Here is a synopsis of the above incident provided to me in a Process Hazards Review training course: 12/02/84 Bhopal, India. Methyl isocyanate release. 2,000+ deaths. Water entered a methyl isocyanate (MIC) storage tank causing a runaway reaction resulting in 2,000+ deaths, the worst industrial accident in history.

[Dykes] Causal Factors:

• Three protective systems out of service. The refrigeration system was taken out of service because of operating costs and the high temperature alarm, indicating an exothermic reaction was occurring, was reset high. The scrubber was inadequately sized for a large release and was under repair during the incident. The flare stack was out of commission while part of the inlet line had been removed for repair.

• Plant was understaffed due to costs.

• Very high inventory of MIC, an extremely toxic material.

• The accident occurred in the early morning.

• Most of the people killed lived in a shanty town located very close to the plant fence.

[Graham] Union Carbide has produced a 17-minute video on their failure investigation, entitled "Unraveling the Tragedy at Bhopal." (This video I happened to stumble across in the public library.) Here are a few notes:

The plant at Bhopal was used to manufacture pesticides, and a primary chemical component of these pesticides is MIC. This material reacts violently with water, and this reaction is what caused the gaseous release. In this case, some 2500 lbf of water got into the MIC storage tank, suggesting that a simple leak was extremely unlikely. It was eventually reported by UCC that a disgruntled employee, apparently working alone, removed a pressure gauge directly attached to the tank, and just stuck in a hose and filled the tank with water. (Many researchers, however, doubt this claim, and UCC doesn't help its validity by identifying any characteristics of the saboteur.) This happened while plant supervisors were on break. There was no valve failure involved at first.

Workers made the following attempts to save the plant:

• They tried to turn on the plant refrigeration system to cool down the environment and slow the reaction. (The refrigeration system had been drained of coolant weeks before and never refilled -- it cost too much.)
• They tried to route expanding gases to a neighboring tank. (The tank's pressure gauge was broken and indicated the tank was full when it was really empty.)
• They tried to purge the gases through a scrubber. (The scrubber was designed for flow rates, temperatures and pressures that were a fraction of what was by this time escaping from the tank. The scrubber was as a result ineffective.)
• They tried to route the gases through a flare tower -- to burn them away. (The supply line to the flare tower was broken and hadn't been replaced.)
• They tried to spray water on the gases and have them settle to the ground -- by this time the chemical reaction was nearly completed. (The gases were escaping at a point 100 feet above ground; the hoses were designed to shoot water up to 40 feet in the air.)

Failing all those attempts, most fled for their lives.

When Union Carbide sent in a team to start the failure investigation, the team was stonewalled by the Indian government, which seized records and denied the team access to the plant, the records and the eyewitnesses. A year or so later, the blackout was lifted (via a USA court order), and the team found that workers had changed or deleted records, eyewitnesses had left the area to find new jobs and were difficult to track down, and some witnesses who were found quickly had contradictory stories to tell.

There are two sets of lessons learned here: those Union Carbide did tell, and those they did not. Here's what they did tell us:

1. When eyewitness interviews are required to determine the root causes of failures, those interviews need to be conducted as quickly as possible after the failure. The probability of losing key witnesses or of getting contradictory information back increases with time.

There were other things they mentioned, but this was the one most significant point. They knew the engineering cause of the failure early in the investigation. What they didn't know was whodunit. Here's what they didn't tell us:

There's what amounts to no buffer zone between the plant and a shanty town that formed hard-up against the plant's fences after the plant was opened. Such shanty towns typically occur in areas where people live on a subsistence-level income and where some high-paying jobs are available, and the formation of this one could well have been foreseen. The plant either needed a larger buffer zone between storage tanks and shanties, or to pay more than subsistence-level to the locals, or both.

3. There was no redundancy involved in physically checking the storage tanks, and with the supervisors on break a golden opportunity arose for a disgruntled employee to do mischief undetected -- indeed, he was the tank-checker. He knew his way around; he knew what water would do in the tank (although he could not have known how much); and he had a motive. Engineers cannot be expected to be detectives (at least, not before the fact), but they certainly can have back-ups -- two plant workers checking each structure along independent paths. That would have prevented such an enormous quantity of water from being introduced.

4. As far as I could tell from review of the failure investigation, there was no alarm system in the plant sufficient to warn the nearby public. In a case such as this, with harmful chemicals stored so close to a densely-populated neighborhood, there probably should not only have been a public alarm system, but possibly plant first-aid personnel available to the locals.

5. If you know that MIC reacts violently with water, then why in Heaven's name would a water source be located so close to a storage tank that water could be fed to the tank with a hose? The water source needed to be somewhere else, or inaccessible except in emergencies. Even fires around the tank could be put out by other means. The MIC could perhaps have been stored in several smaller tanks, limiting the damage caused by one; there could perhaps have been a pressure-activated bleed valve into an empty holding tank for vapors.

6. An emergency evacuation plan may have been in place, and may even have been drilled by plant employees. But such an evacuation plan should include the locals as well, and if it wasn't in place, there was another problem.

7. Finally, I was unable to tell whether the leak could have been contained. Based on what Union Carbide presented, I cannot but assume that the storage tanks were not even in a building.

The failure investigation team of course cannot be held accountable for not presenting this stuff in their video, because it's likely to cast Union Carbide in somewhat of a bad light -- and one of the purposes of the video was to show the rigor of the failure investigation under some really bad circumstances. Nevertheless, you can bet that UC learned some valuable lessons about containment, redundancy, buffer zones and alarms as a result of this terrible accident.

Subsequent articles published by the Village Voice and others indicate the following aftermath:

Records were seized by the Indian government and withheld from failure investigators. The plant was closed, also by the government. The failure investigation was delayed in other ways, until a US court order forced the Indian government to release the records and remove the padlocks. By the time the padlocks were off, the witnesses had mostly relocated, often in search of new jobs. Witnesses who had been tracked down, as much as a year or more after the fact, sometimes gave conflicting testimony. The Indian government, negotiating with Union Carbide on behalf of the families and survivors, accepted a settlement that amounted to a mere several thousand dollars (US) per victim.

The alleged saboteur was never identified. Though UCC claims to know exactly who it was. Warren Anderson, then Chairman of UCC, is now a fugitive from Indian justice, and having been given no protection by US courts has gone into hiding. Current UCC officials aren't telling where he is, if they know. Survivors are protesting the merger of Union Carbide with Dow Chemical. Their arguments include A merger will cause UCC to "disappear" without justice. The two companies maintain UCC has no criminal liability. Their merger would impede both world peace and plant safety standards -- it'd be like asking for another disaster.

References

Casey, S. Set Phasers on Stun. Aegean Publishing, 1998.
Mehta, S. "Bhopal Lives." Village Voice, 12.96.
www.bhopal.net