Hydrocarbon Processing Copying and distributing are prohibited without permission of the publisher
Email a friend
  • Please enter a maximum of 5 recipients. Use ; to separate more than one email address.



The Bhopal disaster

06.01.2012  |  Jung, B.,  Consultant, Woodbury, MinnesotaBloch, K. ,  Consultant, Rosemount, Minnesota

Avoid future incidents by learning the full impact of unreliable plant machinery.

Keywords: [Bhopal] [safety] [machinery] [failure] [accident] [death] [management] [procedures] [Methyl isocyanate]

A common misconception lingering today is that the toxic chemical release in Bhopal, India, was an extreme, outlier event. However, when the public record is considered, a different picture emerges. What follows is a careful and recent evaluation of information that has slowly been released into the public domain over a twenty-seven year period. The warnings this assessment offers should be of poignant interest and concern for all organizations responsible for the lives of others.

Methyl isocyanate release

Union Carbide began producing methyl isocyanate (MIC) in Bhopal, India, on February 5, 1980.1 MIC is a highly reactive intermediate chemical that Union Carbide used to manufacture various pesticides. It is also a very lethal substance that can be harmful or fatal if inhaled or absorbed through the skin.2 MIC reacts exothermically with a variety of potential contaminants including rust and particularly water.2

Routine maintenance activities were taking place in the factory on the evening of December 2, 1984. Sometime around 10:45 p.m., a large quantity of water began entering a chemical storage tank containing over 40 tons of MIC. The reaction mixture inside the tank progressively warmed as conditions moved closer to a thermal runaway reaction.

Water continued entering the tank until shortly after midnight (December 3, 1984), when the thermal runaway reaction took place. This caused the MIC storage tank’s pressure gauge, shown in Fig. 1, to suddenly spike above scale.3 Although this drew attention to the tank, it was too late to stop the catastrophic loss of process containment.

  Fig. 1. a) MIC storage tank 610 control room
  pressure gauge. b) MIC storage tank control
  room temperature gauge.


Shortly after the runaway reaction occurred, hot MIC vapor burst through the tank’s automatic pressure relief system and into the relief valve vent header (RVVH).3 Although this prevented an explosion, a major release involving up to 40 tons of toxic MIC drifted downwind into the surrounding community. By morning, thousands of people and animals were dead.4

Systems that should have prevented the release, including a refrigeration unit and alarms, failed. None of the safety equipment capable of containing the potential release or at least minimizing its consequences had worked either. The factory never reopened and Union Carbide, once an undisputed leader in the chemical manufacturing industry, struggled to survive before selling off its remaining business in 1999.5

About MIC

Carbon steel is incompatible with MIC.4 Rust (Fe2O3) catalyzes the exothermic MIC trimerization reaction shown in Fig. 2.4 This reaction forms a nuisance deposit that can clog pipes.6 Therefore, stainless steel is recommended in MIC service.6 In theory, more economical carbon steel components could be substituted when protected by a corrosion inhibitor4 such as nitrogen. If so, then the inert gas would be critical for mechanical integrity (corrosion and fouling resistance). However, stainless steel represents an inherently safe choice that eliminates the reactivity hazard associated with carbon steel.4

  Fig. 2. MIC trimerization reaction.



Designing the disaster

In March 1985, Union Carbide issued an investigation report3 that included the piping and instrumentation diagram (P&ID) shown in Fig. 3. The P&ID shows the MIC storage tank design. Fig. 3 provides design information that explains how equipment reliability contributed to the Bhopal disaster.

  Fig. 3. Original MIC storage tank P&ID.



The MIC produced at the factory was stored in two stainless steel storage tanks, designated as Tanks 610 and 611.4 An identical tank (Tank 619) received contaminated material from either Tank 610 or 611 on an emergency basis only.3 This tank provided extra storage volume to allow for an adequate response to a potential thermal runaway reaction.3 A nitrogen blanket4 was used to maintain slight pressure6 inside the MIC storage tanks while continuously purging MIC vapor into the process vent header (PVH).

The tanks were equipped with the two centrifugal pumps appearing in Fig. 3. Each of the pumps had a specific function. The “transfer pump” exported stored MIC into the derivatives unit as needed to produce pesticides. The “circulation pump” processed MIC through a fluorocarbon-based refrigeration system.7 The refrigeration system kept the stored MIC temperature near 0°C3 to prevent a thermal runaway reaction.2

The pumps were connected to four flanged nozzles on the side of each tank head. Fig. 4 shows how these nozzles were configured on Tank 610. Both pumps circulated MIC through internal pipe extensions that dropped to the tank bottom, as shown in the P&ID. The discharge lines returning to the tank were provided so that the pumps would operate continuously.

  Fig. 4. MIC storage tank 610 side-head nozzle
  configuration.



Procedures

The factory suffered from a series of chronic MIC leaks.8 MIC is a highly volatile compound that represents an immediate exposure hazard upon its release.2 For reference purposes, the eight-hour threshold limit value (TLV) for MIC is 0.02 ppm5 compared to a 10 ppm TLV for H2S. MIC could therefore not safely be released into the environment.2

Although the transfer pumps were provided to export MIC into the derivatives unit, there is no record of their use at any time while the factory was in operation. Instead, an alternative transfer method was developed that excluded the pumps. This method involved raising the MIC storage tank pressure to at least 14 psig with nitrogen.9 Under these conditions, the MIC would reverse-flow directly into the derivatives unit through the alternative pathway shown in Fig. 5. This practice minimized the potential for transfer pump seal failures to expose factory workers to the lethal process.6

  Fig. 5. Alternative MIC storage tank operating method.



However, nonstandard operating procedures10 may address one hazard while introducing others. In this case, pressurizing the tanks in order to bypass the transfer pumps required isolating the tanks from the PVH. As the P&ID shows, this interrupted excess nitrogen flow into the PVH.4

Loss of excess nitrogen flow was an issue because the PVH and RVVH were made of carbon steel.4 Fig. 6 shows the vent gas scrubber (VGS) piping configuration. The photograph shows that the vent header inlet pipes enter above the VGS caustic overflow line. Therefore, air migrated into the atmospheric VGS when nitrogen was isolated to pressurize the tanks. Afterward, the inert environment inside the PVH and RVVH ceased to exist. The vent lines started to corrode,4 which produced rust. Rust catalyzes the formation of MIC trimer deposits, according to Fig. 2.

  Fig. 6. Vent gas scrubber pipe configuration.



After sealing the tanks, other MIC vapor sources continued venting into the PVH.3 This prompted the creation of a maintenance procedure to remove MIC trimer deposits polymerizing inside the PVH and RVVH. The procedure involved flushing out the MIC trimer deposits with water.11

Although MIC could still be exported without the transfer pumps, there was no way to refrigerate MIC without operating the circulation pumps. A seal failure on or before January 7, 1982,8 provided a maintenance opportunity to “upgrade” the original metallic seal with a more fouling resistant, but weaker ceramic seal.6 In MIC fouling service (reactive environment), using a ceramic seal may seem logical. But if a force-related failure mechanism is causing unacceptable seal performance, then a lower strength ceramic material may not be the best choice.12

On January 9, 1982, the fragile ceramic substitute seal was shattered in an unprecedented catastrophic failure.8 This failure produced a massive MIC release that sent about 25 workers to the hospital with serious injuries.13 On January 12, 1982, a formal notice was issued to declare that the refrigeration system was being shut down.8 In doing so, a third non-standard operating procedure was introduced: running the plant without MIC refrigeration.

Disabling instruments and alarms

After shutting down refrigeration system, the MIC storage temperature varied from about 15°C to 40°C.14 This new operating range exceeded the 11°C MIC storage tank high temperature alarm14 in the control room (Fig. 7). Therefore, the high temperature alarms were disconnected.3 Likewise, the actual temperature inside the tank was unknown8 after shutting down the refrigeration system because the control room temperature gauge (Fig. 1) was not scaled for operation above +25°C. Similarly, the normal operating pressure inside the tank increased from less than 2 psig2 with an unobstructed tank vent open to the PVH6 to about 25 psig3 after bypassing the MIC transfer pumps.

  Fig. 7. MIC storage tank 610 high temperature
  panel alarm.



In April 1982, factory workers printed hundreds of handouts expressing their concern about decisions being made inside the factory that might influence the community outside the factory.8 In May 1982, an independent audit team from the US arrived in Bhopal to perform a safety audit.6 The audit report formalized several recommendations that might improve managing the MIC pump hazards. For example, it was recommend that a nitrogen purge system with low flow alarms at an alternative MIC system venting into the PVH6 should be installed (this would restore the inert environment inside the PVH and RVVH without operating the transfer pumps). Installing dual seals on centrifugal pumps6 was also recommended. Another recommendation was to provide water spray protection for the MIC pumps in the storage area, for vapor cloud suppression.15

The audit team complimented the factory’s creative approach to improving workplace safety with nonstandard operating and maintenance procedures.4 It is, therefore, understandable why the decision to shut down the refrigeration system was not questioned.8 Accordingly, the factory’s safety manuals were rewritten in 1983 and 1984 to reflect actual operation without MIC refrigeration.8

The fateful night

On the evening of December 2, 1984, the vent lines were corroded and choked with MIC trimer deposits.4 The pipes were being flushed with water to remove the MIC trimer deposits.13 MIC trimer deposits form in the presence of rust. Rust forms on carbon steel pipes not protected by an inhibitor. The inhibitor (nitrogen) was isolated from the PVH and RVVH in order to pressurize the MIC storage tanks. The MIC storage tanks were pressurized to bypass the transfer pumps.

Somehow, water entered Tank 610, which contained over 40 tons of MIC. Under normal circumstances, this would have activated the tank’s high temperature alarm. But the high temperature alarm was disconnected when the refrigeration system was shut down. Likewise, the control room MIC temperature gauge could not be trusted because it normally read above scale without refrigeration. The refrigeration system was shut down almost three years before the incident4 because pump seal failures exposed factory workers to the hazardous process. The contamination event inside Tank 610 remained hidden while the reaction mixture temperature continued rising.

Tank 610’s vent valve was leaking on the evening of December 2, 1984.4 The MIC storage tank pressure increased as the reaction mixture evolved more vapors into the PVH.3 Although the control room pressure gauge seemed to be within normal range for a sealed tank,3 the tank was not sealed.3 Therefore, contamination was not detected until a thermal runaway reaction took place, which sent the tank’s pressure gauge off scale.13 Although factory workers responded immediately, by that time it was too late.

The refrigeration equipment and process alarms were provided to prevent a thermal runaway reaction should the MIC be contaminated by any means. But process safety was compromised in an attempt to manage personal exposure hazards represented by potential pump seal failures.

Can we learn more from Bhopal?

Bhopal forever changed the way industry approaches process safety management (PSM). Increasing clarity around the events leading up to the release complements and reinforces these important lessons. Time has allowed us to take an even closer look at regrettable decisions that resulted in disabling the system whose purpose it was to prevent the scenario that resulted in the release. Most industry professionals no doubt plainly see from this examination that we confront the same decisions at work every day. Perhaps this is the message contained in “recognized and generally accepted good engineering practices.” The decisions we make throughout the life of a process, especially before its construction, can and will affect us as well as all those who follow.

As an industry professional you will make decisions daily that as a whole define your process safety identity. We can’t tell you what the right answers are. It is therefore important to allow your conscience be guided by what took place in Bhopal. This is where Bhopal has even more redeeming value. With these thoughts in mind, the focus is on insightful advice:

  • When you choose not to investigate a chronic failure, remember Bhopal.
  • When the right choice is not the most economical choice, remember Bhopal.
  • When choosing to accept actual operation because you cannot get expected or design operation, remember Bhopal.
  • When designing a solution that manages a hazard instead of eliminating it, remember Bhopal.
  • When tempted to execute a procedure the way you think it should be written instead of how it is actually written, remember Bhopal.
  • When thinking about substituting engineered equipment with people, remember Bhopal.
  • When you perform a safety audit, remember Bhopal.
  • When redesigning a system to make it “safer,” remember Bhopal.
  • When operators have concerns with a decision you are about to make, remember Bhopal.
  • When making changes for the sake of improving personal safety, remember Bhopal.

Finding your identity

After 27 years, there are two prevailing theories that may explain how water entered the MIC storage tank. An examination of the events preceding the incident supports the argument that this detail is irrelevant.5 However, the explanation you favor is governed by your process safety identity. If you believe that a single event can cause a process safety incident of extraordinary magnitude, then the cause was probably sabotage. But if you believe that significant process safety failures result from a complex series of interacting events that may include design defects, repeat failures and missed warning signals, then maybe the cause was inadequate process isolation during a routine maintenance procedure (perhaps even during a maintenance activity required to contain the process in a factory like yours).

What can you do?

When you report for work tomorrow, remember Bhopal. And when you return to the comfort of your home, convince yourself it is because you did. HP

PHOTO CREDITS

Figs. 1, 6 and 7: Dennis Hendershot Fig. 4: Paul Cochrane

LITERATURE CITED

1 Deposition of Vinod Kumar Tyagi, “Proceedings before the chief judicial magistrate, Bhopal on March 6, 7, and 8, 2000 in criminal case No. RT-8460/96,” 2010, http://bhopal.net/oldsite/oldwebsite/new2depo.html.
2 Union Carbide Corporation, “Review of MIC production at the Union Carbide Corporation Facility Institute West Virginia April 15, 1985,” Danbury, Connecticut, 1985, http://nepis.epa.gov/Exe/ZyPURL.cgi?Dockey=2000W9PM.txt.
3 Union Carbide Corporation, “Bhopal MIC incident investigation team report March, 1985,” Danbury, Connecticut, 1985, http://nepis.epa.gov/Exe/ZyPURL.cgi?Dockey=2000W9PM.txt (at Attachment 1).
4 District Court of Bhopal, India, “State of Madhya Pradesh vs. Warren Anderson & Others,” June 7, 2010, http://www.indiaenvironmentportal.org.in/files/UCIL.pdf.
5 Willey, R., D. Hendershot and S. Berger, “The accident in Bhopal: Observations 20 years later,” 40th Loss Prevention Symposium, Orlando, 2006, http://www.aiche.org/uploadedfiles/ccps/about/bhopal20yearslater.pdf.
6 D’Silva, T., The Black Box of Bhopal, Trafford Publishing, Victoria, BC, Canada, 2006, ISBN 978-1-4120-8412-3
7 Worthy, W., “Methyl Isocyanate: The Chemistry of a Hazard,” Chemical & Engineering News, p. 30, February 11, 1985.
8 Supreme Court of India, “Curative Petition (Criminal) No. 39-42 of 2010 in Criminal Appeal No. 1672-75 of 1996 on Bhopal Gas Disaster,” April 2011, http://www.indiaenvironmentportal.org.in/files/CriminalCurativeBhopal.pdf.
9 Kalelkar, A. S., “Investigation of large-magnitude incidents: Bhopal as a case study,” Institution of Chemical Engineers Conference on Preventing Major Chemical Accidents, London, UK, 1988, http://www.bhopal.com/~/media/Files/Bhopal/casestdy.pdf.
10 Wines, M., “Firm calls ‘deliberate’ act possible in Bhopal disaster,” Los Angeles Times, March 21, 1985, http://articles.latimes.com/1985-03-21/news/mn-20658_1_bhopal-disaster#.Tr6AWuGD4LY.
11 Examination of Dr. S. Varadarajan, “Proceedings before the chief judicial magistrate, Bhopal on January 10 and 11, 2000, in Criminal Case No. RT-8460/96,” http://bhopal.net/oldsite/oldwebsite/newdepo.html.
12 Bloch, H. P., Pump Wisdom, John Wiley & Sons, Hoboken, NJ, 2011. ISBN 978-1-118-04123-9
13 Agarwal, A. and S. Narain (editors), “The Bhopal Disaster,” State of India’s Environment 1984-85: The Second Citizens’ Report, p. 207, 215, 1985, http://www.cseindia.org/userfiles/THE%20BHOPAL%20DISASTER.pdf.
14 Supreme Court of India, “Supreme Court Judgment on Bhopal Gas Disaster,” September 13, 1996, http://www.indiaenvironmentportal.org.in/files/SC%20judgement%20of%201996.doc.
15 Union Carbide Corporation, “Operational Safety Survey,” Danbury, CT, 1982, p. 6, http://bhopal.net/source_documents/1982%20safety%20audit.pdf.

The authors

Kenneth Bloch is a PHA/loss control engineer who specializes in petrochemical industry incident investigation and failure analysis. He speaks regularly at AFPM, API, and AIChE process safety symposiums on experiences that help prevent process safety failures in the manufacturing industry. Mr. Bloch graduated with honors from Lamar University in Beaumont, Texas, in 1988. 

Briana Jung is a senior operations engineer in the petrochemical industry. She is a certified PHA facilitator with over 10 years of process plant troubleshooting and optimization experience. Ms. Jung graduated from the University of Minnesota with a BS in chemical engineering in 2001. 




Have your say
  • All comments are subject to editorial review.
    All fields are compulsory.

André de Jager
01.31.2013

The audit team can only recommend changes, the local management is responsible for execution of recommendations. I think the audit team should have more authority.

Ingrid Eckerman
08.08.2012

I like very much the conclusions you did, of what we (you) can learn from the Bhopal disaster. I hope many engineers will read this. I add this article to the many references at Wikipedia. See also my book "The Bhopal Saga - causes and consequences of the world's largest industrial disaster" 2004. www.eckerman.nu

Keith Bowers
06.15.2012

The 'Bhopal Incident' is likely the most reviewed, analyzed, referenced tragedy resulting from a chemical or refining facility. This incident was a major driver in developing U.S. federal legislation regarding 'process safety'. HAZOP, PSM, PHA, and many other acronyms resulted, formalizing the legal requirement of Owners/Operators regarding obligations to 'the community' to maintain safe conditions at all times. Operators/Owners are obligated to know the plant is safe in all respects. Operators/Owners are also obligated to practice Process Safety Management ,Hazards Analyses, and HAZOPS prior to ANY change in either procedures, or physical changes to the facility.

Bhadresh Mehta
06.05.2012

Dear Editor,
I read the informative article on Bhopal disaster by K. Bloch and B. Jung in your Hydrocarbon Processing magazine of June, 2012. How all safety stanndards were bypassed for a storage Tank of Methyl isocyanate is descibed in very easy understandable article by authors. I have worked in Hydrocarbon Industries in India for 20 years and 24 years in US. I was to join this Bhopal Plant in September 1971 but I did not joined.

The authors have done a commandable job for the exhaustive search of documents of design and changes in operations. They analysed all scenerios and brought back home the the goal of safety and this shows their expert knowldge of maintenance and process. The Process Safety Management mandates contol of changes and design. This OSHA regulations Title 29 Part 1910.119 is a safe guard for such changes in the process of hazardous materials.

This article describes the design conditions and changes in operation of plant , bypass of Transfer Pumps, close of refrigeration plant and increase of blanketing nitogen pressure to 25 psig to transfer product for pesticide derivatives. The leak of water had run away reactions and loss of refrigeration caused release of cloud of Methyle isocyanate in atmosphere to cause a heavy loss of lives in the history of processing plants.

I have worked in Orthoxylene plant where they used ceramic seat in pumps operating above 240 F. Ceramic cracks at that temperature. There were many failures of mechanical seals of these pumps. We substituted with Ni resist seat and solved the problem. Byypassing alarms is a norm in operating plants. The choice of inferior materials is also a norm to reduce project cost. Except for main reactor / process vessel, the choice of carbon steel against alloy steel is also a norm in projects of chemical plants.

My experience of working in manufacturing plants concludes that design, process controls and alarms for unsafe conditions is adequate for processing plants. Management pays attention to a good design and mitigating risks in event of abnormal circumstances. However pressure to reduce cost by cutting manpower, out source without adequate quality control and short cuts are the root cause of all explosions and disasters.

Thanks Kenneth and Briana Jung for a fine article.

Related articles

FEATURED EVENT

GasPro North America

Sign-up for the Free Daily HP Enewsletter!

Boxscore Database

A searchable database of project activity in the global hydrocarbon processing industry

Poll

Should the US allow exports of crude oil? (At present, US companies can export refined products derived from crude but not the raw crude itself.)


66%

34%




View previous results

Popular Searches

Please read our Term and Conditions and Privacy Policy before using the site. All material subject to strictly enforced copyright laws.
© 2014 Hydrocarbon Processing. © 2014 Gulf Publishing Company.