Incident Case Description Bhopal, India 1984

 Bhopal located in North Central India  Very old town in picturesque lakeside setting  Tourist centre  Industry encouraged to go to Madhya Pradesh as part of a policy to bring industry to less developed states  Annual rent $40 per acre  Decision by Union Carbide in 1970 to build was welcomed Bhopal Capitol of Madhya Pradesh The Setting

 Operator : Union Carbide India Ltd.  Half owned by Union Carbide USA (50.9%)  Plant built to produce carbonyl pesticide : SEVIN-DDT substitute  Very successful initially - part of India’s Green Revolution  Initial staff 1000 The Plant

 Initially in quiet suburb  Later the town expanded around it  Attracted a large squatter camp, as in many third world countries The Surroundings

SEVIN manufactured from Carbon Monoxide (CO) imported by truck Monomethylamine (MMA) Chlorine (Cl 2 ) made on site Alpha-Napthol (AN) Process route CO + Cl 2 COCl 2 (Phosgene) COCl 2 + MMA MMC + MIC MIC stored in three 15,000 gal tanks MIC + AN SEVIN } } The Sevin Process

Toxic, flammable gas Boiling point is near to ambient Runaway reaction with water possible unless chilled below 11 C M I C Hazards NFPA Diamond Flammability Toxicity Reactivity DOT = US Dept of Transport CAS = Chemical Abstracts No. ID = United Nations Ref No. Properties of MIC

(National Fire Protection Association) Right Side Top of Diamond Left Side Extract from NFPA 704

Reaction System Phosgene Still Pyrolysis MIC Refining Still MIC Storage MMAPhosgene HCl Chloroform Tails Residue Flare and ScrubberDerivatives Plant Simplified Process Flow Chart

MIC Storage Tank

SAFEGUARDTYPE Mounded/insulated MIC Tanks Refrigeration below reaction initiation temperature Refrigeration uses non-aqueous refrigerant (Freon) Corrosion protection (cathodic) to prevent water ingress Rigorous water isolation procedures (slip blinds) Nitrogen padding gas used for MIC transfer not pumped Relief Valve and rupture disk Vent gas scrubber with continuous caustic circulation Elevated flare Water Curtain around MIC Tanks Passive Active Passive Active Passive + Active Active MIC Safeguards Table

1. Why it was not categorized as passive? It is permanently installed 2. What would you say constitutes a passive safeguard ? The vent gas scrubber was defined previously as an active safeguard What do we mean by Safeguards?

 Accidents are normally characterised by a sequence of events leading from the initiating event, propagation of the accident, and realisation of the undesired outcome  Safeguards may be equipment items or procedures designed to prevent the initiating event, limit or terminate the propagation, or mitigate the outcome  Active safeguards are those which require human procedures or mechanical initiation to operate (e.g. work permit procedures, scrubber caustic circulation) Safeguards

 Passive safeguards are those which are designed in and which do not require any initiation (e.g. concrete fireproofing, elevated vent stack for dispersion)  Both active and passive safeguards can be defeated through inadequate Safety Management Systems Safeguards

 A-Napthol plant shut down  SEVIN production no longer making money, so cost savings sought, and plant run intermittently  Minimum maintenance  Safety procedures simplified for small jobs  Refrigeration unit shut down and Freon sold  Scrubber circulation stopped  Manning cut to 600  Morale low  Slip blinding no longer mandatory during washing  High temperature alarm shut-off as T now > 11 C  RV and PCV headers joined (for maintenance)  Emergency flare line corroded, disconnected  : 6 accidents with phosgene or MIC  1982 audit critical of MIC tank and instrumentation  1984 warning of potential runaway reaction hazard Plant Problems – Precursor to Disaster

 Occurred late at night, soon after shift change  MIC tank overheated, over- pressured and vented through scrubber  Elevated discharge of massive quantity of MIC (approximately 25 tons)  Operational staff retreated upwind, no casualties  Staff from other plants evacuated, few casualties The Incident

Source of Water  Filters were being flushed using high pressure water  Drain line from filter was blocked, operator observed no flow to drain  Flushing continued despite blockage  High pressure could cause valve leak; force water into relief header and then? Incident Causes

 Route of Water  RV and PCV headers were joined by jumper pipe, no blinds  MIC tank could not be pressurised because tank PCV failed open?  Leakage through a single valve would allow water from RV header to enter tank  Head of water sufficient for flow  Slow initial reaction would allow 1600 lbs. to enter Incident Causes

Probable Route of Ingress of Water into Tank 610

Probable Route of Gas Leakage before 0030 hrs

Probable Route of Gas Leakage after 0030 hrs

 No alarm or warning to public  Very stable atmosphere and low wind directly into town  Surrounding population asleep  Over 2,500 fatalities  Over 250,000 sought medical treatment  Panic The Incident

 Note how the cloud boundary (to the level of “serious” harm) almost exactly matches the area of highest population density  Had the wind blown north the Bhopal incident, although it would have still been serious, would have been less disastrous  Other incidents could have been worse but for luck in timing and the wind direction  Seveso (wind direction)  Flixborough (occurred at a week-end) The Incident’s Extent

 Chemistry causing incident is not in dispute  41 tonnes of MIC in storage reacted with 500 to 900 kg water plus contaminants  Resultant exothermic reaction reached 400 to 480ºF (200 to 250ºC)  Tank pressure rose to 200+ psig (14+ bar) - tank was designed for 70 psig (4 bar)  Venting caused ground to shake! Incident Chemistry

 No universally accepted cause.  Sabotage theory  Disgruntled employee  Alternative theory involves connection of water hose to storage tank 610  Evidence said to include the finding of the disconnected pressure gauge from tank 610 after the disaster  A rough drawing found, said to depict a hose connected to a pressure vessel  Management systems theory  Inadequate safety management allowed water entry through inadequate slip-blinding and uncontrolled plant modifications  Design safeguards should have prevented the disaster of either case Z Z Z Z Z OR ? Incident Causes

 Many theories can be put forward and all mechanisms give insights into the vulnerability of the system  Main objective is to learn from the consequences; multiple possible causes only serve to highlight the weaknesses Incident Causes

 Early safety study would question hazardous inventories and plant siting  Detailed study would identify contamination problem  Safety Studies may propose a training function, should involve parent company staff  Safety Studies may review procedures, especially those involving hazards (water washing?) Lessons Learnt What Could Safety Studies have done?

 Safety Studies on modifications:  Disconnecting flare system  Not running refrigeration  Jumper pipe between vent headers  Stopping scrubber caustic circulation  Safety Studies would emphasise need for emergency plans Lessons Learnt What Could Safety Studies have done?