Upgrades could take as long as 15 years for unsafe railroad tank cars, NTSB says