In the 11th century, Raja Bhoj of Dhar founded a city on the shores of a beautiful lake in central India. Today, that city, Bhopal, is a bustling metropolis of 2 million people. The city and surrounding area is home to a large wildlife refuge, a museum of Indian tribal life, a collection of historical palaces and temples, and Stone Age cave paintings.
Almost anywhere else in the world, this city would be a major tourist attraction, but Bhopal is well-known for something else: It is the site of the deadliest industrial accident in history.
The Accident
In the early morning hours of 3 December, 1984, a large amount of toxic methyl isocyanate (MIC) gas was released from a Union Carbide India Limited (UCIL) pesticide plant, which swept over a large, densely populated area south of the plant. The cloud also wafted over a railway station 2 km away, where many people waiting for and arriving on trains died.
About 500,000 people downwind were exposed to the gas cloud. Thousands of people died in the immediate aftermath, although the precise number is unknown. A commonly accepted number is 2,000 (D’Silva 2006), but it may be as high as 8,000 (Amnesty International 2004). Tens of thousands were severely injured, thousands of whom died prematurely from their injuries in the months and years following the release.
A Personal Connection
I was an employee of Union Carbide Corp. (UCC), the US parent company of UCIL at the time of the accident. Like other UCC employees, I know exactly where I was when I first heard the news.
While traveling in India recently, I traveled to Bhopal to see the site of the accident.
The plant has been idle for 30 years, rusting away, and overgrown with trees and shrubs. Many have clamored for years to have the plant demolished and the site cleaned up. Others have petitioned that it be maintained as a United Nations Educational, Scientific, and Cultural Organization World Heritage site.
Today, the accident is still alive in the neighborhood around the plant. Billboards and graffiti demand restitution. Hospitals and rehabilitation centers continue to treat the injured. Thousands still seek medical attention for problems, especially lung damage, and also immune system impairment, neurological damage, cancers, gynecological disorders, and mental health issues (Amnesty International).
The accident caused social and economic problems. For example, an already poor area was made much poorer, many families lost their sole breadwinners, and others lost their employment. Young women exposed to the gas cloud carry a social stigma and have had difficulty finding husbands.
I am frequently struck by how little people know about this accident. As the 30th anniversary of the event approaches, I think that it is important to remember those killed and injured in the accident, and to further resolve to learn from this accident, so that nothing like it will ever happen again.
Seeking the Truth
We will never know the whole truth about Bhopal. It is difficult to investigate a catastrophe of this magnitude, and it was particularly difficult to investigate Bhopal becauseof interference from vested interests.
A great deal has been written about the incident and the plight of the affected people and communities, but much of it was speculation, or was written to achieve the specific objectives of various involved parties.
I have sorted through competing narratives and claims to present the following, which is based on my experiences and research.
The Political, Legal, Economic and Social Environment
Trevor Kletz, a renowned safety expert, argued that there is no such thing as a root cause, but only a point at which we stop asking questions.
In this case, I think that it is appropriate to begin the inquiry during the days of the British Raj, the colonial occupation of India, because the residue of colonialism affected the psyche of the people and the political and legal systems of the country in ways that contributed to the tragedy.
Fig. 1 illustrates the cultural environment at the time of the accident.
- On the left, four drivers of the culture are
- The recent history of colonialism (the domination of India by a foreign power)
- The general poverty of the country and abject poverty of many people living near the plant
- The appeal of socialism in India at the time in history
- The lack of a safety culture
Fig. 1 also shows the effects of the drivers, which include
- The development of a legal system that was unashamedly pro-India, pro-citizen, and antiforeign corporation. This made it difficult for western companies to make a profit, and even more difficult to expatriate any profits that they managed to make. Most western companies, including IBM and Coca-Cola, left the country.
- A shantytown developed quickly in the undeveloped land around the plant, which was supposed to be a buffer area. Local politicians supported the squatters and rebuffed UCIL’s attempts to evict them from the property.
- Employees’ mistrust of management made it difficult to instill a safety culture that was appropriate to the inherent risks associated with the plant. It was impossible to even investigate incidences and near misses because they were covered up by the workers.
The plant was not making money for a couple of reasons. Sales were much lower than predicted because of economic hardships in India and unexpected competition. Manufacturing costs were high due to problems with the technology. It cost four times as much to make the pesticide in Bhopal as it did to make it in the United States (Fig. 2).
UCIL had decided to permanently shut down the plant and ship it out of India. The plant was in its last production run at the time of the accident, working off the last batch of MIC.
It was against this legal, political, economic, and social backdrop that the final events and decisions leading to the tragedy unfolded.
Description of the Plant
Fig. 3 illustrates the pesticide production facilities at which the MIC was produced on site in the production plant and consumed on site as a raw material in the pesticide plant (MIC consumer).
The plant design (partially batch) required MIC storage, which was to be kept at minimum volumes. A caustic scrubber was provided to neutralize the MIC vented from the storage tanks, and a flare was used to burn the vented MIC. A refrigeration system was provided to keep the stored MIC cold to decrease the rate of MIC’s reaction with water and other contaminants.
Initiating Event: Operator Error or Sabotage?
Accidents begin with one triggering (initiating) event. The initiating event for Bhopal was the introduction of a large amount of water into the tank (about 200 gal). MIC is a stable compound, but is very reactive with water, generating an exothermic (gives off heat) reaction. As the reaction progressed, the tank’s temperature and pressure increased, slowly at first, then at an accelerating rate until the venting began.
There is controversy over how the water got there. One story is that operators in another part of the plant were water-washing the vent header and did not properly isolate the header, allowing water to reach the MIC tank. However, this story does not pass technical muster. Simple pressure drop calculations show the scenario to be impossible (Kalelkar 1988). But this scenario sounds plausible, and is still argued by some who have vested legal and political interests in its acceptance.
It is likely that the true cause was sabotage. A disgruntled worker intentionally injected water into the tank, presumably to ruin the batch of MIC (D’Silva 2006; Kalelkar 1988).
Bypassed or Broken Safeguards
Significant safeguards were designed into the plant to prevent an MIC release, or at least to minimize its impact. Although the safeguards were probably adequate for handling typical initiating events, they may not have been adequate to handle the quantity of water injected into the tank on that day. We will never know, because all of the other safeguards were bypassed, out-of-service that night, or otherwise rendered ineffective.
No Means of Adding Water to the Tank
It is common in industrial facilities to install valves and drains in piping systems to make it easy to vent and drain the systems and inject water, steam, nitrogen, or air for purging or cleaning the systems. The designers of the Bhopal facility were aware that accidental injection of water could be catastrophic. Hence, the installed system had no drains or vents. Investigation (Kalelker) suggested that the injection of water could not have been a simple human error. It appears that the saboteur removed a pressure gauge and installed a hose connection in its place.
Minimizing the Stored Volume of MIC
The simplest of the safeguards was a safety directive to minimize the quantity of stored MIC stored. As indicated in Fig. 3, there were three storage tanks. According to the procedure, two tanks should have been empty and the third should have been at less than 50% level.
The actual level in Tank E-610 was about 70% (and Tank E-611 also contained MIC). Had there been less MIC in the tank, operators may have had the options to add diluent to slow the reaction.
Refrigeration System Out of Service
The rate of an exothermic reaction is decreased by decreasing the temperature. A refrigeration system was provided to keep the MIC at about 30°F. Had the tank been operated at that temperature, the reaction rate would have been much lower and the event may have been far less catastrophic.
Ironically, the refrigeration system was turned off months before the accident as a safety measure. The seals of the pump circulating the MIC through the refrigeration unit were prone to leaks. After one catastrophic seal failure, the refrigeration system was shut down permanently.
Caustic Scrubber
The vented MIC escaped through the vent gas scrubber (caustic scrubber). In the scrubber, it should have contacted caustic (sodium hydroxide), which would have neutralized at least some of the MIC.
There are conflicting reports on the operation of the scrubber. Some report that the scrubber was out of service for maintenance, while others report that it was operating, but that the flowmeter was not working. Hence, we have no direct evidence that caustic was pumped to the scrubber.
Even if the scrubber was in service, it probably had little effect. Scrubbers function by causing intimate contact between the liquid and gas streams. The gas flow rate on the night of the accident was probably from four to five times the scrubber design rate. At that flow rate, the vapor/liquid contact would have been poor.
Flare Out of Service
As in most processing facilities, the ultimate line of defense against vented gases is the flare, which is designed to burn the vented gases going through it. On the night of the accident, the flare was out of service. A section of pipe in the flare header was corroded and the flare had been taken out of service.
Shantytown in the Plant Buffer Area
India is a crowded country with inadequate public transportation. The UCIL plant was a major employer, so it was natural that people would want to live near the plant. The poorest of the poor set up a shantytown along the plant perimeter, many literally using the plant’s concrete fence as one wall of their house. UCIL had tried multiple times to have the shantytown removed, but was unsuccessful because the shantytown residents were voters, and the local politicians supported them.
Ineffective Emergency Response
No on-duty UCIL employees were killed in the event because as the plant operators became aware of what was happening, including the direction from which the wind blew, they chose an appropriate evacuation route.
An effective emergency response would undoubtedly have saved many people in the community. UCIL issued no alarm to the community and provided no information to civil authorities until about 2 hours after the initial release of the gas.
Ineffective Treatment of the Injured
A final safeguard would have been effective treatment of the injured. In the immediate aftermath, the doctors did not know the cause of the incident and were unable to determine the appropriate treatment of the injured.
Local groups argue that still today, thousands are suffering from the exposure and that the funding allotted for their treatment is inadequate.
Internal Communication Failures
It was a remarkable series of defeated safeguards and it seems incredible that a plant would be operated in this manner. As I read the various accident reports, I sensed that the decisions were made by different people at different times. It was possible that no single person knew that all of the safeguards were out of service. It is a fundamental weakness of defense in depth when an individual can bypass a single safeguard, convinced that other available safeguards will provide adequate protection.
The Perfect Storm
In all or most major accidents, we see a similar pattern of multiple things going wrong. The list of things that went wrong at Bhopal is striking, including:
- The plant was losing money, which resulted in staff and maintenance budget cutbacks.
- A social system that dismissed safety culture and created extreme tension between management and workers to the extent that one disgruntled worker was willing to intentionally ruin a batch of MIC.
- The plant was to close permanently, which, no doubt, significantly affected operator morale and contributed to the lack of maintenance and the bypassing of safety systems.
- Adverse meteorological conditions contributed to the harm done. Stable conditions with low wind speed kept the gas cloud intact for an extended period of time and moved it slowly over a large section of the city.
- The complete failure or lack of an emergency response program.
- Ineffective treatment of the injured.
It is unlikely that there will ever be another industrial accident as deadly as Bhopal, which was a “perfect storm” event.
What We Learned
Bhopal has had a significant effect on safety culture across multiple industries in the world. The legacy of Bhopal includes many things today that we take for granted, such as hazard and operability analysis, management of change, permit to work, and dispersion modeling.
Plants around the world immediately moved to limit the storage and shipping of toxic materials. It is unlikely that anyone will ever again store 15,000 gal of a substance as toxic as MIC.
What We Have Not Learned
There were significant problems with the Bhopal plant design. Since then, we have learned to design safer plants. But the plant design played only a small role in the accident, which was caused largely by the failure to operate the plant as the designers intended (e.g., the bypassing of safeguard systems in particular and the violations in adhering to standard operating procedures [SOPs] in general).
UCC recognized the failure to follow SOPs as a root cause and launched a corporatewide program to update SOPs and instill a culture of using them effectively. In the years since, the airline industry has learned to make the following of SOPs a priority, resulting in improvements in the safety of air travel—a lesson that the oil and gas industry has yet to learn.
For Further Reading
D’Silva, T. 2006. The Black Box of Bhopal: A Closer Look at the World’s Deadliest Industrial Accident. Trafford Publishing. (The author worked in the UCC agricultural products division at the time of the accident and participated in the accident investigation. He wrote this book after he retired. I consider it to be the definitive book on the accident. The majority of the information in this article can be found in D’Silva’s book.)
Jung, B. and Bloch, K. 2012. The Bhopal Disaster. Hydrocarbon Processing June.
Kalelkar, A. 1988. Investigation of Large-Magnitude Incidents: Bhopal as a Case Study. Oral presentation given at the Institution of Chemical Engineers Conference on Preventing Major Chemical Accidents, London, England, May 1988. http://www.bhopal.com/~/media/Files/Bhopal/casestdy.pdf (downloaded 25 April 2014). (The speaker discussed why it was difficult to investigate major accidents and why it was especially difficult to investigate Bhopal. He provided the best arguments that I have seen for why the cause was most likely a sabotage.)
Mukherjee, S. 2010. Surviving Bhopal: Dancing Bodies, Written Texts, and Oral Testimonials of Women in the Wake of an Industrial Disaster. Palgrave Macmillan. (Results from an oral history project.)
Sinha, I. 2008. Animal’s People. Simon and Schuster. (A novel about people injured in the Bhopal accident and a group of activists.)
Union Carbide Corp. 1985. Bhopal Methyl Isocyanate Incident: Investigation Team Report. http://nepis.epa.gov/Exe/ZyPURL.cgi?Dockey=2000W9PM.txt (Attachment One).
