Incident Case Description

Bhopal, India 1984

The Setting
Bhopal located in North Central India Very old town in picturesque lakeside setting Tourist centre Industry encouraged to go to Madhya Pradesh as part of a policy to bring industry to less developed states Annual rent $40 per acre Decision by Union Carbide in 1970 to build was welcomed
Bhopal Capitol of Madhya Pradesh

The Plant
Operator : Union Carbide India Ltd. Half owned by Union Carbide USA (50.9%) Plant built to produce carbonyl pesticide : SEVIN-DDT substitute Very successful initially - part of Indias Green Revolution Initial staff 1000

The Surroundings
Initially in quiet suburb Later the town expanded around it Attracted a large squatter camp, as in many third world countries

The Sevin Process

SEVIN manufactured from Carbon Monoxide (CO) Monomethylamine (MMA) Chlorine (Cl2) Alpha-Napthol (AN)

} }

imported by truck
made on site

Process route CO + Cl2 COCl2 (Phosgene) COCl2 + MMA MMC + MIC MIC stored in three 15,000 gal tanks MIC + AN SEVIN

Properties of MIC
Flammability Toxicity Reactivity

NFPA Diamond
DOT = US Dept of Transport CAS = Chemical Abstracts No. ID = United Nations Ref No.

M I C Hazards
Toxic, flammable gas Boiling point is near to ambient Runaway reaction with water possible unless chilled below 11 C

Extract from NFPA 704

(National Fire Protection Association)
Right Side Top of Diamond Left Side

Simplified Process Flow Chart

MMA Phosgene

Reaction System Chloroform Phosgene Still

HCl
Residue

Pyrolysis

Tails
MIC Refining Still

Flare and Scrubber

MIC Storage

Derivatives Plant

MIC Storage Tank

MIC Safeguards Table

SAFEGUARD
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Mounded/insulated MIC Tanks Refrigeration below reaction initiation temperature Refrigeration uses non-aqueous refrigerant (Freon) Corrosion protection (cathodic) to prevent water ingress Rigorous water isolation procedures (slip blinds) Nitrogen padding gas used for MIC transfer not pumped Relief Valve and rupture disk Vent gas scrubber with continuous caustic circulation Elevated flare Water Curtain around MIC Tanks

TYPE
Passive Active Active Active Active Active Passive Active Passive + Active Active

What do we mean by Safeguards?

The vent gas scrubber was defined previously as an active safeguard 1. Why it was not categorized as passive? It is permanently installed 2. What would you say constitutes a passive safeguard ?

Accidents are normally characterised by a sequence of events leading from the initiating event, propagation of the accident, and realisation of the undesired outcome Safeguards may be equipment items or procedures designed to prevent the initiating event, limit or terminate the propagation, or mitigate the outcome Active safeguards are those which require human procedures or mechanical initiation to operate (e.g. work permit procedures, scrubber caustic circulation)

Safeguards

Safeguards
Passive safeguards are those which are designed in and which do not require any initiation (e.g. concrete fireproofing, elevated vent stack for dispersion) Both active and passive safeguards can be defeated through inadequate Safety Management Systems

Plant Problems Precursor to Disaster

A-Napthol plant shut down SEVIN production no longer making money, so cost savings sought, and plant run intermittently
Minimum maintenance Safety procedures simplified for small jobs Refrigeration unit shut down and Freon sold Scrubber circulation stopped Manning cut to 600 Morale low Slip blinding no longer mandatory during washing High temperature alarm shut-off as T now > 11 C RV and PCV headers joined (for maintenance) Emergency flare line corroded, disconnected 1981-1984: 6 accidents with phosgene or MIC 1982 audit critical of MIC tank and instrumentation 1984 warning of potential runaway reaction hazard

The Incident
Occurred late at night, soon after shift change MIC tank overheated, overpressured and vented through scrubber Elevated discharge of massive quantity of MIC (approximately 25 tons) Operational staff retreated upwind, no casualties Staff from other plants evacuated, few casualties

Incident Causes
Source of Water Filters were being flushed using high pressure water Drain line from filter was blocked, operator observed no flow to drain Flushing continued despite blockage High pressure could cause valve leak; force water into relief header and then?

Incident Causes
Route of Water RV and PCV headers were joined by jumper pipe, no blinds MIC tank could not be pressurised because tank PCV failed open? Leakage through a single valve would allow water from RV header to enter tank Head of water sufficient for flow Slow initial reaction would allow 1600 lbs. to enter

Probable Route of Ingress of Water into Tank 610

To VCS RWH Line Jumper Line

To VGS and FVH

PI

FVH Line

MRS RVVH PVH VGS FVH

MIC Reactor Side Relief Valve Vent Header Process Valve Vent Header Vent Gas Scrubber Flare Vent Header Route of water ingress

N2 Header Isolation Valve

RV

To VCS

Slip Blind required here

Valve which let water in

PI

Rupture Disk

From Refrigeration

40 PSI

From MRS

Refrigerator

Water Source Area

Quench Filter - pressure safety valve lines (at ground level)

Phosphene Stripping Still Filter- pressure safety valve lines (at ground level) Water Drain

Tank No. 610 To Reactor Conditioner

Educator

Concrete Cover

Ultimate destination of water

Probable Route of Gas Leakage before 0030 hrs

To VCS RWH Line To VGS and FVH
PI

Jumper Line FVH Line

MIC to vent

MRS RVVH PVH VGS FVH

MIC Reactor Side Relief Valve Vent Header Process Valve Vent Header Vent Gas Scrubber Flare Vent Header Route of gas leakage after 0030

N2 Header Isolation Valve

RV

PI

Rupture Disk

From Refrigeration

To VCS

Valve which let water in

40 PSI

From MRS

Vent not working!

Refrigerator Quench Filter - pressure safety valve lines (at ground level) Phosphene Stripping Still Filter- pressure safety valve lines (at ground level) Water Drain Tank No. 610 To Reactor Conditioner

Educator

Concrete Cover

Reaction

Probable Route of Gas Leakage after 0030 hrs

To VCS RWH Line To VGS and FVH FVH Line Jumper Line

Increased rate of release

MRS RVVH PVH VGS FVH MIC Reactor Side Relief Valve Vent Header Process Valve Vent Header Vent Gas Scrubber Flare Vent Header Route of gas leakage before 0030

PI

N2 Header Isolation Valve

RV

PI

Rupture Disk

From Refrigeration

To VCS

Valve which let water in

40 PSI

From MRS

Rupture disk bursts

Quench Filter - pressure safety valve lines (at ground level) Phosphene Stripping Still Filter- pressure safety valve lines (at ground level) Water Drain Tank No. 610

Refrigerator

To Reactor Conditioner

Educator

Concrete Cover

The Incident
No alarm or warning to public Very stable atmosphere and low wind directly into town Surrounding population asleep Over 2,500 fatalities Over 250,000 sought medical treatment Panic

The Incidents Extent

Note how the cloud boundary (to the level of serious harm) almost exactly matches the area of highest population density Had the wind blown north the Bhopal incident, although it would have still been serious, would have been less disastrous Other incidents could have been worse but for luck in timing and the wind direction Seveso (wind direction) Flixborough (occurred at a week-end)

Incident Chemistry
Chemistry causing incident is not in dispute 41 tonnes of MIC in storage reacted with 500 to 900 kg water plus contaminants Resultant exothermic reaction reached 400 to 480F (200 to 250C) Tank pressure rose to 200+ psig (14+ bar) - tank was designed for 70 psig (4 bar) Venting caused ground to shake!

Incident Causes
No universally accepted cause. Sabotage theory
Disgruntled employee Alternative theory involves connection of water hose to storage tank 610 Evidence said to include the finding of the disconnected pressure gauge from tank 610 after the disaster A rough drawing found, said to depict a hose connected to a pressure vessel

Z
Z
Z

OR
Z

Management systems theory

Inadequate safety management allowed water entry through inadequate slip-blinding and uncontrolled plant modifications

Design safeguards should have prevented the disaster of either case

Incident Causes
Many theories can be put forward and all mechanisms give insights into the vulnerability of the system Main objective is to learn from the consequences; multiple possible causes only serve to highlight the weaknesses

What Could Safety Studies have done?

Early safety study would question hazardous inventories and plant siting Detailed study would identify contamination problem Safety Studies may propose a training function, should involve parent company staff Safety Studies may review procedures, especially those involving hazards (water washing?)

Lessons Learnt

What Could Safety Studies have done?

Safety Studies on modifications: Disconnecting flare system Not running refrigeration Jumper pipe between vent headers Stopping scrubber caustic circulation Safety Studies would emphasise need for emergency plans Lessons Learnt