Published on November 7, 2007
Incident Case Description: Incident Case Description Bhopal, India 1984 Slide2: Bhopal located in North Central India Very old town in picturesque lakeside setting Tourist centre Industry encouraged to go to Madhya Pradesh as part of a policy to bring industry to less developed states Annual rent $40 per acre Decision by Union Carbide in 1970 to build was welcomed Bhopal Capitol of Madhya Pradesh The Setting Slide3: Operator : Union Carbide India Ltd. Half owned by Union Carbide USA (50.9%) Plant built to produce carbonyl pesticide : SEVIN-DDT substitute Very successful initially - part of India’s Green Revolution Initial staff 1000 The Plant Slide4: Initially in quiet suburb Later the town expanded around it Attracted a large squatter camp, as in many third world countries The Surroundings Slide5: SEVIN manufactured from Carbon Monoxide (CO) imported by truck Monomethylamine (MMA) Chlorine (Cl2) made on site Alpha-Napthol (AN) Process route CO + Cl2 COCl2 (Phosgene) COCl2 + MMA MMC + MIC MIC stored in three 15,000 gal tanks MIC + AN SEVIN } } The Sevin Process Slide6: Toxic, flammable gas Boiling point is near to ambient Runaway reaction with water possible unless chilled below 11 C M I C Hazards NFPA Diamond Flammability Toxicity Reactivity DOT = US Dept of Transport CAS = Chemical Abstracts No. ID = United Nations Ref No. Properties of MIC Slide7: (National Fire Protection Association) Right Side Top of Diamond Left Side Extract from NFPA 704 Slide8: Simplified Process Flow Chart Slide9: MIC Storage Tank Slide10: MIC Safeguards Table Slide11: 1. Why it was not categorized as passive? It is permanently installed 2. What would you say constitutes a passive safeguard ? The vent gas scrubber was defined previously as an active safeguard What do we mean by Safeguards? Slide12: Accidents are normally characterised by a sequence of events leading from the initiating event, propagation of the accident, and realisation of the undesired outcome Safeguards may be equipment items or procedures designed to prevent the initiating event, limit or terminate the propagation, or mitigate the outcome Active safeguards are those which require human procedures or mechanical initiation to operate (e.g. work permit procedures, scrubber caustic circulation) Safeguards Slide13: Passive safeguards are those which are designed in and which do not require any initiation (e.g. concrete fireproofing, elevated vent stack for dispersion) Both active and passive safeguards can be defeated through inadequate Safety Management Systems Safeguards Slide14: A-Napthol plant shut down SEVIN production no longer making money, so cost savings sought, and plant run intermittently Minimum maintenance Safety procedures simplified for small jobs Refrigeration unit shut down and Freon sold Scrubber circulation stopped Manning cut to 600 Morale low Slip blinding no longer mandatory during washing High temperature alarm shut-off as T now > 11 C RV and PCV headers joined (for maintenance) Emergency flare line corroded, disconnected 1981-1984: 6 accidents with phosgene or MIC 1982 audit critical of MIC tank and instrumentation 1984 warning of potential runaway reaction hazard Plant Problems – Precursor to Disaster Slide15: Occurred late at night, soon after shift change MIC tank overheated, over-pressured and vented through scrubber Elevated discharge of massive quantity of MIC (approximately 25 tons) Operational staff retreated upwind, no casualties Staff from other plants evacuated, few casualties The Incident Slide16: Source of Water Filters were being flushed using high pressure water Drain line from filter was blocked, operator observed no flow to drain Flushing continued despite blockage High pressure could cause valve leak; force water into relief header and then? Incident Causes Slide17: Route of Water RV and PCV headers were joined by jumper pipe, no blinds MIC tank could not be pressurised because tank PCV failed open? Leakage through a single valve would allow water from RV header to enter tank Head of water sufficient for flow Slow initial reaction would allow 1600 lbs. to enter Incident Causes Slide18: Probable Route of Ingress of Water into Tank 610 Slide19: Probable Route of Gas Leakage before 0030 hrs Slide20: Probable Route of Gas Leakage after 0030 hrs Slide21: No alarm or warning to public Very stable atmosphere and low wind directly into town Surrounding population asleep Over 2,500 fatalities Over 250,000 sought medical treatment Panic The Incident Slide22: Note how the cloud boundary (to the level of “serious” harm) almost exactly matches the area of highest population density Had the wind blown north the Bhopal incident, although it would have still been serious, would have been less disastrous Other incidents could have been worse but for luck in timing and the wind direction Seveso (wind direction) Flixborough (occurred at a week-end) The Incident’s Extent Slide23: Chemistry causing incident is not in dispute 41 tonnes of MIC in storage reacted with 500 to 900 kg water plus contaminants Resultant exothermic reaction reached 400 to 480ºF (200 to 250ºC) Tank pressure rose to 200+ psig (14+ bar) - tank was designed for 70 psig (4 bar) Venting caused ground to shake! Incident Chemistry Slide24: No universally accepted cause. Sabotage theory Disgruntled employee Alternative theory involves connection of water hose to storage tank 610 Evidence said to include the finding of the disconnected pressure gauge from tank 610 after the disaster A rough drawing found, said to depict a hose connected to a pressure vessel Management systems theory Inadequate safety management allowed water entry through inadequate slip-blinding and uncontrolled plant modifications Design safeguards should have prevented the disaster of either case OR ? Incident Causes Slide25: Many theories can be put forward and all mechanisms give insights into the vulnerability of the system Main objective is to learn from the consequences; multiple possible causes only serve to highlight the weaknesses Incident Causes Slide26: Early safety study would question hazardous inventories and plant siting Detailed study would identify contamination problem Safety Studies may propose a training function, should involve parent company staff Safety Studies may review procedures, especially those involving hazards (water washing?) What Could Safety Studies have done? Slide27: Safety Studies on modifications: Disconnecting flare system Not running refrigeration Jumper pipe between vent headers Stopping scrubber caustic circulation Safety Studies would emphasise need for emergency plans What Could Safety Studies have done?