Incident Case Description

1. Incident Case Description Bhopal, India 1984

2. Bhopal located in North Central India Very old town in picturesque lakeside setting Tourist centre Industry encouraged to go to Madhya Pradesh as part of a policy to bring industry to less developed states Annual rent $40 per acre Decision by Union Carbide in 1970 to build was welcomed The Setting Bhopal Capitol of Madhya Pradesh

3. Operator : Union Carbide India Ltd. Half owned by Union Carbide USA (50.9%) Plant built to produce carbonyl pesticide : SEVIN-DDT substitute Very successful initially - part of India’s Green Revolution Initial staff 1000 The Plant

4. Initially in quiet suburb Later the town expanded around it Attracted a large squatter camp, as in many third world countries The Surroundings

5. SEVIN manufactured from Carbon Monoxide (CO) imported bytruck Monomethylamine (MMA) Chlorine (Cl2) made on site Alpha-Napthol (AN) Process route CO + Cl2 COCl2 (Phosgene) COCl2 + MMA MMC + MIC MIC stored in three 15,000 gal tanks MIC + AN SEVIN The Sevin Process } }

6. Properties of MIC Flammability Toxicity Reactivity NFPA Diamond DOT = US Dept of Transport CAS = Chemical Abstracts No. ID = United Nations Ref No. M I C Hazards • Toxic, flammable gas • Boiling point is near to ambient • Runaway reaction with water possible unless chilled below 11 C

7. (National Fire Protection Association) Right Side Top of Diamond Left Side Extract from NFPA 704

8. MMA Phosgene Reaction System Chloroform Phosgene Still HCl Pyrolysis Tails Residue MIC Refining Still MIC Storage Flare and Scrubber Derivatives Plant Simplified Process Flow Chart

9. MIC Storage Tank

10. SAFEGUARD TYPE 1. Mounded/insulated MIC Tanks Passive 2. Refrigeration below reaction initiation temperature Active 3. Refrigeration uses non-aqueous refrigerant (Freon) Active 4. Corrosion protection (cathodic) to prevent water ingress Active 5. Rigorous water isolation procedures (slip blinds) Active 6. Nitrogen padding gas used for MIC transfer not pumped Active 7. Relief Valve and rupture disk Passive 8. Vent gas scrubber with continuous caustic circulation Active 9. Elevated flare Passive + Active 10. Water Curtain around MIC Tanks Active MIC Safeguards Table

11. What do we mean by Safeguards? The vent gas scrubber was defined previously as an active safeguard 1. Why it was not categorized as passive? It is permanently installed 2. What would you say constitutes a passive safeguard ?

12. Safeguards • Accidents are normally characterised by a sequence of events leading from the initiating event, propagation of the accident, and realisation of the undesired outcome • Safeguards may be equipment items or procedures designed to prevent the initiating event, limit or terminate the propagation, or mitigate the outcome • Active safeguards are those which require human procedures or mechanical initiation to operate (e.g. work permit procedures, scrubber caustic circulation)

13. Safeguards • Passive safeguards are those which are designed in and which do not require any initiation (e.g. concrete fireproofing, elevated vent stack for dispersion) • Both active and passive safeguards can be defeated through inadequate Safety Management Systems

14. A-Napthol plant shut down SEVIN production no longer making money, so cost savings sought, and plant run intermittently Minimum maintenance Safety procedures simplified for small jobs Refrigeration unit shut down and Freon sold Scrubber circulation stopped Manning cut to 600 Morale low Slip blinding no longer mandatory during washing High temperature alarm shut-off as T now > 11 C Plant Problems – Precursor to Disaster • RV and PCV headers joined (for maintenance) • Emergency flare line corroded, disconnected • 1981-1984: 6 accidents with phosgene or MIC • 1982 audit critical of MIC tank and instrumentation • 1984 warning of potential runaway reaction hazard

15. Occurred late at night, soon after shift change MIC tank overheated, over-pressured and vented through scrubber Elevated discharge of massive quantity of MIC (approximately 25 tons) Operational staff retreated upwind, no casualties Staff from other plants evacuated, few casualties The Incident

16. Source of Water Filters were being flushed using high pressure water Drain line from filter was blocked, operator observed no flow to drain Flushing continued despite blockage High pressure could cause valve leak; force water into relief header and then? Incident Causes

17. Route of Water RV and PCV headers were joined by jumper pipe, no blinds MIC tank could not be pressurised because tank PCV failed open? Leakage through a single valve would allow water from RV header to enter tank Head of water sufficient for flow Slow initial reaction would allow 1600 lbs. to enter Incident Causes

18. Jumper Line To VCS RWH Line To VGS and FVH FVH Line PI MRS MIC Reactor Side RVVH Relief Valve Vent Header PVH Process Valve Vent Header VGS Vent Gas Scrubber FVH Flare Vent Header Route of water ingress N2 Header Isolation Valve From Refrigeration Rupture Disk PI Slip Blind required here RV To VCS From MRS 40 PSI Valve which let water in Refrigerator Quench Filter - pressure safety valve lines (at ground level) Water Source Area Tank No. 610 Phosphene Stripping - Still Filter- pressure safety valve lines (at ground level) To Reactor Conditioner Concrete Cover Educator Water Drain Ultimate destination of water Probable Route of Ingress of Water into Tank 610

19. Jumper Line To VCS RWH Line To VGS and FVH FVH Line PI MRS MIC Reactor Side RVVH Relief Valve Vent Header PVH Process Valve Vent Header VGS Vent Gas Scrubber FVH Flare Vent Header Route of gas leakage after 0030 MIC to vent N2 Header Isolation Valve From Refrigeration Rupture Disk PI RV To VCS From MRS 40 PSI Valve which let water in Refrigerator Vent not working! Quench Filter - pressure safety valve lines (at ground level) Tank No. 610 Phosphene Stripping - Still Filter- pressure safety valve lines (at ground level) To Reactor Conditioner Concrete Cover Educator Water Drain Reaction Probable Route of Gas Leakage before 0030 hrs

20. Jumper Line To VCS RWH Line To VGS and FVH FVH Line Increased rate of release PI MRS MIC Reactor Side RVVH Relief Valve Vent Header PVH Process Valve Vent Header VGS Vent Gas Scrubber FVH Flare Vent Header Route of gas leakage before 0030 N2 Header Isolation Valve From Refrigeration Rupture Disk PI RV To VCS From MRS 40 PSI Valve which let water in Rupture disk bursts Refrigerator Quench Filter - pressure safety valve lines (at ground level) Tank No. 610 Phosphene Stripping - Still Filter- pressure safety valve lines (at ground level) To Reactor Conditioner Concrete Cover Educator Water Drain Probable Route of Gas Leakage after 0030 hrs

21. No alarm or warning to public Very stable atmosphere and low wind directly into town Surrounding population asleep Over 2,500 fatalities Over 250,000 sought medical treatment Panic The Incident

22. Note how the cloud boundary (to the level of “serious” harm) almost exactly matches the area of highest population density Had the wind blown north the Bhopal incident, although it would have still been serious, would have been less disastrous Other incidents could have been worse but for luck in timing and the wind direction Seveso (wind direction) Flixborough (occurred at a week-end) The Incident’s Extent

23. Chemistry causing incident is not in dispute 41 tonnes of MIC in storage reacted with 500 to 900 kg water plus contaminants Resultant exothermic reaction reached 400 to 480ºF(200 to 250ºC) Tank pressure rose to 200+ psig (14+ bar) - tank was designed for 70 psig (4 bar) Venting caused ground to shake! Incident Chemistry

24. No universally accepted cause. Sabotage theory Disgruntled employee Alternative theory involves connection of water hose to storage tank 610 Evidence said to include the finding of the disconnected pressure gauge from tank 610 after the disaster A rough drawing found, said to depict a hose connected to a pressure vessel Management systems theory Inadequate safety management allowed water entry through inadequate slip-blinding and uncontrolled plant modifications Design safeguards should have prevented the disaster of either case Z Z Z Z Z Incident Causes ? OR

25. Many theories can be put forward and all mechanisms give insights into the vulnerability of the system Main objective is to learn from the consequences; multiple possible causes only serve to highlight the weaknesses Incident Causes

26. Early safety study would question hazardous inventories and plant siting Detailed study would identify contamination problem Safety Studies may propose a training function, should involve parent company staff Safety Studies may review procedures, especially those involving hazards (water washing?) Lessons Learnt What Could Safety Studies have done?

27. Safety Studies on modifications: Disconnecting flare system Not running refrigeration Jumper pipe between vent headers Stopping scrubber caustic circulation Safety Studies would emphasise need for emergency plans Lessons Learnt What Could Safety Studies have done?