Lessons after Bhopal: CSB a catalyst for change

Journal of Loss Prevention in the Process Industries 18 (2005) 537–548 www.elsevier.com/locate/jlp

Lessons after Bhopal: CSB a catalyst for change Giby Joseph*, Mark Kaszniak, Lisa Long U.S. Chemical Safety and Hazard Investigation Board, 2175 K Street, NW, Suite 400, Washington, DC 20037, USA

Abstract The Bhopal tragedy was a defining moment in the history of the chemical industry. On December 3, 1984, a runaway reaction within a methyl isocyanate storage tank at the Union Carbide India Limited pesticide plant released a toxic gas cloud that killed thousands and injured hundreds of thousands. After Bhopal, industrial chemical plants became a major public concern. Both the public and the chemical industry realized the necessity of improving chemical process safety. Bhopal served as a wake-up call. To prevent the same event from occurring in the United States, many legislative and industrial changes were invoked—one of which was formation of the U.S. Chemical Safety and Hazard Investigation Board (CSB). The ultimate goal of CSB is to use the lessons learned and recommendations from its investigations to achieve positive change within the chemical industry—preventing incidents and saving lives. Although it seems clear that the lessons learned at Bhopal have improved chemical plant safety, CSB investigations indicate that the systemic problems identified at Bhopal remain the underlying causes of many incidents. These include: † † † † † †

Lack of awareness of reactive hazards. Lack of management of change. Inadequate plant design and maintenance. Ineffective employee training. Ineffective emergency preparedness and community notification. Lack of root cause incident investigations and communication of lessons learned.

The aim of this paper is to present common themes from recent cases investigated by CSB and to discuss how these issues might be best addressed in the future. This paper has not been independently approved by the Board and is published for general informational purposes only. Any material in the paper that did not originate in a Board-approved report is solely the responsibility of the authors and does not represent an official finding, conclusion, or position of the Board. q 2005 Elsevier Ltd. All rights reserved.

1. Background Around 12:30 a.m. on December 3, 1984, there was a massive release from a methyl isocyanate (MIC) storage tank at the Union Carbide India Limited (UCIL) plant in Bhopal, India. Highly toxic MIC gas drifted beyond the plant boundary, killing thousands and injuring hundreds of thousands more. Most of the victims lived in the densely populated shanty towns adjacent to the plant—Jayaprakash

* Corresponding author. Tel.: C1 202 261 7633; fax: C1 202 974 7633. E-mail address: [email protected] (G. Joseph).

0950-4230/$ - see front matter q 2005 Elsevier Ltd. All rights reserved. doi:10.1016/j.jlp.2005.07.009

Nagar, Kazi Camp, Chola Kenchi, and the Railway Colony (Lees, 1996). The immediate cause of the incident was the contamination of the MIC storage tank by about 2000 pounds of water. This triggered a runway reaction. The temperature and pressure within the tank rose. A valve designed to prevent tank over pressurization opened and discharged nearly 54,000 pounds of unreacted MIC vapor to the atmosphere within a two-hour period (Kletz, 2001). A complex set of interdependent organizational and technological factors played a critical role in the incident. Inadequate safety standards and maintenance procedures at the plant had a direct impact on the magnitude of the release. Table 1 lists several safety systems that should have prevented or minimized the release but were either out of order or not in full working order. Also, managers

538

G. Joseph et al. / Journal of Loss Prevention in the Process Industries 18 (2005) 537–548

Table 1 Breakdown in UCIL Bhopal MIC unit safety systems Safety system

System breakdown

Source

Refrigeration system

A 30-ton Freon based refrigeration system was used to keep MIC cool around zero degrees Celsius. However, the refrigeration was shut down Gauges measuring temperature and pressure in the various parts of the MIC unit, including MIC storage, were unreliable The alarm on the storage tank failed to signal the increase in temperature The gas scrubber was a safety device designed to neutralize vented MIC gas from the storage tank with a caustic soda solution. The MIC gas from the tank vented into the scrubber but the system was not fully operational and allowed untreated MIC gas to be released through the scrubber stacks. Even had it been operative, post-disaster inquiries revealed, it was not designed to handle the large quantities of MIC released over the short duration The flare tower, designed to burn off MIC gas, was turned off, waiting for a replacement of a corroded piece of pipe. The flare also was inadequately designed for its task, as it was capable of handling only a quarter of the volume of gas released A set of water-spray pipes that shoots water about 50 feet high could have been used to knock down or control escaping gases. The water jets were turned on but they could not reach the MIC being released from the scrubber stacks at a height of 100 feet The MIC storage system consisted of three underground storage tanks. Of these, one was supposed to be kept empty for emergency situations. However, the spare tank was not empty or could not be accessed The recommended capacity for the MIC tanks was 50%. Tank 610 was 80% full at the time of the incident The community toxic gas alarm was activated nearly an hour into the incident. It was turned off after five minutes and then turned back on after nearly another hour

Lees 1990

Gauges Temperature alarm Vent gas scrubber

Flare tower

Water curtain

Spare tank

Tank capacity Community alarm

and workers at the Bhopal facility had limited knowledge of the reactive hazards associated with MIC. The impact of the incident was worsened by the lack of adequate community notification and emergency response procedures (Shrivastava, 1992). The Bhopal incident was the impetus for an examination of chemical safety worldwide and for the emphasis on safety measures that continues today. Table 2 outlines the tremendous strides that have been made over the past 20 years (especially within the United States and Europe) in practices and attitudes in the chemical industry, including regulatory advances. In fact, the lack of an independent Federal oversight agency to investigate a serious chemical incident within the United States led to the formation of the U.S. Chemical Safety and Hazard Investigation Board (CSB). Although it seems clear that Bhopal has had a positive impact on chemical safety, CSB investigations indicate that many systemic, organizational, and technological failures identified at Bhopal remain the underlying causes of many incidents.

Weir, 1987 Morehouse 1986 Morehouse 1986

Weir, 1987

Shrivastava, 1992

Shrivastava, 1992

Shrivastava, 1992 Lees 1990

Amendments of 1990 and funded in 1998, CSB is responsible for determining the root and contributing causes of incidents, issuing safety recommendations, studying chemical safety issues, and evaluating the effectiveness of other government agencies involved in chemical safety (US Congress, 1990). Since 1998, CSB has conducted 29 incident investigations, one major hazard investigation on reactive hazards, and four safety studies. Table 3 indicates that of the 29 incident investigations, 11 were reactive incidents.1 The incidents CSB investigates occur anywhere hazardous chemicals are used—but mostly in the chemical manufacturing industry. Six of the 29 investigations are still ongoing. This paper addresses the underlying causes associated with the 23 completed investigations. As seen in Table 4, many incidents have multiple underlying causes, some of which are the same failures that happened nearly 20 years ago at Bhopal.

3. Awareness of reactive hazards 2. Introduction CSB is a catalyst for chemical incident prevention. CSB is an independent Federal agency whose mission is to ensure the safety of workers, the public, and the environment by investigating chemical incidents. The Board is a scientific investigative organization; it is not an enforcement or regulatory body. Established by the Clean Air Act

The Bhopal catastrophe was a reactive incident involving inadvertent mixing of incompatible chemicals, a runaway decomposition reaction, and a devastating toxic gas release. 1 A reactive incident is a sudden event involving an uncontrolled chemical reaction—with significant increases in temperature, pressure, or gas evolution—that has caused, or has the potential to cause, serious harm to people, property, or the environment.

G. Joseph et al. / Journal of Loss Prevention in the Process Industries 18 (2005) 537–548

539

Table 2 Advances in chemical plant safety Year

Safety advances

1985

Center for Chemical Process Safety (CCPS) created by the American Institute of Chemical Engineers (AIChE) to advance chemical plant safety Congress passed the Superfund Amendments and Reauthorization Act—which included the Emergency Planning and Community Right-to-Know Act (EPCRA) The American Chemistry Council or ACC (known then as Chemical Manufactures Association) launched the Responsible Care Program. Responsible Care requires companies to meet specific environmental, health, safety, and security performance criteria as a condition of membership CCPS publishes Guidelines for Technical Management of Chemical Process Safety. This book provided detailed guidance on how to incorporate safety into chemical plant operations (process safety management) The Synthetic Organic Chemical Manufacturers Association (SOCMA) adopted ACC’s Responsible Care program as a requirement for its members Congress passed the Clean Air Act Amendments (CAAA) to improve chemical safety through increased governmental oversight on worker safety, public and environmental protection, and incident investigations National Association of Chemical Distributors (NACD) initiated The Responsible Distribution ProcessSM (RDP). The program functions similar to ACC’s Responsible Care but with the added requirement that member companies must also go through a thirdparty verification process Directed by the CAAA 1990, the Occupational Safety and Health Administration (OSHA) promulgated the PSM standard—Process Safety Management of Highly Hazardous Chemicals (29 CFR 1910.119). The standard requires the management of hazards through a comprehensive program that integrates technologies, procedures, and management practices Mary Kay O’Connor Process Safety Center established. The Center conducts programs and research activities that enhance safety in the chemical process industries Directed by the CAAA 1990, the U.S. Environmental Protection Agency issued its risk management program (RMP) rule (40 CFR 68) requiring companies to analyze the hazards of their processes and establish board safety management systems to handle the hazards As authorized by CAAA 1990, the U.S. Chemical Safety and Hazard Investigation Board (CSB) began operations to investigative underlying causes of serious chemical incidents CSB published Improving Reactive Hazard Management from its two-year investigation into role of reactive hazards in chemical plant incidents. CCPS published Essential Practices for Managing Reactive Chemistry Hazards to provide guidance for industry practitioners regarding reactivity hazards Chemical Reactivity Hazards Alliance formed to increase awareness and provide as a source for guidance information

1986 1988

1989 1990 1990 1991

1992

1995 1996

1998 2002 2003 2004

In Bhopal: Anatomy of a Crisis, Paul Shrivastava writes ‘Managers and plant workers had little information on the hazard potential of the (UCIL Bhopal) plant’ for example that water contamination of the tanks containing MIC could initiate an uncontrolled chemical reaction (Shrivastava, 1992). This lack of reactive hazard awareness played a critical role in causing the incident. Numerous other incidents since Bhopal have occurred as a result of lack of awareness of the hazards presented by reactive chemicals. 3.1. CSB reactive hazard investigation Chemicals such as MIC can undergo potentially hazardous chemical reactions if not managed properly. These uncontrolled reactions may cause fires, explosions, and toxic gas releases. One example of a reactive hazard is a runaway reaction, where one or more chemicals suddenly react or decompose, accompanied by steep and accelerating temperature increases. In the confines of a chemical reactor or storage tank, as at Bhopal, such severe heating can result in a dangerous pressure increase that causes vessel rupture. Just such a runaway reaction and vessel rupture occurred at

a Morton International facility in New Jersey in 1998. CSB investigated this incident and determined that reactive hazards merited a more systemic analysis. The 2-year-long hazard investigation by CSB uncovered 167 serious chemical incidents within the United Sates over a 20-year period that involved uncontrolled chemical reactions. These incidents caused 108 deaths as well as hundreds of millions of dollars in property damage. The Board concluded that reactive chemical incidents pose a significant problem and that the pertinent Federal process safety regulations promulgated in response to Bhopal and other catastrophic incidents in the United States. contain significant gaps in their applicability and specific provisions. Over 90 percent of the incidents analyzed by CSB involved reactive hazards that were already recognized and documented in published literature. This finding indicated the need for greater outreach and dissemination of information to the facilities that process reactive chemicals (USCSB, 2002e). The CSB hazard investigation also found that more than half of the 167 surveyed incidents involved chemicals that are not covered by either the U.S. Occupational Safety and Health Administration (OSHA) Process Safety

540

G. Joseph et al. / Journal of Loss Prevention in the Process Industries 18 (2005) 537–548

Table 3 CSB Investigations Date

Investigations

Incident

City

State

Status

Reactive incident

23-Apr 12-Apr 8-Apr

2004 2004 2004

Formosa Plastics MFG Chemical Inc. Giant Industries

Illiopolis Dalton Gallup

Illinois Georgia New Mexico

Current Current Current

No Yes No

17-Nov 29-Oct

2003 2003

DPC Enterprises Hayes Lemmerz

Explosion Toxic Gas Release Refinery Explosions and Fire Chlorine Release Dust Explosions and Fire

Arizona Indiana

Current Complete

No No

21-Sep

2003

Isotec

Gas Explosion

Ohio

Complete

Yes

20-Jul

2003

Honeywell

Chemical Incidents

Louisiana

Current

No

1-May 11-Apr

2003 2003

DPC Enterprises D.D. Williamson & Co.

Chlorine Release Catastrophic Vessel Failure

Missouri Kentucky

Complete Complete

No No

20-Feb 7-Feb

2003 2003

CTA Acoustics Technic Inc.

Kentucky Rhode Island

Current Complete

No Yes

29-Jan

2003

Kinston

No

2003

North Carolina Texas

Complete

13-Jan

West Pharmaceutical Services BLSR Operating Ltd.

Dust Explosions and Fire Collection System Explosion Dust Explosion and Fire

Glendale Huntington Miamisburg Baton Rouge Festus Louisville Corbin Cranston

Complete

No

2-Jan

2003

Catalyst Systems Inc.

Ohio

Complete

Yes

11-Dec

2002

Environmental Enterprises

Ohio

Complete

Yes

13-Oct

2002

First Chemical Corp.

Mississippi

Complete

Yes

1-May

2002

Third Coast Industries

Texas

Complete

No

25-Apr

2002

Kaltech Industries

Reactive Chemical Explosion Petroleum Products Facility Fire Waste Mixing Explosion

New York

Complete

Yes

16-Jan

2002

Georgia-Pacific Corp.

Hydrogen Sulfide Poisoning

Alabama

Complete

Yes

17-Jul

2001

Motiva Enterprises

Delaware

Complete

No

13-Mar

2001

BP Amoco

Georgia

Complete

Yes

2-Feb

2001

Bethlehem Steel Corporation

Sulfuric Acid Tank Explosion Thermal Decomposition Incident Gas Condensate Fire

Indiana

Complete

No

23-Feb 19-Feb

1999 1999

Tosco Avon Refinery Concept Sciences

Petroleum Naphtha Fire Hydroxylamine Explosion

California Pennsylvania

Complete Complete

No Yes

9-Apr

1998

Herrig Brothers Farm

Propane Tank Explosion

Iowa

Complete

No

8-Apr

1998

Morton International Inc.

New Jersey

Complete

Yes

27-Mar

1998

Union Carbide Corp.

4-Mar

1998

Sonat Exploration Co.

7-Jan

1998

Sierra Chemical Co.

Runaway Chemical Reaction Nitrogen Asphyxiation Incident Catastrophic Vessel Overpressurization Reclaimed Munitions Explosion

Vapor Cloud Fire Reactive Chemical Explosion Hydrogen Sulfide Release

Date released

Hazard investigations and safety study publications

08-Sep 15-Jul 15-Jul

2004 2004 2004

25-Jun 17-Sep 1-Aug

2003 2002 2001

Rosharon Gnadenhutten Cincinnati Pascagoula Brazoria County New York Pennington Delaware City Augusta Chesterton Martinez Allentown Albert City Paterson Hahnville Pitkin

Louisiana

Complete

No

Louisiana

Complete

No

Mustang

Nevada

Complete

No

Combustible dust hazards Sodium hydrosulfide: preventing harm Removal of hazardous material from piping systems Hazards of Nitrogen Asphyxiation Improving Reactive Hazard Management Management of change

Current Complete Complete Complete Complete Complete

Table 4 Underlying causes of CSB investigations (USCSB, 1998b; 2002b; 2003b) Completed Investigations

Underlying causes

Bethlehem Steel Corporation BLSR Operating Ltd. BP Amocoa Catalyst Systems Inc.a Concept Sciencesa D.D. Williamson & Co. DPC Enterprises L.P. Environmental Enterprisesa First Chemical Corp.a Georgia-Pacific Corp.a Hayes Lemmerz Inc. Herrig Brothers Farm Isoteca Kaltech Industriesa Morton International Inc.a Motiva Enterprises Sierra Chemical Co. Sonat Exploration Co. Technic, Inca Third Coast Industries Tosco Avon Refinery Union Carbide Corp. West Pharmaceuticals Services a

Reactive incident.

X X X X X

X X X

Hazard evaluation

X

X X X X X

X

Operating procedures

Mechanical integrity

Management of change

X X X

Hazard communication

Employee training

X X

X X

Emergency response and planning

Incident investigation

X X

X X X

X X X X

X X X

Design

X

X X X X X

X

X X X

X X X

X X X X X

X

X

X

X X X

X X

X X

X X

X X

X

X X X

X X X X

X X

X X

X X

X X

X X X X

X

X

X

X

X

X

G. Joseph et al. / Journal of Loss Prevention in the Process Industries 18 (2005) 537–548

Hazard awareness

541

542

G. Joseph et al. / Journal of Loss Prevention in the Process Industries 18 (2005) 537–548

Management (PSM) or U.S. Environmental Protection Agency (EPA) Risk Management Program (RMP) rules. These rules require companies to apply good safety management practices to certain hazardous chemical processes. The Board recommended that both OSHA and EPA broaden the respective regulations to include coverage of reactive hazards. OSHA, EPA, the American Chemical Council (ACC), and the Synthetic Organic Chemical Manufacturers Association (SOCMA) have formed an alliance to educate industry about chemical reactivity hazards. After an initial meeting set up by CSB, industry, government, and academia have continued participating in a reactive hazard roundtable. The roundtable, sponsored by the American Institute of Chemical Engineers (AIChE), is attempting to develop minimum practices for safely managing reactive hazards. The Center for Chemical Process Safety (CCPS) has developed and published comprehensive guidelines on effectively managing reactive hazards. In Essential Practices for Managing Chemical Reactivity Hazards, CCPS responded to the CSB’s recommendation by providing additional guidance to industry (CCPS, 2003). CCPS subsequently formed a partnership with government and industry to publish the guide without charge through the websites of OSHA and EPA.

3.2. CSB incident investigations Of the 23 completed CSB investigations, 10 were reactive incidents. Lack of hazard awareness was identified as an underlying cause in 8 of the 10 incidents—Morton, Concept Sciences, BP Amoco, Georgia-Pacific, First Chemical, Technic, Kaltech, and Catalyst Systems.2 Some of these incidents are described in greater detail below (USCSB, 2003g). On January 16, 2002, sulfuric acid was being added to an acid sewer to control pH downstream at the GeorgiaPacific Naheola pulp and paper mill in Pennington, Alabama. Sodium hydrosulfide (NaHS), a process chemical that had spilled in the unloading area, drained to the sewer and reacted with the sulfuric acid to form hydrogen sulfide (H2S). The highly toxic gas vented from the sewer through a nearby fiberglass manhole cover. Several people working in the area were exposed. Two contractors were killed, and eight others were injured (USCSB, 2003a). The Board concluded that neither Georgia-Pacific nor the previous plant owners adequately analyzed or controlled the hazards of the sewer system, including the potential for hazardous chemical reactions. It 2

Of the 13 other completed investigations that were not reactive incidents, hazard awareness was an underlying cause in eight of the incidents.

recommended that Georgia-Pacific review sewer system safety at all its plants to prevent the inadvertent mixing of potentially reactive chemicals—including those that can form toxic gases. The Board also requested that GeorgiaPacific identify plant areas (such as NaHS unloading areas) where there is a risk of hydrogen sulfide release and require appropriate safeguards and training for all workers in those areas. As a result, Georgia Pacific has developed an approach for evaluating reactive hazards, in sewers particularly, and it is in the process of applying this hazard evaluation method at all Georgia Pacific facilities in the United States. Georgia Pacific is also developing corporate policies on both reactive hazards and process sewers. The Georgia Pacific incident also prompted the Board to initiate a special hazard investigation on the handling and use of NaHS in the United States. During the study, CSB found that NaHS hazard and safety information on manufacturer material safety data sheets (MSDS) was inconsistent. CSB published a safety bulletin, Sodium Hydrosulfide: Preventing Harm, to increase awareness of the hazards and outline safety practices to minimize potential harm to workers and the public. Reactive hazard awareness must move beyond the chemical processing industry to wherever hazardous chemicals are present. Data analysis indicated that—though 70 percent of the 167 incidents occurred in the chemical manufacturing industry—30 percent involved a variety of other industrial sectors that store, handle, or use chemicals in bulk quantities. The CSB investigation at Kaltech Industries,, a commercial sign manufacturer, serves as an excellent example. On April 25, 2002, an explosion in a mixed-use commercial building in downtown Manhattan injured 36 people, including 14 members of the public and six firefighters. Thirty-one of the injured were treated in hospitals, including four who required intensive care. The explosion originated in the basement of the building and caused damage as high as the fifth floor (USCSB, 2003f). CSB found that the Kaltech incident, resulted from mixing two incompatible waste chemicals—lacquer thinner and nitric acid—without following basic safety requirements. As at Bhopal, employees were not aware of the potential reactive hazards and lacked the necessary training to understand the hazards. The Board also found that the New York City fire code lacked sufficient chemical safety precautions to detect unsafe practices. In addition to its recommendations to Kaltech, CSB recommended that New York City revise its fire prevention code to achieve more comprehensive control over the storage and use of hazardous materials. In March 2004, the New York City Council announced that the city’s fire department had decided to revise the code and had allocated substantial funding to support the revision.

G. Joseph et al. / Journal of Loss Prevention in the Process Industries 18 (2005) 537–548

4. Management of change Change represents a deviation from the original design, fabrication, installation, or operation of a process. Even simple changes, if not properly managed, can result in catastrophic consequences. The objective of a management of change (MOC) program is to ensure that all changes to a process are properly reviewed and that hazards introduced by the change are identified, analyzed, and controlled prior to resuming operation. At Bhopal, the MIC plant was designed with several safety features (Table 1). Lack of adequate MOC was one reason these features were nonfunctional at the time of the incident. Of the 23 completed CSB investigations, lack of MOC was an underlying cause in six incidents—Morton, Tosco, Motiva, Technic, Hayes Lemmerz, and Georgia-Pacific. The Morton and Tosco incidents are described in greater detail below. On April 8, 1998, a runaway reaction during the production of Automate Yellow 96 dye initiated a sequence of events that led to an explosion and fire at the Morton International, Inc., plant in Paterson, New Jersey. On the day of the incident, flammable materials were released as the result of an uncontrolled rapid temperature and pressure rise in a 2000-gallon kettle in which orthonitrochlorobenzene (o-NCB) and 2-ethylhexylamine (2-EHA) were being reacted. Nine employees were injured in the explosion and fire, including two seriously. Potentially hazardous materials were released into the community, and the physical plant was extensively damaged. The Board concluded that lack of MOC was one important underlying cause of the incident (USCSB, 1998e). The Board recommended that the Morton Paterson plant establish a program to investigate any unsafe process deviations and recommended that OSHA and EPA issue joint guidelines on the management of reactive process hazards. The Board also called on the two agencies to cooperate with CSB in the investigation of reactive hazards. On February 23, 1999, a fire occurred in the crude unit at the Tosco Avon oil refinery in Martinez, California. Workers were attempting to replace piping attached to a 150-foot-tall fractionator tower while the process unit was in operation. During removal of the piping, naphtha was released onto the hot fractionator and ignited. The flames engulfed five workers located at different heights on the tower. Three of the fatalities were contractors—two were employed by a scaffold erection company, and the other worked for a crane company. The fourth fatality and the one seriously injured worker were Tosco maintenance employees (USCSB, 2001). CSB investigators found that the valves and piping had corroded at an excessive rate because an upstream vessel, known as the crude oil desalter—which removes salt, water, and solids from the oil feed—was being operated beyond its design limits. Tosco should have evaluated operational changes that could worsen the corrosion of piping and

543

valves—such as feeding different material into the process, increasing the amounts being processed, and making longterm adjustments to valve positions. No MOC evaluation was applied to these process modifications. This omission contributed to the final breakdown and the fire. The Board recommended that the refinery implement a comprehensive system for safely managing hazardous maintenance work. An effective MOC program is critical to the safe operation of a chemical facility. MOC requires the participation of everyone at the facility, including temporary and contract workers.

5. Hazard evaluations Hazard evaluations, or process hazard analyses, are organized efforts to identify and assess the significance of hazardous scenarios associated with a process or activity and to establish a design and operating basis for safety. One of the key lessons learned from Bhopal is that an adequate hazard evaluation might have caused management to question the decision to operate without fully functional refrigeration, scrubbing, and flare systems. Of the 23 completed CSB investigations, inadequate hazard evaluation was identified as an underlying cause in 12 incidents (see Table 4). Two examples, First Chemical and BP Amoco, are described in greater detail below (USCSB, 1998d; 2004b, c, d). An explosion at the First Chemical Corporation (FCC) facility in Pascagoula, Mississippi, on October 13, 2002, propelled large fragments of debris offsite, several of which landed near crude oil storage tanks. Steam leaking through manual valves heated mononitrotoluene (MNT) inside a distillation column, which was shut down at the time of the incident and was believed to be isolated. The column contained about 1200 gallons of MNT, a potentially highly energetic reactive material when heated. The material decomposed over several days, resulting in a runaway reaction and explosion. The blast blew the top off the distillation tower that was approximately 145 feet tall. Explosion debris caused a fire in an MNT storage tank, which burned for almost 3 h, and there were numerous smaller fires both onsite and offsite. Some of the debris— including one piece weighing over 6 tons—landed in an adjacent facility. The offsite consequences could have been catastrophic. Three plant employees were injured when glass windows shattered into the control room where they were working (USCSB, 2003h). The Board concluded that FCC had not effectively evaluated the hazards of processing MNT. CSB recommended that the Pascagoula facility and the DuPont Corporation—which purchased FCC following the incident—improve its hazard analyses, conduct process safety audits, install appropriate warning devices, and track the facility’s progress. The Board also recommended that ACC and SOCMA amend the Technical Specifications guidelines

544

G. Joseph et al. / Journal of Loss Prevention in the Process Industries 18 (2005) 537–548

in the Responsible Care Management System to explicitly require facilities to identify findings and lessons learned from process hazard analyses and incident investigations in one unit and apply them to other equipment that processes similar material. Three people were killed as they opened a process vessel containing hot plastic at the BP Amoco Polymers plant in Augusta, Georgia, on March 13, 2001. They were unaware that the vessel was pressurized. The workers were killed when the partially unbolted cover blew off the vessel, expelling hot plastic. The force of the release caused some nearby tubing to break. Hot fluid from the tubing ignited, resulting in a fire. Neither Amoco’s research and development (R&D) department nor the process design department had a systematic procedure specifically for evaluating hazards from unintended or uncontrolled chemical reactions (USCSB, 2002c). CSB recommended that the company ensure that reactive hazards are identified and evaluated during product R&D, and during both conceptual design, and detailed design of a new process; and before changes are made to existing equipment or process chemistry. The Board also recommended that the company communicate the results of this review to the workforce.

6. Plant design and maintenance In Learning from Accidents, Trevor Kletz advises that you have to ‘keep protective equipment in working order— and size it correctly.’ At Bhopal, the high temperature and pressure instruments were poorly maintained and known to be unreliable. The MIC storage tank relief valve was too small. It was not designed to handle a runaway reaction or two-phase flow. A water spray system was designed to absorb small leaks at or near ground level. It was not intended to absorb releases at a high level and failed to do so (Kletz, 2001). Inadequate plant design or mechanical integrity3 was identified as an underlying cause in 18 incidents (see Table 4). The Motiva (mechanical integrity) and D. D. Williamson (design) incident investigations are summarized below as examples. On July 17, 2001, an explosion occurred at the Motiva Enterprises LLC refinery in Delaware City, Delaware. A contractor, Jeffrey Davis, was killed, and eight other workers were injured. A spark from carbon-arc welding equipment ignited flammable vapors in a 415,000-gallon sulfuric acid storage tank. The surrounding sulfuric acid tank farm was heavily damaged in the blast, and an estimated 1.1 million gallons of the powerful corrosive were ultimately released to the environment, including nearly 3

Mechanical integrity includes maintenance activity.

100,000 gallons that flowed into the nearby Delaware River (USCSB, 2002e). The CSB investigation found significant deficiencies in Motiva’s mechanical integrity program. An effective program should have prevented the extensive corrosion damage that was evident in several tanks. Some of the tanks contained thousands of pounds of flammable hydrocarbons in addition to the corrosive sulfuric acid. CSB investigators found that Motiva did not consider the tank farm to be covered by the requirements of the OSHA PSM.4 The Board recommended that OSHA take steps to include such tanks farms under its regulatory system. As a result of the incident, the State of Delaware adopted legislation (the Jeffrey Davis Aboveground Storage Tank Act) that required new regulations to be implemented for aboveground storage tanks. CSB recommended that the Delaware Department of Natural Resources and Environmental Control ensure that the regulations required facility management to take prompt action in response to evidence of tank corrosion that presents hazards to people or the environment. On Friday April 11, 2003, a vessel at the D. D. Williamson & Co., Inc., plant in Louisville, Kentucky, exploded. One operator was killed. Twenty-six thousand pounds of aqua ammonia (29.4 percent ammonia in water solution) was released; 26 residents were evacuated and 1500 were sheltered-in-place. The explosion caused extensive damage to parts of the facility (USCSB, 2004a). The explosion and resulting ammonia release were caused by overpressurization of an 8-foot-tall food additive processing tank. CSB investigators determined that the incident could have been prevented had the company installed an emergency pressure relief valve on the tank. One of the underlying causes of the incident was that the tank was installed without a review of its design or fitness for service. Investigators concluded that D. D. Williamson did not have effective programs to determine if equipment and processes met basic engineering requirements.

7. Ineffective employee training Prior to December 1984, the Bhopal plant had been losing money for several years due to the weak demand for pesticides. This resulted in major personnel reductions, particularly in production and maintenance. Due to the cutbacks, plant personnel received limited training on MIC operations, and there was a general lack of safety consciousness (Shrivastava, 1992). Ineffective employee training was identified as an underlying cause in 9 of the 23 CSB completed investigations—D. D. Williamson, BLSR, DPC Festus, Hayes 4 Nonpressurized atmospheric storage tanks are exempt from coverage under the OSHA PSM Standard.

G. Joseph et al. / Journal of Loss Prevention in the Process Industries 18 (2005) 537–548

Lemmerz, Georgia-Pacific, Kaltech, Bethlehem Steel, Sonat, and Sierra (USCSB, 2002a; USCSB, 2003e). The Sierra incident is described in greater detail below. On January 7, 1998, two massive explosions just seconds apart destroyed the Sierra Chemical Company’s Kean Canyon explosives manufacturing plant 10 miles east of Reno, Nevada, killing four workers and injuring six others. The initial explosion occurred in a room where workers made ‘boosters’—small explosive devices used in the mining industry to detonate larger explosives. A second, more powerful blast destroyed the PETN building used for drying explosives, leaving a 40-by-60-foot crater that was up to 6 feet deep (USCSB, 1998a). There was no physical evidence or eyewitnesses who could conclusively pinpoint the cause of the explosion; however, CSB investigators identified the following most credible scenario. Base mix left overnight in a mixing pot stratified and solidified. The next morning, when the mixing pot was turned on, the mixer blade detonated the explosives by impact, shearing, or friction. The explosive shock wave detonated several thousand pounds of explosives in the room, which then destroyed the building. A heavy piece of equipment or burning debris from the first blast most likely fell through the reinforced-concrete roof or the skylight of the PETN building, initiating the second explosion 3.5 s later. The majority of workers at the Kean Canyon plant spoke only Spanish, but the plant had no operational policies or procedures in that language. Personnel primarily relied on experience to perform their jobs. Operators routinely made changes in the steps they took in manufacturing explosives. CSB found that employee training was conducted primarily in an ineffective, informal manner that relied primarily on on-the-job training. This resulted in inconsistent and hazardous work practices. Additionally, there were no written procedures for the process area in which the explosion occurred. Although operating procedures and training are generally considered to be lower level administrative safeguards, they can still be very important in preventing catastrophic incidents. This is particularly true in cases where process safety management principles are not applied, and more reliable safeguards are not in place (Bird 1985).

8. Emergency planning, notification, and response One of the key lessons learned from the Bhopal disaster is the need for proper planning, notification, and response in the event of a toxic chemical release. Although debate may continue over certain causes of the Bhopal incident, there seems to be general agreement that offsite emergency response plans, procedures, and actions were less than adequate (CCPS, 1992). After the Bhopal disaster, legislation was passed in the United States in 1986 to plan and coordinate chemical emergency response activities at

545

the community level. This legislation contained four major provisions: emergency planning, emergency release notification, hazardous chemical storage reporting requirements, and toxic chemical release inventory. After a series of high profile chemical disasters in the United States, additional legislation was passed in 1990 that required EPA and OSHA to issue regulations for chemical incident prevention. Facilities that had certain chemicals above specified threshold quantities were required to develop process safety and risk management programs to identify, evaluate, and manage hazards. Facilities subject to EPA’s risk management program also needed to submit a plan summarizing the program, portions of which are available to the public. Although a great deal of attention has been devoted to emergency planning, notification, and response efforts in the United States since the Bhopal disaster, seven of the 23 investigations completed thus far by CSB listed inadequate emergency planning, notification, or response as an underlying cause—Technic, Isotec, BLSR, First Chemical, Georgia Pacific, DPC, and Herrig Brothers. As illustrated by the CSB Herrig Brothers investigation outlined below, lack of planning, notification, or inadequate emergency response goes beyond the chemical processing industry and is an issue wherever hazardous chemicals are present. On April 9, 1998, an 18,000-gallon propane storage tank exploded at the Herrig Brothers Feather Creek Farm in Albert City, Iowa. The tank was engulfed in flames due to a leak of propane under the tank; the flames created conditions that resulted in a BLEVE (boiling liquid expanding vapor explosion). The explosion killed two volunteer firefighters and injured seven other emergency response personnel who were attempting to extinguish the fire (USCSB, 1998c). Among other underlying causes, CSB found that some training materials provided to the firefighters led them to believe that they would be protected from a propane tank explosion by positioning themselves to the sides of the tank and by avoiding the areas extending to the two ends of the tank. As a consequence, they were positioned too close to the sides of the burning propane storage tank when it exploded. The firefighters did not adequately recognize the potential for a BLEVE and that itcan scatter tank fragments in all directions. CSB recommended that the Fire Service Institute of Iowa State University, which had provided training to some members of the Albert City Volunteer Fire Department, ensure that its firefighter training materials address proper response procedures for BLEVEs. CSB also recommended that the National Propane Gas Association, ensure that its firefighting training materials address proper response procedures for BLEVEs. The Herrig investigation also uncovered a potentially misleading statement in the U.S. Department of Transportation’s (DOT) North American Emergency Response Guidebook. The Guidebook is carried in thousands of fire

546

G. Joseph et al. / Journal of Loss Prevention in the Process Industries 18 (2005) 537–548

trucks around the country, and firefighters often consult it when responding to hazardous material incidents. The 1996 version stated that responders should ‘always stay away from the ends of tanks’ when fighting flammable liquid tank fires. This advice could give the false impression that the sides of the tank are safe in such cases. On the advice of the Board, DOT revised the year 2000 guidebook, which now counsels firefighters who face propane fires to ‘always stay away from tanks engulfed in fire.’ However, these same problems can exist at facilities handling well-known toxic chemicals. On August 14, 2002, 48,000 pounds of chlorine was released during a railroad tank car unloading operation at DPC Enterprises, LP, near Festus, Missouri. Chlorine is a toxic chemical. Concentrations as low as 10 parts per million are classified by the National Institute of Occupational Safety and Health (NIOSH) as ‘immediately dangerous to life or health’. Although the wind direction on the day of the release carried the majority of the chlorine plume away from neighboring residential areas, some areas were evacuated (USCSB, 2003c). Sixty-three people from the surrounding community sought medical evaluation at the local hospital for respiratory distress, and three were admitted for overnight observation. The release affected hundreds of other nearby residents and employees, and the community was advised to shelter-in-place for 4 h. Traffic was halted on a nearby interstate highway for 1.5 h. Among other underlying causes, CSB found that DPC’s emergency preparedness planning was deficient and that its community notification system was inefficient for a large uncontrolled release of chlorine. CSB also found that the Jefferson County community emergency preparedness planning was inadequate for an incident of this magnitude. CSB recommended that DPC revise its emergency response plan and review the plan with the Local Emergency Planning Community (LEPC) and the local fire department. CSB also recommended that the Jefferson County Emergency Management Agency implement a community notification system for chemical releases.

9. Incident investigation and communication of lessons learned Since the Bhopal disaster, incident investigation has become a familiar and integral part of process safety management programs. In the United States, employers must assemble a team to investigate each incident that resulted in, or could reasonably have resulted in, a catastrophic release of a highly hazardous chemical. These investigations must begin within 48 h of the occurrence, and a report must be prepared to describe the incident and discuss the factors that contributed to it.

Table 5 Missed opportunities in incident investigations Only a single cause is found, often the final triggering event Only the immediate causes are found and ways of avoiding the hazard, or weaknesses in the management system, are not identified Human error is listed as a cause without identifying what caused the error, such as ignorance, lapse of attention, or non-compliance Reports look for people to blame, which diverts attention away from what can be done by better design or methods of operation Reports list causes that are difficult or impossible to remove Procedures are changed rather than designs. The first choice should be to see if the hazard can be removed—the inherently safer approach Sometimes too much time and money is spent making sure nothing similar could possibly happen again even though the probability is extremely unlikely Others do not learn from our experiences because circulation of incident reports is restricted Only overviews of incidents are received and read, especially by senior management. This reliance on secondary sources instead of primary ones can perpetuate errors Lessons learned are forgotten and the incident happens again. Safety education training is too theoretical and passive. Databases are incomplete and passive. People have cultural and psychological blocks, which encourage them to forget the lessons of the past

Any recommendations resulting from these investigations must be promptly addressed, resolved, and documented.5 Thus, by applying a lessons learned approach, it is possible to prevent future incidents by making changes in design, procedures, or training (CCPS, 1989). As illustrated below, five of CSB’s 23 completed investigations have identified deficiencies in incident investigation and communication of lessons learned as underlying causes— Environmental Enterprises, Georgia Pacific, BP Amoco, Hayes Lemmerz, and Morton. Two examples, BP Amoco and Environmental Enterprises Inc., are described below. As the Environmental Enterprises incident shows, deficiencies in these programs are not limited to just the chemical processing industry; incident investigation programs are needed wherever hazardous chemicals are present. In the BP Amoco incident, CSB found that the plant system for investigating incidents and near misses did not adequately identify causes or related hazards. Previous incidents and near misses involving the polymer catch tank were treated as isolated events, and no effective means were implemented or countermeasures developed to prevent recurrence. CSB recommended that the Augusta site implement a program to conduct periodic management reviews of incidents and near misses, address root causes, and implement and track corrective measures (USCSB, 2002c). On December 11, 2002, a maintenance employee was overcome by hydrogen sulfide gas and collapsed at the Environmental Enterprises, wastewater treatment facility in 5

CFR 1910.119 sub m.

G. Joseph et al. / Journal of Loss Prevention in the Process Industries 18 (2005) 537–548

Cincinnati, Ohio. Fortunately, fellow employees found him a few minutes later and pulled him to safety. He recovered, and there were no other injuries. Among other underlying causes, CSB found that Environmental Enterprises had no formal system for investigating incidents and communicating findings to employees. A past incident involving the release of strong hydrogen sulfide odors prompted a written order from the Office of Environmental Management to install a hydrogen sulfide detector in the wastewater treatment area. The detector was installed, but no procedures were developed or training conducted to ensure that employees understood its function and purpose. CSB recommended that Environmental Enterprises develop an incident investigation program that includes determining root causes of safety and environmental incidents and communicating the lessons learned to affected employees (USCSB, 2003d).

10. Conclusion In the United States, we have seen much progress in chemical process safety over the last 20 years. However, CSB has found that many of the management system failures that occurred at Bhopal are still fairly common. Why have we apparently failed to learn the lessons from Bhopal? One reason is that many incidents occur—not because they cannot be prevented—but because the organization did not learn, or did not retain, the lessons from past incidents. As Kletz states in Still Going Wrong!, ‘Organizations have no memory. Only people have memories and after a few years they move on, taking their memories with them’. He argues that even the bestdocumented, reported, and circulated investigations are often read, filed, and then forgotten. Table 5 lists 10 major missed opportunities in incident investigations that Kletz believes keep us from benefiting from lessons learned. CSB subscribes to Kletz’s approach. The Board’s investigations point out that learning from incidents involves not only searching within the organization for warning signs and deficiencies (e.g., in management systems), but also scanning the wider environment for lessons learned from other organizations (Kletz, 2003). A second contributing reason for failing to learn lessons from Bhopal is that the technological and organizational factors normally considered during incident investigation may not extend the causal network far enough to prevent recurrence. Too many investigations address only symptoms of what might be larger problems. Seemingly remote (or high level) underlying factors— such as corporate oversight and safety culture, and production and cost cutting pressures—may play a significant role in the cause of incidents. However, these fundamental issues are often not considered because they are not well defined.

547

There is yet much to be done to improve chemical safety and prevent the recurrences of incidents. CSB will continue to investigate major incidents and determine their underlying causes. The Board’s reports will continue to be made available to the public so that others can learn these lessons. CSB recommendations will target industry, trade organizations, and government in an attempt to further advance chemical safety. CSB will continue to serve as a catalyst to bring about positive change, in the chemical industry.

References Bird, F. E., & Germain, G. L. (1985). Practical loss control leadership. Loganville:GA: International Loss Control Institute, Inc.. CCPS (1989). Guidelines for technical management of chemical process safety. New York: AICHE. CCPS (1992). Guidelines for investigating chemical process incidents. New York: AICHE. Center for Chemical Process Safety (CCPS) (2003). Essential practices for managing chemical reactivity hazards. New York: AICHE. US Congress 1990, Public Law 101-549. November 15, 1990 Section r(6). Kletz, T. (2001). Learning from accidents. Oxford, UK Office: Butterworth-Heinemann. Kletz, T. (2003). Still going wrong!, case histories of process plant disasters and how they could have been avoided. Oxford, UK Office: Butterworth-Heinemann. Lees, F. (1996). (2nd ed.) Loss prevention in the process industries. Boston: Butterworth-Heinemann. Shrivastava, P. (1992). Bhopal anatomy of a crisis. London: Paul Chapman Publishing Ltd.. U.S. Chemical Safety Board (USCSB) (1998a). Investigation report, explosives manufacturing incident, January 7. Mustang, Nevada: Sierra Chemical Company (No. 98-001-I-NV). USCSB (1998b). Investigation Report, Nitrogen Asphyxiation, March 27. Hahnville, Louisiana: Union Carbide Corporation (No. 98-05-I-LA). USCSB (1998c). Investigation report, propane tank explosion, April 9. Albert City, Iowa: Herrig Brothers Feather Creek Farm (No. 98-007I-IA). USCSB (1998d). Investigation report, catastrophic vessel overpressurization, March 4. Pitkin, Louisiana: Sonat Exploration Company (No. 1998-002-I-LA). USCSB (1998e). Investigation report, chemical manufacturing incident, April 8. Paterson, New Jersey: Morton International, Inc. (No. 1998-06I-NJ). USCSB (2001). Investigation report, refinery fire incident, February 23, 1999. Martinez, California: Tosco Avon Refinery (No. 99-014-I-CA). USCSB (2002a). Investigation report, steel manufacturing incident, February 2, 2001. Chesterton, Indiana: Bethlehem Steel Corporation (No. 2001-02-I-IN). USCSB, 2002. Case study, The explosion at concept sciences: Hazards of Hydroxylamine, No. 1999-13-C-PA, March 2002. USCSB (2002c). Investigation report, thermal decomposition incident, March 13, 2001. Augusta, Georgia: BP Amoco Polymers, Inc. (No. 2001-03-I-GA). USCSB (2002d). Investigation report, refinery incident, July 17, 2001. Delaware City, Delaware: Motiva Enterprises LLC (No. 2001-05-I-DE). USCSB (2002e). Hazard investigation, improving reactive hazard management (No. 2002-01-H). USCSB (2003a). Investigation report, hydrogen sulphide poisoning, January 16, 2002. Pennington, Alabama: Georgia Pacific (No. 200201-I-AL).

548

G. Joseph et al. / Journal of Loss Prevention in the Process Industries 18 (2005) 537–548

USCSB (2003b). Investigation report, petroleum products facility incident, May 1, 2002. Friendswood, Texas: Third Coast Industries (Report No. 2002-03-I-TX). USCSB (2003c). Investigation report, chlorine release, August 14, 2002. Festus, Missouri: DPC Enterprises L.P. (No. 2002-04-I-MO). USCSB (2003d). Case study, hydrogen sulphide exposure, December 11, 2003. Cincinnati, Ohio: Environmental Enterprises (No. 200302-C-OH). USCSB (2003e). Investigation report, vapor cloud deflagration and fire, January 13, 2003. Rosharon, Texas: BLSR Operating, Ltd (No. 200306-I-TX). USCSB (2003f). Investigation report, chemical waste-mixing incident, April 25, 2002. New york city, New York: Kaltech Industries Group, Inc. (No.2002-02-I-NY). USCSB (2003g). Case study, fire and explosion: Hazards of benzoyl peroxide, January 2, 2003. Gnadenhutten,Ohio: Catalyst Systems, Inc. (No. 2003-01-I-MS).

USCSB (2003h). Investigation report, explosion and fire, October 13, 2002. Pascagoula, Mississippi: First Chemical Corporation (No. 2003-01-IMS). USCSB (2004a). Investigation report, catastrophic vessel failure, April 11, 2003. Louisville, Kentucky: D.D. Williamson and Co., Inc. (No. 200311-I-KY). USCSB (2004b). Case study, explosion at biochemical facility; Liquid Nitric Oxide release, September 21, 2003. Miami Township, Ohio: Isotec (No. 2003-15-C-OH). USCSB (2004c). Investigation report, dust explosion, January 29, 2003. Kinston, North Carolina: West Pharmaceuticals Services Inc. (No. 2003-07-I-NC). USCSB (2004d). Investigation report, aluminium dust explosion, October 29, 2003. Huntington, Indiana: Hayes Lemmerz InternationalHuntington, Inc. (No. 2004-01-I-IN). Weir, D. (1987). The Bhopal syndrome: Pesticides, environment, and health. San Francisco: Sierra Club Books.