When a leak developed in Reactor 5,
plant personnel decided to remove Reactor
5 for repairs and provide a large, temporary
piping connection between Reactors 4 and
6. The bellows and piping, however, had
not been properly engineered by a chartered engineer, and the only documentation for the change was a chalk drawing on
the workshop floor. Additionally, pressure
testing was not properly conducted on the
new piping, and a process hazards analysis
was not conducted on the design change
to detect and mitigate any new hazards.
When the bellows failed in the temporary piping connecting the two reactors, 40
tons of hot cyclohexane vapor was released.
The vapor cloud then exploded. Twenty-eight people were killed and much of the
plant was destroyed. The loss of life would
have been much greater had not the incident occurred on a Saturday.
A New Approach
Prior to 1977, the approach to process
safety was to control hazards via improved
procedures, additional safety interlocks
and systems, and improved emergency
response. In the wake of the Flixborough
disaster, Kletz came up with a different
idea: Change the process to eliminate the
hazard completely, or reduce its magni-
tude sufficiently to eliminate the need for
elaborate systems and procedures. His
insights eventually led to what are now
the four basic approaches to inherently
The first of the four approaches is to
simply use smaller quantities of hazardous
substances (a technique also called intensification). One example is a new process
for cyclohexane oxidation that uses a gas-phase oxidation process that has a much
lower inventory of cyclohexane at process
temperatures and pressures than the six
large reactors at Flixborough.
Another example of minimization
comes from the 1984 tragedy in Bhopal,
India, where the loss of containment of
a large inventory of methyl isocyanate
(MIC) killed at least 3,000 people and more
than 100,000 suffered permanent health
effects. The MIC was an intermediate, but
a large inventory was kept in tanks for
convenience in operation, even though
the plant was shut down at the time.
During the plant shutdown and against
safe practice, water entered a large MIC
storage tank, possibly due to a leaky valve
during cleaning of connected pipework.
The water reacted with the MIC, causing
an exothermic (heat releasing) reaction.
As a result of the heat release, the MIC
boiled in the storage tank and MIC vapor
vented through the pressure relief valve
on the tank. During normal operation, the
vapor from the pressure relief valve would
be piped to a scrubber or to a flare, thus
preventing an atmospheric release of MIC.
However, the scrubber was not operating,
and the pipe to the flare had corroded and
been removed for replacement.
Like Flixborough, the Bhopal tragedy
was a watershed event for the process
industries and a wake-up call. In the US,
one manufacturer was operating a plant
that had been importing tank-car quantities of MIC from another US plant over a
distance of 1,200 miles. Recognizing the
potential hazards of shipping MIC, within
six months after the Bhopal disaster the
plant had installed a new process in which
MIC was made at the site, eliminating the
need to import it. In this process, the MIC
was immediately reacted with 1-napthol to
form the desired crop-protection product.
Now, the new process never has more
than a few pounds of the MIC intermediate in
the plant at one time, and the plant has operated without any MIC releases since then.
Replacing a hazardous substance with
a less hazardous material is the second
approach to inherently safer processes. For
example, transporting and using aqueous
sodium hypochlorite (bleach) may be safer
than transporting liquefied chlorine under
pressure. (In this case, however, more truck
loads may be needed, so the entire supply
chain should be examined.)
The production of acrylonitrile, which is
used in the manufacture of plastics, provides
another example. The hazardous route
involves combining acetylene and hydrogen
cyanide, which both are highly flammable
and explosive under the wrong conditions.
Hydrogen cyanide is also very toxic.
A less hazardous route uses propylene,
ammonia, and oxygen to produce acrylonitrile. Although propylene is flammable and
ammonia will burn, explosion and toxicity
hazards are much less with this route.
THE DILAPIDATED PREMISES OF THE INFAMOUS UNION CARBIDE PLANT STAND AS A REMINDER OF THE 1984 TRAG-