Incident Case Description

Bhopal, India1984

Bhopal located in North Central India

Very old town in picturesque lakeside setting

Tourist centreIndustry encouraged to go to

Madhya Pradesh as part of a policy to bring industry to less developed states

Annual rent $40 per acreDecision by Union Carbide in 1970

to build was welcomed

Bhopal Capitol ofMadhya Pradesh

The Setting

Operator : Union Carbide India Ltd.Half owned by Union Carbide USA (50.9%)Plant built to produce carbonyl pesticide :

SEVIN-DDT substituteVery successful initially - part of India’s

Green RevolutionInitial staff 1000

The Plant

Initially in quiet suburb

Later the town expanded around it

Attracted a large squatter camp, as in many third world countries

The Surroundings

SEVIN manufactured fromCarbon Monoxide (CO) imported by truck

Monomethylamine (MMA)

Chlorine (Cl2) made on site

Alpha-Napthol (AN)

Process route

CO + Cl2 COCl2 (Phosgene)

COCl2 + MMA MMC + MIC

MIC stored in three 15,000 gal tanks

MIC + AN SEVIN

}}

The Sevin Process

• Toxic, flammable gas• Boiling point is near to

ambient• Runaway reaction with

water possible unless chilled below 11 C

M I C Hazards

NFPA Diamond

Flammability

Toxicity Reactivity

DOT = US Dept of Transport

CAS = Chemical Abstracts No.

ID = United Nations Ref No.

Properties of MIC

(National Fire Protection Association)Right Side Top of Diamond Left Side

Extract from NFPA 704

Reaction SystemReaction System

Phosgene StillPhosgene Still

PyrolysisPyrolysis

MIC Refining StillMIC Refining Still

MIC StorageMIC Storage

MMA Phosgene

HCl

Chloroform

TailsResidue

Flare and Scrubber Derivatives Plant

Simplified Process Flow Chart

MIC Storage Tank

SAFEGUARD TYPE

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

Mounded/insulated MIC Tanks

Refrigeration below reaction initiation temperature

Refrigeration uses non-aqueous refrigerant (Freon)

Corrosion protection (cathodic) to prevent water ingress

Rigorous water isolation procedures (slip blinds)

Nitrogen padding gas used for MIC transfer not pumped

Relief Valve and rupture disk

Vent gas scrubber with continuous caustic circulation

Elevated flare

Water Curtain around MIC Tanks

Passive

Active

Active

Active

Active

Active

Passive

Active

Passive + Active

Active

MIC Safeguards Table

1. Why it was not categorized as passive? It is permanently installed

2. What would you say constitutes a passive safeguard ?

The vent gas scrubber was defined previously as an active safeguard

What do we mean by Safeguards?

Accidents are normally characterised by a sequence of events leading from the initiating event, propagation of the accident, and realisation of the undesired outcome

Safeguards may be equipment items or procedures designed to prevent the initiating event, limit or terminate the propagation, or mitigate the outcome

Active safeguards are those which require human procedures or mechanical initiation to operate (e.g. work permit procedures, scrubber caustic circulation)

Safeguards

Passive safeguards are those which are designed in and which do not require any initiation (e.g. concrete fireproofing, elevated vent stack for dispersion)

Both active and passive safeguards can be defeated through inadequate Safety Management Systems

Safeguards

A-Napthol plant shut down SEVIN production no longer making

money, so cost savings sought, and plant run intermittently

Minimum maintenance Safety procedures simplified for small

jobs Refrigeration unit shut down and Freon

sold Scrubber circulation stopped Manning cut to 600 Morale low Slip blinding no longer mandatory

during washing High temperature alarm shut-off as

T now > 11 C

RV and PCV headers joined (for maintenance)

Emergency flare line corroded, disconnected

1981-1984: 6 accidents with phosgene or MIC

1982 audit critical of MIC tank and instrumentation

1984 warning of potential runaway reaction hazard

Plant Problems – Precursor to Disaster

Occurred late at night, soon after shift changeMIC tank overheated, over-pressured and vented

through scrubberElevated discharge of massive quantity of MIC

(approximately 25 tons)Operational staff retreated upwind, no casualtiesStaff from other plants evacuated, few casualties

The Incident

Source of WaterFilters were being flushed using high pressure

waterDrain line from filter was blocked, operator

observed no flow to drainFlushing continued despite blockageHigh pressure could cause valve leak; force

water into relief header and then?

Incident Causes

Route of WaterRV and PCV headers were joined by jumper pipe,

no blindsMIC tank could not be pressurised because tank

PCV failed open?Leakage through a single valve would allow water

from RV header to enter tankHead of water sufficient for flowSlow initial reaction would allow 1600 lbs. to enter

Incident Causes

Water Drain

PI

RV

Valve which let water in

Quench Filter - pressuresafety valve lines(at ground level)

Phosphene Stripping -Still Filter- pressuresafety valve lines(at ground level)

To VCS RWH Line

To VGS and FVH FVH Line

N2 Header Isolation Valve

RuptureDisk

Concrete Cover

From MRS

From Refrigeration

To Reactor Conditioner

Refrigerator

Tank No. 610

40 PSI

Educator

MRS MIC Reactor SideRVVH Relief Valve Vent HeaderPVH Process Valve Vent HeaderVGS Vent Gas ScrubberFVH Flare Vent Header

Route of water ingress

ToVCS

PI

JumperLine

Slip Blindrequired here

WaterSourceArea

Ultimate destination of water

Probable Route of Ingress of Water into Tank 610

Water Drain

PI

RV

Valve which let water in

Quench Filter - pressuresafety valve lines(at ground level)

Phosphene Stripping -Still Filter- pressuresafety valve lines(at ground level)

To VCS RWH Line

To VGS and FVH FVH Line

N2 Header Isolation Valve

RuptureDisk

Concrete Cover

From MRS

From Refrigeration

To Reactor Conditioner

Refrigerator

Tank No. 610

Educator

MRS MIC Reactor SideRVVH Relief Valve Vent HeaderPVH Process Valve Vent HeaderVGS Vent Gas ScrubberFVH Flare Vent Header

Route of gas leakage after 0030

ToVCS

PI

40 PSI

JumperLine

MICto

vent

Ventnot

working!

Reaction

Probable Route of Gas Leakage before 0030 hrs

Water Drain

PI

RV

Valve which let water in

Quench Filter - pressuresafety valve lines(at ground level)

Phosphene Stripping -Still Filter- pressuresafety valve lines(at ground level)

To VCS RWH Line

To VGS and FVH FVH Line

N2 Header Isolation Valve

RuptureDisk

Concrete Cover

From MRS

From Refrigeration

To Reactor Conditioner

Refrigerator

Tank No. 610

Educator

MRS MIC Reactor SideRVVH Relief Valve Vent HeaderPVH Process Valve Vent HeaderVGS Vent Gas ScrubberFVH Flare Vent Header

Route of gas leakage before 0030

ToVCS

PI

40 PSI

JumperLine

Rupture disk bursts

Increased rate of release

Probable Route of Gas Leakage after 0030 hrs

No alarm or warning to publicVery stable atmosphere and low wind

directly into townSurrounding population asleepOver 2,500 fatalitiesOver 250,000 sought medical treatmentPanic

The Incident

Note how the cloud boundary (to the level of “serious” harm) almost exactly matches the area of highest population density

Had the wind blown north the Bhopal incident, although it would have still been serious, would have been less disastrous

Other incidents could have been worse but for luck in timing and the wind directionSeveso (wind direction)Flixborough (occurred at a week-

end)

The Incident’s Extent

Chemistry causing incident is not in dispute

41 tonnes of MIC in storage reacted with 500 to 900 kg water plus contaminants

Resultant exothermic reaction reached 400 to 480ºF(200 to 250ºC)

Tank pressure rose to 200+ psig (14+ bar) - tank was designed for 70 psig (4 bar)

Venting caused ground to shake!

Incident Chemistry

No universally accepted cause.Sabotage theory

Disgruntled employeeAlternative theory involves connection of water

hose to storage tank 610Evidence said to include the finding of the

disconnected pressure gauge from tank 610 after the disaster

A rough drawing found, said to depict a hose connected to a pressure vessel

Management systems theory Inadequate safety management allowed water

entry through inadequate slip-blinding and uncontrolled plant modifications

Design safeguards should have prevented the disaster of either case

ZZ

ZZ

Z

OR ?

Incident Causes

Many theories can be put forward and all mechanisms give insights into the vulnerability of the system

Main objective is to learn from the consequences; multiple possible causes only serve to highlight the weaknesses

Incident Causes

Early safety study would question hazardous inventories and plant siting

Detailed study would identify contamination problem

Safety Studies may propose a training function, should involve parent company staff

Safety Studies may review procedures, especially those involving hazards (water washing?)

Lessons

Learnt

What Could Safety Studies have done?

Safety Studies on modifications:Disconnecting flare systemNot running refrigerationJumper pipe between vent headersStopping scrubber caustic

circulationSafety Studies would emphasise need

for emergency plans

Lessons

Learnt

What Could Safety Studies have done?