The Bhopal Incident
Some Questions on Hazard
Identification and Assessment
Background
• Incident started when a storage tank of MIC became
contaminated with water – and a runaway reaction
occurred
• The MIC production unit had been shut down six
weeks prior to the incident
• The storage tank (Tank 610) had been isolated at that
time
• The temperature and pressure rose, the tank relief
valve lifted and MIC vapour was discharged into the
atmosphere
Why did a runway reaction occur?
• The MIC storage tank became contaminated by substantial
quantities of water and chloroform, up to a ton of water and
1.5 tons of chloroform
• This led to:
a complex series of runaway reactions
a rise in temperature and pressure
discharge of MIC vapour from the storage tank relief valves
The MIC Storage Tank
To Vent Line
Scrubber
Relief Valve PG
TAH
N2 line
MIC Vapour
Liquid MIC
Refrigeration Coil
To Process
Several Causation Theories
• How did the water enter the tank?
• One theory: it came from a section of vent line some
distance away that was being washed out
• An MIC operator was told to wash a section of a sub header
of the relief valve vent header in the MIC manufacturing
unit
• He failed to insert a slip-blind (SOP); water backed up into
the header and eventually found its way into the process
vent header through a tubing connection near the tanks
• It then flowed into the MIC storage tank, located more than
400 feet by pipeline from the initial point of entry
• However, for that the water would have had to pass
through six valves in series! (An unlikely event?)
• Another theory: water entered via the nitrogen supply line
• The other theory: deliberate act of sabotage by someone
who did not realize what the results of his actions would be
Unavailability of Protective Systems
• The refrigeration system which should have cooled the
storage tank was shut down
• The scrubbing system which should have absorbed the
vapour was not immediately available
• The flare system, which should have burnt any vapour
which got past the scrubbing system, was out of use
• A water spray system which was designed to absorb small
leaks at or near ground level
• It was not intended to absorb relief valve discharges at a
high level and failed to do so
Further…
• The high temperature and pressure on the MIC tank were
at first ignored
• Because the instruments were poorly maintained and
known to be unreliable
• The high temperature alarm did not operate as the set
point had been altered and was too high
Design Suitability of the Protective Systems
• The refrigeration, scrubbing and flare systems were not
designed to cope with a runaway reaction of the size that
occurred
• Argument: There would have been a substantial discharge
of MIC to atmosphere even if they had all been in full
working order
• But if in working condition, they would have reduced the
size of the discharge and delayed its start
The MIC Tank Relief Valve
• RV was too small for the discharge from a runway reaction
• Storage vessel design pressure ~ 40 psig (2.7 barg)
• Pressure attained ~ 200-250 psi (14-17 bar)
• The vessel was distorted and nearly burst
• If it had burst the loss of life might have been lower as
there would have been less dispersion of the vapour
• RV designed to handle vapor only; actual flow was two
phase mixture of vapor and liquid
Some Questions
• Why were the protective equipment not designed to handle
a runaway or two-phase flow?
• Were the possibilities of a runaway or two-phase flow not
foreseen?
• Or were they considered so unlikely that it was not
necessary to guard against them?
• What formal HAZID procedures were used during design to
answer these questions?
Other Issues…
• No HAZOP had been done on the tank as it was not
considered part of the process
• Runaway reactions, leaks, and discharges from relief valves
are commoner on plants than on storage systems but they
do occur on storage systems
• 24% of largest insurance losses during 1965-95 occurred in
storage areas and their value was higher than average loss!
• Since a relief valve was installed on the storage tank,
protective equipment should have been available to handle
the discharge
• If the designers were sure that a relief valve would never
lift there would have been no need to install it!
Would a HAZOP have helped?
• Might have alerted if the protective equipment was
designed to handle a runaway or two-phase flow
• Might have shown up possible ways in which contamination
could have occurred
• HAZOP would have allowed identification of possible ingress
of water as contaminant (guide word: ‘as well as’)
• Would have drawn attention to the need to keep all supplies
of water well away from methyl isocyanate
• Companies often lack a structured, systematic HAZOP
procedure that would ensure that all deviations are
considered
• But would only a formal HAZOP prevented the incident?
Key Issues Beyond HAZOP
• Shortcomings risk analysis techniques
• Keeping protective systems in order
• Level and quality of instrumentation
• Significance of administrative controls
• Retention of process safety knowledge despite
manpower turnover
Limitations of HAZOP / Risk Assessment
• A semi-quantitative HAZOP would have identified the
possibilities of combined failure probabilities of the
refrigeration, scrubbing and flare systems
• And would have estimated that likelihood to be negligibly
small
• But may not have considered the possibility that they might
all be switched off!
Level and Quality of Instrumentation
• Instrumentation at Bhopal was less sophisticated than on
similar plants in the US
• It has been suggested that this may have led to the
accident
• If conventional instrumentation was not adequately
maintained and its warnings were ignored, would
computerized instrumentation have been treated any
differently?
• The reverse may be the case if people are unable or
unwilling to maintain basic equipment
• If the safety equipment provided is not used during an
incident, people often suggest that more equipment be
installed
Procedural Controls
• Easy to buy safety equipment
• Much more difficult to make sure that the equipment is kept
in full working order,
• Especially when the initial enthusiasm has worn off
• Procedures, including testing and maintenance procedures
tend to fade rapidly without trace in a few months once
managers lose interest
• Often unknown to them, operators tend to discontinue
safety measures
Contd…
• At Bhopal it went further than this
• Disconnecting the flare system and shutting down the
refrigeration system were decisions that operators would
not have taken on their own
• Managers themselves must have taken these decisions
• Evidence of lack of understanding and/or commitment
• Continuous auditing effort is needed by managers at all
levels to make sure that procedures are maintained
Manpower Training / Experience
• At Bhopal the original managers had left and had been
replaced by others whose experience had been mainly in
the manufacture of batteries
• There had been eight different managers in charge of the
plant in 15 years
• Many of the original operators had also left
• How well were their successors trained?
• Reductions in manning may lead to poor management and
lowering of commitment to safety
Lessons from Bhopal Incident
• Need to design protective systems reliably
• Need to keep alive the protective systems even if the plant
is shutdown
• Wholesale reliance on HAZOP / RISK analysis not a practical
loss prevention approach
• Need to ensure that procedural controls are audited
regularly and kept efficient, especially in high hazard areas
• Need for adopting a clear corporate approach to
undertaking HAZOP
END
Key Issues Beyond HAZOP
• Shortcomings of HAZOP and Risk Analysis Techniques
• Keeping Protective Systems in Order
• Human Error Factors (find out from Kletz why was this
discussed????)
• Level and Quality of Instrumentation
• Significance of Administrative Controls
• Retention of Process Safety Knowledge despite Manpower
Turnover
Human Error Estimates
• Estimates of human error are usually estimates of the
probability that a man will forget to carry out a task (such
as closing a valve)
• Or carry it out wrongly
• Not possible to estimate the probability that he will make a
conscious decision not to close it:
• Either because he considers it unnecessary to do so
• Or because he wishes to sabotage operations
