Incident Case

Description
Bhopal, India
1984
 The Setting

Bhopal located in North Bhopal Capitol of
Central India Madhya Pradesh

Very old town in picturesque
lakeside setting

Tourist centre

Industry encouraged to go to
Madhya Pradesh as part of a
policy to bring industry to
less developed states

Annual rent $40 per acre

Decision by Union Carbide in
1970 to build was welcomed
 The Plant

Operator : Union Carbide India
Ltd.

Half owned by Union Carbide
USA (50.9%)
Plant built to produce carbonyl

Plant
pesticide : SEVIN-DDT substitute

Very successful initially - part of
India’s Green Revolution

Initial staff 1000
 The Surroundings

Initially in quiet
suburb

Later the town

expanded around it

Attracted a large
squatter camp, as
in many third world
countries
The Sevin Process

SEVIN manufactured from

Carbon Monoxide (CO)
Monomethylamine (MMA) } imported by truck

Chlorine (Cl2)
Alpha-Napthol (AN) } made on site

Process route
CO + Cl2 COCl2 (Phosgene)
COCl2 + MMA MMC + MIC
MIC stored in three 15,000 gal tanks
MIC + AN SEVIN
Properties of MIC
Flammability

Toxicity Reactivity

NFPA Diamond
DOT = US Dept of Transport
CAS = Chemical Abstracts No.
ID = United Nations Ref No.

M I C Hazards
• Toxic, flammable gas
• Boiling point is near to
ambient
• Runaway reaction with
water possible unless
chilled below 11 C
 Extract from NFPA 704
(National Fire Protection Association)
Right Side Top of Diamond Left Side
 Simplified Process Flow Chart
MMA Phosgene

Reaction System
Chloroform

Phosgene Still

HCl
Pyrolysis
Tails
Residue
MIC Refining Still

Flare and Scrubber MIC Storage Derivatives Plant

MIC Storage Tank
MIC Safeguards Table

SAFEGUARD TYPE

1. Mounded/insulated MIC Tanks Passive

2. Refrigeration below reaction initiation temperature Active

3. Refrigeration uses non-aqueous refrigerant (Freon) Active

4. Corrosion protection (cathodic) to prevent water ingress Active

5. Rigorous water isolation procedures (slip blinds) Active

6. Nitrogen padding gas used for MIC transfer not pumped Active

7. Relief Valve and rupture disk Passive

8. Vent gas scrubber with continuous caustic circulation Active

9. Elevated flare Passive + Active

10. Water Curtain around MIC Tanks Active

What do we mean by Safeguards?

The vent gas scrubber was defined

previously as an active safeguard

1. Why it was not categorized as

passive? It is permanently installed

2. What would you say constitutes a

passive safeguard ?
 Safeguards

Accidents are normally characterised by
a sequence of events leading from the
initiating event, propagation of the
accident, and realisation of the undesired
outcome

Safeguards may be equipment items or
procedures designed to prevent the
initiating event, limit or terminate the
propagation, or mitigate the outcome

Active safeguards are those which
require human procedures or mechanical
initiation to operate (e.g. work permit
procedures, scrubber caustic circulation)
 Safeguards

Passive safeguards are those which are
designed in and which do not require any
initiation (e.g. concrete fireproofing,
elevated vent stack for dispersion)

Both active and passive safeguards can
be defeated through inadequate Safety
Management Systems
 Plant Problems – Precursor to
Disaster

A-Napthol plant shut down

SEVIN production no longer
making money, so cost savings
sought, and plant run intermittently

Minimum maintenance
RV and PCV headers joined

Safety procedures simplified for (for maintenance)
small jobs
Emergency flare line

Refrigeration unit shut down and corroded, disconnected
Freon sold

1981-1984: 6 accidents with

Scrubber circulation stopped phosgene or MIC

Manning cut to 600

1982 audit critical of MIC

Morale low tank and instrumentation

Slip blinding no longer mandatory
1984 warning of potential
during washing
runaway reaction hazard

High temperature alarm shut-off as
T now > 11 C
 The Incident

Occurred late at night, soon after
shift change

MIC tank overheated, over-
pressured and vented through
scrubber

Elevated discharge of massive
quantity of MIC (approximately 25
tons)

Operational staff retreated
upwind, no casualties

Staff from other plants evacuated,
few casualties
 Incident Causes
Source of Water

Filters were being flushed using
high pressure water

Drain line from filter was blocked,
operator observed no flow to drain

Flushing continued despite
blockage

High pressure could cause valve
leak; force water into relief header
and then?
 Incident Causes

Route of Water

RV and PCV headers were joined
by jumper pipe, no blinds
MIC tank could not be pressurised

MIC
because tank PCV failed open?

Leakage through a single valve
would allow water from RV header
to enter tank

Head of water sufficient for flow

Slow initial reaction would allow
1600 lbs. to enter
 Probable Route of Ingress of
Water into Tank 610
Jumper
To VCS RWH Line
Line

To VGS and FVH FVH Line

PI
MRS MIC Reactor Side
RVVH Relief Valve Vent Header
PVH Process Valve Vent Header
VGS Vent Gas Scrubber
FVH Flare Vent Header
Route of water ingress N2 Header Isolation Valve

From Refrigeration
RV PI Rupture
Slip Blind Disk

To
required here
From MRS
VCS Valve which let water in 40 PSI

Refrigerator
Quench Filter - pressure
safety valve lines
Water (at ground level)

Source Phosphene Stripping - Tank No. 610

Area Still Filter- pressure To Reactor Conditioner
safety valve lines
(at ground level)
Concrete Cover
Water Drain Educator

Ultimate destination of water

 Probable Route of Gas Leakage
before 0030 hrs
Jumper
To VCS RWH Line
Line

To VGS and FVH FVH Line

PI
MRS MIC Reactor Side
RVVH Relief Valve Vent Header
MIC PVH
VGS
Process Valve Vent Header
Vent Gas Scrubber
to FVH Flare Vent Header
Route of gas leakage after 0030 N2 Header Isolation Valve
vent
From Refrigeration
RV PI Rupture
Disk

To From MRS
VCS Valve which let water in 40 PSI

Refrigerator
Vent Quench Filter - pressure
safety valve lines
not (at ground level)

working! Phosphene Stripping - Tank No. 610

Still Filter- pressure To Reactor Conditioner
safety valve lines
(at ground level)
Concrete Cover
Water Drain Educator
Reaction
 Probable Route of Gas Leakage
after 0030 hrs
Jumper
To VCS RWH Line Line

To VGS and FVH FVH Line

Increased rate of release
PI
MRS MIC Reactor Side
RVVH Relief Valve Vent Header
PVH Process Valve Vent Header
VGS Vent Gas Scrubber
FVH Flare Vent Header
Route of gas leakage before 0030 N2 Header Isolation Valve

From Refrigeration
RV PI Rupture
Disk

To From MRS
VCS Valve which let water in 40 PSI

Rupture disk bursts Refrigerator

Quench Filter - pressure
safety valve lines
(at ground level)

Phosphene Stripping - Tank No. 610

Still Filter- pressure To Reactor Conditioner
safety valve lines
(at ground level)

Concrete Cover
Water Drain Educator
 The Incident

No alarm or warning to public

Very stable atmosphere and
low wind directly into town

Surrounding population
asleep

Over 2,500 fatalities

Over 250,000 sought medical
treatment

Panic
 The Incident’s Extent

Note how the cloud boundary
(to the level of “serious” harm)
almost exactly matches the
area of highest population
density

Had the wind blown north the
Bhopal incident, although it
would have still been serious,
would have been less
disastrous

Other incidents could have been
worse but for luck in timing and
the wind direction

Seveso (wind direction)

Flixborough (occurred at a
week-end)
 Incident Chemistry

Chemistry causing incident is
not in dispute

41 tonnes of MIC in storage
reacted with 500 to 900 kg
water plus contaminants
Resultant exothermic reaction

Resultant
reached 400 to 480ºF
(200 to 250ºC)

Tank pressure rose to 200+
psig (14+ bar) - tank was
designed for 70 psig (4 bar)

Venting caused ground to
shake!
 Incident Causes

No universally accepted cause.

Sabotage theory

Disgruntled employee

Alternative theory involves connection of
water hose to storage tank 610

Evidence said to include the finding of the
disconnected pressure gauge from tank 610
after the disaster

A rough drawing found, said to depict a hose
connected to a pressure vessel

Management systems theory
Z
Z
OR
Z
Z
?

Inadequate safety management allowed water Z

entry through inadequate slip-blinding and

uncontrolled plant modifications

Design safeguards should have prevented
the disaster of either case
 Incident Causes

Many theories can be put

forward and all mechanisms
give insights into the
vulnerability of the system

Main objective is to learn from

the consequences; multiple
possible causes only serve to
highlight the weaknesses
 What Could Safety Studies have
done?

Early safety study would question

hazardous inventories and plant
siting Lessons

Detailed study would identify Learnt
contamination problem

Safety Studies may propose a
training function, should involve
parent company staff

Safety Studies may review
procedures, especially those
involving hazards (water washing?)
 What Could Safety Studies have
done?

Safety Studies on modifications:

Disconnecting flare system Lessons

Not running refrigeration Learnt
Jumper pipe between vent

Jumper
headers

Stopping scrubber caustic
circulation

Safety Studies would emphasise
need for emergency plans
• The Flixborough disaster was an
explosion at a chemical plant close
to the village of Flixborough England
on 1 st June 1974.

• It killed 28 people and seriously

injured 26

28
• The chemical plant, owned by Nypro (UK) and
in operation since 1967.

• Produced caprolactam, a precursor chemical

used in the manufacture of nylon.

• The process involved oxidation of cyclohexane

with air in a series of six reactors to produce a
mixture of cyclohexanol and cyclohexanone.

29
• Two months prior to the explosion, a
crack was discovered in the number
5 reactor.

• It was decided to install a temporary

50 cm (20 inch) diameter pipe to
bypass the leaking reactor to allow
continued operation of the plant
while repairs were made.

30
 The Disaster
• At 16:53 on Saturday 1 June 1974, the temporary bypass
pipe (containing cyclohexane at 150°C and 1 MPa) ruptured,
possibly as a result of a fire on a nearby 8 inch (20 cm) pipe
which had been burning for nearly an hour.

• Within a minute, about 40 tonnes of the plant's 400 tonne

store of cyclohexane leaked from the pipe and formed a
vapour cloud 100–200 metres in diameter.

31
• The cloud, on coming in contact with an ignition source
(probably a furnace at a nearby hydrogen production plant)
exploded, completely destroying the plant.

• Around 1,800 buildings within a mile radius of the site were

damaged.

32
• The fuel-air explosion was estimated to be equivalent
to 15 tonnes of TNT and it killed all 18 employees in
the nearby control room. Nine other site workers were
killed, and a delivery driver died of a heart attack in his
cab.
• Had the explosion occurred on a weekday, more than
500 plant employees would likely have been killed.
• Resulting fires raged in the area for over 10 days and
the blast was heard (and felt) twenty-five miles away
in Grimsby.

33
 Consequences

• The official inquiry into the accident determined

that the bypass pipe had failed due to unforeseen
lateral stresses in the pipe during a pressure
surge.
• The bypass had been designed by engineers who
were not experienced in high-pressure pipework,
no plans had been produced or calculations
produced, the pipe was not pressure-tested, and
was mounted on temporary scaffolding poles that
allowed the pipe to twist under pressure.

34