Lessons after Bhopal: CSB a catalyst for change

Lessons after Bhopal: CSB a catalyst for change

Giby Joseph*, Mark Kaszniak, Lisa Long

U.S. Chemical Safety and Hazard Investigation Board, 2175 K Street, NW, Suite 400, Washington, DC 20037, USA

Abstract

The Bhopal tragedy was a defining moment in the history of the chemical industry. On December 3, 1984, a runaway reaction within a

methyl isocyanate storage tank at the Union Carbide India Limited pesticide plant released a toxic gas cloud that killed thousands and injured

hundreds of thousands. After Bhopal, industrial chemical plants became a major public concern. Both the public and the chemical industry

realized the necessity of improving chemical process safety.

Bhopal served as a wake-up call. To prevent the same event from occurring in the United States, many legislative and industrial changes

were invoked—one of which was formation of the U.S. Chemical Safety and Hazard Investigation Board (CSB). The ultimate goal of CSB is

to use the lessons learned and recommendations from its investigations to achieve positive change within the chemical industry—preventing

incidents and saving lives.

Although it seems clear that the lessons learned at Bhopal have improved chemical plant safety, CSB investigations indicate that the

systemic problems identified at Bhopal remain the underlying causes of many incidents. These include:

† Lack of awareness of reactive hazards.

† Lack of management of change.

† Inadequate plant design and maintenance.

† Ineffective employee training.

† Ineffective emergency preparedness and community notification.

† Lack of root cause incident investigations and communication of lessons learned.

The aim of this paper is to present common themes from recent cases investigated by CSB and to discuss how these issues might be best

addressed in the future.

This paper has not been independently approved by the Board and is published for general informational purposes only. Any material in

the paper that did not originate in a Board-approved report is solely the responsibility of the authors and does not represent an official finding,

conclusion, or position of the Board.

q 2005 Elsevier Ltd. All rights reserved.

1. Background

Around 12:30 a.m. on December 3, 1984, there was a

massive release from a methyl isocyanate (MIC) storage

tank at the Union Carbide India Limited (UCIL) plant in

Bhopal, India. Highly toxic MIC gas drifted beyond the

plant boundary, killing thousands and injuring hundreds of

thousands more. Most of the victims lived in the densely

populated shanty towns adjacent to the plant—Jayaprakash

0950-4230/$ - see front matter q 2005 Elsevier Ltd. All rights reserved.

doi:10.1016/j.jlp.2005.07.009

* Corresponding author. Tel.: C1 202 261 7633; fax: C1 202 974 7633.

E-mail address: [email protected] (G. Joseph).

Nagar, Kazi Camp, Chola Kenchi, and the Railway Colony

(Lees, 1996).

The immediate cause of the incident was the contami-

nation of the MIC storage tank by about 2000 pounds of

water. This triggered a runway reaction. The temperature

and pressure within the tank rose. A valve designed to

prevent tank over pressurization opened and discharged

nearly 54,000 pounds of unreacted MIC vapor to the

atmosphere within a two-hour period (Kletz, 2001).

A complex set of interdependent organizational and

technological factors played a critical role in the incident.

Inadequate safety standards and maintenance procedures at

the plant had a direct impact on the magnitude of the release.

Table 1 lists several safety systems that should have

prevented or minimized the release but were either out of

order or not in full working order. Also, managers

Journal of Loss Prevention in the Process Industries 18 (2005) 537–548

www.elsevier.com/locate/jlp

http://www.elsevier.com/locate/jlp

Table 1

Breakdown in UCIL Bhopal MIC unit safety systems

Safety system System breakdown Source

Refrigeration system A 30-ton Freon based refrigeration system was used to keep MIC cool around zero

degrees Celsius. However, the refrigeration was shut down

Lees 1990

Gauges Gauges measuring temperature and pressure in the various parts of the MIC unit,

including MIC storage, were unreliable

Weir, 1987

Temperature alarm The alarm on the storage tank failed to signal the increase in temperature Morehouse 1986

Vent gas scrubber The gas scrubber was a safety device designed to neutralize vented MIC gas from the

storage tank with a caustic soda solution. The MIC gas from the tank vented into the

scrubber but the system was not fully operational and allowed untreated MIC gas to be

released through the scrubber stacks. Even had it been operative, post-disaster inquiries

revealed, it was not designed to handle the large quantities of MIC released over the short

duration

Morehouse 1986

Flare tower The flare tower, designed to burn off MIC gas, was turned off, waiting for a replacement

of a corroded piece of pipe. The flare also was inadequately designed for its task, as it was

capable of handling only a quarter of the volume of gas released

Weir, 1987

Water curtain A set of water-spray pipes that shoots water about 50 feet high could have been used to

knock down or control escaping gases. The water jets were turned on but they could not

reach the MIC being released from the scrubber stacks at a height of 100 feet

Shrivastava, 1992

Spare tank The MIC storage system consisted of three underground storage tanks. Of these, one was

supposed to be kept empty for emergency situations. However, the spare tank was not

empty or could not be accessed

Shrivastava, 1992

Tank capacity The recommended capacity for the MIC tanks was 50%. Tank 610 was 80% full at the

time of the incident

Shrivastava, 1992

Community alarm The community toxic gas alarm was activated nearly an hour into the incident. It was

turned off after five minutes and then turned back on after nearly another hour

Lees 1990

G. Joseph et al. / Journal of Loss Prevention in the Process Industries 18 (2005) 537–548538

and workers at the Bhopal facility had limited knowledge of

the reactive hazards associated with MIC. The impact of the

incident was worsened by the lack of adequate community

notification and emergency response procedures (Shrivas-

tava, 1992).

The Bhopal incident was the impetus for an examination

of chemical safety worldwide and for the emphasis on safety

measures that continues today. Table 2 outlines the

tremendous strides that have been made over the past 20

years (especially within the United States and Europe) in

practices and attitudes in the chemical industry, including

regulatory advances. In fact, the lack of an independent

Federal oversight agency to investigate a serious chemical

incident within the United States led to the formation of the

U.S. Chemical Safety and Hazard Investigation Board

(CSB). Although it seems clear that Bhopal has had a

positive impact on chemical safety, CSB investigations

indicate that many systemic, organizational, and techno-

logical failures identified at Bhopal remain the underlying

causes of many incidents.

1 A reactive incident is a sudden event involving an uncontrolled

chemical reaction—with significant increases in temperature, pressure, or

gas evolution—that has caused, or has the potential to cause, serious harm

to people, property, or the environment.

2. Introduction

CSB is a catalyst for chemical incident prevention. CSB

is an independent Federal agency whose mission is to ensure

the safety of workers, the public, and the environment by

investigating chemical incidents. The Board is a scientific

investigative organization; it is not an enforcement or

regulatory body. Established by the Clean Air Act

Amendments of 1990 and funded in 1998, CSB is

responsible for determining the root and contributing causes

of incidents, issuing safety recommendations, studying

chemical safety issues, and evaluating the effectiveness of

other government agencies involved in chemical safety (US

Congress, 1990).

Since 1998, CSB has conducted 29 incident investi-

gations, one major hazard investigation on reactive hazards,

and four safety studies. Table 3 indicates that of the 29

incident investigations, 11 were reactive incidents.1 The

incidents CSB investigates occur anywhere hazardous

chemicals are used—but mostly in the chemical manufac-

turing industry. Six of the 29 investigations are still

ongoing. This paper addresses the underlying causes

associated with the 23 completed investigations. As seen

in Table 4, many incidents have multiple underlying causes,

some of which are the same failures that happened nearly 20

years ago at Bhopal.

3. Awareness of reactive hazards

The Bhopal catastrophe was a reactive incident involving

inadvertent mixing of incompatible chemicals, a runaway

decomposition reaction, and a devastating toxic gas release.

Table 2

Advances in chemical plant safety

Year Safety advances

1985 Center for Chemical Process Safety (CCPS) created by the American Institute of Chemical Engineers (AIChE) to advance chemical

plant safety

1986 Congress passed the Superfund Amendments and Reauthorization Act—which included the Emergency Planning and Community

Right-to-Know Act (EPCRA)

1988 The American Chemistry Council or ACC (known then as Chemical Manufactures Association) launched the Responsible Care

Program. Responsible Care requires companies to meet specific environmental, health, safety, and security performance criteria as a

condition of membership

1989 CCPS publishes Guidelines for Technical Management of Chemical Process Safety. This book provided detailed guidance on how to

incorporate safety into chemical plant operations (process safety management)

1990 The Synthetic Organic Chemical Manufacturers Association (SOCMA) adopted ACC’s Responsible Care program as a requirement

for its members

1990 Congress passed the Clean Air Act Amendments (CAAA) to improve chemical safety through increased governmental oversight on

worker safety, public and environmental protection, and incident investigations

1991 National Association of Chemical Distributors (NACD) initiated The Responsible Distribution ProcessSM (RDP). The program

functions similar to ACC’s Responsible Care but with the added requirement that member companies must also go through a third-

party verification process

1992 Directed by the CAAA 1990, the Occupational Safety and Health Administration (OSHA) promulgated the PSM standard—Process

Safety Management of Highly Hazardous Chemicals (29 CFR 1910.119). The standard requires the management of hazards through

a comprehensive program that integrates technologies, procedures, and management practices

1995 Mary Kay O’Connor Process Safety Center established. The Center conducts programs and research activities that enhance safety in

the chemical process industries

1996 Directed by the CAAA 1990, the U.S. Environmental Protection Agency issued its risk management program (RMP) rule (40 CFR

68) requiring companies to analyze the hazards of their processes and establish board safety management systems to handle the

hazards

1998 As authorized by CAAA 1990, the U.S. Chemical Safety and Hazard Investigation Board (CSB) began operations to investigative

underlying causes of serious chemical incidents

2002 CSB published Improving Reactive Hazard Management from its two-year investigation into role of reactive hazards in chemical

plant incidents.

2003 CCPS published Essential Practices for Managing Reactive Chemistry Hazards to provide guidance for industry practitioners

regarding reactivity hazards

2004 Chemical Reactivity Hazards Alliance formed to increase awareness and provide as a source for guidance information

G. Joseph et al. / Journal of Loss Prevention in the Process Industries 18 (2005) 537–548 539

In Bhopal: Anatomy of a Crisis, Paul Shrivastava writes

‘Managers and plant workers had little information on

the hazard potential of the (UCIL Bhopal) plant’ for

example that water contamination of the tanks containing

MIC could initiate an uncontrolled chemical reaction

(Shrivastava, 1992). This lack of reactive hazard awareness

played a critical role in causing the incident. Numerous

other incidents since Bhopal have occurred as a result of

lack of awareness of the hazards presented by reactive

chemicals.

3.1. CSB reactive hazard investigation

Chemicals such as MIC can undergo potentially

hazardous chemical reactions if not managed properly.

These uncontrolled reactions may cause fires, explosions,

and toxic gas releases. One example of a reactive hazard is a

runaway reaction, where one or more chemicals suddenly

react or decompose, accompanied by steep and accelerating

temperature increases. In the confines of a chemical reactor

or storage tank, as at Bhopal, such severe heating can result

in a dangerous pressure increase that causes vessel rupture.

Just such a runaway reaction and vessel rupture occurred at

a Morton International facility in New Jersey in 1998. CSB

investigated this incident and determined that reactive

hazards merited a more systemic analysis.

The 2-year-long hazard investigation by CSB uncovered

167 serious chemical incidents within the United Sates over

a 20-year period that involved uncontrolled chemical

reactions. These incidents caused 108 deaths as well as

hundreds of millions of dollars in property damage. The

Board concluded that reactive chemical incidents pose a

significant problem and that the pertinent Federal process

safety regulations promulgated in response to Bhopal and

other catastrophic incidents in the United States. contain

significant gaps in their applicability and specific pro-

visions. Over 90 percent of the incidents analyzed by CSB

involved reactive hazards that were already recognized and

documented in published literature. This finding indicated

the need for greater outreach and dissemination of

information to the facilities that process reactive chemicals

(USCSB, 2002e).

The CSB hazard investigation also found that more than

half of the 167 surveyed incidents involved chemicals that

are not covered by either the U.S. Occupational Safety

and Health Administration (OSHA) Process Safety

Table 3

CSB Investigations

Date Investigations Incident City State Status Reactive

incident

23-Apr 2004 Formosa Plastics Explosion Illiopolis Illinois Current No

12-Apr 2004 MFG Chemical Inc. Toxic Gas Release Dalton Georgia Current Yes

8-Apr 2004 Giant Industries Refinery Explosions and

Fire

Gallup New Mexico Current No

17-Nov 2003 DPC Enterprises Chlorine Release Glendale Arizona Current No

29-Oct 2003 Hayes Lemmerz Dust Explosions and Fire Hunting-

ton

Indiana Complete No

21-Sep 2003 Isotec Gas Explosion Miamis-

burg

Ohio Complete Yes

20-Jul 2003 Honeywell Chemical Incidents Baton

Rouge

Louisiana Current No

1-May 2003 DPC Enterprises Chlorine Release Festus Missouri Complete No

11-Apr 2003 D.D. Williamson & Co. Catastrophic Vessel Failure Louis-

ville

Kentucky Complete No

20-Feb 2003 CTA Acoustics Dust Explosions and Fire Corbin Kentucky Current No

7-Feb 2003 Technic Inc. Collection System

Explosion

Cranston Rhode Island Complete Yes

29-Jan 2003 West Pharmaceutical Ser-

vices

Dust Explosion and Fire Kinston North Caro-

lina

Complete No

13-Jan 2003 BLSR Operating Ltd. Vapor Cloud Fire Rosh-

aron

Texas Complete No

2-Jan 2003 Catalyst Systems Inc. Reactive Chemical

Explosion

Gnaden-

hutten

Ohio Complete Yes

11-Dec 2002 Environmental Enterprises Hydrogen Sulfide Release Cincin-

nati

Ohio Complete Yes

13-Oct 2002 First Chemical Corp. Reactive Chemical

Explosion

Pasca-

goula

Mississippi Complete Yes

1-May 2002 Third Coast Industries Petroleum Products Facility

Fire

Brazoria

County

Texas Complete No

25-Apr 2002 Kaltech Industries Waste Mixing Explosion New

York

New York Complete Yes

16-Jan 2002 Georgia-Pacific Corp. Hydrogen Sulfide Poisoning Penning-

ton

Alabama Complete Yes

17-Jul 2001 Motiva Enterprises Sulfuric Acid Tank

Explosion

Delaware

City

Delaware Complete No

13-Mar 2001 BP Amoco Thermal Decomposition

Incident

Augusta Georgia Complete Yes

2-Feb 2001 Bethlehem Steel Corporation Gas Condensate Fire Chester-

ton

Indiana Complete No

23-Feb 1999 Tosco Avon Refinery Petroleum Naphtha Fire Martinez California Complete No

19-Feb 1999 Concept Sciences Hydroxylamine Explosion Allen-

town

Pennsylvania Complete Yes

9-Apr 1998 Herrig Brothers Farm Propane Tank Explosion Albert

City

Iowa Complete No

8-Apr 1998 Morton International Inc. Runaway Chemical

Reaction

Paterson New Jersey Complete Yes

27-Mar 1998 Union Carbide Corp. Nitrogen Asphyxiation

Incident

Hahn-

ville

Louisiana Complete No

4-Mar 1998 Sonat Exploration Co. Catastrophic Vessel

Overpressurization

Pitkin Louisiana Complete No

7-Jan 1998 Sierra Chemical Co. Reclaimed Munitions

Explosion

Mustang Nevada Complete No

Date released Hazard investigations and safety study publications

08-Sep 2004 Combustible dust hazards Current

15-Jul 2004 Sodium hydrosulfide: preventing harm Complete

15-Jul 2004 Removal of hazardous material from

piping systems

Complete

25-Jun 2003 Hazards of Nitrogen Asphyxiation Complete

17-Sep 2002 Improving Reactive Hazard Management Complete

1-Aug 2001 Management of change Complete


Table 4

Underlying causes of CSB investigations (USCSB, 1998b; 2002b; 2003b)

Completed Investigations Underlying causes

Hazard

awareness

Hazard

evaluation

Design Operating

procedures

Mechanical

integrity

Management

of change

Hazard

communication

Employee

training

Emergency

response and

planning

Incident

investigation

Bethlehem Steel Corporation X X X X

BLSR Operating Ltd. X X X X X

BP Amocoa X X X X X

Catalyst Systems Inc.a X X

Concept Sciencesa X X

D.D. Williamson & Co. X X X X

DPC Enterprises L.P. X X X

Environmental Enterprisesa X X X X

First Chemical Corp.a X X X X X

Georgia-Pacific Corp.a X X X X X X X X

Hayes Lemmerz Inc. X X X X X X

Herrig Brothers Farm X X

Isoteca X X X X

Kaltech Industriesa X X X

Morton International Inc.a X X X X X X

Motiva Enterprises X X X

Sierra Chemical Co. X X X

Sonat Exploration Co. X X X X

Technic, Inca X X X X X X X

Third Coast Industries X X

Tosco Avon Refinery X X X X

Union Carbide Corp. X X

West Pharmaceuticals Ser-

vices

X X X X

a Reactive incident.

G.

Josep

het

al.

/Jo

urn

al

of

Lo

ssP

reventio

nin

the

Pro

cessIn

du

stries1

8(2

00

5)

53

7–

54

85

41


Management (PSM) or U.S. Environmental Protection

Agency (EPA) Risk Management Program (RMP) rules.

These rules require companies to apply good safety

management practices to certain hazardous chemical

processes. The Board recommended that both OSHA and

EPA broaden the respective regulations to include coverage

of reactive hazards.

OSHA, EPA, the American Chemical Council (ACC),

and the Synthetic Organic Chemical Manufacturers Associ-

ation (SOCMA) have formed an alliance to educate industry

about chemical reactivity hazards.

After an initial meeting set up by CSB, industry,

government, and academia have continued participating in

a reactive hazard roundtable. The roundtable, sponsored by

the American Institute of Chemical Engineers (AIChE), is

attempting to develop minimum practices for safely

managing reactive hazards.

The Center for Chemical Process Safety (CCPS) has

developed and published comprehensive guidelines on

effectively managing reactive hazards. In Essential Prac-

tices for Managing Chemical Reactivity Hazards, CCPS

responded to the CSB’s recommendation by providing

additional guidance to industry (CCPS, 2003). CCPS

subsequently formed a partnership with government and

industry to publish the guide without charge through the

websites of OSHA and EPA.

3.2. CSB incident investigations

Of the 23 completed CSB investigations, 10 were

reactive incidents. Lack of hazard awareness was identified

as an underlying cause in 8 of the 10 incidents—Morton,

Concept Sciences, BP Amoco, Georgia-Pacific, First

Chemical, Technic, Kaltech, and Catalyst Systems.2 Some

of these incidents are described in greater detail below

(USCSB, 2003g).

On January 16, 2002, sulfuric acid was being added to

an acid sewer to control pH downstream at the Georgia-

Pacific Naheola pulp and paper mill in Pennington,

Alabama. Sodium hydrosulfide (NaHS), a process

chemical that had spilled in the unloading area, drained

to the sewer and reacted with the sulfuric acid to form

hydrogen sulfide (H2S). The highly toxic gas vented from

the sewer through a nearby fiberglass manhole cover.

Several people working in the area were exposed. Two

contractors were killed, and eight others were injured

(USCSB, 2003a).

The Board concluded that neither Georgia-Pacific nor

the previous plant owners adequately analyzed or

controlled the hazards of the sewer system, including

the potential for hazardous chemical reactions. It

2 Of the 13 other completed investigations that were not reactive

incidents, hazard awareness was an underlying cause in eight of the

incidents.

recommended that Georgia-Pacific review sewer system

safety at all its plants to prevent the inadvertent mixing of

potentially reactive chemicals—including those that can

form toxic gases. The Board also requested that Georgia-

Pacific identify plant areas (such as NaHS unloading

areas) where there is a risk of hydrogen sulfide release

and require appropriate safeguards and training for all

workers in those areas.

As a result, Georgia Pacific has developed an approach

for evaluating reactive hazards, in sewers particularly, and it

is in the process of applying this hazard evaluation method

at all Georgia Pacific facilities in the United States. Georgia

Pacific is also developing corporate policies on both reactive

hazards and process sewers.

The Georgia Pacific incident also prompted the Board to

initiate a special hazard investigation on the handling and

use of NaHS in the United States. During the study, CSB

found that NaHS hazard and safety information on

manufacturer material safety data sheets (MSDS) was

inconsistent. CSB published a safety bulletin, Sodium

Hydrosulfide: Preventing Harm, to increase awareness of

the hazards and outline safety practices to minimize

potential harm to workers and the public.

Reactive hazard awareness must move beyond the

chemical processing industry to wherever hazardous

chemicals are present. Data analysis indicated that—though

70 percent of the 167 incidents occurred in the chemical

manufacturing industry—30 percent involved a variety of

other industrial sectors that store, handle, or use chemicals

in bulk quantities. The CSB investigation at Kaltech

Industries,, a commercial sign manufacturer, serves as an

excellent example.

On April 25, 2002, an explosion in a mixed-use

commercial building in downtown Manhattan injured 36

people, including 14 members of the public and six

firefighters. Thirty-one of the injured were treated in

hospitals, including four who required intensive care.

The explosion originated in the basement of the building

and caused damage as high as the fifth floor (USCSB,

2003f).

CSB found that the Kaltech incident, resulted from

mixing two incompatible waste chemicals—lacquer

thinner and nitric acid—without following basic safety

requirements. As at Bhopal, employees were not aware

of the potential reactive hazards and lacked the necessary

training to understand the hazards. The Board also found

that the New York City fire code lacked sufficient

chemical safety precautions to detect unsafe practices. In

addition to its recommendations to Kaltech, CSB

recommended that New York City revise its fire

prevention code to achieve more comprehensive control

over the storage and use of hazardous materials. In

March 2004, the New York City Council announced that

the city’s fire department had decided to revise the code

and had allocated substantial funding to support the

revision.


4. Management of change

Change represents a deviation from the original design,

fabrication, installation, or operation of a process. Even

simple changes, if not properly managed, can result in

catastrophic consequences. The objective of a management

of change (MOC) program is to ensure that all changes to a

process are properly reviewed and that hazards introduced

by the change are identified, analyzed, and controlled prior

to resuming operation. At Bhopal, the MIC plant was

designed with several safety features (Table 1). Lack of

adequate MOC was one reason these features were

nonfunctional at the time of the incident.

Of the 23 completed CSB investigations, lack of MOC

was an underlying cause in six incidents—Morton, Tosco,

Motiva, Technic, Hayes Lemmerz, and Georgia-Pacific.

The Morton and Tosco incidents are described in greater

detail below.

On April 8, 1998, a runaway reaction during the

production of Automate Yellow 96 dye initiated a sequence

of events that led to an explosion and fire at the Morton

International, Inc., plant in Paterson, New Jersey. On the

day of the incident, flammable materials were released as

the result of an uncontrolled rapid temperature and pressure

rise in a 2000-gallon kettle in which orthonitrochloroben-

zene (o-NCB) and 2-ethylhexylamine (2-EHA) were being

reacted. Nine employees were injured in the explosion and

fire, including two seriously. Potentially hazardous

materials were released into the community, and the

physical plant was extensively damaged. The Board

concluded that lack of MOC was one important underlying

cause of the incident (USCSB, 1998e).

The Board recommended that the Morton Paterson plant

establish a program to investigate any unsafe process

deviations and recommended that OSHA and EPA issue

joint guidelines on the management of reactive process

hazards. The Board also called on the two agencies to

cooperate with CSB in the investigation of reactive hazards.

On February 23, 1999, a fire occurred in the crude unit at

the Tosco Avon oil refinery in Martinez, California.

Workers were attempting to replace piping attached to a

150-foot-tall fractionator tower while the process unit was

in operation. During removal of the piping, naphtha was

released onto the hot fractionator and ignited. The flames

engulfed five workers located at different heights on the

tower. Three of the fatalities were contractors—two were

employed by a scaffold erection company, and the other

worked for a crane company. The fourth fatality and the one

seriously injured worker were Tosco maintenance employ-

ees (USCSB, 2001).

CSB investigators found that the valves and piping had

corroded at an excessive rate because an upstream vessel,

known as the crude oil desalter—which removes salt, water,

and solids from the oil feed—was being operated beyond its

design limits. Tosco should have evaluated operational

changes that could worsen the corrosion of piping and

valves—such as feeding different material into the process,

increasing the amounts being processed, and making long-

term adjustments to valve positions. No MOC evaluation

was applied to these process modifications. This omission

contributed to the final breakdown and the fire. The Board

recommended that the refinery implement a comprehensive

system for safely managing hazardous maintenance work.

An effective MOC program is critical to the safe

operation of a chemical facility. MOC requires the

participation of everyone at the facility, including tempor-

ary and contract workers.

5. Hazard evaluations

Hazard evaluations, or process hazard analyses, are

organized efforts to identify and assess the significance of

hazardous scenarios associated with a process or activity

and to establish a design and operating basis for safety. One

of the key lessons learned from Bhopal is that an adequate

hazard evaluation might have caused management to

question the decision to operate without fully functional

refrigeration, scrubbing, and flare systems.

Of the 23 completed CSB investigations, inadequate

hazard evaluation was identified as an underlying cause in

12 incidents (see Table 4). Two examples, First Chemical

and BP Amoco, are described in greater detail below

(USCSB, 1998d; 2004b, c, d).

An explosion at the First Chemical Corporation (FCC)

facility in Pascagoula, Mississippi, on October 13, 2002,

propelled large fragments of debris offsite, several of which

landed near crude oil storage tanks. Steam leaking through

manual valves heated mononitrotoluene (MNT) inside a

distillation column, which was shut down at the time of the

incident and was believed to be isolated. The column

contained about 1200 gallons of MNT, a potentially highly

energetic reactive material when heated. The material

decomposed over several days, resulting in a runaway

reaction and explosion. The blast blew the top off the

distillation tower that was approximately 145 feet tall.

Explosion debris caused a fire in an MNT storage tank,

which burned for almost 3 h, and there were numerous

smaller fires both onsite and offsite. Some of the debris—

including one piece weighing over 6 tons—landed in an

adjacent facility. The offsite consequences could have been

catastrophic. Three plant employees were injured when

glass windows shattered into the control room where they

were working (USCSB, 2003h).

The Board concluded that FCC had not effectively

evaluated the hazards of processing MNT. CSB rec-

ommended that the Pascagoula facility and the DuPont

Corporation—which purchased FCC following the inci-

dent—improve its hazard analyses, conduct process safety

audits, install appropriate warning devices, and track the

facility’s progress. The Board also recommended that ACC

and SOCMA amend the Technical Specifications guidelines


in the Responsible Care Management System to explicitly

require facilities to identify findings and lessons learned

from process hazard analyses and incident investigations in

one unit and apply them to other equipment that processes

similar material.

Three people were killed as they opened a process vessel

containing hot plastic at the BP Amoco Polymers plant in

Augusta, Georgia, on March 13, 2001. They were unaware

that the vessel was pressurized. The workers were killed

when the partially unbolted cover blew off the vessel,

expelling hot plastic. The force of the release caused some

nearby tubing to break. Hot fluid from the tubing ignited,

resulting in a fire. Neither Amoco’s research and develop-

ment (R&D) department nor the process design department

had a systematic procedure specifically for evaluating

hazards from unintended or uncontrolled chemical reactions

(USCSB, 2002c).

CSB recommended that the company ensure that reactive

hazards are identified and evaluated during product R&D,

and during both conceptual design, and detailed design of a

new process; and before changes are made to existing

equipment or process chemistry. The Board also rec-

ommended that the company communicate the results of

this review to the workforce.

6. Plant design and maintenance

In Learning from Accidents, Trevor Kletz advises that

you have to ‘keep protective equipment in working order—

and size it correctly.’ At Bhopal, the high temperature and

pressure instruments were poorly maintained and known to

be unreliable. The MIC storage tank relief valve was too

small. It was not designed to handle a runaway reaction or

two-phase flow. A water spray system was designed to

absorb small leaks at or near ground level. It was not

intended to absorb releases at a high level and failed to do so

(Kletz, 2001).

Inadequate plant design or mechanical integrity3 was

identified as an underlying cause in 18 incidents (see

Table 4). The Motiva (mechanical integrity) and D. D.

Williamson (design) incident investigations are summarized

below as examples.

On July 17, 2001, an explosion occurred at the Motiva

Enterprises LLC refinery in Delaware City, Delaware. A

contractor, Jeffrey Davis, was killed, and eight other

workers were injured. A spark from carbon-arc welding

equipment ignited flammable vapors in a 415,000-gallon

sulfuric acid storage tank. The surrounding sulfuric acid

tank farm was heavily damaged in the blast, and an

estimated 1.1 million gallons of the powerful corrosive were

ultimately released to the environment, including nearly

3 Mechanical integrity includes maintenance activity.

100,000 gallons that flowed into the nearby Delaware River

(USCSB, 2002e).

The CSB investigation found significant deficiencies in

Motiva’s mechanical integrity program. An effective

program should have prevented the extensive corrosion

damage that was evident in several tanks. Some of the tanks

contained thousands of pounds of flammable hydrocarbons

in addition to the corrosive sulfuric acid.

CSB investigators found that Motiva did not consider the

tank farm to be covered by the requirements of the OSHA

PSM.4 The Board recommended that OSHA take steps to

include such tanks farms under its regulatory system.

As a result of the incident, the State of Delaware adopted

legislation (the Jeffrey Davis Aboveground Storage Tank

Act) that required new regulations to be implemented for

aboveground storage tanks. CSB recommended that the

Delaware Department of Natural Resources and Environ-

mental Control ensure that the regulations required facility

management to take prompt action in response to evidence

of tank corrosion that presents hazards to people or the

environment.

On Friday April 11, 2003, a vessel at the D. D.

Williamson & Co., Inc., plant in Louisville, Kentucky,

exploded. One operator was killed. Twenty-six thousand

pounds of aqua ammonia (29.4 percent ammonia in water

solution) was released; 26 residents were evacuated and

1500 were sheltered-in-place. The explosion caused

extensive damage to parts of the facility (USCSB, 2004a).

The explosion and resulting ammonia release were

caused by overpressurization of an 8-foot-tall food additive

processing tank. CSB investigators determined that the

incident could have been prevented had the company

installed an emergency pressure relief valve on the tank.

One of the underlying causes of the incident was that the

tank was installed without a review of its design or fitness

for service. Investigators concluded that D. D. Williamson

did not have effective programs to determine if equipment

and processes met basic engineering requirements.

7. Ineffective employee training

Prior to December 1984, the Bhopal plant had been

losing money for several years due to the weak demand for

pesticides. This resulted in major personnel reductions,

particularly in production and maintenance. Due to the

cutbacks, plant personnel received limited training on MIC

operations, and there was a general lack of safety

consciousness (Shrivastava, 1992).

Ineffective employee training was identified as an

underlying cause in 9 of the 23 CSB completed investi-

gations—D. D. Williamson, BLSR, DPC Festus, Hayes

4 Nonpressurized atmospheric storage tanks are exempt from coverage

under the OSHA PSM Standard.


Lemmerz, Georgia-Pacific, Kaltech, Bethlehem Steel,

Sonat, and Sierra (USCSB, 2002a; USCSB, 2003e). The

Sierra incident is described in greater detail below.

On January 7, 1998, two massive explosions just seconds

apart destroyed the Sierra Chemical Company’s Kean

Canyon explosives manufacturing plant 10 miles east of

Reno, Nevada, killing four workers and injuring six others.

The initial explosion occurred in a room where workers

made ‘boosters’—small explosive devices used in the

mining industry to detonate larger explosives. A second,

more powerful blast destroyed the PETN building used for

drying explosives, leaving a 40-by-60-foot crater that was

up to 6 feet deep (USCSB, 1998a).

There was no physical evidence or eyewitnesses who

could conclusively pinpoint the cause of the explosion;

however, CSB investigators identified the following most

credible scenario. Base mix left overnight in a mixing pot

stratified and solidified. The next morning, when the mixing

pot was turned on, the mixer blade detonated the explosives

by impact, shearing, or friction. The explosive shock wave

detonated several thousand pounds of explosives in the

room, which then destroyed the building. A heavy piece of

equipment or burning debris from the first blast most likely

fell through the reinforced-concrete roof or the skylight of

the PETN building, initiating the second explosion 3.5 s

later.

The majority of workers at the Kean Canyon plant spoke

only Spanish, but the plant had no operational policies or

procedures in that language. Personnel primarily relied on

experience to perform their jobs. Operators routinely made

changes in the steps they took in manufacturing explosives.

CSB found that employee training was conducted primarily

in an ineffective, informal manner that relied primarily on

on-the-job training. This resulted in inconsistent and

hazardous work practices. Additionally, there were no

written procedures for the process area in which the

explosion occurred.

Although operating procedures and training are generally

considered to be lower level administrative safeguards, they

can still be very important in preventing catastrophic

incidents. This is particularly true in cases where process

safety management principles are not applied, and more

reliable safeguards are not in place (Bird 1985).

8. Emergency planning, notification, and response

One of the key lessons learned from the Bhopal disaster

is the need for proper planning, notification, and response in

the event of a toxic chemical release. Although debate may

continue over certain causes of the Bhopal incident, there

seems to be general agreement that offsite emergency

response plans, procedures, and actions were less than

adequate (CCPS, 1992). After the Bhopal disaster,

legislation was passed in the United States in 1986 to plan

and coordinate chemical emergency response activities at

the community level. This legislation contained four major

provisions: emergency planning, emergency release notifi-

cation, hazardous chemical storage reporting requirements,

and toxic chemical release inventory.

After a series of high profile chemical disasters in the

United States, additional legislation was passed in 1990 that

required EPA and OSHA to issue regulations for chemical

incident prevention. Facilities that had certain chemicals

above specified threshold quantities were required to

develop process safety and risk management programs to

identify, evaluate, and manage hazards. Facilities subject to

EPA’s risk management program also needed to submit a

plan summarizing the program, portions of which are

available to the public.

Although a great deal of attention has been devoted to

emergency planning, notification, and response efforts in the

United States since the Bhopal disaster, seven of the 23

investigations completed thus far by CSB listed inadequate

emergency planning, notification, or response as an

underlying cause—Technic, Isotec, BLSR, First Chemical,

Georgia Pacific, DPC, and Herrig Brothers. As illustrated by

the CSB Herrig Brothers investigation outlined below, lack

of planning, notification, or inadequate emergency response

goes beyond the chemical processing industry and is an

issue wherever hazardous chemicals are present.

On April 9, 1998, an 18,000-gallon propane storage tank

exploded at the Herrig Brothers Feather Creek Farm in

Albert City, Iowa. The tank was engulfed in flames due to a

leak of propane under the tank; the flames created

conditions that resulted in a BLEVE (boiling liquid

expanding vapor explosion). The explosion killed two

volunteer firefighters and injured seven other emergency

response personnel who were attempting to extinguish the

fire (USCSB, 1998c).

Among other underlying causes, CSB found that some

training materials provided to the firefighters led them to

believe that they would be protected from a propane tank

explosion by positioning themselves to the sides of the tank

and by avoiding the areas extending to the two ends of the

tank. As a consequence, they were positioned too close to

the sides of the burning propane storage tank when it

exploded. The firefighters did not adequately recognize the

potential for a BLEVE and that itcan scatter tank fragments

in all directions.

CSB recommended that the Fire Service Institute of Iowa

State University, which had provided training to some

members of the Albert City Volunteer Fire Department,

ensure that its firefighter training materials address proper

response procedures for BLEVEs. CSB also recommended

that the National Propane Gas Association, ensure that its

firefighting training materials address proper response

procedures for BLEVEs.

The Herrig investigation also uncovered a potentially

misleading statement in the U.S. Department of Transpor-

tation’s (DOT) North American Emergency Response

Guidebook. The Guidebook is carried in thousands of fire

Table 5

Missed opportunities in incident investigations

Only a single cause is found, often the final triggering event

Only the immediate causes are found and ways of avoiding the hazard, or

weaknesses in the management system, are not identified

Human error is listed as a cause without identifying what caused the error,

such as ignorance, lapse of attention, or non-compliance

Reports look for people to blame, which diverts attention away from what

can be done by better design or methods of operation

Reports list causes that are difficult or impossible to remove

Procedures are changed rather than designs. The first choice should be to

see if the hazard can be removed—the inherently safer approach

Sometimes too much time and money is spent making sure nothing similar

could possibly happen again even though the probability is extremely

unlikely

Others do not learn from our experiences because circulation of incident

reports is restricted

Only overviews of incidents are received and read, especially by senior

management. This reliance on secondary sources instead of primary ones

can perpetuate errors

Lessons learned are forgotten and the incident happens again. Safety

education training is too theoretical and passive. Databases are incomplete

and passive. People have cultural and psychological blocks, which

encourage them to forget the lessons of the past


trucks around the country, and firefighters often consult it

when responding to hazardous material incidents. The 1996

version stated that responders should ‘always stay away

from the ends of tanks’ when fighting flammable liquid tank

fires. This advice could give the false impression that the

sides of the tank are safe in such cases. On the advice of the

Board, DOT revised the year 2000 guidebook, which now

counsels firefighters who face propane fires to ‘always stay

away from tanks engulfed in fire.’

However, these same problems can exist at facilities

handling well-known toxic chemicals. On August 14, 2002,

48,000 pounds of chlorine was released during a railroad

tank car unloading operation at DPC Enterprises, LP, near

Festus, Missouri. Chlorine is a toxic chemical. Concen-

trations as low as 10 parts per million are classified by the

National Institute of Occupational Safety and Health

(NIOSH) as ‘immediately dangerous to life or health’.

Although the wind direction on the day of the release carried

the majority of the chlorine plume away from neighboring

residential areas, some areas were evacuated (USCSB,

2003c).

Sixty-three people from the surrounding community

sought medical evaluation at the local hospital for

respiratory distress, and three were admitted for overnight

observation. The release affected hundreds of other nearby

residents and employees, and the community was advised to

shelter-in-place for 4 h. Traffic was halted on a nearby

interstate highway for 1.5 h.

Among other underlying causes, CSB found that

DPC’s emergency preparedness planning was deficient

and that its community notification system was inefficient

for a large uncontrolled release of chlorine. CSB also

found that the Jefferson County community emergency

preparedness planning was inadequate for an incident of

this magnitude. CSB recommended that DPC revise its

emergency response plan and review the plan with the

Local Emergency Planning Community (LEPC) and the

local fire department. CSB also recommended that the

Jefferson County Emergency Management Agency

implement a community notification system for chemical

releases.

5 CFR 1910.119 sub m.

9. Incident investigation and communication of lessons

learned

Since the Bhopal disaster, incident investigation has

become a familiar and integral part of process safety

management programs. In the United States, employers

must assemble a team to investigate each incident that

resulted in, or could reasonably have resulted in, a

catastrophic release of a highly hazardous chemical.

These investigations must begin within 48 h of the

occurrence, and a report must be prepared to describe

the incident and discuss the factors that contributed to it.

Any recommendations resulting from these investigations

must be promptly addressed, resolved, and documented.5

Thus, by applying a lessons learned approach, it is

possible to prevent future incidents by making changes in

design, procedures, or training (CCPS, 1989). As illustrated

below, five of CSB’s 23 completed investigations have

identified deficiencies in incident investigation and com-

munication of lessons learned as underlying causes—

Environmental Enterprises, Georgia Pacific, BP Amoco,

Hayes Lemmerz, and Morton. Two examples, BP Amoco

and Environmental Enterprises Inc., are described below.

As the Environmental Enterprises incident shows,

deficiencies in these programs are not limited to just the

chemical processing industry; incident investigation pro-

grams are needed wherever hazardous chemicals are

present.

In the BP Amoco incident, CSB found that the plant

system for investigating incidents and near misses did not

adequately identify causes or related hazards. Previous

incidents and near misses involving the polymer catch tank

were treated as isolated events, and no effective means were

implemented or countermeasures developed to prevent

recurrence. CSB recommended that the Augusta site

implement a program to conduct periodic management

reviews of incidents and near misses, address root causes,

and implement and track corrective measures (USCSB,

2002c).

On December 11, 2002, a maintenance employee was

overcome by hydrogen sulfide gas and collapsed at the

Environmental Enterprises, wastewater treatment facility in


Cincinnati, Ohio. Fortunately, fellow employees found him

a few minutes later and pulled him to safety. He recovered,

and there were no other injuries. Among other underlying

causes, CSB found that Environmental Enterprises had no

formal system for investigating incidents and communicat-

ing findings to employees. A past incident involving the

release of strong hydrogen sulfide odors prompted a written

order from the Office of Environmental Management to

install a hydrogen sulfide detector in the wastewater

treatment area. The detector was installed, but no

procedures were developed or training conducted to ensure

that employees understood its function and purpose. CSB

recommended that Environmental Enterprises develop an

incident investigation program that includes determining

root causes of safety and environmental incidents and

communicating the lessons learned to affected employees

(USCSB, 2003d).

10. Conclusion

In the United States, we have seen much progress in

chemical process safety over the last 20 years. However,

CSB has found that many of the management system

failures that occurred at Bhopal are still fairly common.

Why have we apparently failed to learn the lessons from

Bhopal?

One reason is that many incidents occur—not because

they cannot be prevented—but because the organization

did not learn, or did not retain, the lessons from past

incidents. As Kletz states in Still Going Wrong!,

‘Organizations have no memory. Only people have

memories and after a few years they move on, taking

their memories with them’. He argues that even the best-

documented, reported, and circulated investigations are

often read, filed, and then forgotten. Table 5 lists 10 major

missed opportunities in incident investigations that Kletz

believes keep us from benefiting from lessons learned.

CSB subscribes to Kletz’s approach. The Board’s

investigations point out that learning from incidents

involves not only searching within the organization for

warning signs and deficiencies (e.g., in management

systems), but also scanning the wider environment for

lessons learned from other organizations (Kletz, 2003).

A second contributing reason for failing to learn

lessons from Bhopal is that the technological and

organizational factors normally considered during incident

investigation may not extend the causal network far

enough to prevent recurrence. Too many investigations

address only symptoms of what might be larger problems.

Seemingly remote (or high level) underlying factors—

such as corporate oversight and safety culture, and

production and cost cutting pressures—may play a

significant role in the cause of incidents. However, these

fundamental issues are often not considered because they

are not well defined.

There is yet much to be done to improve chemical

safety and prevent the recurrences of incidents. CSB will

continue to investigate major incidents and determine

their underlying causes. The Board’s reports will continue

to be made available to the public so that others can learn

these lessons. CSB recommendations will target industry,

trade organizations, and government in an attempt to

further advance chemical safety. CSB will continue to

serve as a catalyst to bring about positive change, in the

chemical industry.

References

Bird, F. E., & Germain, G. L. (1985). Practical loss control leadership.

Loganville:GA: International Loss Control Institute, Inc..

CCPS (1989). Guidelines for technical management of chemical process

safety. New York: AICHE.

CCPS (1992). Guidelines for investigating chemical process incidents.

New York: AICHE.

Center for Chemical Process Safety (CCPS) (2003). Essential practices for

managing chemical reactivity hazards. New York: AICHE.

US Congress 1990, Public Law 101-549. November 15, 1990 Section r(6).

Kletz, T. (2001). Learning from accidents. Oxford, UK Office: Butter-

worth-Heinemann.

Kletz, T. (2003). Still going wrong!, case histories of process plant

disasters and how they could have been avoided. Oxford, UK Office:

Butterworth-Heinemann.

Lees, F. (1996). (2nd ed.) Loss prevention in the process industries. Boston:

Butterworth-Heinemann.

Shrivastava, P. (1992). Bhopal anatomy of a crisis. London: Paul Chapman

Publishing Ltd..

U.S. Chemical Safety Board (USCSB) (1998a). Investigation report,

explosives manufacturing incident, January 7. Mustang, Nevada: Sierra

Chemical Company (No. 98-001-I-NV).

USCSB (1998b). Investigation Report, Nitrogen Asphyxiation, March 27.

Hahnville, Louisiana: Union Carbide Corporation (No. 98-05-I-LA).

USCSB (1998c). Investigation report, propane tank explosion, April 9.

Albert City, Iowa: Herrig Brothers Feather Creek Farm (No. 98-007-

I-IA).

USCSB (1998d). Investigation report, catastrophic vessel overpressuriza-

tion, March 4. Pitkin, Louisiana: Sonat Exploration Company (No.

1998-002-I-LA).

USCSB (1998e). Investigation report, chemical manufacturing incident,

April 8. Paterson, New Jersey: Morton International, Inc. (No. 1998-06-

I-NJ).

USCSB (2001). Investigation report, refinery fire incident, February 23,

1999. Martinez, California: Tosco Avon Refinery (No. 99-014-I-CA).

USCSB (2002a). Investigation report, steel manufacturing incident,

February 2, 2001. Chesterton, Indiana: Bethlehem Steel Corporation

(No. 2001-02-I-IN).

USCSB, 2002. Case study, The explosion at concept sciences: Hazards of

Hydroxylamine, No. 1999-13-C-PA, March 2002.

USCSB (2002c). Investigation report, thermal decomposition incident,

March 13, 2001. Augusta, Georgia: BP Amoco Polymers, Inc. (No.

2001-03-I-GA).

USCSB (2002d). Investigation report, refinery incident, July 17, 2001.

Delaware City, Delaware: Motiva Enterprises LLC (No. 2001-05-I-DE).

USCSB (2002e). Hazard investigation, improving reactive hazard manage-

ment (No. 2002-01-H).

USCSB (2003a). Investigation report, hydrogen sulphide poisoning,

January 16, 2002. Pennington, Alabama: Georgia Pacific (No. 2002-

01-I-AL).


USCSB (2003b). Investigation report, petroleum products facility incident,

May 1, 2002. Friendswood, Texas: Third Coast Industries (Report No.

2002-03-I-TX).

USCSB (2003c). Investigation report, chlorine release, August 14, 2002.

Festus, Missouri: DPC Enterprises L.P. (No. 2002-04-I-MO).

USCSB (2003d). Case study, hydrogen sulphide exposure, December

11, 2003. Cincinnati, Ohio: Environmental Enterprises (No. 2003-

02-C-OH).

USCSB (2003e). Investigation report, vapor cloud deflagration and fire,

January 13, 2003. Rosharon, Texas: BLSR Operating, Ltd (No. 2003-

06-I-TX).

USCSB (2003f). Investigation report, chemical waste-mixing incident,

April 25, 2002. New york city, New York: Kaltech Industries Group,

Inc. (No.2002-02-I-NY).

USCSB (2003g). Case study, fire and explosion: Hazards of benzoyl

peroxide, January 2, 2003. Gnadenhutten,Ohio: Catalyst Systems, Inc.

(No. 2003-01-I-MS).

USCSB (2003h). Investigation report, explosion and fire, October 13, 2002.

Pascagoula, Mississippi: First Chemical Corporation (No. 2003-01-I-

MS).

USCSB (2004a). Investigation report, catastrophic vessel failure, April 11,

2003. Louisville, Kentucky: D.D. Williamson and Co., Inc. (No. 2003-

11-I-KY).

USCSB (2004b). Case study, explosion at biochemical facility; Liquid

Nitric Oxide release, September 21, 2003. Miami Township, Ohio:

Isotec (No. 2003-15-C-OH).

USCSB (2004c). Investigation report, dust explosion, January 29, 2003.

Kinston, North Carolina: West Pharmaceuticals Services Inc.

(No. 2003-07-I-NC).

USCSB (2004d). Investigation report, aluminium dust explosion, October

29, 2003. Huntington, Indiana: Hayes Lemmerz International-

Huntington, Inc. (No. 2004-01-I-IN).

Weir, D. (1987). The Bhopal syndrome: Pesticides, environment, and

health. San Francisco: Sierra Club Books.

Documents

Lessons after Bhopal: CSB a catalyst for change