SOCIETY OF NAVAL ARCHITECTS AND MARINE ENGINEERS
New York Metropolitan Section 601 Pavonia Avenue, Jersey City,
Paper presented at the 1994 Ship Operations,
Management and Economics Symposium at the U.S. Merchant Marine
Academy. Kings Point, NY. May 12, 1994
An Oil Spill Prevention
System for Tankers - The Underpressure System
Roger G. Brow, Visitor Techmatics, Inc.,
Mo Husain, Visitor
Charles Quirmbach, Visitor MH Systems, Inc., Del Mar, CA
OIL POLLUTION ACT OF 1990
CONTROL SYSTEM CRITERIA
This paper provides
a brief review of the background and purpose of the Oil Pollution
Act of 1990, with emphasis on Title IV, Subtitle A, Prevention.
This section of the legislation has reached the rulemaking
stage, and comments are being accumulated. 
The proposed rulemaking
fails to define in specific quantitative terms what the oil
spill prevention systems covered by the legislation will have
to accomplish in order to be approved for service. The review
of candidate systems attaches subjective descriptions to each
but offers no guidance as to how they can be modified to merit
approval. Only two approaches, the double-hull and a system
of reduced cargo loading, will be allowed. Others seeking
approval, including innovative concepts as yet undiscovered,
cannot be evaluated impartially because there is no objective
basis for evaluation.
There are suggested approaches
under which effectiveness scenarios and probabilistic evaluation
criteria can be developed as a basis for evaluating candidate
systems in quantitative terms.
The American Underpressure System,
one of the numerous systems discussed in the proposed rulemaking,
is described in some detail. It was identified in the Regulatory
Impact Analysis commissioned by the Coast Guard as the most
cost-effective approach to the tanker oil spill problem which
OPA 90 seeks to eliminate. The concept discussed uses a sub-atmospheric
pressure above the cargo as a means of reducing or preventing
loss of cargo due to accidental rupture of a tanker hull.
The concept uses active underpressure control in the inerted
ullage space of the cargo tank. The principal design features
of the American Underpressure System are discussed.
Oil Pollution-Sources and Remedies
Oil released to
the environment due to all kinds of tanker accidents, including
collision, grounding, fire and explosion, structural failure
and terrorist attack accounts for about twelve percent of
total pollution. The remainder is due largely to leakage,
faulty equipment and procedural error. Losses attributable
to grounding and collision, the primary focus of this paper,
account for only about three percent of the total. When grounding
and collision events occur, however, the effects are concentrated
in a limited area and within a limited time period, and can
be devastating to the affected environment. Figure
1 and Table I show selected statistics of oil spillage
and accident statistics .
Table 1 Percentage of Oil Released
to The Environment
|Tanker Operational Discharges
|Other (i.e., natural seepage)
The grounding of the
EXXON VALDEZ is the most recent major incident in U.S. waters.
Despite its widespread effects in the immediate area, its
unprecedented cleanup cost and its extensive and dramatic
press coverage, it is only the tenth largest spill in the
historical record. Even more catastrophic events can be expected
unless appropriate preventive measures are taken. These measures
include both improved design of ships and shipboard equipment
and more effective operational procedures.
The United States Congress
has been considering oil spill legislation for fifteen years
or more. These investigations led to the passage of the Oil
Pollution Act of 1990 (OPA 90), a comprehensive law which
addresses the key engineering, operational and legal issues
involved in oil spill prevention. Similar efforts have been
undertaken at the international level under the auspices of
the International Maritime Organization.
OPA 90 defines objectives
and establishes a framework within which detailed implementation
can take place. That implementation is now being carried out.
The potential social benefits to be achieved are high; the
potential social costs are high, too. The detailed implementation
of OPA 90 will determine both benefits and costs and will
have far-reaching effects on our petroleum-based economy.
Inevitably, a major redirection of this kind gives rise to
conflicting views. In the present case, environmental concern
demands that the designated system and procedures shall be
effective in preventing cargo loss; regulatory officials must
have regulations that can be conveniently and effectively
enforced, oil consumers, and the economy as a whole, require
that the cost of implementing them be as low as possible.
Finally, the potential suppliers of ships and equipment desire
to maximize financial return. The implementation process must
reconcile these conflicting views to develop an optimum solution.
In this paper we are
concerned with the prevention (by tanker design) sections
of OPA 90. We hope to achieve two objectives. The first is
to advocate a redefinition of the rulemaking process so that
it establishes what the oil spill prevention system has to
accomplish rather than what kind of system it has to be. Adoption
of this approach would assure that any selected system would
achieve specific quantitative objectives. It would also assure
that all-eligible systems are fairly considered on the merits.
Our second objective
is to advocate one specific alternative, of the many that
should be considered, which we believe to be a cost-effective
solution to the oil spill problem. The system uses a reduced
pressure applied above the cargo, to reduce the losses experienced
as a result of collision or grounding.
OPA 90 is an all-encompassing
and comprehensive law, approved after extensive study and
intense debate. It defines stringent requirements for oil
spill liability and accountability, tanker design and construction
and manning and licensing requirements. The law also establishes
a billion-dollar federal trust fund for cleanup and damages.
Nine -area are covered by the law:
Title I Oil Pollution Liability and Compensation
Title II Conforming Amendments
Title III International Oil Pollution
Prevention and Removal
Title IV Prevention and Removal
Title V Prince William Sound Provisions
Title VI Miscellaneous
Title VII Oil Pollution Research and Development
Title VIII Trans-Alaska Pipeline System
Title IX Amendments to the Oil Spill Liability
The focus of this paper
is Title IV - Prevention and Removal, in particular Subtitle
A - Prevention. Section 4115 establishes the baseline requirement
as the double-hull tanker configuration, or the equivalent
in capability, and sets up a retirement schedule for existing
tankers that do not need the mandated requirements. The Secretary
of Transportation is assigned the responsibility of determining
if there is any equivalent alternative to the double hull.
It is the responsibility of the United States Coast Guard
to translate the intent of OPA 90 into rulemaking.
The National Academy
of Sciences or other qualified organizations may be utilized
to provide technical support for these decisions. These tasks
must be completed in five years .
The rulemaking process
requires a series of steps in implementing the Federal Law.
They include Regulatory Impact Analyses (RIA), Advanced Notices
of Proposed Rulemaking (ANPRM) and Notices of Proposed Rulemaking
(NPRM). As of this writing, a study has been completed by
the National Academy of Sciences [31 and the RIA has been
completed . The rulemaking itself is divided into one section
on new ships and a second section on interim measures for
existing ships. The ANPRM and NPRM for new ships have been
completed. The NPRM covering requirements for existing ships
has been released and comments solicited. With respect to
new buildings, the NPRM essentially specifies the double hull,
not only as the standard of effectiveness, but also as the
sole technical solution that will be allowed.
The ANPRM for existing
tankers takes up a number of alternative approaches to oil
spill prevention and provides a brief discussion of each.
The double hull is found acceptable (but not required) if
in conformance to a specified design standard. A concept identified
as "PL/Spaces", which consists of operating the
vessel at reduced loading in order to reduce the amount of
cargo at risk in the event of collision or grounding by protectively
locating non-cargo tanks, is found to be conditionally acceptable.
Concepts such as hydrostatic Balance Loading (HBL), segregated
Ballast Tanks (SBT), Double Sides, and Double Bottoms all
operating at a loss of cargo carrying capacity arc also acceptable.
All of the other concepts are identified as ineffective, unproven,
complex or costly. Although each may be considered for approval
in the future, there are no quantitative standards against
which criteria such as effectiveness, complexity or cost can
be evaluated. And there are no defined procedures under which
a proposed concept can be proven.
To be acceptable in the context
of OPA 90, a candidate oil spill prevention concept must be
effective, and its effectiveness must be demonstrated by experience,
test or acceptable analysis. In should also be economical,
insofar as possible, so that its impact on national economic
welfare and competitiveness is minimized. As these terms are
merely descriptive adjectives, they should be defined, as
part of the rulemaking process with care and precision.
Elements of Effectiveness
A system is effective
if does what it is intended to do. The standard of effectiveness
adopted by OPA 90 is the double hull design. It was identified
as a standard because it is known to be capable of significantly
reducing the likelihood that a collision or grounding event
will rupture the hull boundary and allow cargo outflow. It
is not, and was never claimed to be, a sure means of preventing
cargo loss under all circumstances. It follows that its effectiveness,
as well as the effectiveness of any other system, must be
defined in probabilistic terms. Since none of the systems
considered is perfect, effectiveness is essentially a probability
statement and is so treated in the Regulatory Impact Analysis
Report commissioned by the Coast Guard. The system is deemed
effective" to the extent that significant cargo loss
in collision or grounding is rendered highly unlikely.
essentially of three components: (1) a low probability that
a given damage incident penetrates the hull; (2) a small expected
loss of cargo if penetration does occur; and (3) a high probability
that all the elements of the system operate satisfactorily.
The double-hull is
effective because the probability of penetration is minimized
by interposing a ballast/void space. Limited historical data
suggest that the likelihood of penetration is reduced by perhaps
80 percent in grounding incidents and 50 percent in collision
incidents. In addition, it is a passive system, involving
no machinery, and can be expected to operate reliably. Thus,
factors (1) and (3) are highly favorable. Factor (2), however,
is no more favorable than in conventional tankers because
the primarily hydrostatic mechanism of cargo loss is the same.
Altogether the combined effect of these three factors yields
an "effective" containment system.
to be discussed later in this report, address primarily the
second factor defined above, the mechanism of cargo loss.
They do so by arranging cargo more advantageously, by providing
rescue tanks, or by provisions which reduce hydrostatic outflow
forces. In general, these alternative systems contribute little
to factor (1), the resistance of the hull to penetration.
However, they may be equal or superior to the double hull
in overall effectiveness. The Regulatory Impact Analysis shows
this quite clearly.
There remains the question
of system reliability, the third factor defined above. This
is the factor that the NPRM is trying to address when it uses
the word "complex." It is certainly true that added
system complexity, in the form of valves, transfer lines or
pumps, can have an adverse effect on reliability; if these
elements fail, and if redundant components are not provided,
then the objective of the system may be defeated. Equally,
however, some degree of complexity may have to be accepted
in modem systems in order to achieve effectiveness and economy.
Otherwise the "effective" abacus would have prevailed
over the "complex" computer chip; apart from economic
considerations, they accomplish the same results. It is the
system designers job to balance reliability and other
factors to achieve the desired overall effectiveness. The
complexity of modem systems such as air traffic control has
created a specific discipline, Reliability Engineering, whose
objective is to integrate this essential element into the
A Measure of Effectiveness
The occurrence of collision
and grounding events as well as the damage and cargo loss
mechanisms, is essentially the product of random phenomena.
We believe that under these circumstances the best measure
of effectiveness for a candidate system is the expected, or
average, outflow experienced per incident. An alternative
measure, the probability of zero outflow, has been used but
is considered less appropriate. The difference may be seen
by comparing an investment strategy based on average return
against one based on the most optimistic possible return.
The expected loss is
calculated using a probability tree [Figure 2] involving a sequence
of possible outcomes. The following discussion refers to a
single tank, and the expected total loss is the sum of the
expected losses for all the cargo tanks.
For a single incident,
the probabilities of grounding or collision may be designated
T and Te, respectively. These quantities are important
only in their relative values so as to properly weight the
capabilities of the design in each type of incident. If these
quantities add up to one, the result of the outflow calculation
is on a "per incident" bases without regard to incidents
other than grounding or collision, for example, fire. Reviews
of accident statistics suggest that collisions account for
about 40 percent of accident events and grounding for the
remaining 60 percent.
Another component of
the calculation is the hit probability for the tank in question.
For a grounding incident, the hit location may be assumed
to be equiprobable over the bottom area of the hull, therefore
the hit probability, Pt. is the effective horizontal area
of the tank divided by the total bottom area. Similarly, collision
hits are assumed equiprobable over the area of the two sides
of the vessel, so the hit probability, Pe, is the
area of the tank in the profile view divided by the total
side area of the ship. In either case, of course, these probabilities
apply only when the tank is adjacent either to the bottom
or the side otherwise the penetration of damage may be assumed
to be limited to external tanks and therefore the probabilities
Pg and Pc arc zero for interior tanks.
For either grounding
or collision, there is a probability that a tank, if involved
in the incident, will actually be ruptured. This factor, designated
either Bg or Bc, defines the resistance
of the design to damage given that a hit has occurred. For
example, it reflects- the difference between conventional
and double-hull designs. Operational experience indicates
that the double-hull provides protection against rupture in
about 50 percent of collision incidents and that the double
bottom provides protection in about 80 percent of grounding
An additional factor
in the calculation is the relative size of the tank, Lge,
expressed as a fraction of total cargo volume. This factor
assures that the vulnerability of the tank is weighted by
its size; the expected total cargo outflow is thus expressed
as a fraction of total cargo.
The calculation for
each tank must also reflect the expected outflow from the
tank as determined from hydrostatic principles. Expected losses
are designated Eg and Ec. for the grounding
and collision cases. The loss mechanisms are primarily hydrostatic
although secondary phenomena, such as tidal effects, entrainment
losses and ship list and trim may be included in the analysis
as data permits.
In summary, the expected
cargo loss for a given tank in a grounding incident, given
that an incident of some kind has occurred, is the product
of the following factors:
Tg, the probability that the incident is a grounding;
Pg, the probability that a tank adjacent to the
bottom is hit;
Bg., the probability of rupture of a bottom tank;
L, the amount of cargo at risk in the tank;
Eg, the expected fraction of tank contents that
and for a collision incident, the expected
loss is the product of:
Tc, the probability that the incident is a collision;
Pc, the probability that a tank adjacent to the
side is hit;
Bc, the probability of rupture of a side tank;
L, the amount of cargo at risk in the tank;
Ec, the expected fraction of tank contents that
Finally, the reliability
of the specific system must be factored into the calculation.
This effect is determined by conducting the foregoing calculation
first, with the system operative and second, with the system
in the failed state. These two outcomes are weighted by the
estimated system reliability. For essentially passive system,
such as the double hull and the mid-deck, the system reliability
is essentially 1.0.
This simple model can
be programmed very easily and adapted as necessary to reflect
new data or improved probability representations for the phenomena
and components involved. The Probabilistic Estimate of Average
Loss Reduction for a national tanker of 280,000 dwt is shown
The most effective
demonstration of effectiveness is the historical record; accident
data, properly interpreted, afford a solid basis for evaluating
a given system. Unfortunately (or better, fortunately) significant
collision or grounding events are rare. Limited data exist,
but the statistical significance is very low. The conclusions
that may be drawn are useful, but not conclusive. Of the measures
considered, the double hull possesses a reasonably adequate
history. As noted previously, it has demonstrated a decrease
of 50 to 80 percent in the probability of tank rupture.
The alternative to
actual experience is an analysis under simplified assumptions.
For instance, with regard to rupture probability, calculations
involving impact energy and a simplified structural model
have given interesting results. Apart from questions of the
purely technical legitimacy of such analyses, a critical problem
arises when it becomes necessary to assume the expected population
of collision or grounding events. Again, there are limited
data available, but its limited scope makes analysis results
highly dependent on the underlying assumptions. For example,
if all collisions arc assumed to occur at very high speed
on a 90-degree relative bearing, then the double hull is nearly
valueless. But for very low speed events it is probably more
effective than available statistics indicate.
Despite these difficulties,
we believe that it is better to establish approximate collision
or grounding accident scenarios as a means of evaluating candidate
systems than to simply assign the descriptors, "proven"
or "unproven" on the basis of subjective judgement.
Furthermore, the key* elements of some systems may be demonstrable
in planned full-scale, or even model-scale, experiments.
The economic impact
of a competing system is probably best expressed by evaluating
the change in required freight rate (RFR) necessitated by
the addition of the proposed system.
Development and startup, costs are amortized over the expected
number of units to be produced. Ship construction, operation
and maintenance costs are determined or, alternatively, the
changes in these factors attributable to the proposed system
arc found. These parameters, together with any changes in
cargo capacity required by the system, lead to the determination
of the RFR change.
As noted in the previous
section, there are two general approaches to minimizing cargo
loss. Ile first is to decrease the likelihood that the hull
structure will be ruptured as a result of collision or grounding.
The second is to reduce the amount of cargo that is lost when
a rupture occurs.
Analysis shows that
simply increasing the structural strength of a single-skin
hull cannot protect it against collision or grounding incidents.
Either the amount of energy available is sufficient to penetrate
the structure or else the weight of material is too great
to leave an economic payload. The double bull is much more
efficient in that the added space between the two hull surfaces
allows increased energy absorption in the outer skin, and
reduces the amount of energy available to penetrate the inner
skin. Thus this solution is the only one that affects rupture
probability to any significant degree.
The second approach
is to reduce the outflow encountered when a hull rupture does
occur. Cargo loss takes place through two mechanisms. The
first is encountered when the hydrostatic pressure inside
the cargo tank is greater than the external pressure. Oil
flows out through the rupture until the inside and outside
pressures are equal. If the rupture is above the bottom of
the tank, the resulting condition, after pressure has equalized,
is unstable. Ile lower-density fluid inside is in contact
with the higher density fluid outside, and any disturbance
will allow the system to a lower-energy state: seawater flows
in, and cargo out, through the rupture until all the cargo
below the rupture is displaced.
both passive and active, for spill prevention have been discussed
by the industry and are reviewed in the US Coast Guard Notice
of Proposed Rulemaking for existing tankers . The passive
systems are the following: Double Hull, Double Side, Double
Bottom, Mid-Deck, Protectively Located Non-Cargo Tanks (PL/Spaces),
Hydrostatic Balance Loading (HBL), Hydrostatic Balance with
PL/Spaces, and Segregated Ballast Tanks (SBT). The active
systems are the following: Underpressure, Emergency Rapid
Transfer System (ERTS), and Emergency Rescue System (ERS).
Double Hull, Double
Side and Double Bottom designs do not require much elaboration.
Double hull is expected to work because a void space and two
layers of steel are more effective than one thick layer. But
in many accidents, the energy involved is sufficient to breach
any man-made structure.
Mid-Deck - alternatively
called Intermediate Oil Tight Deck (IOTD) consists of an oil-tight
deck located approximately at the mid-point of the vertical
height of the tank. Essentially, the mid-deck halves the depth
of the cargo in the holed tank, with the result that the pressure
outside the tank is greater than within the tank. The net
result would be that there would be an inflow of water in
the tank rather an outflow of oil. The mid-deck design with
side bull is an excellent candidate for new construction tankers,
and based on our probabilistic outflow calculations is superior
to double hull configuration, in preventing spillage of oil.
Operational and cost issues would have to be resolved. The
US Coast Guard is opposed to the mid-deck design as an alternative
to double hull.
Non-Cargo Tanks - PL/Spaces: Protectively located non-cargo
tanks are required to cover at least 30 percent of the vessels
cargo tank length on both sides for its full depth, or at
least 30 percent of the projected bottom area of the cargo
Loading (HBL) - HBL results when the internal pressure head
(head due to cargo liquid) is equal to the external pressure
head (draft head).
When the external pressure
is equal to internal pressure, in the case of a bottom rupture,
the net outflow is zero under ideal conditions.
Tanks (SBT) - This design was initially required as an operational
measure to ensure that oil-contaminated ballast water was
not discharged at sea or in port. Subsequent MARPOL requirements
mandated the location of segregated ballast tanks so that
defined minimum of the bottom shell and side shell was protected
from the effects of grounding and collision.
The Underpressure System
- This concept is the primary subject matter of the present
paper. The system consists of exhaust pumps fitted to the
ship's inert, gas system to create and maintain underpressure
in the ullage spaces at all times. Electronic sensors and
controls maintain the underpressure and inert gas pressure
at a safe level.
Emergency Rapid Transfer
System (ERTS) - ERTS consists of pipes with blank flanges
connecting the cargo tanks to the ballast tanks. When damage
to a tank occurs and the cargo level drops, sensors automatically
cause the flange bolts to be ruptured. Cargo flows from the
damaged tank into the empty ballast tanks by force of gravity.
Emergency Rescue System
(ERS) - The ERS is located inside the tank of the vessel.
In the event of a grounding or collision, the ERS is designed
to contain the oil while the oil is still in the cargo tank.
This is accomplished using high flow rate pumps attached to
flexible containment bags, which expand and conform to the
internal structure of the cargo tank.
The following Table
2 was extracted from the Regulatory Impact Analysis  shows
Costs & Benefits for existing vessel structural alternatives.
Table 2: Benefits and
Costs for Existing Vessel Structural Design Alternatives
Economically Feasible Conversions
Total Fleet Converted
|ERS + HBL
The underpressure system
prevents outflow of oil at a rupture in the hull by equalizing
the external hydrostatic pressure due to draft with the internal
pressure produced by the liquid cargo. The equalization of
pressure is achieved by means of slight underpressure (or
vacuum) in the ullage space.
In typical tanker loading
configurations, a rupture at the tank bottom usually means
the hydrostatic pressures at the level of the puncture inside
the tank is higher than the surrounding column of water. The
application of slight underpressure in the tank ullage effectively
equalizes the pressure inside and outside the tanker at the
ruptured area. When a rupture occurs, the water displaces
the oil up to the top of the ruptured area. If pressure equalization
at this point of the rupture is undertaken no further oil
The hydrostatic pressure
differential at the rupture depends on factors such as cargo
density, loading conditions, tanker configuration, and the
height of the rupture from the tank bottom, and is determined
A typical tank cross-section
is shown in Figure 4 with a grounding
rupture such that the distance from the waterline to the top
of the rupture is He and the height of the contained
oil above the top of the rupture is Hi. The ullage
space is set to a controlled underpressure Pv.
The underpressure is set to balance the pressures internal
to and external to the tank at an arbitrary point of rupture.
The forces that predominate are the hydrostatic fluid pressures
and the ambient and underpressure forces.
External Pressure (Pe)
= Atm. Pressure (Pa) + Hydrostatic Water Pressure
(Dw x He)
Internal Pressure (Pi)
= Controlled Ullage Pressure (Pv) + Hydrostatic
Oil Pressure (Do x Hi)
Dw and Do are the
densities of water and oil, respectively.
For Equilibrium, we must have:
Pe - Pi = 0
Pv = Pa + Dw
x He = Do x Hi
In a typical case:
He = 30 ft; Hi = 40 ft.
Dw = Density of Water =
64 lb/ft3 D.
Do = Density of Oil 57
Pa = Atm. pressure 14.7
Pv =14.7 x 144 + 64 x 30
- 57 x 40 = 1757 (psf) or 12.2 psia
And the underpressure is:
Pa - Pv = 14.7
- 12.2 = 2.5 psia
There are cases, such
as a partly loaded tanker or a tanker operating with segregated
ballast, where the liquid cargo depth is significantly higher
than the waterline (draft). In some of these configurations,
the underpressure can approach vacuum conditions. In such
cases, especially for a partly loaded tanker, it will be necessary
to redistribute the cargo load among the various tanks to
ensure moderate underpressure requirements. Moderate underpressure
requirements of 2 psi are expected for most tanker configurations,
with a slight variation in underpressure, if the rupture is
not at the bottom of the tanker.
Underpressure System Options
There are three types
of underpressure systems: passive, quasi-passive and dynamically-controlled
The passive underpressure
system assumes that all openings from the ullage space to
atmosphere are closed and air tight. In the event of rupture,
the underpressure is developed by allowing cargo loss to continue
until it creates its own underpressure to achieve a balance
of hydrostatic forces at the rupture location. Ultimately,
the underpressure created in this manner prevents further
outflow. However, there are drawbacks with this system:
1. A certain amount of initial loss will always occur.
2. Total air-tightness is difficult to achieve.
3. It may be difficult to maintaining the required inert condition
in the ullage space.
The quasi-passive underpressure
system augments the passive system by sensing the existence
of a rupture and using this signal to start a pump to speed
up the creation of ullage space underpressure. Its effectiveness
depends on the time constant of the auxiliary pumpdown system
and on the rate of cargo loss through the hull rupture. Its
capability is essentially the same as that of the passive
system if the pumpdown system is of low capacity and/or the
rupture is very severe. It approaches the effectiveness of
the active underpressure system when the pumpdown system is
large or the cargo loss rate is very low.
The dynamically controlled
active underpressure system is an active, inert gas, pressure-controlled
system. The underpressure is preset or controlled to a value
determined by accident risk, pumping capacity, actual or potential
damage or other criterion. The control logic is as follows:
The minimum required underpressure is determined by calculation
assuming hull rupture at the lowest point of the tank; the
maximum required underpressure is determined assuming hull
rupture at the waterline. For older ships retrofitted with
the underpressure system, there may be a structural pressure
limit determined after vessel survey and design calculations.
The actual underpressure used at any time is preset, adjusted
from the bridge or controlled automatically having regard
for the following factors:
- The maximum underpressure is the safest
condition and imposes little penalty except for minor increases
in operating power and/or vapor loss.
- A higher level of protection can be
set when maneuvering in close quarters or near shallow-water
areas, a lower level when operating in the open sea.
- The addition of suitable instrumentation
will allow the pressure to be set to correspond with the
apparent level of damage. This feature is not essential
to the operation of the system.
Active Underpressure System Description
An Integrated Block
Diagram of the Inert Gas (I.G.) system combined with the AUPS
system is shown in Figure
5. The existing I.G. system will essentially remain unchanged
both in functionality as a positive pressure system, as well
as in its hardware design. For retrofit installations, the
condition and reliability of the existing I.G. Systems will
be checked and enhanced if necessary. Changes in P/V valve
settings will be needed to accommodate the underpressure suitable
to each vessel.
The AUPS system consists
of exhaust blowers with isolation and control valves providing
access to the main inert gas system distribution lines downstream
of the inert gas system deck seal/non-return valves. The major
additions are the blowers, an improved set of pressure sensors
and a control system that monitors the status of individual
tank conditions. Pressure, oxygen concentration, hydrocarbon
concentration and cargo levels are instrumented. This continuous
readout requires a data handling distribution subsystem utilizing
the information from the tank sensors and the supporting machinery
for automatic control of the system. The inert gas system
controls are integrated with the AUPS system to accomplish
The system lends itself
to a simple retrofit to existing tankers, normally utilizing
the inert gas system already installed. The inert gas mixture
in the ullage space is maintained in accordance with the IMO
standards at all times -notwithstanding air leakage problems
specifically associated with negative pressures. The system
in conjunction with the existing inert gas system can be used
as the primary oil containment device or as a supplement to
other approaches such as the double hull. It provides instant
corrective action when an accident occurs, because the underpressure
is set at the start of the voyage or from time to time, and
avoids the time delay resulting from human evaluation time
and machinery start-up.
The use of a sub-atmospheric
pressure above the cargo introduces special design issues.
These are discussed in the following paragraphs.
Under Reduced Tank Pressure The effects of negative tank pressure
on the hull structure has been studied by Professor A.E. Mansour,
of the University of California, Berkeley. The study concluded
that for most hull structures the resulting stresses arc within
allowable limits, from 60 to 70 percent of yield. The general
conclusion of the study was that the introduction of a vacuum
six psi would result in an increase in the stress level in
the lank structure of less than eight percent. This calculation
can be carried out for any given hull configuration during
the initial installation workup.
The technical prerequisite
with regard to the vapor pressure of different oil qualities
is to ensure that the oil be a compressed liquid at all times.
This means a liquid under an externally imposed pressure that
exceeds the saturated vapor pressure corresponding to the
temperature of the oil. About 35 percent of all oil products,
those constituting the principal content of crude oil, have
vapor pressures below seven psia, so this requires that the
underpressure not exceed seven psia. Such a large underpressure
is not expected as a requirement with the active system.
We have conducted model
tests with oil with known vapor pressure; when subjected to
negative pressure higher than the vapor pressure of the liquid,
we find no evidence of 'boil-off". However, it is certain
that there some low level evaporation will occur.
Flammability of Ullage Gas Mixture
There are three potentially
hazardous operations that involve replacement of gas in cargo
Initial Inerting and
Subsequent Application of Underpressure: Tanks must be inerted
prior to cargo loading or when tanks contain cargo residues
or ballast. The existing inert gas system presently performs
this function by introducing inert gas until an oxygen content
less than eight percent by volume is achieved. The tanks are
then marginally pressurized (less than 0. 14 psi) above ambient
and then loaded. Prior to the loaded passage a check is made
of inherent gas leakage and, if it is satisfactory the AUPS
system is activated to reduce the gas pressure to its predetermined
value based on cargo loading, cargo density and draft (usually
< 2 psi). This pressure is maintained throughout the voyage
with topping operations performed as required.
Gas Freeing Operations:
Gas freeing of cargo tanks is performed when tank cleaning
or repairs arc necessary. Fresh air is introduced into the
tank to displace toxic, flammable and inert gases until the
oxygen content is near 21 percent by volume and the hydrocarbon
content is less than one percent by volume. This ensures the
hydrocarbon content is insufficient to support combustion.
The existing inert gas system handles this function, isolating
the tanks, purging with inert gas to a level less than two
percent by volume, and only then introducing air until the
oxygen content reaches 21 percent by volume, and hydrocarbon
one percent by volume. The AUPS system is totally isolated
during these phases of operation and does not introduce any
Tank Gas Leakage During
the Voyage: The cargo tanks have various cut-outs to which
ancillary equipment arc attached, and these assemblies are
leakage candidates. The AUPS system maintains underpressure
during the voyage that enhances the entry of outside air into
the tanks. Currently, slow leakage is accommodated by topping
with inert gas to maintain a positive pressure above ambient
and prevent the ingress of oxygen into the tanks. The AUPS
will meet this concern by implementing more exacting leak
specifications on all susceptible assemblies, requiring constant
(electronic) monitoring of tank pressure levels as a primary
leak detection measurement as well as the oxygen content of
the ullage gases. In addition, more frequent topping operations
will be performed with the AUPS system and inert gas system
deployed. The inert gas system will raise the pressure (say
1/2 psi) and the AUPS will then exhaust it down to its nominal
underpressure requirement. This periodic purging will insure
the gas mixtures remain free and out of the range of flammability.
The inert gas controlled AUPS maintains at all times, the
oxygen content of a tank at about six percent (far less than
the 11.5 percent limit) to avoid flammability zones and prevent
explosion. Figure 6.
The American Underpressure
System utilizes the existing Inert Gas system in its intact
configuration and functions. The positive pressure function
of the existing I.G. system remains unchanged. The underpressure
system simply adds a modular system to draw down the inerted
ullage gas mixture to a predetermined underpressure level,
and maintains the underpressure using a simple control system.
Thus a major portion of the underpressure system is already
present in existing ships. Some current inert gas systems
lack redundant functionality, and may be upgraded as part
of the underpressure system installation. Further investigation
to establish reliability baselines is needed in this area
as the current systems are often not tracked for failure history.
The underpressure system
is an active system, that is, it functions through the operation
of components such as valves, fans and controls. In designing
the system for seagoing service, consideration must be given
to the reliability of the system so that its ability to control
cargo loss is not impaired. This objective is achieved through
three mechanisms, (1) the selection of high reliability components,
(2) the use of parallel redundancy for key components and
(3) the inherent ability of the system to function in degraded
modes of operation.
The first element of
the design that contributes to system reliability is the use
of high-reliability components. The key elements of the system
are selected for their ability to operate for extended periods
under adverse conditions. Failure modes data and reliability
estimates are not as readily available for mechanical components
as they are for electrical/electronic components. Moreover,
the mechanisms of failure and the distribution of failures
over time are different. Initial estimates of component reliability
have been based principally on Non-electronic Parts Reliability
Data (NPRD-3), a publication of the Reliability Analysis Center
of the United States Department of Defense . This database
presents experienced failure rates for mechanical components
under a variety of environmental conditions. The condition
adopted for the reliability analysis is the NS, or ship sheltered
environment typical of military vessels. The failure model
used for the analysis of the system is the exponential, or
uniform failure rate, model developed originally for electronic
components. This model applies reasonably well to many mechanical
design elements so long as they are operating within their
recommended life. For structural elements and certain other
components, such as bearings, there is an extensive literature
and a number of more sophisticated formats for determining
This generic data is
being used to develop preliminary reliability estimates and
to prepare a reliability allocation. The budget will be tracked
as the design proceeds, and performance and reliability specifications
can be prepared. Finally, selection is made from components
having demonstrated levels of reliability.
The reliability data,
especially for mechanical components, represents only an approximate
estimate of actual capability, and there will always be some
uncertainty in the reliability estimating and budgeting process.
For this reason, a second design mechanism, redundancy, is
emphasized in the design concept in order to provide an additional
margin. Redundancy is achieved by providing two or more elements
capable of accomplishing a given part of the system capability.
Sizing is chosen so that only one needs to be operating in
order to achieve the intended operation of the system.
redundancy may be provided by spare units that can be substituted
for operational units within an acceptable time frame. The
baseline design for the underpressure system affords at least
two-element redundancy for all components except structural
and ducting functions. Since the critical electronic components
are relatively inexpensive, critical online capabilities utilize
the error detection/correction capability provided by a three-element
design with voting logic.
The third element of
system reliability is the capacity of the system to sustain
component failure without losing its ability to control cargo
loss. The system comprises three major component groups: the
fans and their power supply system, the sensors and controls
needed to control fan pressure, and the valving which controls
the distribution of the sub-atmospheric pressure to the tanks.
In normal operation, pressure is set for at some point' between
the required value for grounding and the required value for
a waterline rupture. The design provides that in the event
that a loss is detected in the control system, the fan pressure
will remain fixed at its intended level. This mode of operation
is available even if all redundant sensors and control media
are lost, providing that the self-test feature is able to
identify the loss. In this degraded mode, there will be some
added cargo loss if the incident only involves collision damage
at a point well above the baseline, but the essential integrity
of the system remains intact. Alternatively, a detected loss
of all control function can be caused to initiate maximum
underpressure. In this case, there is no added loss of cargo,
but the system could be operating at a higher power level
than normally necessary.
An additional degraded
mode is available. This mode would be resorted to in the event
of total fan loss coupled with an inability to cross-connect
underpressure from a parallel system. In this unlikely event,
the tank would be disconnected from ducting and fans and would
thus be converted to a passive underpressure system of the
sort discussed at the beginning of this section. This second-level-degraded
system must allow some loss of cargo in order to function,
but still affords a margin of loss control.
Cost of Underpressure System
Major cost categories
and their percentages are shown below in Table 3. A cost estimate
for the installation of the underpressure system on five tankers
is shown in Table 4. It is estimated that the cost of retrofitting
the American Underpressure System to an existing tanker varies
from 1% to 1.5% of the new construction (US) cost. Retrofitting
cost of a double hull is about 35 % to 40 % of the new cost
of a tanker. The average installation cost for retrofitting
the underpressure system is approximately one week; retrofitting
time for a double hull on an existing tanker is approximately
6 months to one year.
Table 3 Cost Category
Hull Stress Monitoring
|55 to 65%
|35 to 45%
The proposed rulemaking
does not define objective standards under which candidate
oil spill prevention systems can be qualified. It is impossible
to determine from the current rulemaking what an acceptable
system has to accomplish or how its capability is to be evaluated
by analysis or confirmed by test. The judgements rendered
in connection with the systems investigated under the rulemaking
analysis consist of subjective descriptions.
It is clear from the
wording of OPA 90 that the legislative intent was to encourage
the development of innovative and cost-effective approaches
to the oil spill problem. The choice of the double hull design
offered a reasonable effective solution to the current problem
and represented a logical and functionally acceptable starting
point for further research and development. R & D efforts,
however, require two key elements in order to have a reasonable
chance of success. The first is a set of quantitative objectives
that the effort is supposed to meet; without goals, the management
of a practical development effort is impossible. The second
is the funding necessary to support the effort. But funding
for a project that lacks well-defined goals is very hard to
find. From both standpoints, the rulemaking process should,
insofar as possible, define a framework for development.
There is a further
difficulty that will result from a non-quantitative specification
for a system having the enormous economic consequences that
this one has. That difficulty is politics. Let us suppose,
for the sake of argument, that the double hull design is approved
as the sole means of importing crude into the United States.
Suppose further that expenditures of hundreds of millions
of dollars are made to create a fleet of such vessels. Finally,
suppose that after this expenditure is made a new concept
having twice the effectiveness and half the cost is discovered.
Can anyone reasonably suppose that the evaluation of this
new concept can be made fairly and impartially by attaching
descriptive adjectives to it? Decisions lacking an objective
basis will be made on an arbitrary basis.
Table 4 Cost Estimate
Type of Vessel
Underpressure = (14.7-Pv)PSI
Pv = Pa + Dw x he
Do x hi
Density of Water: Dw = 64lb/ft3
Oil: Do = 55 lb/ft3
Power Source For Under-Pressure
Recommended Gas Medium
Cost Under-Pressure Retrofit
Pv = Pa + 64 x
34.0 55 x 44.0
Underpressure = Pa + Pv=1.7psi
He = 37.8
Underpressure = 1.9 psi
He = 50.0
Underpressure = 3.0 psi
He = 64.0
Underpressure = 4.5 psi
He = 65.2
Underpressure = 2.4 psi
We recommend that the
rulemaking be revised to define more objective standards under
which potential systems can be evaluated. We recognize that
these standards will not be easy to formulate. But surely
a society that can establish and meet specifications for a
space shuttle is capable of defining what it wants an oil
tanker to do. The paper suggests that effectiveness scenarios
and probabilistic evaluation criteria can be developed to
define those aspects of an acceptable system that are difficult
to define using normal specification formats.
 Oil Pollution Act of 1990, Public
Law 101-380, August 18, 1990
 Furguson, J.M. Oil Tankers and the
Planning for the Future, Lloyd's Register
of Shipping, 1992
 National Research Council, Committee
on Tank Vessel Design, Tanker Spills: Prevention by Design,
February 12, 1991
[4) Regulatory Impact Analysis of Structural
and Operational Measures for Existing Tank Vessels: Mercer
Management Consulting, Inc. and George G. Sharp, Inc., January
 Notice of Proposed Rulemaking: Structural
and Operational Measures to Reduce Oil Spills from Existing
Tank Vessels Without Double Hulls
 Non-electronic Parts Reliability Data
(NPRD-3): Reliability Analysis Center US Department of Defense
Your further inquiries are invited.
Write to: Corporate@mhsystemscorp.com