The Bhopal Incident

Some Questions on Hazard

Identification and Assessment
Background
• Incident started when a storage tank of MIC became
contaminated with water – and a runaway reaction
occurred

• The MIC production unit had been shut down six

weeks prior to the incident

• The storage tank (Tank 610) had been isolated at that

time

• The temperature and pressure rose, the tank relief

valve lifted and MIC vapour was discharged into the
atmosphere
Why did a runway reaction occur?
• The MIC storage tank became contaminated by substantial
quantities of water and chloroform, up to a ton of water and
1.5 tons of chloroform

• This led to:

 a complex series of runaway reactions

 a rise in temperature and pressure

 discharge of MIC vapour from the storage tank relief valves

 The MIC Storage Tank

To Vent Line

Scrubber

Relief Valve PG
TAH
N2 line
MIC Vapour

Liquid MIC
Refrigeration Coil

To Process
Several Causation Theories
• How did the water enter the tank?

• One theory: it came from a section of vent line some

distance away that was being washed out

• An MIC operator was told to wash a section of a sub header

of the relief valve vent header in the MIC manufacturing
unit

• He failed to insert a slip-blind (SOP); water backed up into

the header and eventually found its way into the process
vent header through a tubing connection near the tanks

• It then flowed into the MIC storage tank, located more than
400 feet by pipeline from the initial point of entry

• However, for that the water would have had to pass

through six valves in series! (An unlikely event?)
• Another theory: water entered via the nitrogen supply line

• The other theory: deliberate act of sabotage by someone

who did not realize what the results of his actions would be
Unavailability of Protective Systems
• The refrigeration system which should have cooled the
storage tank was shut down

• The scrubbing system which should have absorbed the

vapour was not immediately available

• The flare system, which should have burnt any vapour

which got past the scrubbing system, was out of use

• A water spray system which was designed to absorb small

leaks at or near ground level

• It was not intended to absorb relief valve discharges at a

high level and failed to do so
Further…
• The high temperature and pressure on the MIC tank were
at first ignored

• Because the instruments were poorly maintained and

known to be unreliable

• The high temperature alarm did not operate as the set

point had been altered and was too high
Design Suitability of the Protective Systems
• The refrigeration, scrubbing and flare systems were not
designed to cope with a runaway reaction of the size that
occurred

• Argument: There would have been a substantial discharge

of MIC to atmosphere even if they had all been in full
working order

• But if in working condition, they would have reduced the

size of the discharge and delayed its start
The MIC Tank Relief Valve
• RV was too small for the discharge from a runway reaction

• Storage vessel design pressure ~ 40 psig (2.7 barg)

• Pressure attained ~ 200-250 psi (14-17 bar)

• The vessel was distorted and nearly burst

• If it had burst the loss of life might have been lower as

there would have been less dispersion of the vapour

• RV designed to handle vapor only; actual flow was two

phase mixture of vapor and liquid
Some Questions

• Why were the protective equipment not designed to handle

a runaway or two-phase flow?

• Were the possibilities of a runaway or two-phase flow not

foreseen?

• Or were they considered so unlikely that it was not

necessary to guard against them?

• What formal HAZID procedures were used during design to

answer these questions?
Other Issues…
• No HAZOP had been done on the tank as it was not
considered part of the process

• Runaway reactions, leaks, and discharges from relief valves

are commoner on plants than on storage systems but they
do occur on storage systems

• 24% of largest insurance losses during 1965-95 occurred in

storage areas and their value was higher than average loss!

• Since a relief valve was installed on the storage tank,

protective equipment should have been available to handle
the discharge

• If the designers were sure that a relief valve would never

lift there would have been no need to install it!
Would a HAZOP have helped?
• Might have alerted if the protective equipment was
designed to handle a runaway or two-phase flow

• Might have shown up possible ways in which contamination

could have occurred

• HAZOP would have allowed identification of possible ingress

of water as contaminant (guide word: ‘as well as’)

• Would have drawn attention to the need to keep all supplies

of water well away from methyl isocyanate

• Companies often lack a structured, systematic HAZOP

procedure that would ensure that all deviations are
considered

• But would only a formal HAZOP prevented the incident?

Key Issues Beyond HAZOP

• Shortcomings risk analysis techniques

• Keeping protective systems in order

• Level and quality of instrumentation

• Significance of administrative controls

• Retention of process safety knowledge despite

manpower turnover
Limitations of HAZOP / Risk Assessment

• A semi-quantitative HAZOP would have identified the

possibilities of combined failure probabilities of the
refrigeration, scrubbing and flare systems

• And would have estimated that likelihood to be negligibly

small

• But may not have considered the possibility that they might
all be switched off!
Level and Quality of Instrumentation
• Instrumentation at Bhopal was less sophisticated than on
similar plants in the US

• It has been suggested that this may have led to the

accident

• If conventional instrumentation was not adequately

maintained and its warnings were ignored, would
computerized instrumentation have been treated any
differently?

• The reverse may be the case if people are unable or

unwilling to maintain basic equipment

• If the safety equipment provided is not used during an

incident, people often suggest that more equipment be
installed
Procedural Controls
• Easy to buy safety equipment

• Much more difficult to make sure that the equipment is kept

in full working order,

• Especially when the initial enthusiasm has worn off

• Procedures, including testing and maintenance procedures

tend to fade rapidly without trace in a few months once
managers lose interest

• Often unknown to them, operators tend to discontinue

safety measures
Contd…

• At Bhopal it went further than this

• Disconnecting the flare system and shutting down the

refrigeration system were decisions that operators would
not have taken on their own

• Managers themselves must have taken these decisions

• Evidence of lack of understanding and/or commitment

• Continuous auditing effort is needed by managers at all

levels to make sure that procedures are maintained
Manpower Training / Experience
• At Bhopal the original managers had left and had been
replaced by others whose experience had been mainly in
the manufacture of batteries

• There had been eight different managers in charge of the

plant in 15 years

• Many of the original operators had also left

• How well were their successors trained?

• Reductions in manning may lead to poor management and

lowering of commitment to safety
Lessons from Bhopal Incident

• Need to design protective systems reliably

• Need to keep alive the protective systems even if the plant

is shutdown

• Wholesale reliance on HAZOP / RISK analysis not a practical

loss prevention approach

• Need to ensure that procedural controls are audited

regularly and kept efficient, especially in high hazard areas

• Need for adopting a clear corporate approach to

undertaking HAZOP
END
Key Issues Beyond HAZOP
• Shortcomings of HAZOP and Risk Analysis Techniques

• Keeping Protective Systems in Order

• Human Error Factors (find out from Kletz why was this
discussed????)

• Level and Quality of Instrumentation

• Significance of Administrative Controls

• Retention of Process Safety Knowledge despite Manpower

Turnover
Human Error Estimates

• Estimates of human error are usually estimates of the

probability that a man will forget to carry out a task (such
as closing a valve)

• Or carry it out wrongly

• Not possible to estimate the probability that he will make a

conscious decision not to close it:

• Either because he considers it unnecessary to do so

• Or because he wishes to sabotage operations