Incident Case

Description
Bhopal, India
1984

The Setting
Bhopal located in North Central
India
Very old town in picturesque
lakeside setting
Tourist centre
Industry encouraged to go to
Madhya Pradesh as part of a
policy to bring industry to less
developed states
Annual rent $40 per acre
Decision by Union Carbide in
1970 to build was welcomed

Bhopal Capitol of
Madhya Pradesh

The Plant
Operator : Union Carbide India Ltd.
Half owned by Union Carbide USA (50.9%)
Plant built to produce carbonyl pesticide :
SEVIN-DDT substitute
Very successful initially - part of Indias
Green Revolution
Initial staff 1000

The Surroundings
Initially in quiet suburb
Later the town expanded
around it
Attracted a large
squatter camp, as in
many third world
countries

The Sevin Process

SEVIN manufactured from
Carbon Monoxide (CO)

Monomethylamine (MMA)
Chlorine (Cl2)

}
}

imported by truck

made on site

Alpha-Napthol (AN)
Process route
CO + Cl2

COCl2 (Phosgene)

COCl2 + MMA

MMC + MIC

MIC stored in three 15,000 gal tanks

MIC + AN

SEVIN

Properties of MIC
Flammability
Toxicity

Reactivity

NFPA Diamond
DOT = US Dept of Transport
CAS = Chemical Abstracts No.
ID = United Nations Ref No.

M I C Hazards
Toxic, flammable gas
Boiling point is near to
ambient
Runaway reaction with
water possible unless
chilled below 11 C

Extract from NFPA 704

(National Fire Protection Association)
Right Side

Top of Diamond

Left Side

Simplified Process Flow Chart

MMA

Phosgene

Reaction
ReactionSystem
System
Chloroform
Phosgene
PhosgeneStill
Still
HCl
Residue

Flare and Scrubber

Pyrolysis
Pyrolysis
Tails
MIC
MICRefining
RefiningStill
Still
MIC
MICStorage
Storage

Derivatives Plant

MIC Storage Tank

MIC Safeguards Table

SAFEGUARD

TYPE

1.

Mounded/insulated MIC Tanks

Passive

2.

Refrigeration below reaction initiation temperature

Active

3.

Refrigeration uses non-aqueous refrigerant (Freon)

Active

4.

Corrosion protection (cathodic) to prevent water ingress

Active

5.

Rigorous water isolation procedures (slip blinds)

Active

6.

Nitrogen padding gas used for MIC transfer not pumped

Active

7.

Relief Valve and rupture disk

Passive

8.

Vent gas scrubber with continuous caustic circulation

Active

9.

Elevated flare

10.

Water Curtain around MIC Tanks

Passive + Active
Active

What do we mean by Safeguards?

The vent gas scrubber was defined
previously as an active safeguard
1. Why it was not categorized as
passive? It is permanently installed
2. What would you say constitutes a
passive safeguard ?

Safeguards

Accidents are normally characterised by

a sequence of events leading from the
initiating event, propagation of the
accident, and realisation of the undesired
outcome
Safeguards may be equipment items or
procedures designed to prevent the
initiating event, limit or terminate the
propagation, or mitigate the outcome
Active safeguards are those which
require human procedures or mechanical
initiation to operate (e.g. work permit
procedures, scrubber caustic circulation)

Safeguards
Passive safeguards are those which are
designed in and which do not require any
initiation (e.g. concrete fireproofing,
elevated vent stack for dispersion)
Both active and passive safeguards can
be defeated through inadequate Safety
Management Systems

Plant Problems Precursor to

Disaster
A-Napthol plant shut down
SEVIN production no longer making
money, so cost savings sought, and
plant run intermittently
Minimum maintenance
Safety procedures simplified for
small jobs
Refrigeration unit shut down and
Freon sold
Scrubber circulation stopped
Manning cut to 600
Morale low
Slip blinding no longer mandatory
during washing
High temperature alarm shut-off as
T now > 11 C

RV and PCV headers joined

(for maintenance)
Emergency flare line
corroded, disconnected
1981-1984: 6 accidents with
phosgene or MIC
1982 audit critical of MIC
tank and instrumentation
1984 warning of potential
runaway reaction hazard

The Incident
Occurred late at night, soon after shift change
MIC tank overheated, over-pressured and vented
through scrubber
Elevated discharge of massive quantity of MIC
(approximately 25 tons)
Operational staff retreated upwind, no casualties
Staff from other plants evacuated, few casualties

Incident Causes
Source of Water
Filters were being flushed using high pressure
water
Drain line from filter was blocked, operator
observed no flow to drain
Flushing continued despite blockage
High pressure could cause valve leak; force
water into relief header and then?

Incident Causes
Route of Water
RV and PCV headers were joined by jumper pipe,
no blinds
MIC tank could not be pressurised because tank
PCV failed open?
Leakage through a single valve would allow
water from RV header to enter tank
Head of water sufficient for flow
Slow initial reaction would allow 1600 lbs. to
enter

Probable Route of Ingress of

Water into Tank 610
To VCS

Jumper
Line

RWH Line
To VGS and FVH
MRS
RVVH
PVH
VGS
FVH

To
VCS

MIC Reactor Side

Relief Valve Vent Header
Process Valve Vent Header
Vent Gas Scrubber
Flare Vent Header
Route of water ingress

Slip Blind
required here

PI

N2 Header Isolation Valve

RV

PI

From Refrigeration

Rupture
Disk

From MRS

40 PSI

Valve which let water in

Water
Source
Area

FVH Line

Refrigerator

Quench Filter - pressure

safety valve lines
(at ground level)
Phosphene Stripping Still Filter- pressure
safety valve lines
(at ground level)
Water Drain

Tank No. 610

To Reactor Conditioner

Educator

Concrete Cover

Ultimate destination of water

Probable Route of Gas Leakage

before 0030 hrs
To VCS

Jumper
Line

RWH Line
To VGS and FVH

MIC
to
vent

MRS
RVVH
PVH
VGS
FVH

MIC Reactor Side

Relief Valve Vent Header
Process Valve Vent Header
Vent Gas Scrubber
Flare Vent Header
Route of gas leakage after 0030

PI

N2 Header Isolation Valve

RV

To
VCS

Vent
not
working!

FVH Line

PI

From Refrigeration

Rupture
Disk

From MRS

40 PSI

Valve which let water in

Refrigerator

Quench Filter - pressure

safety valve lines
(at ground level)
Phosphene Stripping Still Filter- pressure
safety valve lines
(at ground level)
Water Drain

Tank No. 610

To Reactor Conditioner

Educator

Concrete Cover

Reaction

Probable Route of Gas Leakage

after 0030 hrs
To VCS

Jumper
Line

RWH Line
To VGS and FVH

Increased rate of release

MRS
RVVH
PVH
VGS
FVH

PI

MIC Reactor Side

Relief Valve Vent Header
Process Valve Vent Header
Vent Gas Scrubber
Flare Vent Header
Route of gas leakage before 0030

N2 Header Isolation Valve

RV

To
VCS

FVH Line

PI

From Refrigeration

Rupture
Disk

From MRS

40 PSI

Valve which let water in

Rupture disk bursts

Refrigerator

Quench Filter - pressure

safety valve lines
(at ground level)
Phosphene Stripping Still Filter- pressure
safety valve lines
(at ground level)
Water Drain

Tank No. 610

To Reactor Conditioner

Educator

Concrete Cover

The Incident
No alarm or warning to public
Very stable atmosphere and low wind
directly into town
Surrounding population asleep
Over 2,500 fatalities
Over 250,000 sought medical treatment
Panic

The Incidents Extent

Note how the cloud boundary (to
the level of serious harm) almost
exactly matches the area of
highest population density
Had the wind blown north the
Bhopal incident, although it would
have still been serious, would have
been less disastrous
Other incidents could have been
worse but for luck in timing and
the wind direction
Seveso (wind direction)
Flixborough (occurred at a
week-end)

Incident Chemistry
Chemistry causing incident is not in
dispute
41 tonnes of MIC in storage reacted with
500 to 900 kg water plus contaminants
Resultant exothermic reaction reached
400 to 480F
(200 to 250C)
Tank pressure rose to 200+ psig (14+ bar)
- tank was designed for 70 psig (4 bar)
Venting caused ground to shake!

Incident Causes
No universally accepted cause.
Sabotage theory

Disgruntled employee
Alternative theory involves connection of
water hose to storage tank 610
Evidence said to include the finding of the
disconnected pressure gauge from tank 610
after the disaster
A rough drawing found, said to depict a hose
connected to a pressure vessel

Management systems theory

Inadequate safety management allowed water

entry through inadequate slip-blinding and
uncontrolled plant modifications

Design safeguards should have prevented

the disaster of either case

Z
Z

OR
Z

Incident Causes
Many theories can be put forward and all
mechanisms give insights into the vulnerability of
the system
Main objective is to learn from the consequences;
multiple possible causes only serve to highlight
the weaknesses

What Could Safety Studies have

done?
Early safety study would question
hazardous inventories and plant
siting
Detailed study would identify
contamination problem
Safety Studies may propose a
training function, should involve
parent company staff
Safety Studies may review
procedures, especially those
involving hazards (water washing?)

Lessons
Learnt

What Could Safety Studies have

done?
Safety Studies on modifications:
Disconnecting flare system
Not running refrigeration
Jumper pipe between vent headers
Stopping scrubber caustic
circulation
Safety Studies would emphasise need
for emergency plans

Lessons
Learnt