Twenty-five years ago this month, the worst accident in the history of the chemical industry occurred — a leak of highly toxic methyl isocyanate (MIC) gas at a Union Carbide pesticide plant in Bhopal, India, that killed thousands of people. Industry learned many lessons; experts wrote many reports. Here, we’ll look at some of the wider lessons learned rather than the narrow points on which most reports concentrated.
The story started in 1974, 10 years before Bhopal, when a large leak of hydrocarbon exploded at a Nypro (UK) plant at Flixborough, U.K., killing 28 people. The leak was large because only 6% of the hydrocarbon fed to the plant was converted; 94% had to be recovered and repeatedly recycled. The most important recommendation made afterward was that we should look for ways to reduce the amount of hazardous materials in a plant, a process called intensification or minimization. The slogan was: “What you don’t have can’t leak.” This thought didn’t occur to most commentators or the official inquiry. Reducing inventory in the Flixborough process isn’t easy. One company started but then abandoned a research project after realizing there was excess capacity in the process, a stage in manufacture of nylon.
The Bhopal disaster wouldn’t have occurred if the plant managers had known about and then adhered to the recommendation made after Flixborough. MIC wasn’t a raw material or product but an intermediate. Storing it was convenient but nonessential. It could have been used as it was made — then the worst leak would have been a few kilograms from a broken pipe rather than a hundred tons from a tank. This time the chemical industry paid attention; within a year many companies had reduced or eliminated their hazardous intermediates stocks and used the materials as they made them.
Broader Relevance
The “Don’t Have” concept can be applied more widely. If chemicals we don’t have can’t leak, people who aren’t there can’t be injured or killed. The human toll at Bhopal was so high because a shanty town had grown up near the plant. It’s difficult in a country like India to control development but necessary nevertheless to prevent people from living too close to hazardous sites.
A 2005 explosion at a BP refinery in Texas City, Texas, killed 15 people and harmed 170. One reason for the large number of deaths and injuries was that temporary buildings used by maintenance workers were close to the explosion site. If the buildings had been placed further away from equipment containing hazardous materials — a recommendation that often has been made — the toll would have been lower.
Similarly, if no buildings are nearby, they can’t be damaged or destroyed by explosions. The worst peacetime explosion in England occurred at Buncefield in 2005 when gasoline overflowed though the vent at the top of a large storage tank. The ensuing explosion extensively damaged the storage area and a large number of offices and small factories on an adjoining site.
How many of the ten accident-avoidance steps that Trevor Kletz cites in his article does your plant now take?
Click here to participate and see how your site compares with others.
The underlying cause of Buncefield was that all the people and organizations involved in design, operations and maintenance were unaware of similar explosions in Newark, N.J., in 1983 [1,2,3], St. Herblain, France, in 1991 [4], Naples, Italy, in 1995 [5], and elsewhere (other incidents easily can be found by googling “gasoline spill”). They believed cold gasoline couldn’t explode in open air. The group of oil companies that owned the storage depot claimed an explosion of cold gasoline in open air never before had occurred. Damage at Buncefield, however, was more extensive than at Newark and elsewhere.
If just one person at Buncefield had known about just one incident, had realized that a similar event could happen there, and had alerted colleagues, the explosion might not have occurred.
If the designers or operators had carried out a search for incidents at similar installations, the explosion probably wouldn’t have occurred. Failing to carry out such a search, and then estimating probability of an explosion and extent of damage, was a dereliction of duty by all organizations involved; they, not just the firm that failed to maintain the high-level trips on the tank, should share cost of the damage.
Many companies now have learned the lessons of Flixborough, Bhopal and Buncefield and have reduced amounts of hazardous materials in process or storage — however, many others still have to learn them. We’re now less likely to build plants near or in urban or built-up areas or allow development close to existing plants, but many current sites are “grandfathered.”
Almost every company has applied the “Don’t Have” principle to employees and has reduced their numbers, often successfully. In many cases, though, what firms have called “empowerment” of remaining employees has been a euphemism for loss of support. The classic example was a 1998 explosion at an Esso gas plant in Longford, Australia, that left the whole state of Victoria without natural gas for two weeks. In this case, the company decided to relocate all professional engineers from the plant to headquarters 200 miles away. The official report on the explosion [6] said moving the engineers “appears to have had a lasting impact on operational practices at the Longford plant. The physical isolation of engineers from the plant deprived operations personnel of engineering expertise and knowledge, which previously they gained through interaction and involvement with engineers on site. Moreover, the engineers themselves no longer gained an intimate knowledge of plant activities. The ability to telephone engineers if necessary, or to speak with them during site visits, did not provide the same opportunities for informal exchanges between the two groups, which are often the means of transfer of vital information.”
Another misuse of the “Don’t Have“ principle concerns knowledge of past accidents at a company or elsewhere. Chemical makers investigate and report on accidents and make changes — but then file away and soon forget the reports. Moreover, they don’t always share them with other firms.
This is a widespread lapse: “It is a truism in business and industry that things go wrong when the last man who remembers the previous disaster retires,” commented Roger Ford in Modern Railways (p. 18, Aug. 2009).
Necessary Steps
Engineers are good at solving problems but not as good at recognizing ones that should be solved. The major safety problem companies should address is maintaining awareness of incidents. Chemical makers should set up systematic procedures — rather than rely on memory — to recall lessons of the past, lessons for which we have paid a high price in deaths and injuries as well as money.
Following are a few of the actions that can prevent the same accidents from recurring so often:
1. Include in every instruction and code a note on the reasons for it and accounts of accidents that wouldn’t have occurred if the instruction or code had existed at the time and been followed.
2. Never remove equipment or ignore instructions before you know why they were adopted.
3. Describe old accidents as well as recent ones in safety bulletins and discuss them at safety meetings.
4. Check at regular intervals to see that recommendations made after accidents are being followed — in design as well as operations.
5. Remember the first step down the road to an accident occurs when someone turns a blind eye to a missing blind.
6. Cover important past accidents in training undergraduates and company employees.
7. Keep a folder of old accident reports in every control room. Make it compulsory reading for recruits; others should look through it from time to time.
8. Read more books, which tell us what’s old, as well as magazines, which tell us what’s new.
9. When downsizing, make sure remaining employees at all levels have adequate knowledge and experience.
10. Devise better retrieval systems so that we can find details of past accidents more easily. Staff members should review all published or privately circulated reports; any relevant information they contain should be placed in a searchable database.
Trevor A. Kletz is visiting professor in the Department of Chemical Engineering at Loughborough University, Loughborough, U.K., and an adjunct professor at Texas A&M, College Station, Texas. The fifth edition of his book “What Went Wrong: Case Histories of Process Plant Disasters and How They Could Have Been Avoided” has just been published (see www.ChemicalProcessing.com/articles/2009/148.html). E-mail him at [email protected].
REFERENCES
1. “Report on the Incident at the Texaco Company’s Newark Storage Facility, 7th January 1983,” Loss Prev. Bulletin, No. 57, p. 11 (June 1984). Reprinted in Loss Prev. Bulletin, No. 188, p. 10 (Apr. 2006).
2. Henry, M. F., “NFPA’s Consensus Standards at Work,” Chem. Eng. Prog., Vol. 8, No. 8, p. 20 (Aug. 1985).
3. Kletz, T. A., “Can Cold Petrol Explode in the Open Air?,” The Chemical Engineer, p. 63 (June 1986). Reprinted in Loss Prev. Bulletin, No. 188, p. 9 (Apr. 2006).
4. Lechaudet, J. F., “Assessment of an Accidental Vapour Cloud Explosion,” Loss Prev. and Safety Prom. in Proc. Ind., Vol. 314, p. 377 (1995).
5. Russo, G., Maremonti, M., Salzano, E., Tufano, V. and S. Ditali, “Vapour Cloud Explosion in a Fuel Storage Area; a Case Study,” Proc. Safety and Env. Protect., Vol. 77, No. B6, p. 310 (1999).
6. Dawson, D. M. and J. B. Brooks, “The Esso Longford Gas Plant Explosion,” report of Royal Commission, State of Victoria, Australia (1999).
