Lessons After Bhopal: CSB a Catalyst for Change

Prepared for presentation at

the December 2004 Bhopal International Conference

Giby Joseph, Mark Kaszniak, and Lisa Long

U. S. Chemical Safety and Hazard Investigation Board

2175 K Street, NW, Suite 400

Washington DC 20037

Telephone 202-261-7633

Fax 202-974-7633

ABSTRACT

The Bhopal tragedy was a defining moment in the history of the chemical industry. On December 3, 1984, a runaway reaction within a methyl isocyanate storage tank at the Union Carbide India Limited pesticide plant released a toxic gas cloud that killed thousands and injured hundreds of thousands. After Bhopal, industrial chemical plants became a major public concern. Both the public and the chemical industry realized the necessity of improving chemical process safety.

Bhopal served as a wake-up call. To prevent the same event from occurring in the United States, many legislative and industrial changes were invoked—one of which was formation of the U.S. Chemical Safety and Hazard Investigation Board (CSB). The ultimate goal of CSB is to use the lessons learned and recommendations from its investigations to achieve positive change within the chemical industry—preventing incidents and saving lives.

Although it seems clear that the lessons learned at Bhopal have improved chemical plant safety, CSB investigations indicate that the systemic problems identified at Bhopal remain the underlying causes of many incidents. These include:

  • Lack of awareness of reactive hazards.
  • Lack of management of change.
  • Inadequate plant design and maintenance.
  • Ineffective employee training.
  • Ineffective emergency preparedness and community notification.
  • Lack of root cause incident investigations and communication of lessons learned.

The aim of this paper is to present common themes from recent cases investigated by CSB and to discuss how these issues might be best addressed in the future.

This paper has not been independently approved by the Board and is published for general informational purposes only. Any material in the paper that did not originate in a Board-approved report is solely the responsibility of the authors and does not represent an official finding, conclusion, or position of the Board.

Background

Around 12:30 a.m. on December 3, 1984, there was a massive release from a methyl isocyanate (MIC) storage tank at the Union Carbide India Limited (UCIL) plant in Bhopal, India. Highly toxic MIC gas drifted beyond the plant boundary, killing thousands and injuring hundreds of thousands more. Most of the victims lived in the densely populated shanty towns adjacent to the plant — Jayaprakash Nagar, Kazi Camp, Chola Kenchi, and the Railway Colony (Lees, 1996).

The immediate cause of the incident was the contamination of the MIC storage tank by about 2,000 pounds of water. This triggered a runway reaction. The temperature and pressure within the tank rose. A valve designed to prevent tank over pressurization opened and discharged nearly 54,000 pounds of unreacted MIC vapor to the atmosphere within a two-hour period (Kletz, 2003).

A complex set of interdependent organizational and technological factors played a critical role in the incident. Inadequate safety standards and maintenance procedures at the plant had a direct impact on the magnitude of the release. Table 1 lists several safety systems that should have prevented or minimized the release but were either out of order or not in full working order. Also, managers and workers at the Bhopal facility had limited knowledge of the reactive hazards associated with MIC. The impact of the incident was worsened by the lack of adequate community notification and emergency response procedures (Shrivastava, 1992).

The Bhopal incident was the impetus for an examination of chemical safety worldwide and for the emphasis on safety measures that continues today. Table 2 outlines the tremendous strides that have been made over the past 20 years (especially within the United States and Europe) in practices and attitudes in the chemical industry, including regulatory advances. In fact, the lack of an independent Federal oversight agency to investigate a serious chemical incident within the United States led to the formation of the U.S. Chemical Safety and Hazard Investigation Board (CSB). Although it seems clear that Bhopal has had a positive impact on chemical safety, CSB investigations indicate that many systemic, organizational, and technological failures identified at Bhopal remain the underlying causes of many incidents.

Introduction

CSB is a catalyst for chemical incident prevention. CSB is an independent Federal agency whose mission is to ensure the safety of workers, the public, and the environment by investigating chemical incidents. The Board is a scientific investigative organization; it is not an enforcement or regulatory body. Established by the Clean Air Act Amendments of 1990 and funded in 1998, CSB is responsible for determining the root and contributing causes of incidents, issuing safety recommendations, studying chemical safety issues, and evaluating the effectiveness of other government agencies involved in chemical safety (US Congress, 1990).

Since 1998, CSB has conducted 29 incident investigations, one major hazard investigation on reactive hazards, and four safety studies. Table 3 indicates that of the 29 incident investigations, 11 were reactive incidents.[1] The incidents CSB investigates occur anywhere hazardous chemicals are used—but mostly in the chemical manufacturing industry. Six of the 29 investigations are still ongoing. This paper addresses the underlying causes associated with the 23 completed investigations. As seen in Table 4, many incidents have multiple underlying causes, some of which are the same failures that happened nearly 20 years ago at Bhopal.

Awareness of Reactive Hazards

The Bhopal catastrophe was a reactive incident involving inadvertent mixing of incompatible chemicals, a runaway decomposition reaction, and a devastating toxic gas release. In Bhopal: Anatomy of a Crisis, Paul Shrivastava writes “Managers and plant workers had little information on the hazard potential of the (UCIL Bhopal) plant” for example that water contamination of the tanks containing MIC could initiate an uncontrolled chemical reaction (Shrivastava, 1992). This lack of reactive hazard awareness played a critical role in causing the incident. Numerous other incidents since Bhopal have occurred as a result of lack of awareness of the hazards presented by reactive chemicals.

CSB Reactive Hazard Investigation

Chemicals such as MIC can undergo potentially hazardous chemical reactions if not managed properly. These uncontrolled reactions may cause fires, explosions, and toxic gas releases. One example of a reactive hazard is a runaway reaction, where one or more chemicals suddenly react or decompose, accompanied by steep and accelerating temperature increases. In the confines of a chemical reactor or storage tank, as at Bhopal, such severe heating can result in a dangerous pressure increase that causes vessel rupture. Just such a runaway reaction and vessel rupture occurred at a Morton International facility in New Jersey in 1998. CSB investigated this incident and determined that reactive hazards merited a more systemic analysis.

The 2-year-long hazard investigation by CSB uncovered 167 serious chemical incidents within the United Sates over a 20-year period that involved uncontrolled chemical reactions. These incidents caused 108 deaths as well as hundreds of millions of dollars in property damage. The Board concluded that reactive chemical incidents pose a significant problem and that the pertinent Federal process safety regulations promulgated in response to Bhopal and other catastrophic incidents in the United States. contain significant gaps in their applicability and specific provisions. Over 90 percent of the incidents analyzed by CSB involved reactive hazards that were already recognized and documented in published literature. This finding indicated the need for greater outreach and dissemination of information to the facilities that process reactive chemicals (USCSB, 2002e).

The CSB hazard investigation also found that more than half of the 167 surveyed incidents involved chemicals that are not covered by either the U.S. Occupational Safety and Health Administration (OSHA) Process Safety Management (PSM) or U.S. Environmental Protection Agency (EPA) Risk Management Program (RMP) rules. These rules require companies to apply good safety management practices to certain hazardous chemical processes. The Board recommended that both OSHA and EPA broaden the respective regulations to include coverage of reactive hazards.

OSHA, EPA, the American Chemical Council (ACC), and the Synthetic Organic Chemical Manufacturers Association (SOCMA) have formed an alliance to educate industry about chemical reactivity hazards.

After an initial meeting set up by CSB, industry, government, and academia have continued participating in a reactive hazard roundtable. The roundtable, sponsored by the American Institute of Chemical Engineers (AIChE), is attempting to develop minimum practices for safely managing reactive hazards.

The Center for Chemical Process Safety (CCPS) has developed and published comprehensive guidelines on effectively managing reactive hazards. In Essential Practices for Managing Chemical Reactivity Hazards, CCPS responded to the CSB’s recommendation by providing additional guidance to industry (CCPS, 2003). CCPS subsequently formed a partnership with government and industry to publish the guide without charge through the websites of OSHA and EPA.

CSB Incident Investigations

Of the 23 completed CSB investigations, 10 were reactive incidents. Lack of hazard awareness was identified as an underlying cause in 8 of the 10 incidents—Morton, Concept Sciences, BP Amoco, Georgia-Pacific, First Chemical, Technic, Kaltech, and Catalyst Systems.[2] Some of these incidents are described in greater detail below (USCSB, 2003g).

On January 16, 2002, sulfuric acid was being added to an acid sewer to control pH downstream at the Georgia-Pacific Naheola pulp and paper mill in Pennington, Alabama. Sodium hydrosulfide (NaHS), a process chemical that had spilled in the unloading area, drained to the sewer and reacted with the sulfuric acid to form hydrogen sulfide (H2S). The highly toxic gas vented from the sewer through a nearby fiberglass manhole cover. Several people working in the area were exposed. Two contractors were killed, and eight others were injured (USCSB, 2003a).

The Board concluded that neither Georgia-Pacific nor the previous plant owners adequately analyzed or controlled the hazards of the sewer system, including the potential for hazardous chemical reactions. It recommended that Georgia-Pacific review sewer system safety at all its plants to prevent the inadvertent mixing of potentially reactive chemicals—including those that can form toxic gases. The Board also requested that Georgia-Pacific identify plant areas (such as NaHS unloading areas) where there is a risk of hydrogen sulfide release and require appropriate safeguards and training for all workers in those areas.

As a result, Georgia Pacific has developed an approach for evaluating reactive hazards, in sewers particularly, and it is in the process of applying this hazard evaluation method at all Georgia Pacific facilities in the United States. Georgia Pacific is also developing corporate policies on both reactive hazards and process sewers.

The Georgia Pacific incident also prompted the Board to initiate a special hazard investigation on the handling and use of NaHS in the United States. During the study, CSB found that NaHS hazard and safety information on manufacturer material safety data sheets (MSDS) was inconsistent. CSB published a safety bulletin, Sodium Hydrosulfide: Preventing Harm, to increase awareness of the hazards and outline safety practices to minimize potential harm to workers and the public.

Reactive hazard awareness must move beyond the chemical processing industry to wherever hazardous chemicals are present. Data analysis indicated that—though 70 percent of the 167 incidents occurred in the chemical manufacturing industry—30 percent involved a variety of other industrial sectors that store, handle, or use chemicals in bulk quantities. The CSB investigation at Kaltech Industries, , a commercial sign manufacturer, serves as an excellent example.

On April 25, 2002, an explosion in a mixed-use commercial building in downtown Manhattan injured 36 people, including 14 members of the public and six firefighters. Thirty-one of the injured were treated in hospitals, including four who required intensive care. The explosion originated in the basement of the building and caused damage as high as the fifth floor (USCSB, 2003f).

CSB found that the Kaltech incident, resulted from mixing two incompatible waste chemicals—lacquer thinner and nitric acid—without following basic safety requirements. As at Bhopal, employees were not aware of the potential reactive hazards and lacked the necessary training to understand the hazards. The Board also found that the New York City fire code lacked sufficient chemical safety precautions to detect unsafe practices. In addition to its recommendations to Kaltech, CSB recommended that New York City revise its fire prevention code to achieve more comprehensive control over the storage and use of hazardous materials. In March 2004, the New York City Council announced that the city’s fire department had decided to revise the code and had allocated substantial funding to support the revision.

Management of Change

Change represents a deviation from the original design, fabrication, installation, or operation of a process. Even simple changes, if not properly managed, can result in catastrophic consequences. The objective of a management of change (MOC) program is to ensure that all changes to a process are properly reviewed and that hazards introduced by the change are identified, analyzed, and controlled prior to resuming operation. At Bhopal, the MIC plant was designed with several safety features (Table 1). Lack of adequate MOC was one reason these features were nonfunctional at the time of the incident.

Of the 23 completed CSB investigations, lack of MOC was an underlying cause in six incidents—Morton, Tosco, Motiva, Technic, Hayes Lemmerz, and Georgia-Pacific. The Morton and Tosco incidents are described in greater detail below.

On April 8, 1998, a runaway reaction during the production of Automate Yellow 96 dye initiated a sequence of events that led to an explosion and fire at the Morton International, Inc., plant in Paterson, New Jersey. On the day of the incident, flammable materials were released as the result of an uncontrolled rapid temperature and pressure rise in a 2,000-gallon kettle in which orthonitrochlorobenzene (o-NCB) and 2-ethylhexylamine (2-EHA) were being reacted. Nine employees were injured in the explosion and fire, including two seriously. Potentially hazardous materials were released into the community, and the physical plant was extensively damaged. The Board concluded that lack of MOC was one important underlying cause of the incident (USCSB, 1998e).

The Board recommended that the Morton Paterson plant establish a program to investigate any unsafe process deviations and recommended that OSHA and EPA issue joint guidelines on the management of reactive process hazards. The Board also called on the two agencies to cooperate with CSB in the investigation of reactive hazards.

On February 23, 1999, a fire occurred in the crude unit at the Tosco Avon oil refinery in Martinez, California. Workers were attempting to replace piping attached to a 150-foot-tall fractionator tower while the process unit was in operation. During removal of the piping, naphtha was released onto the hot fractionator and ignited. The flames engulfed five workers located at different heights on the tower. Three of the fatalities were contractors—two were employed by a scaffold erection company, and the other worked for a crane company. The fourth fatality and the one seriously injured worker were Tosco maintenance employees (USCSB, 2001).

CSB investigators found that the valves and piping had corroded at an excessive rate because an upstream vessel, known as the crude oil desalter—which removes salt, water, and solids from the oil feed – was being operated beyond its design limits. Tosco should have evaluated operational changes that could worsen the corrosion of piping and valves—such as feeding different material into the process, increasing the amounts being processed, and making long-term adjustments to valve positions. No MOC evaluation was applied to these process modifications. This omission contributed to the final breakdown and the fire. The Board recommended that the refinery implement a comprehensive system for safely managing hazardous maintenance work.

An effective MOC program is critical to the safe operation of a chemical facility. MOC requires the participation of everyone at the facility, including temporary and contract workers.

Hazard Evaluations

Hazard evaluations, or process hazard analyses, are organized efforts to identify and assess the significance of hazardous scenarios associated with a process or activity and to establish a design and operating basis for safety. One of the key lessons learned from Bhopal is that an adequate hazard evaluation might have caused management to question the decision to operate without fully functional refrigeration, scrubbing, and flare systems.

Of the 23 completed CSB investigations, inadequate hazard evaluation was identified as an underlying cause in 12 incidents (see Table 4). Two examples, First Chemical and BP Amoco, are described in greater detail below (USCSB, 1998d; 2004b, 2004c, 2004d.)