Project Appraisal

ISSN: 0268-8867 (Print) (Online) Journal homepage: http://www.tandfonline.com/loi/tiap18

An analysis of the Bhopal accident

B. Bowonder

To cite this article: B. Bowonder (1987) An analysis of the Bhopal accident, Project Appraisal, 2:3,
157-168

To link to this article: https://doi.org/10.1080/02688867.1987.9726622

Published online: 17 Feb 2012.

Submit your article to this journal

Article views: 7433

View related articles

Citing articles: 1 View citing articles

Full Terms & Conditions of access and use can be found at

http://www.tandfonline.com/action/journalInformation?journalCode=tiap18

Download by: [113.210.106.241] Date: 15 December 2017, At: 23:24

 Prajeci Appraisal, volume 2, number 3, September 1987, pages 157-168. Beech Tree Publishing, 10 Watford Close, Guildford, Surrey GUl 2EP, England.
Industrial hazard management
An analysis of the Bhopal accident
B Bowonder
This paper analyzes the causes of the Bhopal
accident in terms of hardware errors, operator
related errors, information related errors and
system related errors. The most critical reasons for
Downloaded by [113.210.106.241] at 23:24 15 December 2017
the occurence of these errors are the corporate level
failure of safety management systems and pro-
cedures. If accidents are to be reduced this needs
maximum attention.
Key words: Bhopal; hazard management; environmental im-
pact
B Bowonder is at the United Nations Economic and Social
Commission for Asia and the Pacific [ESCAP], Asian and
Pacific Centre for Transfer of Technology [APCTT], 49, Palace
Road, Bangalore 560 052, INDIA.
The views and interpretations given in this paper are the
authors and not attributed to the United Nations Organiza-
tion with which the author is affiliated.
The author would like to thank Dr M Nawaz Sharif,
Director, APCTT for providing the support, and John
Withers, University of Technology, Loughborough, England,
for the valuable comments on the draft manuscript.
Project Appraisal September I987 0268-8867/87/030157-12
M AMAGEMENT O F HAZARDS from com-
plex technological systems (Perrow 1984) is
becoming a crucial need as indicated by the
frequent occurrence of major accidents (Lagadec 1982)
such as the Mexico gas explosion, Bhopal and Chernobyl.
It has become highly inperative to institutionalize
industrial risk management practices..
The Bhopal accident was the worst industrial disaster
in terms of fatalities (Bowonder ,Kasperson and Kasper-
son 1985). This paper is an attempt to derive lessons for
industrial risk managment based on the issues brought to
light by Bhopal. It is imperative to analyze the causes of
the accident so as to derive lessons for managers and
decision makers.
It is essential that decision makers perceive and
estimate the hazards arising out of a project at the project
formulation phase. Hazard management has to start at
the site selection and project feasibility analysis phase
itself such a comprehensive approach is the only way to
have cheaper and safer plants.
Thinking about the hazards after the commissioning of
the project is likely to minimize the extent of hazards
whereas the anticipate-and-prevent approach is likely to
provide minimum cost options, if initiated at the project
formulation phase itself.
Bhopal accident
First a very brief description of the Bhopal accident is
presented. Bhopal accident was the spillage of a very
toxic substance - methyl isocyanate (MIC) - to the
atmosphere in large quantities from a pesticide plant. It
was a result of poor hazard management, poor safety
management practice, poor use of early warning system,
poor perception of the risk involved and so on.
Detailed accounts of Bhopal accident and its consequ-
ences have been published elsewhere (Bowonder 1985,
Bowonder Kasperson and Kasperson 1985, Degrazia
1985, Gladwin 1985, Kletz 1985, Morehouse and Sub-
ramanian 1986, Technica 1985). A lot of new facts have
been brought to light subsequently.
Bhopal is the capital of a state, Madhya Pradesh,
which is essentially underdeveloped. This state provided
a number of incentives to start industries, such as
backward area investment allowance. Union Carbide
India Ltd set up a unit at Bhopal to formulate a range of
pesticides and herbicides derived from a carbaryl base.
US$03.00 0 Beech Tree Publishing 157
 Bhopal accident
0
-
;::;:::
IKn
a A S AWECTED ARE*
......
FIG. I . EXTENT OF MIC'DI'SPERSAL
Downloaded by [113.210.106.241] at 23:24 15 December 2017
Union Carbide India Ltd (UCIL) is a subsidiary of
Union Carbide Corporation (UCC), USA which has
50.9% of the stock holdings. Whilst in the early years of
the firm, American management staff occupied key
positions, they have been progressively phased out and at
the time of the Bhopal accident all the management
positions in the company were held by Indian personnel
(until 1981 the Managing Director was a US national).
This, nowadays, is a common situation for the overseas
operations of multinational corporations. UCC has a
reputation of having a relatively centralized decision
making style (Morehouse and Subramaniam 1986).
In the manufacturing process at Bhopal, methyl
from
158
isocyanate and alpha naphthol react to produce carbaryl
pesticides. Until 1979, both the major chemicals were
imported. Only in 1979, UCIL started its own manaufac-
turing facility at Bhopal.
The plant was located adjacent to residential areas and
was only twohhree kilometers from the Bhopal Railway
statiodbus stand (Figure 1). When UCIL applied for a
licence to manufacture MIC, the Administrator of the
city suggested that the unit should be shifted outside the
city, but this was not accepted by the Government and
UCIL was given licence to manufacture MIC in the
existing premises.
Bhopal was a city which had expanded at the rate of
75% during the 1971-1981 period and, because of this
mushrooming urban growth, a large number of squatter
settlements had come close to the factory. During the
1983-1984 period, the local government gave these
't
residents legal sanction to stay in their localities.
The new manufacturing facility was sanctioned in
1979, and UCIL was licenced to produce 5000 tonnes of
carbaryl based pesticides. The production of MIC
achieved in 1981, 1982, 1983 was 2704 tonnes, 2308
tonnes and 1657 tonnes respectively. The demand for the
pesticide was reducing because of the import of new
products like synthetic pyrethroids. The sales of MIC
based pesticides were only 1500 tonnes in 1983 compared
to 2211 tonnes in 1982.
The unit was not making a profit and many technical
people left to take up new positions elsewhere. One of
the major consequences of loss making was assigning less
importance to safety and maintenance practices.
A brief description of the manufacturing facility will
be given here so that the sequence of events becomes
clear. MIC is stored in three underground tanks made of
stainless steel. The tanks have to be kept refrigerated so
that the temperature of storage is kept close to 0C and
Source: Chem 8 Engg
News Morch 25,1985
p e r ticido unil
Project Appraisal September 1987
 -
Bhopal accident
To V Q S RVVH llnr
-- --t

I
'1 c

*lo V Q S ond FVH

i

Ir-
I iI

4.
Ouench filter

KEY:
I , Intereconnccth RVVH
isolation volve
2. Interconnection PVH isolatron
Downloaded by [113.210.106.241] at 23:24 15 December 2017
Phosgene strlpplngstlll
filter pmsure or vmt 8crubb.r
safety vdve liner
(at ground iewl) Concrete cover
7. Nitmgm header lsolotion 13.Supturedisk RWH-relief valvr vent hrader
valw I 4 . PIC lsolatlon valw PVH- proms volve vmt header
8 .RVV isolation valve I 5. PI isolation valve VGS- vent gas scrubber
9 . w Meedrr~ valve I6.RVVHlsolotlon voIW p ~ - f l m e v e nheader
t

valve I0.Relief v o h fa MIC tank I?.vahre fromwhlch waterfar MRS-MIC reactaside

3. PVH Isolation valve I I. first RWH Isolation valve for
4 . 8 1 0 ~docrnDMV MIC tank
3.Makeup DMV 12.t i r s t w tsolotlon valve for
6.Check valve faf nHrogsh line MIC tonk
FIG. 3 . DETAILS
not about 15C as given by the safety manual of UCC.
After the tank there is a vent gas scrubber to neutralize
the MIC in case of release, by spraying alkali. Then there
is a flare tower to burn the remaining gases going from
the vent gas scrubber. The detail of the storage system is
shown in Figure 2 and the details of MIC processing
plant in Figure 3.
Trigger of the accident
As per the safety manual the scrubber should be kept in
active mode, which means that the pump has to spray
alkali as long as the plant is operating. In October 1984 a
decision was taken to keep it in passive mode. Similarly
it was decided to shut down the refrigeration plant.
Neither of these in themselves would have caused any
problem .
There are two process venting lines RVVH and PVH
(see Figure 3). The relief valve and vent header (RVVH)
is a line for toxic gases from the pressure relief valve to
the vent gas scrubber, if there is a pressure build-up in
any one of the tanks and gases are released.
The second vent line is the process vent header (PVH)
leading from the tanks to the vent gas scrubber (VGS).
This line is connected to the nitrogen pressurization
system. The routine release of process gases goes through
the PVH to the VGS. As per the process chart given
(Figure 2) by Union Carbide Corporation, RVVH and
PVH are not interconnected. A decision was taken to
In October 1984 it was decided to keep
the vent gas scrubber in passive mode
and to shut down the refrigeration
plant against safety manual
instructions.
fluang wos let in --- Routrof water lngms
lb,19,20,21. Down stream -.-.- route of gas leakage befbfu0030hrt
lsdotlon Valves flltrn - mute of pas~mkogeafter 0030hrs
22,23,24,25. Bleeder valves
OF MIC PLANT
carry out a major plant modification connecting RVVH
and PVH sometime in May 1984 before the accident
(Jumper line in Figures 3 and 4) (Bhushan and Subrama-
niam 1985, Fera 1985, Morehouse and Subramaniam
1986, Technica 1985).
The plant was shut down for maintenance two months
prior to the accident and was to resume operations in
early December 1984. Around 26 November 1984, the
operator tried to pressurize MIC tank 610 to transfer
MIC to the processing unit, as it contained about 42
tonnes of MIC. Though nitrogen was sent in, the tank
failed to get pressurized. This itself was an indicatin that
there is a leak somewhere. Instead of attending to the
leak, the management decided to pressurize tank E611
containing about 40 tonnes of MIC.
On December 3, the MIC plant supervisor ordered
washing of MIC lines assuming that there was a blockage
in the line. At about 9.30 pm on 3 December 1984, the
operator began washing out four lines in the MIC storage
area, and all these were connected to the RVVH. The
operation started pumping water under high pressure
into the four lines, but he found that some lines were
clogged, (valve 17 in Figure 3).
He stopped washing and reported the problem to the
supervisor. The supervisor, who was transferred from a
completely different plant to this unit only two weeks
before the event, gave further instructions for rewashing
after 20 minutes.
The operator was to insert a slip blind so that water
would not go into the MIC tank before washing. Water
which accumulated during the earlier washing entered
the RVVH. Water had accumulated at a height of 20 feet
(see Figure 3). The absence of using a slip blind while
washing the lines was the triggering event for the water
entry, the route of which is shown in Figure 3.
The jumper line gave a direct route through the leaky
nitrogen valve to the MIC storage tank. If the washing
had not been carried out or if the jumper line had not

Project Appraisal September 1987 159

 Bhopal accident

been provided the whole sequence of events leading to 11.50 pm MIC operator sees yellow drip from
entry of water to the MIC tank would not have occurred. RVVH
The investigations conducted in India indicated that 12.00 am Supervisor ordered stopping of
UCC had given permission to UCIL to carry out the washing operations
plant modifications for interconnecting PVH and RVVH 12.15 am Tea break for operator
in May 1984 (Morehouse and Subramanian 1986). 12.20 am Attempt to start the vent gas scrubber
Pump
12.25 am Plant superintendent, on being in-
Description of events formed about the leak, arrives at the
spot
The refrigeration unit was decommissioned in June 1984. 12.30 am Pressure gauge reading over range.
The pressure indicator control and level indicator of the Concrete tanks get very hot
MIC tank and the temperature indicator alarm were all 12.40 am MIC operator reports escape of MIC
faulty for a long time. The operators never gave attention through the vent line at 33 meters
to these instrument readings. 01.00 am Toxic Gas Alarm was alerted, but
On 22 October 1984 the MIC plant was closed for shut switched off. Police official on patrol
down. On 25 November 1984 the flare tower was reports to police control room that
disconnected and the jumper l i e connecting R W H and something had gone wrong at UCIL
PVH was opened. Actual instructions for washing the 01.15 am Police control room informs the city
quench filter and relief valve lines were given on the police chief
morning of 2 December 1984. The sequence of events 01.30 am UCIL staff when telephoned report
that followed are given briefly (Union Carbide Corp, that everything is normal
1985, Technica 1985). 01.45 am Additional District Magistrate informs
Downloaded by [113.210.106.241] at 23:24 15 December 2017

09.15 pm Washing of relief valve lines without the Works Manager of UCIL at his
isolation residence about the leak
09.30 pm 02.00 am to The safety valve reseated, but 40 to 45
Operator notices the lines are blocked
10.00 pm 02.30 am tonnes of MIC escaped before that.
MIC Plant supervisor orders washing
to continue Public siren was restarted at full blast.
10.20 pm Pressure in the tank 610 is 2 Psi. 610 MIC vapours started affecting people in the vicinity, and
failed to get pressurized a large number of people started running out of the
10.45 pm Shift changed houses. On the morning of 3 December, Hamidia
10.45 pm Water entry from RVVH to PVH and hospital had about 12000 persons. Again on the night of
the tank 3/4 December, MIC from the atmosphere recondensed
11.00 pm Operator logs pressure in tank 610 as and more people were affected. On the 4 December 1984
10 Psi Hamidia Hospital had to handle about 55000 people,
11.30 pm to, First leak of MIC detected. Plant whereas the hospital had capacity for only 750 people
11.45 pm sipervisor notified about the high (Khandekar and Dubey 1984).
pressure and MIC leak People staying in the vicinity of the firm were severely

R VVH

W T A

1 I
n
4
1
3
I
MIC TANK

I.NlTROGEN OUT VALVE

2.PVH ISOLATION VALVE

3.RUPTURE DISC
4.SAFETY VALVE P V H PROCESS VENT HEADER
RVVH RELIEF VALVE VENT HEADER ( Sourco: Foro, 198s)

F I G . 4 . HOW THE WATER ENTERED.

160 Project Appraisal September I987


If regular rehearsal of emergency
procedures had been in force in Bhopal
many of the plant and operator inade-
quacies could have been corrected
affected. The number of people who died has been
officially reported to be about 2500, whereas the reports
published by voluntary agencies put the figure at 5000 to
8000 based on a door to door survey after the accident
(Delhi Science Forum 1985).
Water entered the MIC tank along with iron from the
iron pipes, though as per the safety manual only stainless
steel can be used. Ferric ions act as catalyst for
polymerization of MIC (Union Carbide Corp 1985).
Water reacts with MIC violently. The polymerization
generated heat and the pressure rose sharply.
The concrete cover of the MIC tank cracked indicating
that the temperature of the tank exceeded 300C. MIC
got released and, at the high temperature prevailing.
some MIC got decomposed into hydrogen cyanide.
Downloaded by [113.210.106.241] at 23:24 15 December 2017
Monomethylamine was also produced.
The wide variety of symptoms observed at Bhopal has
been due to the exposure of a large number of toxic
substances in varying concentrations at different loca-
tions. Even after three days, the air in the vicinity of the
plant had fairly high levels of cyanide concentration
(Appen, 1985). On the night of December 3/4 many
persons were affected and, on the night of the 4th, the
vapours got recondensed and some more people were
seriously affected.
Prime cause
The prime cause of the accident and poor mitigation
response can be summarised as follows: Flushing out the
MIC pipeline by washing should be a safe routine
maintenance operation, but it led to the admission of
water into the MIC tank 610 because of
0 partly leaking isolation valves
0 omission to insert a slip plate
0 a remotely operated valve being open when it should
have been shut, and
Table 1. Hardware errors
Code Errors
HI Scrubber capacity insufficient
H2 Refrigeration plant was not operational
H3 No automatic sensors to warn temperature increases
H4 Pressure indicator and temperature indicator not working
H5 Sufficient gas masks were not available
H6 Flare tower was disconnected
H7 Vent gas scrubber not in active mode
H8 Plant modification connecting RVVH and PVH
H9 Use of iron pipelines for MIC
HI0 Manual mechanism for switching off scrubber
H I1 No regular cleaning of pipes and valves
HI2 No online monitor for MIC tanks
HI3 No indicator for monitoring position of valves in control room
HI4 Pressure monitor indicated a reading o f 10 Psig when actual pressure is
40 Psig
HI5 Water curtain can only reach 10 meters height
H I 6 Maximum range o f pressure gauge 35 Psig, so operator did not know
the exact pressure
rc
Project Appraisal September 1987
Bhopal accident
0 a plant modification connecting relief valve and
process vent headers
Due to large quanties of MIC being stored in tanks 610
and 611, contrary to operating instructions, the empty
tank 619 was not used as a surge tank for giving the
operators more time to regain control of their plant.
As for safety system for mitigating the release of MIC,
although the released gas went through a scrubber, it is
not clear whether it did not work or whether alkali was
not present. In any case, the operating manual suggests
that it could be inadequate for the handling of the
massive release.
From the vent gas scrubber the gas should have gone
to a flare tower to burn up the escaping MIC, but this
was out of service, the pipe leading to it having been
removed some weeks before. The emergency water
sprays were ineffective either due to lack of pressure or it
was not designed to reach the height of 33 meters from
where the gas escaped.
The most important aspect of emergency planning was
missing - the rehearsal of emergency procedure prefer-
ably on the real, live plant with the active involvement of
all levels of management. If such regular practices had
been in force at Bhopal, many of the consequences of
plant deficiencies and operator inadequacies would have
been made. evident and perhaps corrective action may
have followed.
Given below is a detailed analysis of the errors which
caused the accident to be so severe, as well as the type of
failure (technical, operator, management or governmen-
tal (regulatory) as the case may be.
Hardware errors
Hardware errors are the ones relating to equipment ,
design materials of construction, levels of instrumenta-
tion, defective fabrication, transient conditions, un-
diagnosed hazard conditions and so on. Though some of
these are human related these are the first order errors: if
uncorrected they can lead to the next order of failures. A
summary of the hardware errors which occurred at
Bhopal and whether each of these is a management, a
technical or operator failure is indicated in Table 1.
0 The scrubber was insufficient (Morehouse and Sub-
Type of failure
Technical failure
Management failure
Technical failure
Management failure
Management failure
Management failure
Management failure
Management failure
Management failure
Technical failure
Management failure
Tech nica I fa iIure
Technical failure
Technical failure
Technical failure
Technical failure
161
 Bhopal accident

Table 2. Operator related errors

Code Errors Type of failure

01 Reduction in operating and maintenance staff Management failure
02 Using a non trained superintendent for MIC plant Management failure
03 Failure of shift operator to communicate information on pressure Management and operator
increase to the next operator failure
04 Repressurizing the tank when it failed to get pressurized once Management and operator
failure
05 Issuing orders for washing when MIC tank failed to get pressurized Management and operator
failure
06 Not following the safety precautions while washing MIC lines Management failure
07 Not confirming the leak when police officials enquired about it Operator failure
08 Not operating the warning siren until the leak became severe Management and operator
failure
09 Switching off the siren immediately after starting it Management and operator
failure
010 Failure to recognize that the pressure rise was something abnormal Management and operator
failure
011 Failure to use the empty MIC tank to release the pressure Management and operator
failure
012 Failure to recognize the seriousness of the leak Operator failure
013 Failure to inform Works Manager as soon as the leak started Management and operator
Downloaded by [113.210.106.241] at 23:24 15 December 2017

failure

ramaniam 1986) to handle such large scale release of
MIC. At the design stage the rates of relP case were
underestimated.
Such factors as no automatic sensors, no manual
mechanism for switching on the scrubber, no on line
monitor for MIC tanks are examples of low safety
levels and low levels of instrumentation (Bowonder
1985).
The water curtain for neutralizing MIC could only
reach 10 meters height whereas the MIC escaped at 30
meters height indicating design deficiency (Degrazia
1985).
Use of iron for pipelines, plant modification connect-
ing RVVH and PVH, disconnecting flare tower, not
keeping the vent gas scrubber in active mode,
switching off the refrigeration plant for cooling the
MIC plant etc are examples of undiagnosed hazard
conditions.
The pressure indicator and temperature indicator of
the MIC tank was not working. Normally this can be a
technical failure, but in MIC plant most of the
instruments were working properly because of poor
safety concerns of the management (Degrazia 1985).
Non availability of sufficient number of gas masks, is a
hardware error caused by poor safety concerns at the
corporate level.
The basic causes for these errors are analyzed in a
subsequent section.
Reduction in operating and maintenance staff (Degra-
zia 1985) in the MIC plant, and use of a non trained
superintendent (Morehouse and Subramaniam 1986)
for the MIC plant are operator related errors caused
by poor safety concerns at the corporate level.
Failure of the shift operator to communicate infor-
mation Qnrapid pressure build up at the MIC facility,
not following the safety precautions while washing the
MIC pipelines, failure to inform Works Manager as
soon as the MIC leak started, are errors caused by
poor hazard management procedures and absence of
hazard analysis in the facility.
Not confirming the leak when the police officials
enquired about the MIC leak at about 12.30 am.
(when the first effects outside the plant were noticed),
not operating the warning siren until the MIC release
became severe, switching off the safety siren (kept for
warning the public living in the vicinity) immediately
after starting it and failure to use the third MIC tank
to release the pressure were due to lack of formaliza-
tion of safety procedures. In hazardous facilities
absence of formalization leads to random or ad hoc
response by operators.
If the errors are analyzed, it can be seen that the only
pure operator failure is the failure of the MIC plant
operator to recognize the seriousness of the leak. This
again was due to poor awareness, lack of openness in
matters regarding safety and hazards, and absence of
emergency response procedures for operators.

Operator related errors Information related errors

The next level of errors are the operator related ones such
as poor perception of the severity of risk, not following
the specific instructions, failure of judgement, failure to
communicate critical information, not taking timely
corrective measures, issuing orders without comprehend-
ing the nature of the whole task and so on. Table 2 gives
the operator related errors as well as the type of failure at
Bhopal. Some typical ones are:
The third set of errors are the ones created due to lack of
information, lack of formalization of procedures, lack of
communication, lack of awareness about toxicity of
various chemicals and so on. Table 3 gives the informa-
tion related errors at the Bhopal plant. The errors can be
due to the corporate management failure or regulatory
failure.
The major errors caused by the poor corporate safety

162 Project Appraisal September 1987

 Bhopal accident

Table 3 Information/communication related errors

Code Errors Type of failure

2

I1 Panic reaction in the plant since no emergency plan Management failure

12 Ad hoc response by operators Management failure
13 No emergency plan for city Government failure
14 No risk analysis before plant modification Management failure
15 Information on possibility of runaway reaction not communicated Management failure
16 Doctors did not learn of treatment Management failure
17 Information on precautions of how to minimize MIC effects not Management and Government
communicated failure
18 Information of wind movement not disseminated Government failure
19 Information on differential sensitivity not disseminated Management failure
110 Not informing public about a possible emergency in the Management failure
neigh bourhood
I11 Significance of alarm siren not known to public Management failure
112 Toxicity of MIC not assessed and dependent on the information Government failure
provided by the firm
113 Delay in providing information on treatment Government failure
114 No action initiated on press reports about poor safety Government and Management
failure
115 Not acting on the fact that large scale storage of MIC not permitted Government and Management
in other countries failure
Management failure
Downloaded by [113.210.106.241] at 23:24 15 December 2017

116 Considering phosgene as more toxic than MIC

117 Absence of a toxic information centre Government failure
118 Confusion about the gas which was released caused problems for Management failure
medical emergency handling
I19 No action was initiated on the enquiry Management and Government
failure
~~ ~

concerns are:
no emergency plan at the plant;
ad hoc response by operators because of no specific
instructions on how to handle emergency;
no hazard analysis before plant modification;
in the West Virginia plant of Union Carbide Corpora-
tion, USA a safety audit conducted in July 1984
indicated that a runaway reaction can occur in the
MIC tank. (This information was not communicated
to UCIL, though UCC took corrective action by
September 1984 and informed USEPA (US Congress
1985) about the implementation of corrective
measures;
information on differential sensitivity of MIC towards
children and elderly people compared to the rest of the
population, was not communicated to public health or
civil authorities to hasten emergency evacuation.
UCC considered phosgene as more toxic and did not
inform public about the precautions. MIC is five times
more toxic than phosgene: the threshold limit value of
phosgene is 0.1 ppm whereas that of MIC is 0.02. This
was known in toxicological literature well before the
accident (Bowonder, Kasperson and Kasperson
1985). There was one publication on toxicity of MIC
published in German: though this was known to UCC,
regulatory agencies in India did not have this infor-
mation (US Congress 1985).
precautions to be taken for minimizing the effect of
MIC were not dsiclosed;
0 the line of treatment for MIC exDosure was ..__ ~ not
disclosed. Most of the informatio; on MIC was
proprietary and open literature gave very little toxico-
logical information on MIC (Dagani 1985, Ten Berge
1985).
Communication related errors can be severe in hazardous
chemical plants because firms dealing with such facilities
are generally very secretive and not open in approach.
The causes of such errors are discussed subsequently.
System related errors
System related errors are the next level of errors such as
poor siting procedures, absence of risk assessment, poor
implementation of safety audit, large scale storage of
toxics, p y r emergency evacuation procedures and lack
of coordination of emergency, and mecdical care. The
major system related errors at Bhopal are listed in Table
4.
At the corporate level, the major errors (management
failure) were:
0 Not evaluating the safety levels needed for a toxic
facility close to human settlements;
0 Not improving safety systems even after the audits
(Bhushan and Subramaniam 1985) indicating poor
safety;
0 Poor emphasis of systems safety and safety pro-
cedures. Emphasis was on component safety;
0 Decision to store MIC in large scale, while laree scale
v

storage is not permitted in many countries (Gladwin

Communication related errors can be
severe in hazardous chemical plants
because firms dealing with such
facilities are generally very secretive
1985). Storing 55 tonnes of MIC, while daily usage -
was only 5 tonnes was a major error.
Failure to monitor whether safety had improved after
the safety audit. The corporation failed to check
whether the recommendation of the internal safety
audit team had been implemented;

Project Appraisal September 1987 163

 Bhopal accident
Table 4 System related errors

Code Errors Type of failure

s1 Locating a hazardous facility close to a city ManagemenVGovernment

failure
s2 Not evaluating safety levels required Management failure
s3 Not improving safety after audits Management failure
s4 Poor emphasis on systems safety Management failure
s5 No improvements i n safety ever after six accidents ManangemenVGovernment
failure
S6 Decision t o store MIC in large scale Management failure
s7 Growth of large settlements close to the firm GovernmentlManagement
failure
S8 Permitting the settlements to become regular settlements Government failure
s9 Poor evacuation measures GovernmentlManagement
failure
s10 Medical emergency procedures became controversial Management failure
s11 No intermediate storage, hence contamination potential Management failure
s12 Storing 55 tonnes o f MIC while usage daily was 5 tonnes Management failure
S13 Decision not t o shift factory when applied for license Government failure
S14 Not updating safety levels while switching to large scale storage of MIC Management failure
S15 Neglecting the safety even after six accidents Management failure
S16 Neglecting safety management at the unit Management failure
Downloaded by [113.210.106.241] at 23:24 15 December 2017

S17 No action o n earlier accident analysis reports Government failure

S18 Failure t o release the telex message on MIC treatment from Management failure
corporate HQ
s19 Failure t o monitor whether the recommendation of safety audit Management failure
implemented
s20 Heavy reliance on inexperienced operators Management failure
s 21 Transfer of a trained superintendent to a non-MIC facility Management failure
s22 Neglecting the warning of factory inspector on washing MIC lines Management failure
without slip blinds
S23 Decision t o reduce operating and maintenance staff i n control Management failure
room/pla nt
S24 Not permitting the German toxicologist to use sodium thiosulphate Government failure
therapy (NATST)
S25 Director of Health Service issuing a letter not to use NATST Government failure
S26 Carrying out plant modifications in hazardous facilities without Management failure
hazard and operability studies

Even after six accidents (three were toxic spills) safety
was not improved (Bowonder 1985). In hazardous
facilities near misses or minor accidents should be
thoroughly investigated (Kletz 1985a, Lees 1982,
Lees 1985);
Carrying out plant modifications (Technica 1985) in
hazardous facilities without hazard and operability
studies;
Decision to reduce operating and maintenance staff in
the MIC plant and control room;
Neglecting the warning of the factory inspector in
1981 that washing MIC lines without slip blinds can
cause serious accidents;
Reliance on inexperienced operators;
Transfer of the specially trained person to a non MIC
facility;
Though the UCC Headquarters had earlier sent a telex
(Ramaseshan 1984, 1985) to Bhopal asking for a
cyanide antidote to be given, when the seriousness of
the situation was known, they retracted from this
position;
There was serious confusion about the nature of the
Not having an emergency plan for the city;
Information on wind movement was not disseminated
and this caused some people to move in the direction
of the MIC cloud movement;
Toxicity of MIC was not independently assessed at the
project approval phase: only the information provided
by the firm was used;
Delay in providing correct toxicological information
on line of treatment for MIC exposed people;
No action was initiated on press reports which
indicated (in 1982 and in 1984) that safety was poor at
the UCIL plant. These provided sufficient early
warnings or near misses of a catastrophe. Nothing
substantial was done to improve safety either by
government or by corporate management (Kletz
1985);
Similarly no action was taken on the enquiry report of
the earlier accident;
Large scale storage of MIC is not permitted in a
number of countries and this itself is a good indication
by the regulatory agencies to monitor the safety
systems involved in storage.

Not having emergency rehearsals to cheik safety Permitting settlements to come close to the firm and
inadequacies. regularizing these settlements;
At the government level (regulatory and administration Decisions not to shift the factory when it applied for a
problems) some of the major errors were: license for manufacturing MIC based pesticides.

164 Project Appraisal September I987

 Bhopal accident

to the growth of large settlements in the vicinity, or it

Analysis of the Bhopal accident shows
that organizational or corporate level
failures are the most critical ones that
need attention if accidents are to be
avoided
Though a government administrator suggested shift-
ing of the factory to outside the city limits, govern-
ment did not agree to this proposal;
Not permitting the toxicologist, who came from West
Germany to use sodium thiosulphate therapy. He was
asked to leave Bhopal though he brought 50,000
injectable vials of sodium thiosulphate (Appen 1985);
Poor evacuation procedures;
Medical emergency procedures became controversial
because different agencies suggested different lines of
treatment and there was severe confusion;
Because of the absence of a formal procedure, no
action was taken on earlier accident analysis reports.
Downloaded by [113.210.106.241] at 23:24 15 December 2017
should have updated its safety system to reduce the
possible exposures. In the absence of a formalized
mangement system, safety levels were not reviewed
subsequent to the changes in the density of population in
the local human settlements.
When the firm was building up the facility, the then
Managing Director of UCIL suggested that small scale
storage of MIC would be preferable to large scale storage
of toxic materials, but his objection was overruled
(Morehouse and Subramaniam 1986).
Whilst corporate management has an undeniable
responsibility for the establishment of systems and proce-
dures and their subsequent audit, it is inevitable that all
the responsibility for enforcement at plant level will be
delegated to the local management. Experience in
industrialized countries suggests that where matters of
safety at work are concerned, active involvement by the.
public authority is also required, backed up by appropri-
ate legislation and a national safety inspectorate. This
usually is the reponsibility of local and national govern-
ment.
In places where safety environment is more conspi-

cuous by its absence, an extra responsibility is placed

Here again, the corporation should have either objected upon the corporate management of a multinational
Table 5. Analysis of causes of failure

Type of failure Errors Basic cause

Technical failure HI, H8, H I 3 1 Poor perception of risk involved

(21) HI, H2, H3, H8, H9, H10, H12, H I 3 2 Absence of hazop and hazan studies
H14, H I 5
04, H11, H12, H I 6 3 Poor safety specifications
H10, H12, H14, H I 5 4 Design failure

Operator failure 12, 05, 010 1 Poor training

(12) 09 2 Overstress
07, 08, 011 3 Poor emergency procedures
08,09, 010,012,013 4 Failure to perceive the gravity of the
situatiodrisk

Management HI, H4, H5, H6, H7, H9, H11, 01, 1 Poor safety concerns at the corporate level
failure 06, 114, S1, S2, S3, S4, S7, S17,
(65) S20, S21, S24
H2, 110, 02, 03, 04, 05, 06, 07, 08, 2 .Nan specification of procedures/lack of
013, S24,27 formalization
H7, H8, 115, 116, S5, S6, S7, S12 3 Poor risk assessment practices
S15, S16
14, S13, S16, S21, S22, S26 4 Similar procedures/methods for hazardous
and non hazardous facilities
15, 16, K7, 19, 111, 113, S19, 118 5, Failure to be open i n approach
H3, H12, H13, S15, H16, S23, S27 6 Failure to equip the plant for required safety
11, S6, S23, H I 5 7 Failure to anticipate the catastrophic
potential

Government 17, 18, 113, S9,S25, S26 1 Poor emergency management

failure s9, SIO, s11, s25 2 Poor co-ordination efforts
(28) S1, S14 3 A d hoc siting procedures
S1, 13, 112, 114, 115 4 Poor risk assessment
(Numbers in the s5, 518, S23, 114, 115, 5 Poor implementation of safety audits results
brackets indicate and regulations
total failures s7, S8 6 Lack of controlling land use and zoning for
under each land use
class) 115, 117, S25, S26 7 Absence of toxic substances management
and policy

Project Appraisal September 1987 165

 Bhopal accident
company. In the Bhopal case the UCC Headquarters did
not exercise this extra responsibility towards the hazard-
ous facility and treated it as if it were a genial
non-hazardous facility.
Analysis of failure
The four levels of errors given in Tables 1,2,3 and 4 are
reclassified in terms of the four causes of these errors
namely technical failure, operator failure, management
(corporate) failure and government failure. Table 5
presents the analysis. Technical failures, accounted for
21 errors, 12 were caused by operator failures, 65 were
the result of management failures and 28 were due to
government failures (regulatory failure).
This clearly supports the view that all human initiated
disasters ultimately can be traced back to deficiencies in
the management of the systems at the corporate level.
Yet in major accident assessment and prevention, these
deficiencies are often overlooked or very inadequately
addressed (Batstone, 1986).
The basic causes of these errors are given in Table 5 ,
Downloaded by [113.210.106.241] at 23:24 15 December 2017
the major ones being:
Poor risk or hazard assessment, procedures and practices
(Technica 1985) such as:
0 poor perception of risk involved,
0 absence of hazard and operability studies,
0 failure to perceive the gravity of the situation after the
trigger event,
0 poor risk assessment practices in toxic facilities,
failure to anticipate the catastrophic potential of a
toxic facility close to human settlement,
0 failure to be open in approach.
Poor safety concerns at the corporate level (Gladwin 1985)
such as:
0 poor safety specifications,
0 design failures,
0 poor training and use of inexperienced operators,
0 poor emergency procedures,
0 poor safety management systems at the corporate
level,
0 non specification of proceduresllack of formalization
to reduce ad hoc actions by operators,
0 use of common procedureslsystems for hazardouslnon
hazardous facilities,
0 failure to equip the plant for the required safety levels,
poor implementation of safety audits and regulations,
0 poor safety rehearsal operations.
Poor implementation of safety by the regulatory agencies
concerned. Some of the other basic causes can be brought
together under poor industrial siting procedures, and
poor hazard assessment capability at the regulatory
agency level. This may be due to absence of information
or absence of risk assessment expertise within the
government system.
Lessons to be learned
A conceptual framework for accident analysis developed
by Batstone (1986, 1987) indicates that in most complex
systems 80 to 85% of the failures are in the management
and organization aspects of the system and only 15-20%
166
are due to human error. The analysis of the Bhopal
accident, presented here corroborates the conclusion of
Batston (1986) that organizational or corporate level
failures are the most critical ones that need attention if
accidents are to be avoided.
The most important prerequisite for accident preven-
tion is the top manangement commitment to safety.
Accident prevention needs not to be treated as an
expensive add-on facility but it has to be an integral part
of management and organizational objectives (Batstone
1987). Regulatory agencies and insurance agencies can
provide a basic framework for the safety and support
systems needed, but the basic institutionalization of
safety procedures should be at the corporate level.
Another major implication of the Bhopal accident is
that, at the project formulation phase itself, hazard
assessment has to be carried out. The safety levels that
are to be adopted in any hazardous facility have to be
determined in terms of population at risk.
When hazardous facilities are to be built in developing
countries, the levels of safety to be achieved must be
higher and not lower than that planned for developed
countries, since, in developing countries,
operators may not be very skilled;
the population around industrial facilities is likely to
be higher;
0 emergency management procedures are likely to be
slow because of the difficulty in quickly communicat-
ing and transporting and;
hazard management practices are not institutional-
ized.
Hazard management costs are likely to be lower if hazard
assessment is carried out along with decision for locating
the project; determining storage requirements; safety
equipment investments; and man power and skill re-
quirements.
Another step needed for institutionalizing hazard
assessment is to internalize the likely damage costs,
through a proper insurance system (Kleindorfer and
Junreuther 1986). Hazardous facilities have to pay
insurance charges commensurate with the risk they pose.
There has to be an international agreement on risk
compensation for hazardous facilities (Ott 1985). This
will force them to improve the safety in those facilities.
Regulatory agencies can press for this reform since it will
reduce the administrative cost of regulations and make
sure that safety is not neglected.
Hazard assessment has to be a part of the project
appraisal system for hazardous facilities or facilities with
low probability-high consequence accidents.
Accident prevention
In hazardous facilities some prerequisites for accident
prevention are:
complete formalization of all the necessary steps so
that operators do not take ad hoc decisions. Otway and
Misenta (1980) have shown that at the time of
emergency, operators will be under severe stress and
there should be minimum intervention by the oper-
ators at the initial stages of an emergency. Steps to be
taken if anything unusual is noticed and also complete
logging and monitoring of all parameters even if some
Project Appraisal September 1987

of them may be considered to be unnecessary by the
operator has to be made statutory. The Bhopal
accident would have been completely averted, if the'
reasons for non-pressurization of the MIC tanks that
occurred five days before the accident were thorough-r
ly investigated before attempting repressurization
again.
starting from the project formulation stage itself the
project proposers have to be open in approach
(Kunreuther and Linneroth 1984) with respect to the
nature of hazards and precautions. In low probability
accident systems sharing of information will have a
positive effect on hazard reduction. At Bhopal if the
corporation had been open about the hazardous nature
of MIC to the government workers, public in the
vicinity and public health authorities, the number of
people affected by the accident would have been much
lower.
carrying out detailed rehearsal of emergency on the
hazardous facilities with the active involvement of all
levels of management, at regular intervals must be
made statutory. Inadequacies of systems should be
evaluated during such rehearsals and corrective action
Downloaded by [113.210.106.241] at 23:24 15 December 2017
initiated.
the hazard causal structure of accident prone facilities
will be such that there will be a number of 'near
misses' before a high consequence event (Lees 1982).
The management system should be such that near
misses have to be investigated fully. Apart from this,
monitoring systems in hazardous facilities may have to
have a higher level of redundancy through duplication
of monitoring instrumentation and reduction of oper-
ator intervention through automated early warning
systems. Hazardous facilities should completely elim-
inate non formalized operator interventions and re-
duce the need for operators' role in actuating early
warning signals.
conventional management structures used for non-
hazardous facilities are likely to be ineffective for
hazardous facilities since safety is a lower level
objective in non hazardous facilities. The status of
safety management at the corporate level has to be
high. Production targets or financial targets cannot be
the prime objective in hazardous facilities since a
subservient safety system cannot gear up the corporate
commitment towards higher levels of safety.
It is necessary to have an outline risk assessment to be
formulated at the project feasibility phase for the purpose
of obtaining planning consent. But the leading part in the
formulation of a detailed hazop (hazard operations) or
hazan (hazard analysis) study on a completed installation
has to be done by internal staff and should be used for
safety management of day-to-day operations. Such work
has to be done by the people with a day-to-day
involvement with the plant as only they are likely to
possess the detailed knowledge necessary based on work
experience.
Of course, such activity is best executed by a team and
may be audited by outsiders such as hazop experts and
the Factory Inspectorate. Though it is difficult to
forecast the likelihood of rare events in very complex
facilities, in the case of Bhopal there was a near certainty
of a catastrophe in the light of the revealed shortcomings
such as a number of previous accidents, indentified safety
lapses by the audit and poor corrective measures.
Relief and blow down reviews and hazard and
Project Appraisal September 1987
Bhopal accident
operability studies normally take place late in design
(Kletz 1985a). If we are to build simpler, cheaper and
safer plants, then we need to allow time in the early
stages of design for a critical review and evaluation of
alternatives before the detailed engineering design starts
(Kletz 1985a).
It is difficult to deal with inconceivable events because
they usually depend by inference on some factors which
are not readily included in the models and systems used
for design of industrial products with respect to normal
performance (Ostberg 1982). Perceiving inconceivable
events is a very difficult and complex problem.
The probabilities of many unlikely events are hard to
assess accurately even for experts who devote their lives
to the task (Fischhoff 1980). Once people's minds are
made up, it is hard to change them since experts tend to
overvalue their knowledge component (Fischhoff 1980).
Hazard assessments have to be done by a team of experts
outside the project proposing agency, that is by accept-
able third parties well versed in this task.
In order to stimulate preparedness for possibly surpris-
ing alternatives in the development of technology, the
proper thing to do should be to encourage open
mindedness in general (Ostberg 1982). For this, manage-
ment has to recognize and stimulate activities related to
inconceivable events by creating an environment that
makes it possible for anyone concerned to work on
diminishing the risk of occurence of inconceivable events
in hazardous facilities.
At the corporate levet, in hazardous facilities, max-
imum emphasis has to be placed for properly equipping
the facilities, installing early warning systems, training
operators, informing public and agencies about the
hazards involved, assessing and reviewing hazards,
carrying out rehearsals of emergencies to identify safety
inadequacies, institutionalizing safety practices, prepar-
ing an emergency plan, and complying with all safety
standards and regulations.
Only by emphasizing safety at the corporate level, can
safe operations of hazardous facilities be ensured. Reg-
ulatory agencies have to create a proper safety climate
and inspection capability and procedures by institutiona-
lizing hazard management procedures.
To sum up, hazard management has to be started
along with the preparation of the feasibility report as an
inherent part of the project appraisal procedure, for all
hazardous facilities. This has to be put into operation
along with the running of the plants through detailed
hazop and hazan, and safety management practices
supported by appropriate corporate safety commitment.
References
Appen, The Bhopal Tragedy (Sahabat Alam Malaysia,
Penang, Malaysia, 1985).
R J Batstone, "Preventing major hazard accidents",
paper presented by IAENUNEPNVHO Workshop,
World Bank, Washington 1986.
R J Batstone, "Major accident prevention", International
Symposium on Preventing Major Chemical Accidents,
Washington DC 1987.
B Bhushan and A Subramaniam, "Bhopal: what really
has happened", Business India, No 182, pages 102-
116, 1985.
B Bowonder, "The Bhopal accident", Environmentalist,
Vol 5, pages 89-103, 1985.
B Bowonder, J X Kasperson and R E Kasperson, "Avoid-
167
 Bhopal accident
ing Future Bhopals", Environment, 27, (71, pages 6-16,
1985.
R Dagani, "Date on MIC's toxicity are scant: leave much
to be learned", Chemical & Engineering News, 63, (6).
pages 37-40, 1985.
A Degrazia, A Cloud Over Bhopal, (Popular Prakashan,
Bombay 1985).
Delhi Science Forum, "Bhopal gas tragedy", Social
Scientist, 13, (140), pages 1-36, 1985.
I Fera, "Not sabotage", Illustrated Weekly of India. 104,
(17). pages 27-33, 1985.
B Fischhoff, Approaches to Acceptable Risk, NUREGICR-
1614,ORNL/SUB-7656/1 (Oak Ridge National Lab, Oak
Ridge, 1985).
T N Gladwin, "The Bhopal tragedy", NYU Business, 5,
(I), pages 17-21, 1985.
S Khandekar and S Dubey, "City of death", India Today,
9, (241, pages 4-24, 1984.
P Kleindorfer and H Kunreuther, Insuring and Managing
Hazardous Risks (IIASA Laxenburg, 1986).
T A Kletz, "Inherently safer plants", Plant Operations
Progress, 4, pages 164-167, 1985.
T A Kletz, What Went Wrong (Gulf Publishing, Houston,
1985).
H Kunreuther and J Linnerooth, "Low probability acci-,
Downloaded by [113.210.106.241] at 23:24 15 December 2017
dents", Risk Analysis, 4, pages 143-152, 1984.
P Lagadec, Major Technological Risk (Pergamon Press,
New York, 1982).
F P Lees, "The hazard warning structure of major
hazards", Transactions of the Institute of Chemical
Engineering, 60, pages 21 1-221, 1982.
F P Lees, "Hazard warning structure", Reliability En-
168
gineering, 10, pages 65-81, 1985.
W Morehouse and A Subramaniam, The Bhopal Tragedy
Council on International and Public Affairs, (New York,
1986).
G Ostberg, "Evaluation of a design for inconceivable
event occurence," Materials and Design, 5, pages
88-93, 1982.
D H Ott, "Bhopal and the Law," Third World Quarterly, 7,
pages 648-660, 1985.
H J Otway and R Misenta, "Some human performance
paradoxes of nuclear operations", futures, 18, pages
340-357, 1980.
C E Perrow, Normal Accidents, (Basic Books, New York,
1984).
R Ramaseshan, "Government responsibility for Bhopal
gas tragedy", Economics and Political Weekly, 19,
pages 2109-21 11, 1984.
R Ramaseshan, "Bhopal gas tragedy", Economics and
Political Weekly, 20, pages 56-57, 1985.
Technica, Bhopal: An Analysis of the Contributory
Causes, (Technica, London, 1985).
W F Ten Berge, "The toxicity of methylisocyanate for
rats", Journal of Hazardous Materials, 12, pages
309-31 1, 1985.
Union Carbide Corporation, Bhopal Methyl Isocyanate
Incident: Investigation Report, (UCC, Danburg, March
1985).
US Congress, House Committee o n Energy and Com-
merce, Subcommittee on Health and Environment
Hazardous Air Pollutants, December 14, 1984, 98th
Congress, 2nd Session USG PO, Washington DC, No
192, 1985.
Project Appraisal September I987