Transcript HAZOP Training

Incident Case
Description
Bhopal, India
1984
The Setting
Bhopal located in North
Central India
Very old town in picturesque
lakeside setting
Tourist centre
Industry encouraged to go
to Madhya Pradesh as part
of a policy to bring industry
to less developed states
Annual rent $40 per acre
Decision by Union Carbide in
1970 to build was welcomed
Bhopal Capitol of
Madhya Pradesh
The Plant
Operator : Union Carbide India
Ltd.
Half owned by Union Carbide
USA (50.9%)
Plant built to produce carbonyl
pesticide : SEVIN-DDT substitute
Very successful initially - part of
India’s Green Revolution
Initial staff 1000
The Surroundings
Initially in quiet
suburb
Later the town
expanded around it
Attracted a large
squatter camp, as
in many third world
countries
The Sevin Process
SEVIN manufactured from
Carbon Monoxide (CO)
Monomethylamine (MMA)
Chlorine (Cl2)
Alpha-Napthol (AN)
}
}
imported by truck
made on site
Process route
CO + Cl2
COCl2 (Phosgene)
COCl2 + MMA
MMC + MIC
MIC stored in three 15,000 gal tanks
MIC + AN
SEVIN
Properties of MIC
Flammability
Toxicity
Reactivity
NFPA Diamond
DOT = US Dept of Transport
CAS = Chemical Abstracts No.
ID = United Nations Ref No.
M I C Hazards
• Toxic, flammable gas
• Boiling point is near to
ambient
• Runaway reaction with
water possible unless
chilled below 11 C
Extract from NFPA 704
(National Fire Protection Association)
Right Side
Top of Diamond
Left Side
Simplified Process Flow Chart
MMA
Phosgene
Reaction System
Chloroform
Phosgene Still
HCl
Residue
Flare and Scrubber
Pyrolysis
Tails
MIC Refining Still
MIC Storage
Derivatives Plant
MIC Storage Tank
MIC Safeguards Table
SAFEGUARD
TYPE
1.
Mounded/insulated MIC Tanks
Passive
2.
Refrigeration below reaction initiation temperature
Active
3.
Refrigeration uses non-aqueous refrigerant (Freon)
Active
4.
Corrosion protection (cathodic) to prevent water ingress
Active
5.
Rigorous water isolation procedures (slip blinds)
Active
6.
Nitrogen padding gas used for MIC transfer not pumped
Active
7.
Relief Valve and rupture disk
Passive
8.
Vent gas scrubber with continuous caustic circulation
Active
9.
Elevated flare
10.
Water Curtain around MIC Tanks
Passive + Active
Active
What do we mean by Safeguards?
The vent gas scrubber was defined
previously as an active safeguard
1. Why it was not categorized as
passive? It is permanently installed
2. What would you say constitutes a
passive safeguard ?
Safeguards
Accidents are normally characterised by
a sequence of events leading from the
initiating event, propagation of the
accident, and realisation of the undesired
outcome
Safeguards may be equipment items or
procedures designed to prevent the
initiating event, limit or terminate the
propagation, or mitigate the outcome
Active safeguards are those which
require human procedures or mechanical
initiation to operate (e.g. work permit
procedures, scrubber caustic circulation)
Safeguards
Passive safeguards are those which are
designed in and which do not require any
initiation (e.g. concrete fireproofing,
elevated vent stack for dispersion)
Both active and passive safeguards can
be defeated through inadequate Safety
Management Systems
Plant Problems – Precursor to
Disaster
 A-Napthol plant shut down
 SEVIN production no longer
making money, so cost savings
sought, and plant run
intermittently
 Minimum maintenance
 Safety procedures simplified for
small jobs
 Refrigeration unit shut down and
Freon sold
 Scrubber circulation stopped
 Manning cut to 600
 Morale low
 Slip blinding no longer mandatory
during washing
 High temperature alarm shut-off as
T now > 11 C
 RV and PCV headers joined
(for maintenance)
 Emergency flare line
corroded, disconnected
 1981-1984: 6 accidents with
phosgene or MIC
 1982 audit critical of MIC
tank and instrumentation
 1984 warning of potential
runaway reaction hazard
The Incident
Occurred late at night, soon after
shift change
MIC tank overheated, overpressured and vented through
scrubber
Elevated discharge of massive
quantity of MIC (approximately 25
tons)
Operational staff retreated
upwind, no casualties
Staff from other plants evacuated,
few casualties
Incident Causes
Source of Water
Filters were being flushed using
high pressure water
Drain line from filter was blocked,
operator observed no flow to drain
Flushing continued despite
blockage
High pressure could cause valve
leak; force water into relief header
and then?
Incident Causes
Route of Water
RV and PCV headers were joined
by jumper pipe, no blinds
MIC tank could not be pressurised
because tank PCV failed open?
Leakage through a single valve
would allow water from RV header
to enter tank
Head of water sufficient for flow
Slow initial reaction would allow
1600 lbs. to enter
Probable Route of Ingress of
Water into Tank 610
To VCS
Jumper
Line
RWH Line
To VGS and FVH
MRS
RVVH
PVH
VGS
FVH
To
VCS
MIC Reactor Side
Relief Valve Vent Header
Process Valve Vent Header
Vent Gas Scrubber
Flare Vent Header
Route of water ingress
Slip Blind
required here
FVH Line
PI
N2 Header Isolation Valve
RV
PI
From Refrigeration
Rupture
Disk
From MRS
40 PSI
Valve which let water in
Refrigerator
Water
Source
Area
Quench Filter - pressure
safety valve lines
(at ground level)
Phosphene Stripping Still Filter- pressure
safety valve lines
(at ground level)
Water Drain
Tank No. 610
To Reactor Conditioner
Educator
Concrete Cover
Ultimate destination of water
Probable Route of Gas Leakage
before 0030 hrs
To VCS
Jumper
Line
RWH Line
To VGS and FVH
MIC
to
vent
MRS
RVVH
PVH
VGS
FVH
MIC Reactor Side
Relief Valve Vent Header
Process Valve Vent Header
Vent Gas Scrubber
Flare Vent Header
Route of gas leakage after 0030
PI
N2 Header Isolation Valve
RV
To
VCS
Vent
not
working!
FVH Line
PI
From Refrigeration
Rupture
Disk
From MRS
40 PSI
Valve which let water in
Refrigerator
Quench Filter - pressure
safety valve lines
(at ground level)
Phosphene Stripping Still Filter- pressure
safety valve lines
(at ground level)
Water Drain
Tank No. 610
To Reactor Conditioner
Educator
Concrete Cover
Reaction
Probable Route of Gas Leakage
after 0030 hrs
To VCS
Jumper
Line
RWH Line
To VGS and FVH
Increased rate of release
MRS
RVVH
PVH
VGS
FVH
PI
MIC Reactor Side
Relief Valve Vent Header
Process Valve Vent Header
Vent Gas Scrubber
Flare Vent Header
Route of gas leakage before 0030
N2 Header Isolation Valve
RV
To
VCS
FVH Line
PI
From Refrigeration
Rupture
Disk
From MRS
40 PSI
Valve which let water in
Rupture disk bursts
Refrigerator
Quench Filter - pressure
safety valve lines
(at ground level)
Phosphene Stripping Still Filter- pressure
safety valve lines
(at ground level)
Water Drain
Tank No. 610
To Reactor Conditioner
Educator
Concrete Cover
The Incident
No alarm or warning to
public
Very stable atmosphere and
low wind directly into town
Surrounding population
asleep
Over 2,500 fatalities
Over 250,000 sought medical
treatment
Panic
The Incident’s Extent
 Note how the cloud boundary
(to the level of “serious” harm)
almost exactly matches the
area of highest population
density
 Had the wind blown north the
Bhopal incident, although it
would have still been serious,
would have been less disastrous
 Other incidents could have been
worse but for luck in timing and
the wind direction
Seveso (wind direction)
Flixborough (occurred at a
week-end)
Incident Chemistry
Chemistry causing incident is
not in dispute
41 tonnes of MIC in storage
reacted with 500 to 900 kg
water plus contaminants
Resultant exothermic reaction
reached 400 to 480ºF
(200 to 250ºC)
Tank pressure rose to 200+
psig (14+ bar) - tank was
designed for 70 psig (4 bar)
Venting caused ground to
shake!
Incident Causes
 No universally accepted cause.
 Sabotage theory
 Disgruntled employee
 Alternative theory involves connection of
water hose to storage tank 610
 Evidence said to include the finding of the
disconnected pressure gauge from tank 610
after the disaster
 A rough drawing found, said to depict a hose
connected to a pressure vessel
 Management systems theory
 Inadequate safety management allowed water
entry through inadequate slip-blinding and
uncontrolled plant modifications
 Design safeguards should have prevented
the disaster of either case
Z
Z
OR
Z
Z
Z
?
Incident Causes
Many theories can be put
forward and all mechanisms
give insights into the
vulnerability of the system
Main objective is to learn from
the consequences; multiple
possible causes only serve to
highlight the weaknesses
What Could Safety Studies have
done?
 Early safety study would question
hazardous inventories and plant
siting
 Detailed study would identify
contamination problem
 Safety Studies may propose a
training function, should involve
parent company staff
 Safety Studies may review
procedures, especially those
involving hazards (water washing?)
Lessons
Learnt
What Could Safety Studies have
done?
 Safety Studies on modifications:
Disconnecting flare system
Not running refrigeration
Jumper pipe between vent
headers
Stopping scrubber caustic
circulation
 Safety Studies would emphasise
need for emergency plans
Lessons
Learnt