Mc Jason LAURETE 28 November 2017

ChE 13 A

Bhopal, India Disaster

I. Overview
The Bhopal disaster, also referred to as the Bhopal gas tragedy, was a gas leak incident in India,
considered the world's worst industrial disaster.
It occurred on the night of 2–3 December 1984 at the Union Carbide India Limited (UCIL) pesticide
plant in Bhopal, Madhya Pradesh. Over 500,000 people were exposed to methyl isocyanate (MIC) gas
and other chemicals. The highly toxic substance made its way into and around the shanty towns
located near the plant.
Estimates vary on the death toll. The official immediate death toll was 2,259. The government of
Madhya Pradesh confirmed a total of 3,787 deaths related to the gas release. A government affidavit
in 2006 stated that the leak caused 558,125 injuries, including 38,478 temporary partial injuries and
approximately 3,900 severely and permanently disabling injuries. Others estimate that 8,000 died
within two weeks, and another 8,000 or more have since died from gas-related diseases.
II. Cause
Shortly after the gas release, UCC launched an aggressive effort to identify the cause. An initial
investigation by UCC showed that a large volume of water had been introduced into the MIC tank.
This caused a chemical reaction that forced the pressure release valve to open and allowed the gas to
leak. A committee of experts working on behalf of the Indian government conducted its own
investigation and reached the same conclusion.
Some two and a half years after the tragedy, and only after the Indian government's reluctant
release of some 70,000 pages of documentation, UCC filed a lengthy court document in India detailing
the findings of its scientific and legal investigations: the cause of the disaster was undeniably
sabotage. UCC’s investigation proved with virtual certainty that the disaster was caused by the direct
entry of water into Tank 610 through a hose connected to the tank.
All of this was supported by hard evidence set forth in the presentation made by Ashok S. Kalelkar
of Arthur D. Little, Inc. at The Institution of Chemical Engineers Conference in London in 1988.
Investigations suggest that only an employee with the appropriate skills and knowledge of the site
could have tampered with the tank. An independent investigation by the engineering consulting firm
Arthur D. Little, Inc., determined that the water could only have been introduced into the tank
deliberately, since process safety systems -- in place and operational -- would have prevented water
from entering the tank by accident.
However, other investigations argue that management (and to some extent, local government)
underinvested in safety, which allowed for a dangerous working environment to develop. Factors
cited include the filling of the MIC tanks beyond recommended levels, poor maintenance after the
plant ceased MIC production at the end of 1984, allowing several safety systems to be inoperable due
to poor maintenance, and switching off safety systems to save money— including the MIC tank
refrigeration system which could have mitigated the disaster severity, and non-existent catastrophe
management plans. Other factors identified by government inquiries included undersized safety
devices and the dependence on manual operations. Specific plant management deficiencies that were
identified include the lack of skilled operators, reduction of safety management, insufficient
maintenance, and inadequate emergency action plans.
 III. Effects
The initial effects of exposure were coughing, severe eye irritation and a feeling of suffocation,
burning in the respiratory tract, blepharospasm, breathlessness, stomach pains and vomiting. People
awakened by these symptoms fled away from the plant. Those who ran inhaled more than those who
had a vehicle to ride. Owing to their height, children and other people of shorter stature inhaled
higher concentrations.
Thousands of people had died by the following morning.
Primary causes of deaths were choking, reflexogenic circulatory collapse and pulmonary oedema.
Findings during autopsies revealed changes not only in the lungs but also cerebral oedema, tubular
necrosis of the kidneys, fatty degeneration of the liver and necrotising enteritis. The stillbirth rate
increased by up to 300% and neonatal mortality rate by around 200%.
IV. Prevention
Although equipment failures increased the severity of the Bhopal disaster, these failures and the
poor emergency response to the incident are indicative of serious flaws in the management of the
facility, and these flaws are considered a root cause of the incident. The recognition of these
organizational and human factors concerns has contributed to the response of the chemical
community described here. The incident served as a catalyst for the chemical industry, government,
chemical engineers, professional organizations, and various stakeholders to develop and adopt
stronger and improved standards and practices for chemical process safety. A significant impact of
Bhopal was to make everybody—corporate management, government, communities—aware of the
potential magnitude of a chemical accident. It is in this context that the widespread use and
acceptance of the concept, “process safety,” and later, chemical process safety, was embraced and
adopted as a standard practice in the industry. The heightened awareness resulted in new
regulations for process safety; best-practices initiatives, such as Responsible Care;2 and an increased
concern about the potential to export the risk as well as the benefits of technology to developing
countries as the chemical industry expanded around the globe. The goal of process safety is to
develop a systematic and comprehensive approach to safety that involves the proactive
identification, evaluation, and mitigation or prevention of chemical releases that might occur as a
result of failures in the process, procedures, or equipment.

Three Mile Island Disaster

I. Overview
The Three Mile Island accident occurred on March 28, 1979, in reactor number 2 of Three Mile
Island Nuclear Generating Station (TMI-2) in Dauphin County, Pennsylvania, United States, near
Harrisburg. It was the most significant accident in U.S. commercial nuclear power plant history. The
incident was rated a five on the seven-point International Nuclear Event Scale: Accident with wider
consequences.
The accident began with failures in the non-nuclear secondary system, followed by a stuck-open
pilot-operated relief valve in the primary system, which allowed large amounts of nuclear reactor
coolant to escape. The mechanical failures were compounded by the initial failure of plant operators
to recognize the situation as a loss-of-coolant accident due to inadequate training and human factors,
such as human-computer interaction design oversights relating to ambiguous control room
indicators in the power plant's user interface. In particular, a hidden indicator light led to an operator
manually overriding the automatic emergency cooling system of the reactor because the operator
mistakenly believed that there was too much coolant water present in the reactor and causing the
steam pressure release.
The accident crystallized anti-nuclear safety concerns among activists and the general public,
resulted in new regulations for the nuclear industry, and has been cited as a contributor to the decline
of a new reactor construction program that was already underway in the 1970s. The partial
meltdown resulted in the release of radioactive gases and radioactive iodine into the environment.
Worries were expressed by anti-nuclear movement activists; however, epidemiological studies
analyzing the rate of cancer in and around the area since the accident, determined there was a small
statistically non-significant increase in the rate and thus no causal connection linking the accident
with these cancers has been substantiated. Cleanup started in August 1979, and officially ended in
December 1993, with a total cleanup cost of about $1 billion.
II. Cause
In the nighttime hours preceding the incident, the TMI-2 reactor was running at 97% of full power,
while the companion TMI-1 reactor was shut down for refueling. The main chain of events leading to
the partial core meltdown began at 4:37 am EST on March 28, 1979, in TMI-2's secondary loop, one
of the three main water/steam loops in a pressurized water reactor (PWR).
The initial cause of the accident happened eleven hours earlier, during an attempt by operators to
fix a blockage in one of the eight condensate polishers, the sophisticated filters cleaning the
secondary loop water. These filters are designed to stop minerals and impurities in the water from
accumulating in the steam generators and increasing corrosion rates in the secondary side.
Blockages are common with these resin filters and are usually fixed easily, but in this case the
usual method of forcing the stuck resin out with compressed air did not succeed. The operators
decided to blow the compressed air into the water and let the force of the water clear the resin. When
they forced the resin out, a small amount of water forced its way past a stuck-open check valve and
found its way into an instrument airline. This would eventually cause the feedwater pumps,
condensate booster pumps, and condensate pumps to turn off around 4:00 am, which would in turn
cause a turbine trip.
With the steam generators no longer receiving feedwater, heat and pressure increased in the
reactor coolant system, causing the reactor to perform an emergency shutdown (SCRAM). Within
eight seconds, control rods were inserted into the core to halt the nuclear chain reaction. The reactor
continued to generate decay heat and, because steam was no longer being used by the turbine, heat
was no longer being removed from the reactor's primary water loop.
Once the secondary feedwater pumps stopped, three auxiliary pumps activated automatically.
However, because the valves had been closed for routine maintenance, the system was unable to
pump any water. The closure of these valves was a violation of a key Nuclear Regulatory Commission
(NRC) rule, according to which the reactor must be shut down if all auxiliary feed pumps are closed
for maintenance. This was later singled out by NRC officials as a key failure.
The loss of heat removal from the primary loop and the failure of the auxiliary system to activate
caused the primary loop pressure to increase, triggering the pilot-operated relief valve at the top of
the pressurizer – a pressure active-regulator tank – to open automatically. The relief valve should
have closed when the excess pressure had been released, and electric power to the solenoid of the
pilot was automatically cut, but the relief valve stuck open because of a mechanical fault. The open
valve permitted coolant water to escape from the primary system, and was the principal mechanical
cause of the primary coolant system depressurization and partial core disintegration that followed.
The pressure in the primary system continued to decrease, reactor coolant continued to flow, but
it was boiling inside the core. First, small bubbles of steam formed and immediately collapsed, known
as nucleate boiling. As the system pressure decreased further, steam pockets began to form in the
reactor coolant. This departure from nucleate boiling (DNB) into the regime of "film boiling" caused
steam voids in coolant channels, blocking the flow of liquid coolant and greatly increasing the fuel
cladding temperature. The overall water level inside the pressurizer was rising despite the loss of
coolant through the open pilot-operated relief valve, as the volume of these steam voids increased
much more quickly than coolant was lost. Because of the lack of a dedicated instrument to measure
the level of water in the core, operators judged the level of water in the core solely by the level in the
pressurizer. Since it was high, they assumed that the core was properly covered with coolant,
unaware that because of steam forming in the reactor vessel, the indicator provided misleading
readings. Indications of high water levels contributed to the confusion, as operators were concerned
about the primary loop "going solid," (i.e. no steam pocket buffer existing in the pressurizer) which
in training they had been instructed to never allow. This confusion was a key contributor to the initial
failure to recognize the accident as a loss-of-coolant accident, and led operators to turn off the
emergency core cooling pumps, which had automatically started after the pilot-operated relief valve
stuck and core coolant loss began, due to fears the system was being overfilled.
With the pilot-operated relief valve still open, the pressurizer relief tank that collected the
discharge from the pilot-operated relief valve overfilled, causing the containment building sump to
fill and sound an alarm at 4:11 am. This alarm, along with higher than normal temperatures on the
pilot-operated relief valve discharge line and unusually high containment building temperatures and
pressures, were clear indications that there was an ongoing loss-of-coolant accident, but these
indications were initially ignored by operators. At 4:15 am, the relief diaphragm of the pressurizer
relief tank ruptured, and radioactive coolant began to leak out into the general containment building.
This radioactive coolant was pumped from the containment building sump to an auxiliary building,
outside the main containment, until the sump pumps were stopped at 4:39 am.
After almost 80 minutes of slow temperature rise, the primary loop's four main reactor coolant
pumps began to cavitate as a steam bubble/water mixture, rather than water, passed through them.
The pumps were shut down, and it was believed that natural circulation would continue the water
movement. Steam in the system prevented flow through the core, and as the water stopped
circulating it was converted to steam in increasing amounts. About 130 minutes after the first
malfunction, the top of the reactor core was exposed and the intense heat caused a reaction to occur
between the steam forming in the reactor core and the Zircaloy nuclear fuel rod cladding, yielding
zirconium dioxide, hydrogen, and additional heat. This reaction melted the nuclear fuel rod cladding
and damaged the fuel pellets, which released radioactive isotopes to the reactor coolant, and
produced hydrogen gas that is believed to have caused a small explosion in the containment building
later that afternoon.
At 6 am, there was a shift change in the control room. A new arrival noticed that the temperature
in the pilot-operated relief valve tail pipe and the holding tanks was excessive and used a backup
valve – called a "block valve" – to shut off the coolant venting via the pilot-operated relief valve, but
around 32,000 US gal (120,000 l) of coolant had already leaked from the primary loop. It was not
until 165 minutes after the start of the problem that radiation alarms activated as contaminated
water reached detectors; by that time, the radiation levels in the primary coolant water were around
300 times expected levels, and the general containment building was seriously contaminated.
III. Solution and Prevention
After the accident, an extensive effort was made to improve the control rooms for existing plants
and to devise regulations that increased the attention paid to human factors, man-machine interfaces,
and other facets of control room design. All plants now have their own simulators that are designed
to mimic the particular plant and are provided with the same operating procedures used in the actual
plant. Operators are on a shift routine that puts them in the simulator for a week at a time every four
to six weeks.
The initiating failures that started the whole sequence took place in the steam plant, a portion of
the power plant that was not subject to as much regulatory or design scrutiny as the portions that
were more closely associated with the nuclear reactor and its direct cooling systems.
An increased level of attention is now paid to structures, systems, and components that are not
directly related to a reactor, but there is still a confusing, expensive, and potentially vulnerable
system that attempts to classify systems and give them an appropriate level of attention.
For at least 10 years prior to March 28, 1979, there had been an increasingly active movement
focused on opposing the use of nuclear energy, while at the same time the industry was expanding
near many major media markets and was one of the fastest growing employment opportunities,
especially for people interested in technical fields. The technology was often in the spotlight, with the
opposition claiming grave safety concerns and the industry pointing to what had been a relatively
unblemished record.

Texas City Disaster

I. Overview
The Texas City disaster was an industrial accident that occurred April 16, 1947, in the Port of
Texas City. It was the deadliest industrial accident in U.S. history, and one of the largest non-nuclear
explosions. Originating with a mid-morning fire on board the French-registered vessel SS Grandcamp
(docked in the port), her cargo of approximately 2,200 tons (approximately 2,100 metric tons) of
ammonium nitrate detonated, with the initial blast and subsequent chain-reaction of further fires
and explosions in other ships and nearby oil-storage facilities. It killed at least 581 people, including
all but one member of the Texas City fire department. The disaster triggered the first ever class action
lawsuit against the United States government, under the then-recently enacted Federal Tort Claims
Act (FTCA), on behalf of 8,485 victims.
II. Cause
The ammonium nitrate, needed either as fertilizer or an explosive, was manufactured in Nebraska
and Iowa and shipped to Texas City by rail before being loaded on the Grandcamp. It was
manufactured in a patented process, mixed with clay, petrolatum, rosin and paraffin wax to avoid
moisture caking. It was also packaged in paper sacks, then transported and stored at temperatures
that increased its chemical activity. Longshoremen reported the bags were warm to the touch before
loading.
On April 16, 1947, around 8:00 a.m. smoke was spotted in the cargo hold of the Grandcamp while
she was still moored. Over the next hour, attempts to extinguish the fire or bring it under control
failed as a red glow returned after each effort to douse the fire.
Shortly before 9:00 a.m., the captain ordered his men to steam the hold, a firefighting method
where steam is piped in to extinguish fires, to preserve the cargo. This was unlikely to be effective, as
ammonium nitrate produces its own oxygen, thus neutralizing the extinguishing properties of steam.
The steam may have contributed to the fire by converting the ammonium nitrate to nitrous oxide,
while augmenting the already intense heat in the ship's hold.
The fire attracted spectators along the shoreline, who believed they were at a safe distance.
Eventually, the steam pressure inside the ship blew the hatches open, and yellow-orange smoke
billowed out. This color is typical for nitrogen dioxide fumes. The unusual color of the smoke
attracted more spectators. Spectators also noted that the water around the docked ship was boiling
from the heat, and the splashing water touching the hull was being vaporized into steam. The cargo
hold and deck began to bulge as the pressure of the steam increased inside.
At 9:12 a.m., the ammonium nitrate reached an explosive threshold from the combination of heat
and pressure. The vessel then detonated, causing great destruction and damage throughout the port.
The tremendous blast sent a 15-foot (4.5 m) wave that was detectable nearly 100 miles (160 km) off
the Texas shoreline. The blast leveled nearly 1,000 buildings on land. The Grandcamp explosion
destroyed the Monsanto Chemical Company plant and resulted in ignition of refineries and chemical
tanks on the waterfront. Falling bales of burning twine from the ship's cargo added to the damage
while the Grandcamp's anchor was hurled across the city. Two sightseeing airplanes flying nearby
had their wings shorn off, forcing them out of the sky. 10 miles (16 km) away, people in Galveston
were forced to their knees. People felt the shock 250 miles (400 km) away in Louisiana. The explosion
blew almost 6,350 short tons (5,760 metric tons) of the ship's steel into the air, some at supersonic
speed. Official casualty estimates came to a total of 567, including all the crewmen who remained
aboard the Grandcamp. All but one member of the 28-man Texas City volunteer fire department were
killed in the initial explosion on the docks while fighting the shipboard fire. With fires raging
throughout Texas City, first responders from other areas were initially unable to reach the site of the
disaster.
The first explosion ignited ammonium nitrate in the nearby cargo ship High Flyer. The crews spent
hours attempting to cut the High Flyer free from her anchor and other obstacles, without success.
After smoke had been pouring from the hold for over five hours, and about 15 hours after the
explosions aboard the Grandcamp, the High Flyer exploded, demolishing the nearby SS Wilson B.
Keene, killing at least two more and increasing the damage to the port and other ships with more
shrapnel and burning material. One of the propellers on the High Flyer was blown off, and
subsequently found nearly a mile inland. It is now part of a memorial park, and sits near the anchor
of the Grandcamp. The propeller is cracked in several places, and one blade has a large piece missing.
The cause of the initial fire on board the Grandcamp was never determined, but it may have been
started by a cigarette discarded the previous day, meaning the ship's cargo had been smoldering
throughout the night when it was discovered on the morning of the day of the explosion.
III. Solution and Prevention
The disaster at Texas City was completely preventable. Key immediate steps by operators on the
day could have prevented the accident, however, the key cause of the disaster was a continuous
failure to learn from near misses, an absence of safety culture, and persistent absence of hazard
prevention by management staff, even after numerous near misses on numerous machines. Also
misplaced priorities could be blamed for the disaster, as investments in safety and hazard prevention
where not made, instead job cuts and poor maintenance culture, which saved BP hundreds of
thousands of dollars, where priority.