A common misconception lingering today is that the toxic chemical release in Bhopal, India, was an extreme, outlier event. However, when the public record is considered, a different picture emerges. What follows is a careful and recent evaluation of information that has slowly been released into the public domain over a twenty-seven year period. The warnings this assessment offers should be of poignant interest and concern for all organizations responsible for the lives of others.
Methyl isocyanate release
Union Carbide began producing methyl isocyanate (MIC) in Bhopal, India, on February 5, 1980.1 MIC is a highly reactive intermediate chemical that Union Carbide used to manufacture various pesticides. It is also a very lethal substance that can be harmful or fatal if inhaled or absorbed through the skin.2 MIC reacts exothermically with a variety of potential contaminants including rust and particularly water.2
Routine maintenance activities were taking place in the factory on the evening of December 2, 1984. Sometime around 10:45 p.m., a large quantity of water began entering a chemical storage tank containing over 40 tons of MIC. The reaction mixture inside the tank progressively warmed as conditions moved closer to a thermal runaway reaction.
Water continued entering the tank until shortly after midnight (December 3, 1984), when the thermal runaway reaction took place. This caused the MIC storage tanks pressure gauge, shown in Fig. 1, to suddenly spike above scale.3 Although this drew attention to the tank, it was too late to stop the catastrophic loss of process containment.
Fig. 1. a) MIC storage tank 610 control room
pressure gauge. b) MIC storage tank control
room temperature gauge.
Shortly after the runaway reaction occurred, hot MIC vapor burst through the tanks automatic pressure relief system and into the relief valve vent header (RVVH).3 Although this prevented an explosion, a major release involving up to 40 tons of toxic MIC drifted downwind into the surrounding community. By morning, thousands of people and animals were dead.4
Systems that should have prevented the release, including a refrigeration unit and alarms, failed. None of the safety equipment capable of containing the potential release or at least minimizing its consequences had worked either. The factory never reopened and Union Carbide, once an undisputed leader in the chemical manufacturing industry, struggled to survive before selling off its remaining business in 1999.5
Carbon steel is incompatible with MIC.4 Rust (Fe2O3) catalyzes the exothermic MIC trimerization reaction shown in Fig. 2.4 This reaction forms a nuisance deposit that can clog pipes.6 Therefore, stainless steel is recommended in MIC service.6 In theory, more economical carbon steel components could be substituted when protected by a corrosion inhibitor4 such as nitrogen. If so, then the inert gas would be critical for mechanical integrity (corrosion and fouling resistance). However, stainless steel represents an inherently safe choice that eliminates the reactivity hazard associated with carbon steel.4
Fig. 2. MIC trimerization reaction.
Designing the disaster
In March 1985, Union Carbide issued an investigation report3 that included the piping and instrumentation diagram (P&ID) shown in Fig. 3. The P&ID shows the MIC storage tank design. Fig. 3 provides design information that explains how equipment reliability contributed to the Bhopal disaster.
Fig. 3. Original MIC storage tank P&ID.
The MIC produced at the factory was stored in two stainless steel storage tanks, designated as Tanks 610 and 611.4 An identical tank (Tank 619) received contaminated material from either Tank 610 or 611 on an emergency basis only.3 This tank provided extra storage volume to allow for an adequate response to a potential thermal runaway reaction.3 A nitrogen blanket4 was used to maintain slight pressure6 inside the MIC storage tanks while continuously purging MIC vapor into the process vent header (PVH).
The tanks were equipped with the two centrifugal pumps appearing in Fig. 3. Each of the pumps had a specific function. The transfer pump exported stored MIC into the derivatives unit as needed to produce pesticides. The circulation pump processed MIC through a fluorocarbon-based refrigeration system.7 The refrigeration system kept the stored MIC temperature near 0°C3 to prevent a thermal runaway reaction.2
The pumps were connected to four flanged nozzles on the side of each tank head. Fig. 4 shows how these nozzles were configured on Tank 610. Both pumps circulated MIC through internal pipe extensions that dropped to the tank bottom, as shown in the P&ID. The discharge lines returning to the tank were provided so that the pumps would operate continuously.
Fig. 4. MIC storage tank 610 side-head nozzle
The factory suffered from a series of chronic MIC leaks.8 MIC is a highly volatile compound that represents an immediate exposure hazard upon its release.2 For reference purposes, the eight-hour threshold limit value (TLV) for MIC is 0.02 ppm5 compared to a 10 ppm TLV for H2S. MIC could therefore not safely be released into the environment.2
Although the transfer pumps were provided to export MIC into the derivatives unit, there is no record of their use at any time while the factory was in operation. Instead, an alternative transfer method was developed that excluded the pumps. This method involved raising the MIC storage tank pressure to at least 14 psig with nitrogen.9 Under these conditions, the MIC would reverse-flow directly into the derivatives unit through the alternative pathway shown in Fig. 5. This practice minimized the potential for transfer pump seal failures to expose factory workers to the lethal process.6
Fig. 5. Alternative MIC storage tank operating method.
However, nonstandard operating procedures10 may address one hazard while introducing others. In this case, pressurizing the tanks in order to bypass the transfer pumps required isolating the tanks from the PVH. As the P&ID shows, this interrupted excess nitrogen flow into the PVH.4
Loss of excess nitrogen flow was an issue because the PVH and RVVH were made of carbon steel.4 Fig. 6 shows the vent gas scrubber (VGS) piping configuration. The photograph shows that the vent header inlet pipes enter above the VGS caustic overflow line. Therefore, air migrated into the atmospheric VGS when nitrogen was isolated to pressurize the tanks. Afterward, the inert environment inside the PVH and RVVH ceased to exist. The vent lines started to corrode,4 which produced rust. Rust catalyzes the formation of MIC trimer deposits, according to Fig. 2.
Fig. 6. Vent gas scrubber pipe configuration.
After sealing the tanks, other MIC vapor sources continued venting into the PVH.3 This prompted the creation of a maintenance procedure to remove MIC trimer deposits polymerizing inside the PVH and RVVH. The procedure involved flushing out the MIC trimer deposits with water.11
Although MIC could still be exported without the transfer pumps, there was no way to refrigerate MIC without operating the circulation pumps. A seal failure on or before January 7, 1982,8 provided a maintenance opportunity to upgrade the original metallic seal with a more fouling resistant, but weaker ceramic seal.6 In MIC fouling service (reactive environment), using a ceramic seal may seem logical. But if a force-related failure mechanism is causing unacceptable seal performance, then a lower strength ceramic material may not be the best choice.12
On January 9, 1982, the fragile ceramic substitute seal was shattered in an unprecedented catastrophic failure.8 This failure produced a massive MIC release that sent about 25 workers to the hospital with serious injuries.13 On January 12, 1982, a formal notice was issued to declare that the refrigeration system was being shut down.8 In doing so, a third non-standard operating procedure was introduced: running the plant without MIC refrigeration.
Disabling instruments and alarms
After shutting down refrigeration system, the MIC storage temperature varied from about 15°C to 40°C.14 This new operating range exceeded the 11°C MIC storage tank high temperature alarm14 in the control room (Fig. 7). Therefore, the high temperature alarms were disconnected.3 Likewise, the actual temperature inside the tank was unknown8 after shutting down the refrigeration system because the control room temperature gauge (Fig. 1) was not scaled for operation above +25°C. Similarly, the normal operating pressure inside the tank increased from less than 2 psig2 with an unobstructed tank vent open to the PVH6 to about 25 psig3 after bypassing the MIC transfer pumps.
Fig. 7. MIC storage tank 610 high temperature
In April 1982, factory workers printed hundreds of handouts expressing their concern about decisions being made inside the factory that might influence the community outside the factory.8 In May 1982, an independent audit team from the US arrived in Bhopal to perform a safety audit.6 The audit report formalized several recommendations that might improve managing the MIC pump hazards. For example, it was recommend that a nitrogen purge system with low flow alarms at an alternative MIC system venting into the PVH6 should be installed (this would restore the inert environment inside the PVH and RVVH without operating the transfer pumps). Installing dual seals on centrifugal pumps6 was also recommended. Another recommendation was to provide water spray protection for the MIC pumps in the storage area, for vapor cloud suppression.15
The audit team complimented the factorys creative approach to improving workplace safety with nonstandard operating and maintenance procedures.4 It is, therefore, understandable why the decision to shut down the refrigeration system was not questioned.8 Accordingly, the factorys safety manuals were rewritten in 1983 and 1984 to reflect actual operation without MIC refrigeration.8
The fateful night
On the evening of December 2, 1984, the vent lines were corroded and choked with MIC trimer deposits.4 The pipes were being flushed with water to remove the MIC trimer deposits.13 MIC trimer deposits form in the presence of rust. Rust forms on carbon steel pipes not protected by an inhibitor. The inhibitor (nitrogen) was isolated from the PVH and RVVH in order to pressurize the MIC storage tanks. The MIC storage tanks were pressurized to bypass the transfer pumps.
Somehow, water entered Tank 610, which contained over 40 tons of MIC. Under normal circumstances, this would have activated the tanks high temperature alarm. But the high temperature alarm was disconnected when the refrigeration system was shut down. Likewise, the control room MIC temperature gauge could not be trusted because it normally read above scale without refrigeration. The refrigeration system was shut down almost three years before the incident4 because pump seal failures exposed factory workers to the hazardous process. The contamination event inside Tank 610 remained hidden while the reaction mixture temperature continued rising.
Tank 610s vent valve was leaking on the evening of December 2, 1984.4 The MIC storage tank pressure increased as the reaction mixture evolved more vapors into the PVH.3 Although the control room pressure gauge seemed to be within normal range for a sealed tank,3 the tank was not sealed.3 Therefore, contamination was not detected until a thermal runaway reaction took place, which sent the tanks pressure gauge off scale.13 Although factory workers responded immediately, by that time it was too late.
The refrigeration equipment and process alarms were provided to prevent a thermal runaway reaction should the MIC be contaminated by any means. But process safety was compromised in an attempt to manage personal exposure hazards represented by potential pump seal failures.
Can we learn more from Bhopal?
Bhopal forever changed the way industry approaches process safety management (PSM). Increasing clarity around the events leading up to the release complements and reinforces these important lessons. Time has allowed us to take an even closer look at regrettable decisions that resulted in disabling the system whose purpose it was to prevent the scenario that resulted in the release. Most industry professionals no doubt plainly see from this examination that we confront the same decisions at work every day. Perhaps this is the message contained in recognized and generally accepted good engineering practices. The decisions we make throughout the life of a process, especially before its construction, can and will affect us as well as all those who follow.
As an industry professional you will make decisions daily that as a whole define your process safety identity. We cant tell you what the right answers are. It is therefore important to allow your conscience be guided by what took place in Bhopal. This is where Bhopal has even more redeeming value. With these thoughts in mind, the focus is on insightful advice:
When you choose not to investigate a chronic failure, remember Bhopal.
When the right choice is not the most economical choice, remember Bhopal.
When choosing to accept actual operation because you cannot get expected or design operation, remember Bhopal.
When designing a solution that manages a hazard instead of eliminating it, remember Bhopal.
When tempted to execute a procedure the way you think it should be written instead of how it is actually written, remember Bhopal.
When thinking about substituting engineered equipment with people, remember Bhopal.
When you perform a safety audit, remember Bhopal.
When redesigning a system to make it safer, remember Bhopal.
When operators have concerns with a decision you are about to make, remember Bhopal.
When making changes for the sake of improving personal safety, remember Bhopal.
Finding your identity
After 27 years, there are two prevailing theories that may explain how water entered the MIC storage tank. An examination of the events preceding the incident supports the argument that this detail is irrelevant.5 However, the explanation you favor is governed by your process safety identity. If you believe that a single event can cause a process safety incident of extraordinary magnitude, then the cause was probably sabotage. But if you believe that significant process safety failures result from a complex series of interacting events that may include design defects, repeat failures and missed warning signals, then maybe the cause was inadequate process isolation during a routine maintenance procedure (perhaps even during a maintenance activity required to contain the process in a factory like yours).
What can you do?
When you report for work tomorrow, remember Bhopal. And when you return to the comfort of your home, convince yourself it is because you did. HP
Figs. 1, 6 and 7: Dennis Hendershot Fig. 4: Paul Cochrane
1 Deposition of Vinod Kumar Tyagi, Proceedings before the chief judicial magistrate, Bhopal on March 6, 7, and 8, 2000 in criminal case No. RT-8460/96, 2010, http://bhopal.net/oldsite/oldwebsite/new2depo.html.
2 Union Carbide Corporation, Review of MIC production at the Union Carbide Corporation Facility Institute West Virginia April 15, 1985, Danbury, Connecticut, 1985, http://nepis.epa.gov/Exe/ZyPURL.cgi?Dockey=2000W9PM.txt.
3 Union Carbide Corporation, Bhopal MIC incident investigation team report March, 1985, Danbury, Connecticut, 1985, http://nepis.epa.gov/Exe/ZyPURL.cgi?Dockey=2000W9PM.txt (at Attachment 1).
4 District Court of Bhopal, India, State of Madhya Pradesh vs. Warren Anderson & Others, June 7, 2010, http://www.indiaenvironmentportal.org.in/files/UCIL.pdf.
5 Willey, R., D. Hendershot and S. Berger, The accident in Bhopal: Observations 20 years later, 40th Loss Prevention Symposium, Orlando, 2006, http://www.aiche.org/uploadedfiles/ccps/about/bhopal20yearslater.pdf.
6 DSilva, T., The Black Box of Bhopal, Trafford Publishing, Victoria, BC, Canada, 2006, ISBN 978-1-4120-8412-3
7 Worthy, W., Methyl Isocyanate: The Chemistry of a Hazard, Chemical & Engineering News, p. 30, February 11, 1985.
8 Supreme Court of India, Curative Petition (Criminal) No. 39-42 of 2010 in Criminal Appeal No. 1672-75 of 1996 on Bhopal Gas Disaster, April 2011, http://www.indiaenvironmentportal.org.in/files/CriminalCurativeBhopal.pdf.
9 Kalelkar, A. S., Investigation of large-magnitude incidents: Bhopal as a case study, Institution of Chemical Engineers Conference on Preventing Major Chemical Accidents, London, UK, 1988, http://www.bhopal.com/~/media/Files/Bhopal/casestdy.pdf.
10 Wines, M., Firm calls deliberate act possible in Bhopal disaster, Los Angeles Times, March 21, 1985, http://articles.latimes.com/1985-03-21/news/mn-20658_1_bhopal-disaster#.Tr6AWuGD4LY.
11 Examination of Dr. S. Varadarajan, Proceedings before the chief judicial magistrate, Bhopal on January 10 and 11, 2000, in Criminal Case No. RT-8460/96, http://bhopal.net/oldsite/oldwebsite/newdepo.html.
12 Bloch, H. P., Pump Wisdom, John Wiley & Sons, Hoboken, NJ, 2011. ISBN 978-1-118-04123-9
13 Agarwal, A. and S. Narain (editors), The Bhopal Disaster, State of Indias Environment 1984-85: The Second Citizens Report, p. 207, 215, 1985, http://www.cseindia.org/userfiles/THE%20BHOPAL%20DISASTER.pdf.
14 Supreme Court of India, Supreme Court Judgment on Bhopal Gas Disaster, September 13, 1996, http://www.indiaenvironmentportal.org.in/files/SC%20judgement%20of%201996.doc.
15 Union Carbide Corporation, Operational Safety Survey, Danbury, CT, 1982, p. 6, http://bhopal.net/source_documents/1982%20safety%20audit.pdf.
||Kenneth Bloch is a PHA/loss control engineer who specializes in petrochemical industry incident investigation and failure analysis. He speaks regularly at AFPM, API, and AIChE process safety symposiums on experiences that help prevent process safety failures in the manufacturing industry. Mr. Bloch graduated with honors from Lamar University in Beaumont, Texas, in 1988. |
||Briana Jung is a senior operations engineer in the petrochemical industry. She is a certified PHA facilitator with over 10 years of process plant troubleshooting and optimization experience. Ms. Jung graduated from the University of Minnesota with a BS in chemical engineering in 2001. |