently and effectively enforced, oil consumers, and the economy as a whole, require that the cost of implementing them be as low as possible. Finally, the potential suppliers of ships and equipment desire to maximize financial return. The implementation process must reconcile these conflicting views to develop an optimum solution.

In this paper we are concerned with the prevention (by tanker design) sections of OPA 90. We hope to achieve two objectives. The first is to advocate a redefinition of the rulemaking process so that it establishes what the oil spill prevention system has to accomplish rather than what kind of system it has to be. Adoption of this approach would assure that any selected system would achieve specific quantitative objectives. It would also assure that all-eligible systems are fairly considered on the merits.

Our second objective is to advocate one specific alternative, of the many that should be considered, which we believe to be a cost-effective solution to the oil spill problem. The system uses a reduced pressure applied above the cargo, to reduce the losses experienced as a result of collision or grounding.

OPA 90 is an all-encompassing and comprehensive law, approved after extensive study and intense debate. It defines stringent requirements for oil spill liability and accountability, tanker design and construction and manning and licensing requirements. The law also establishes a billion-dollar federal trust fund for cleanup and damages. Nine -area are covered by the law:

The focus of this paper is Title IV - Prevention and Removal, in particular Subtitle A - Prevention. Section 4115 establishes the baseline requirement as the double-hull tanker configuration, or the equivalent in capability, and sets up a retirement schedule for existing tankers that do not need the mandated requirements. The Secretary of Transportation is assigned the responsibility of determining if there is any equivalent alternative to the double hull. It is the responsibility of the United States Coast Guard to translate the intent of OPA 90 into rulemaking.

The National Academy of Sciences or other qualified organizations may be utilized to provide technical support for these decisions. These tasks must be completed in five years [1].

The rulemaking process requires a series of steps in implementing the Federal Law. They include Regulatory Impact Analyses (RIA), Advanced Notices of Proposed Rulemaking (ANPRM) and Notices of Proposed Rulemaking (NPRM). As of this writing, a study has been completed by the National Academy of Sciences [31 and the RIA has been completed [4]. The rulemaking itself is divided into one section on new ships and a second section on interim measures for existing ships. The ANPRM and NPRM for new ships have been completed. The NPRM covering requirements for existing ships has been released and comments solicited. With respect to new buildings, the NPRM essentially specifies the double hull, not only as the standard of effectiveness, but also as the sole technical solution that will be allowed.

The ANPRM for existing tankers takes up a number of alternative approaches to oil spill prevention and provides a brief discussion of each. The double hull is found acceptable (but not required) if in conformance to a specified design standard. A concept identified as "PL/Spaces", which consists of operating the vessel at reduced loading in order to reduce the amount of cargo at risk in the event of collision or grounding by protectively locating non-cargo tanks, is found to be conditionally acceptable. Concepts such as hydrostatic Balance Loading (HBL), segregated Ballast Tanks (SBT), Double Sides, and Double Bottoms all operating at a loss of cargo carrying capacity arc also acceptable. All of the other concepts are identified as ineffective, unproven, complex or costly. Although each may be considered for approval in the future, there are no quantitative standards against which criteria such as effectiveness, complexity or cost can be evaluated. And there are no defined procedures under which a proposed concept can be proven.

To be acceptable in the context of OPA 90, a candidate oil spill prevention concept must be effective, and its effectiveness must be demonstrated by experience, test or acceptable analysis. In should also be economical, insofar as possible, so that its impact on national economic welfare and competitiveness is minimized. As these terms are merely descriptive adjectives, they should be defined, as part of the rulemaking process with care and precision.

A system is effective if does what it is intended to do. The standard of effectiveness adopted by OPA 90 is the double hull design. It was identified as a standard because it is known to be capable of significantly reducing the likelihood that a collision or grounding event will rupture the hull boundary and allow cargo outflow. It is not, and was never claimed to be, a sure means of preventing cargo loss under all circumstances. It follows that its effectiveness, as well as the effectiveness of any other system, must be defined in probabilistic terms. Since none of the systems considered is perfect, effectiveness is essentially a probability statement and is so treated in the Regulatory Impact Analysis Report commissioned by the Coast Guard. The system is deemed effective" to the extent that significant cargo loss in collision or grounding is rendered highly unlikely.

Effectiveness consists essentially of three components: (1) a low probability that a given damage incident penetrates the hull; (2) a small expected loss of cargo if penetration does occur; and (3) a high probability that all the elements of the system operate satisfactorily.

The double-hull is effective because the probability of penetration is minimized by interposing a ballast/void space. Limited historical data suggest that the likelihood of penetration is reduced by perhaps 80 percent in grounding incidents and 50 percent in collision incidents. In addition, it is a passive system, involving no machinery, and can be expected to operate reliably. Thus, factors (1) and (3) are highly favorable. Factor (2), however, is no more favorable than in conventional tankers because the primarily hydrostatic mechanism of cargo loss is the same. Altogether the combined effect of these three factors yields an "effective" containment system.

Competing systems, to be discussed later in this report, address primarily the second factor defined above, the mechanism of cargo loss. They do so by arranging cargo more advantageously, by providing rescue tanks, or by provisions which reduce hydrostatic outflow forces. In general, these alternative systems contribute little to factor (1), the resistance of the hull to penetration. However, they may be equal or superior to the double hull in overall effectiveness. The Regulatory Impact Analysis shows this quite clearly.

There remains the question of system reliability, the third factor defined above. This is the factor that the NPRM is trying to address when it uses the word "complex." It is certainly true that added system complexity, in the form of valves, transfer lines or pumps, can have an adverse effect on reliability; if these elements fail, and if redundant components are not provided, then the objective of the system may be defeated. Equally, however, some degree of complexity may have to be accepted in modem systems in order to achieve effectiveness and economy. Otherwise the "effective" abacus would have prevailed over the "complex" computer chip; apart from economic considerations, they accomplish the same results. It is the system designer’s job to balance reliability and other factors to achieve the desired overall effectiveness. The complexity of modem systems such as air traffic control has created a specific discipline, Reliability Engineering, whose objective is to integrate this essential element into the design process.

The occurrence of collision and grounding events as well as the damage and cargo loss mechanisms, is essentially the product of random phenomena. We believe that under these circumstances the best measure of effectiveness for a candidate system is the expected, or average, outflow experienced per incident. An alternative measure, the probability of zero outflow, has been used but is considered less appropriate. The difference may be seen by comparing an investment strategy based on average return against one based on the most optimistic possible return.

The expected loss is calculated using a probability tree [Figure 2] involving a sequence of possible outcomes. The following discussion refers to a single tank, and the expected total loss is the sum of the expected losses for all the cargo tanks.

For a single incident, the probabilities of grounding or collision may be designated T and T_e, respectively. These quantities are important only in their relative values so as to properly weight the capabilities of the design in each type of incident. If these quantities add up to one, the result of the outflow calculation is on a "per incident" bases without regard to incidents other than grounding or collision, for example, fire. Reviews of accident statistics suggest that collisions account for about 40 percent of accident events and grounding for the remaining 60 percent.

Another component of the calculation is the hit probability for the tank in question. For a grounding incident, the hit location may be assumed to be equiprobable over the bottom area of the hull, therefore the hit probability, Pt. is the effective horizontal area of the tank divided by the total bottom area. Similarly, collision hits are assumed equiprobable over the area of the two sides of the vessel, so the hit probability, P_e, is the area of the tank in the profile view divided by the total side area of the ship. In either case, of course, these probabilities apply only when the tank is adjacent either to the bottom or the side otherwise the penetration of damage may be assumed to be limited to external tanks and therefore the probabilities P_g and P_c arc zero for interior tanks.

For either grounding or collision, there is a probability that a tank, if involved in the incident, will actually be ruptured. This factor, designated either B_g or B_c, defines the resistance of the design to damage given that a hit has occurred. For example, it reflects- the difference between conventional and double-hull designs. Operational experience indicates that the double-hull provides protection against rupture in about 50 percent of collision incidents and that the double bottom provides protection in about 80 percent of grounding incidents.

An additional factor in the calculation is the relative size of the tank, L_ge, expressed as a fraction of total cargo volume. This factor assures that the vulnerability of the tank is weighted by its size; the expected total cargo outflow is thus expressed as a fraction of total cargo.

The calculation for each tank must also reflect the expected outflow from the tank as determined from hydrostatic principles. Expected losses are designated E_g and E_c. for the grounding and collision cases. The loss mechanisms are primarily hydrostatic although secondary phenomena, such as tidal effects, entrainment losses and ship list and trim may be included in the analysis as data permits.

In summary, the expected cargo loss for a given tank in a grounding incident, given that an incident of some kind has occurred, is the product of the following factors:

Finally, the reliability of the specific system must be factored into the calculation. This effect is determined by conducting the foregoing calculation first, with the system operative and second, with the system in the failed state. These two outcomes are weighted by the estimated system reliability. For essentially passive system, such as the double hull and the mid-deck, the system reliability is essentially 1.0.

This simple model can be programmed very easily and adapted as necessary to reflect new data or improved probability representations for the phenomena and components involved. The Probabilistic Estimate of Average Loss Reduction for a national tanker of 280,000 dwt is shown in Figure 3.

The most effective demonstration of effectiveness is the historical record; accident data, properly interpreted, afford a solid basis for evaluating a given system. Unfortunately (or better, fortunately) significant collision or grounding events are rare. Limited data exist, but the statistical significance is very low. The conclusions that may be drawn are useful, but not conclusive. Of the measures considered, the double hull possesses a reasonably adequate history. As noted previously, it has demonstrated a decrease of 50 to 80 percent in the probability of tank rupture.

The alternative to actual experience is an analysis under simplified assumptions. For instance, with regard to rupture probability, calculations involving impact energy and a simplified structural model have given interesting results. Apart from questions of the purely technical legitimacy of such analyses, a critical problem arises when it becomes necessary to assume the expected population of collision or grounding events. Again, there are limited data available, but its limited scope makes analysis results highly dependent on the underlying assumptions. For example, if all collisions arc assumed to occur at very high speed on a 90-degree relative bearing, then the double hull is nearly valueless. But for very low speed events it is probably more effective than available statistics indicate.

Despite these difficulties, we believe that it is better to establish approximate collision or grounding accident scenarios as a means of evaluating candidate systems than to simply assign the descriptors, "proven" or "unproven" on the basis of subjective judgement. Furthermore, the key* elements of some systems may be demonstrable in planned full-scale, or even model-scale, experiments.

The economic impact of a competing system is probably best expressed by evaluating the change in required freight rate (RFR) necessitated by the addition of the proposed system. Development and startup, costs are amortized over the expected number of units to be produced. Ship construction, operation and maintenance costs are determined or, alternatively, the changes in these factors attributable to the proposed system arc found. These parameters, together with any changes in cargo capacity required by the system, lead to the determination of the RFR change.

As noted in the previous section, there are two general approaches to minimizing cargo loss. Ile first is to decrease the likelihood that the hull structure will be ruptured as a result of collision or grounding. The second is to reduce the amount of cargo that is lost when a rupture occurs.

Analysis shows that simply increasing the structural strength of a single-skin hull cannot protect it against collision or grounding incidents. Either the amount of energy available is sufficient to penetrate the structure or else the weight of material is too great to leave an economic payload. The double bull is much more efficient in that the added space between the two hull surfaces allows increased energy absorption in the outer skin, and reduces the amount of energy available to penetrate the inner skin. Thus this solution is the only one that affects rupture probability to any significant degree.

The second approach is to reduce the outflow encountered when a hull rupture does occur. Cargo loss takes place through two mechanisms. The first is encountered when the hydrostatic pressure inside the cargo tank is greater than the external pressure. Oil flows out through the rupture until the inside and outside pressures are equal. If the rupture is above the bottom of the tank, the resulting condition, after pressure has equalized, is unstable. Ile lower-density fluid inside is in contact with the higher density fluid outside, and any disturbance will allow the system to a lower-energy state: seawater flows in, and cargo out, through the rupture until all the cargo below the rupture is displaced.

Several alternatives, both passive and active, for spill prevention have been discussed by the industry and are reviewed in the US Coast Guard Notice of Proposed Rulemaking for existing tankers [5]. The passive systems are the following: Double Hull, Double Side, Double Bottom, Mid-Deck, Protectively Located Non-Cargo Tanks (PL/Spaces), Hydrostatic Balance Loading (HBL), Hydrostatic Balance with PL/Spaces, and Segregated Ballast Tanks (SBT). The active systems are the following: Underpressure, Emergency Rapid Transfer System (ERTS), and Emergency Rescue System (ERS).

Double Hull, Double Side and Double Bottom designs do not require much elaboration. Double hull is expected to work because a void space and two layers of steel are more effective than one thick layer. But in many accidents, the energy involved is sufficient to breach any man-made structure.

Mid-Deck - alternatively called Intermediate Oil Tight Deck (IOTD) consists of an oil-tight deck located approximately at the mid-point of the vertical height of the tank. Essentially, the mid-deck halves the depth of the cargo in the holed tank, with the result that the pressure outside the tank is greater than within the tank. The net result would be that there would be an inflow of water in the tank rather an outflow of oil. The mid-deck design with side bull is an excellent candidate for new construction tankers, and based on our probabilistic outflow calculations is superior to double hull configuration, in preventing spillage of oil. Operational and cost issues would have to be resolved. The US Coast Guard is opposed to the mid-deck design as an alternative to double hull.

Protectively Located Non-Cargo Tanks - PL/Spaces: Protectively located non-cargo tanks are required to cover at least 30 percent of the vessels cargo tank length on both sides for its full depth, or at least 30 percent of the projected bottom area of the cargo tank depth.

Hydrostatically Balanced Loading (HBL) - HBL results when the internal pressure head (head due to cargo liquid) is equal to the external pressure head (draft head).

When the external pressure is equal to internal pressure, in the case of a bottom rupture, the net outflow is zero under ideal conditions.

Segregated Ballast Tanks (SBT) - This design was initially required as an operational measure to ensure that oil-contaminated ballast water was not discharged at sea or in port. Subsequent MARPOL requirements mandated the location of segregated ballast tanks so that defined minimum of the bottom shell and side shell was protected from the effects of grounding and collision.

The Underpressure System - This concept is the primary subject matter of the present paper. The system consists of exhaust pumps fitted to the ship's inert, gas system to create and maintain underpressure in the ullage spaces at all times. Electronic sensors and controls maintain the underpressure and inert gas pressure at a safe level.

Emergency Rapid Transfer System (ERTS) - ERTS consists of pipes with blank flanges connecting the cargo tanks to the ballast tanks. When damage to a tank occurs and the cargo level drops, sensors automatically cause the flange bolts to be ruptured. Cargo flows from the damaged tank into the empty ballast tanks by force of gravity.

Emergency Rescue System (ERS) - The ERS is located inside the tank of the vessel. In the event of a grounding or collision, the ERS is designed to contain the oil while the oil is still in the cargo tank. This is accomplished using high flow rate pumps attached to flexible containment bags, which expand and conform to the internal structure of the cargo tank.

The following Table 2 was extracted from the Regulatory Impact Analysis [4] shows Costs & Benefits for existing vessel structural alternatives.

Economically Feasible Conversions				Total Fleet Converted
	Cost ($,000,000)	Benefits(Bbls)	Net Benefits ($,000/Bbl)	Cost ($,000,000)	Benefits (Bbls)	Net Benefits ($,000/Bbl)
PL/Spaces	829	27,889	30	876	46,229	19
SBT	1,640	132,845	12	1,706	137,805	12
HBL	4,027	220,887	18	5,936	268,480	22
PL/Spaces + HBL	5,655	192,990	29	6,645	369,694	18
Double Bottom	1,451	47,452	31	6,163	237,170	26
Double Sides	2,084	(28,008)	(74)	2,948	(113,489)	(26)
ERS + HBL	2,742	278,103	10	3,848	309,023	12
ERS	1,569	199,945	8	1,612	239,824	7
UPS	570	336,585	2	579	360,874	2
ERTS	3,829	330,976	12	3,963	360,434	11
HBL Pre-MARPOL	2,288	163,363	14	4,140	205,607	20

The underpressure system prevents outflow of oil at a rupture in the hull by equalizing the external hydrostatic pressure due to draft with the internal pressure produced by the liquid cargo. The equalization of pressure is achieved by means of slight underpressure (or vacuum) in the ullage space.

In typical tanker loading configurations, a rupture at the tank bottom usually means the hydrostatic pressures at the level of the puncture inside the tank is higher than the surrounding column of water. The application of slight underpressure in the tank ullage effectively equalizes the pressure inside and outside the tanker at the ruptured area. When a rupture occurs, the water displaces the oil up to the top of the ruptured area. If pressure equalization at this point of the rupture is undertaken no further oil spillage occurs.

The hydrostatic pressure differential at the rupture depends on factors such as cargo density, loading conditions, tanker configuration, and the height of the rupture from the tank bottom, and is determined as follows:

A typical tank cross-section is shown in Figure 4 with a grounding rupture such that the distance from the waterline to the top of the rupture is H_e and the height of the contained oil above the top of the rupture is H_i. The ullage space is set to a controlled underpressure P_v. The underpressure is set to balance the pressures internal to and external to the tank at an arbitrary point of rupture. The forces that predominate are the hydrostatic fluid pressures and the ambient and underpressure forces.

External Pressure (P_e) = Atm. Pressure (P_a) + Hydrostatic Water Pressure (D_w x H_e)

Internal Pressure (P_i) = Controlled Ullage Pressure (P_v) + Hydrostatic Oil Pressure (D_o x H_i)

There are cases, such as a partly loaded tanker or a tanker operating with segregated ballast, where the liquid cargo depth is significantly higher than the waterline (draft). In some of these configurations, the underpressure can approach vacuum conditions. In such cases, especially for a partly loaded tanker, it will be necessary to redistribute the cargo load among the various tanks to ensure moderate underpressure requirements. Moderate underpressure requirements of 2 psi are expected for most tanker configurations, with a slight variation in underpressure, if the rupture is not at the bottom of the tanker.

There are three types of underpressure systems: passive, quasi-passive and dynamically-controlled active underpressure.

The passive underpressure system assumes that all openings from the ullage space to atmosphere are closed and air tight. In the event of rupture, the underpressure is developed by allowing cargo loss to continue until it creates its own underpressure to achieve a balance of hydrostatic forces at the rupture location. Ultimately, the underpressure created in this manner prevents further outflow. However, there are drawbacks with this system:

3. It may be difficult to maintaining the required inert condition in the ullage space.

The quasi-passive underpressure system augments the passive system by sensing the existence of a rupture and using this signal to start a pump to speed up the creation of ullage space underpressure. Its effectiveness depends on the time constant of the auxiliary pumpdown system and on the rate of cargo loss through the hull rupture. Its capability is essentially the same as that of the passive system if the pumpdown system is of low capacity and/or the rupture is very severe. It approaches the effectiveness of the active underpressure system when the pumpdown system is large or the cargo loss rate is very low.

The dynamically controlled active underpressure system is an active, inert gas, pressure-controlled system. The underpressure is preset or controlled to a value determined by accident risk, pumping capacity, actual or potential damage or other criterion. The control logic is as follows: The minimum required underpressure is determined by calculation assuming hull rupture at the lowest point of the tank; the maximum required underpressure is determined assuming hull rupture at the waterline. For older ships retrofitted with the underpressure system, there may be a structural pressure limit determined after vessel survey and design calculations. The actual underpressure used at any time is preset, adjusted from the bridge or controlled automatically having regard for the following factors:

An Integrated Block Diagram of the Inert Gas (I.G.) system combined with the AUPS system is shown in Figure 5. The existing I.G. system will essentially remain unchanged both in functionality as a positive pressure system, as well as in its hardware design. For retrofit installations, the condition and reliability of the existing I.G. Systems will be checked and enhanced if necessary. Changes in P/V valve settings will be needed to accommodate the underpressure suitable to each vessel.

The AUPS system consists of exhaust blowers with isolation and control valves providing access to the main inert gas system distribution lines downstream of the inert gas system deck seal/non-return valves. The major additions are the blowers, an improved set of pressure sensors and a control system that monitors the status of individual tank conditions. Pressure, oxygen concentration, hydrocarbon concentration and cargo levels are instrumented. This continuous readout requires a data handling distribution subsystem utilizing the information from the tank sensors and the supporting machinery for automatic control of the system. The inert gas system controls are integrated with the AUPS system to accomplish single-panel control.

The system lends itself to a simple retrofit to existing tankers, normally utilizing the inert gas system already installed. The inert gas mixture in the ullage space is maintained in accordance with the IMO standards at all times -notwithstanding air leakage problems specifically associated with negative pressures. The system in conjunction with the existing inert gas system can be used as the primary oil containment device or as a supplement to other approaches such as the double hull. It provides instant corrective action when an accident occurs, because the underpressure is set at the start of the voyage or from time to time, and avoids the time delay resulting from human evaluation time and machinery start-up.

The use of a sub-atmospheric pressure above the cargo introduces special design issues. These are discussed in the following paragraphs.

Structural Integrity Under Reduced Tank Pressure The effects of negative tank pressure on the hull structure has been studied by Professor A.E. Mansour, of the University of California, Berkeley. The study concluded that for most hull structures the resulting stresses arc within allowable limits, from 60 to 70 percent of yield. The general conclusion of the study was that the introduction of a vacuum six psi would result in an increase in the stress level in the lank structure of less than eight percent. This calculation can be carried out for any given hull configuration during the initial installation workup.

The technical prerequisite with regard to the vapor pressure of different oil qualities is to ensure that the oil be a compressed liquid at all times. This means a liquid under an externally imposed pressure that exceeds the saturated vapor pressure corresponding to the temperature of the oil. About 35 percent of all oil products, those constituting the principal content of crude oil, have vapor pressures below seven psia, so this requires that the underpressure not exceed seven psia. Such a large underpressure is not expected as a requirement with the active system.

We have conducted model tests with oil with known vapor pressure; when subjected to negative pressure higher than the vapor pressure of the liquid, we find no evidence of 'boil-off". However, it is certain that there some low level evaporation will occur.

There are three potentially hazardous operations that involve replacement of gas in cargo tanks.

Initial Inerting and Subsequent Application of Underpressure: Tanks must be inerted prior to cargo loading or when tanks contain cargo residues or ballast. The existing inert gas system presently performs this function by introducing inert gas until an oxygen content less than eight percent by volume is achieved. The tanks are then marginally pressurized (less than 0. 14 psi) above ambient and then loaded. Prior to the loaded passage a check is made of inherent gas leakage and, if it is satisfactory the AUPS system is activated to reduce the gas pressure to its predetermined value based on cargo loading, cargo density and draft (usually < 2 psi). This pressure is maintained throughout the voyage with topping operations performed as required.

Gas Freeing Operations: Gas freeing of cargo tanks is performed when tank cleaning or repairs arc necessary. Fresh air is introduced into the tank to displace toxic, flammable and inert gases until the oxygen content is near 21 percent by volume and the hydrocarbon content is less than one percent by volume. This ensures the hydrocarbon content is insufficient to support combustion. The existing inert gas system handles this function, isolating the tanks, purging with inert gas to a level less than two percent by volume, and only then introducing air until the oxygen content reaches 21 percent by volume, and hydrocarbon one percent by volume. The AUPS system is totally isolated during these phases of operation and does not introduce any risk.

Tank Gas Leakage During the Voyage: The cargo tanks have various cut-outs to which ancillary equipment arc attached, and these assemblies are leakage candidates. The AUPS system maintains underpressure during the voyage that enhances the entry of outside air into the tanks. Currently, slow leakage is accommodated by topping with inert gas to maintain a positive pressure above ambient and prevent the ingress of oxygen into the tanks. The AUPS will meet this concern by implementing more exacting leak specifications on all susceptible assemblies, requiring constant (electronic) monitoring of tank pressure levels as a primary leak detection measurement as well as the oxygen content of the ullage gases. In addition, more frequent topping operations will be performed with the AUPS system and inert gas system deployed. The inert gas system will raise the pressure (say 1/2 psi) and the AUPS will then exhaust it down to its nominal underpressure requirement. This periodic purging will insure the gas mixtures remain free and out of the range of flammability. The inert gas controlled AUPS maintains at all times, the oxygen content of a tank at about six percent (far less than the 11.5 percent limit) to avoid flammability zones and prevent explosion. Figure 6.

The American Underpressure System utilizes the existing Inert Gas system in its intact configuration and functions. The positive pressure function of the existing I.G. system remains unchanged. The underpressure system simply adds a modular system to draw down the inerted ullage gas mixture to a predetermined underpressure level, and maintains the underpressure using a simple control system. Thus a major portion of the underpressure system is already present in existing ships. Some current inert gas systems lack redundant functionality, and may be upgraded as part of the underpressure system installation. Further investigation to establish reliability baselines is needed in this area as the current systems are often not tracked for failure history.

The underpressure system is an active system, that is, it functions through the operation of components such as valves, fans and controls. In designing the system for seagoing service, consideration must be given to the reliability of the system so that its ability to control cargo loss is not impaired. This objective is achieved through three mechanisms, (1) the selection of high reliability components, (2) the use of parallel redundancy for key components and (3) the inherent ability of the system to function in degraded modes of operation.

The first element of the design that contributes to system reliability is the use of high-reliability components. The key elements of the system are selected for their ability to operate for extended periods under adverse conditions. Failure modes data and reliability estimates are not as readily available for mechanical components as they are for electrical/electronic components. Moreover, the mechanisms of failure and the distribution of failures over time are different. Initial estimates of component reliability have been based principally on Non-electronic Parts Reliability Data (NPRD-3), a publication of the Reliability Analysis Center of the United States Department of Defense [6]. This database presents experienced failure rates for mechanical components under a variety of environmental conditions. The condition adopted for the reliability analysis is the NS, or ship sheltered environment typical of military vessels. The failure model used for the analysis of the system is the exponential, or uniform failure rate, model developed originally for electronic components. This model applies reasonably well to many mechanical design elements so long as they are operating within their recommended life. For structural elements and certain other components, such as bearings, there is an extensive literature and a number of more sophisticated formats for determining reliability.

This generic data is being used to develop preliminary reliability estimates and to prepare a reliability allocation. The budget will be tracked as the design proceeds, and performance and reliability specifications can be prepared. Finally, selection is made from components having demonstrated levels of reliability.

The reliability data, especially for mechanical components, represents only an approximate estimate of actual capability, and there will always be some uncertainty in the reliability estimating and budgeting process. For this reason, a second design mechanism, redundancy, is emphasized in the design concept in order to provide an additional margin. Redundancy is achieved by providing two or more elements capable of accomplishing a given part of the system capability. Sizing is chosen so that only one needs to be operating in order to achieve the intended operation of the system.

Alternatively, standby redundancy may be provided by spare units that can be substituted for operational units within an acceptable time frame. The baseline design for the underpressure system affords at least two-element redundancy for all components except structural and ducting functions. Since the critical electronic components are relatively inexpensive, critical online capabilities utilize the error detection/correction capability provided by a three-element design with voting logic.

The third element of system reliability is the capacity of the system to sustain component failure without losing its ability to control cargo loss. The system comprises three major component groups: the fans and their power supply system, the sensors and controls needed to control fan pressure, and the valving which controls the distribution of the sub-atmospheric pressure to the tanks. In normal operation, pressure is set for at some point' between the required value for grounding and the required value for a waterline rupture. The design provides that in the event that a loss is detected in the control system, the fan pressure will remain fixed at its intended level. This mode of operation is available even if all redundant sensors and control media are lost, providing that the self-test feature is able to identify the loss. In this degraded mode, there will be some added cargo loss if the incident only involves collision damage at a point well above the baseline, but the essential integrity of the system remains intact. Alternatively, a detected loss of all control function can be caused to initiate maximum underpressure. In this case, there is no added loss of cargo, but the system could be operating at a higher power level than normally necessary.

An additional degraded mode is available. This mode would be resorted to in the event of total fan loss coupled with an inability to cross-connect underpressure from a parallel system. In this unlikely event, the tank would be disconnected from ducting and fans and would thus be converted to a passive underpressure system of the sort discussed at the beginning of this section. This second-level-degraded system must allow some loss of cargo in order to function, but still affords a margin of loss control.

Major cost categories and their percentages are shown below in Table 3. A cost estimate for the installation of the underpressure system on five tankers is shown in Table 4. It is estimated that the cost of retrofitting the American Underpressure System to an existing tanker varies from 1% to 1.5% of the new construction (US) cost. Retrofitting cost of a double hull is about 35 % to 40 % of the new cost of a tanker. The average installation cost for retrofitting the underpressure system is approximately one week; retrofitting time for a double hull on an existing tanker is approximately 6 months to one year.

The proposed rulemaking does not define objective standards under which candidate oil spill prevention systems can be qualified. It is impossible to determine from the current rulemaking what an acceptable system has to accomplish or how its capability is to be evaluated by analysis or confirmed by test. The judgements rendered in connection with the systems investigated under the rulemaking analysis consist of subjective descriptions.

It is clear from the wording of OPA 90 that the legislative intent was to encourage the development of innovative and cost-effective approaches to the oil spill problem. The choice of the double hull design offered a reasonable effective solution to the current problem and represented a logical and functionally acceptable starting point for further research and development. R & D efforts, however, require two key elements in order to have a reasonable chance of success. The first is a set of quantitative objectives that the effort is supposed to meet; without goals, the management of a practical development effort is impossible. The second is the funding necessary to support the effort. But funding for a project that lacks well-defined goals is very hard to find. From both standpoints, the rulemaking process should, insofar as possible, define a framework for development.

There is a further difficulty that will result from a non-quantitative specification for a system having the enormous economic consequences that this one has. That difficulty is politics. Let us suppose, for the sake of argument, that the double hull design is approved as the sole means of importing crude into the United States. Suppose further that expenditures of hundreds of millions of dollars are made to create a fleet of such vessels. Finally, suppose that after this expenditure is made a new concept having twice the effectiveness and half the cost is discovered. Can anyone reasonably suppose that the evaluation of this new concept can be made fairly and impartially by attaching descriptive adjectives to it? Decisions lacking an objective basis will be made on an arbitrary basis.

We recommend that the rulemaking be revised to define more objective standards under which potential systems can be evaluated. We recognize that these standards will not be easy to formulate. But surely a society that can establish and meet specifications for a space shuttle is capable of defining what it wants an oil tanker to do. The paper suggests that effectiveness scenarios and probabilistic evaluation criteria can be developed to define those aspects of an acceptable system that are difficult to define using normal specification formats.

[3] National Research Council, Committee on Tank Vessel Design, Tanker Spills: Prevention by Design, February 12, 1991

[4) Regulatory Impact Analysis of Structural and Operational Measures for Existing Tank Vessels: Mercer Management Consulting, Inc. and George G. Sharp, Inc., January 1994.

[5] Notice of Proposed Rulemaking: Structural and Operational Measures to Reduce Oil Spills from Existing Tank Vessels Without Double Hulls

[6] Non-electronic Parts Reliability Data (NPRD-3): Reliability Analysis Center US Department of Defense