SAFETY The word "safety" used to mean the older strategy of accident prevention through the use of hard

hats, safety shoes, and a variety of rules and regulations. The main emphasis was on worker safety. Much more recently, "safety" has been replaced by "loss prevention." This term includes hazard identification, technical evaluation, and the design of new engineering features to prevent loss. The subject of this text is loss prevention, but for convenience, the words "safety and "loss prevention" will be used synonymously throughout.
Safety, hazard, and risk are frequently-used terms in chemical process safety. Their definitions are Safety or loss prevention: the prevention of accidents through the use of appropriate technologies to identify the hazards of a chemical plant and eliminate them before an accident occurs. Hazard: a chemical or physical condition that has the potential to cause damage to people, property, or the environment.

Risk: a measure of human injury, environmental damage, or economic loss in terms of both the incident likelihood and the magnitude of the loss or injury.

To provide safety in chemical industries, there must be safety programs. A successful safety program requires several ingredients. These ingredients are 1. System: The program needs a system (a) to record what needs to be done to have an outstanding safety program, (b) to do what needs to be done, and (c) to record that the required tasks are done.
2. Attitude: The participants must have a positive attitude. 3. Fundamentals: The participants must understand and use the fundamentals of chemical process safety in the design, construction, and operation of their plants. 4. Experience: Everyone must learn from the experience of history 5. Time: Everyone should recognize that safety takes time. 6. You: Everyone (you) should take the responsibility to contribute to the safety program.
* A good safety program identifies and eliminates existing safety hazards. * An outstanding safety program has management systems that prevent the existence of safety hazards.

Accident and Loss Statistics Accident and loss statistics are important measures of the effectiveness of safety programs. These statistics are valuable for determining whether a process is safe or whether a safety procedure is working effectively. Many statistical methods are available to characterize accident and loss performance. OSHA incidence rate fatal accident rate (FAR), fatality rate, or deaths per person per year.

Unfortunately, no single method is capable of measuring all required aspects.

OSHA: OSHA stands for the Occupational Safety and Health Administration of the United States government. OSHA is responsible for ensuring that workers are provided with a safe working environment. The OSHA incidence rate is based on cases per 100 full-time workers (working 40 hrs per week, 50 weeks per year). The OSHA incidence rate is therefore based on 200,000 hours of worker exposure to a hazard. The OSHA incidence rate is calculated from the number of occupational injuries and illnesses and the total number of employee hours worked during the applicable period. The following equation is used:

An incidence rate can also be based on lost workdays instead of injuries and illnesses. For this case

Where lost work days are Number of days (consecutive or not) after but not including the day of injury or illness during which the employee would have worked but could not do so, that is, during which the employee could not perform all or any part of his or her normal assignment during all or any part of the workday or shift because of the occupational injury or illness. The OSHA incidence rate provides information on all types of work-related injuries and illnesses, including fatalities. This provides a better representation of worker accidents than systems based on fatalities alone. Example: A university has 1200 full-time employees. In a particular year this university had 38 reportable lost-time injuries with a resulting 274 lost workdays. Compute the OSHA incidence rate based on injuries and lost workdays.

FAR: The FAR is used mostly by the British chemical industry. This statistic is used here because there are some useful and interesting FAR data available in the open literature. The FAR reports the number of fatalities based on 1000 employees working their entire lifetime. The employees are assumed to work a total of 50 years. Thus the FAR is based on 10^8working hours. The resulting equation is

This approach is useful for performing calculations on the general population, where the number of exposed hours is poorly defined. The applicable equation is

The nature of the accident process

Accidents follow a three-step sequence: i)Initiation (the event that starts the accident). ii)Propagation (the event or events that maintain or expand the accident). iii)Termination (the event or events that stop the accident or diminish it in size).
For eg. A worker walking across a high walkway in a process plant stumbles and falls toward the edge. To prevent the fall, he grabs a nearby valve stem. Unfortunately, the valve stem shears off and flammable liquid begins to spew out. A cloud of flammable vapor rapidly forms and is ignited by a nearby truck. The explosion and fire quickly spread to nearby equipment. The resulting fire lasts for six days until all flammable materials in the plant are consumed, and the plant is completely destroyed. Initiation: the tripping of worker Propagation: shearing of the valve and the resulting explosion and growing fire Termination: consumption of all flammable materials

Defeating the accident process

Inherent Safety Inherent safety has first widely expressed in the late 1970's by Trevor Kletz. The basic principles are common sense and include avoiding the use of hazardous materials, minimising the inventories of hazardous materials and aiming for simpler processes with more benign and moderate process alternatives.

An inherently safer design is one that avoids and removes hazards instead of controlling them, particularly by removing or reducing the amount of hazardous material in the plant or the number of hazardous operations.
Inherently safer plants are tolerant of errors and are often the most cost effective. A process that does not require complex safety interlocks and elaborate procedures is simpler, easier to operate, and more reliable. Smaller equipment, operated at less severe temperatures and pressures, has lower capital and operating costs.

Basic Principles of Inherent Safety as follows: Intensification "What you don't have, can't leak. Substitution If intensification is not possible, an alternative is substitution.

Attenuation If intensification and substitution are not possible or practicable, an alternative is attenuation. This means carrying out a hazardous reaction under less hazardous conditions, or storing or transporting a hazardous material in a less hazardous form.

 Limitation of Effects If it is not possible to make plants safer by intensification, substitution or attenuation, the effects of a failure should be limited. For instance equipment is designed so that it can leak only at a low rate that is easy to stop or control. Simplification Simpler plants are inherently safer than complex plants, because they provide fewer opportunities for error and contain less equipment that can go wrong. Change Early Change Early means identification of hazards as early as possible in the process design. The payback for early hazard identification can make or break the capital budget of a new process. This can be achieved by dedicated safety evaluation methodologies which are designed for preliminary process design purposes.

 Avoiding Knock-On Effects Safer plants are designed so that those incidents, which do occur, do not produce knock-on or domino effects. Making Status Clear Equipment should be chosen so, that it can be easily seen, whether it has been installed correctly or whether it is in the open or shut position. Making Incorrect Assembly Impossible Safe plants are designed so that incorrect assembly is difficult or impossible. Assembled components must meet their design requirements. A loss of containment may result from using eg. a wrong type of gaskets. Tolerance Equipment should tolerate maloperation, poor installation or maintenance without failure. E.g. expansion loops in pipe work are more tolerant to poor installation than bellows. The construction materials should be resistant to corrosion and physical conditions. For most applications metal is safer than glass or plastic.

 Ease of Control A process should be controlled by the use of physical principles rather than addedon control equipment (i.e. the dynamics of the process should be favourable). If a process is difficult to control, one should look for ways of changing the process or the principles of control before an investment in complex control system is made. Administrative Controls/Procedures Human error is the most frequent cause of the loss of containment. Training and certification of personnel on critical procedures are permanent considerations. Also some other inherent safety principles, like ease of control, making status clear, tolerance and making incorrect assembly impossible, come into play here. In an attempt to make these principles more understandable, the following four words have recently been recommended to describe inherent safety: minimize (intensification) substitute (substitution) moderate (attenuation and limitation of effects) simplify (simplification and error tolerance).

A CASE HISTORY: BHOPAL GAS TRAGEDY

BHOPAL GAS DISASTER: Worst industrial disaster in history 2,000 people died on immediate aftermath Another 13,000 died in next fifteen years

10-15 persons dying every month

520,000 diagnosed chemicals in blood causing different health complications 120,000 people still suffering from Cancer Tuberculosis Partial or complete blindness, Post traumatic stress disorders, Menstrual irregularities Rise in spontaneous abortion and still birth

December 3-4, 1984: 40 tonnes of methyl iso-cyanate (MIC) released from Union Carbide plant at Bhopal Accidental release caused by leakage of water into MIC storage tank None of the safety systems worked Safety standards and maintenance system ignored for months Complete absence of community information and emergency procedures Public alarm system operated after the gas had leaked for nearly four hours

ACCIDENT OVERVIEW A pesticide plant in India produced the compound Methyl Iso Cyanate (MIC) as an intermediate product in the process. MIC is an extremely toxic and unstable substance and even in very small quantities is fatal. Large quantities of the MIC were stored in steel tank. The tank had many safety features to maintain the product in a safe and stable form. Economic pressures meant that most of these features were abandoned to save money.

Water, inadvertently entered the storage tank and caused an exothermic, runaway reaction to occur.
The MIC boiled up and MIC vapour was expelled through the bursting disc vent.

The scrubber and flare stack were in-operational so the MIC vapour was discharged directly to atmosphere.
The wind carried it as a plume over the adjacent city of Bhopal where the victims were living.

PLANT & PROCESS DESCRIPTION The Union Carbide plant at Bhopal produced the product Sevin an insecticide for spraying on crops. The capacity of the plant was 5,000 tonnes of Sevin per annum. It commenced full production in 1980. The factory was located at the northern end of the town of Bhopal in what was originally a relatively sparsely populated area. Over the years though unplanned urban growth meant densely populated suburbs were allowed to be built at the southern edge of the factory. The prevailing wind was from the North.

Plant View

PROCESS DESCRIPTION There were five main process areas on site: Carbon Monoxide Production Carbon plus Oxygen to Carbon Monoxide Phosgene Manufacturing Plant Carbon Monoxide plus Chlorine to Phosgene Methyl Isocyanate Plant Phosgene plus Methyl Amine to MIC Alpha Napthol Plant Sevin Plant MIC plus Alpha Napthol to Sevin MIC was produced by reacting Phosgene with Methyl Amine and separating out the MIC by distillation. The liquid MIC was then pumped to storage tanks.

PRODUCT DESCRIPTION Although only MIC and Phosgene were implicated in the disaster, the plant was characterized by the production and storage of a large number of very dangerous compounds.

Methyl Isocyanate

(MIC)

CH3NCO

Molecular Weight M = 57 Boiling Point at atmospheric pressure b.p. = 39 C It is a colourless, highly volatile liquid at room temperatures with a vapour twice as dense as air. MIC is a toxic gas attacking the skin, eyes, respiratory systems and internal organs. It is more lethal than Chlorine or Phosgene. MIC is both volatile and unstable at higher temperatures and can breakdown exothermically to give out large amounts of heat. For safe handling, it must be maintained at about 0 C . Chlorine Cl2

Molecular Weight M = 71 Boiling point at atmospheric pressure b.p. = - 35 C. It is a greenish yellow gas at room temperatures with vapour 2.5 times as dense as air. It is a toxic gas that attacks the lungs and other soft tissue.

Phosgene (Carbonyl Chloride)

COCl2

Molecular Weight M = 99 Boiling point at atmospheric pressure b.p. = 8 C. It is a volatile liquid or colourless gas at room temperatures with vapour 3.5 times as dense as air. It is a toxic gas that attacks the lungs and other soft tissue.

Note both Chlorine and Phosgene were used extensively in WW1 as poison gases.
Carbon Monoxide Molecular Weight M = 28 CO

It is a colourless, odourless, non-irritating, permanent gas slightly less dense than air. It is moderately toxic and kills by interfering with the blood oxygen transport mechanism.

CONTAINMENT DESCRIPTION There were three identical MIC storage vessels all built from stainless steel, type 304. The tanks were mounded in earth and the mound covered with concrete. The disaster had its origin in one of these, tank 610. The tank was horizontal, cylindrical in orientation with a diameter, D of 2.43 m and length, L of 13 m. Approximate Nominal Volume, V

D 2 L 60 m 3

Actual capacity would have been less than this taking into account internal fittings, etc.; possibly 55 m3.

TANK PRESSURE / STRESS DESIGN Normal Storage Pressure Design Pressure Hydraulic Test Pressure Estimated Rupture Pressure 0.2 bar g 2.72 bar g 4 bar g 10 to 12 bar g

The membrane stress in the tank wall is proportional to the pressure; the rupture pressure should correspond to the ultimate tensile strength of the material (SS 304). Given the large margin between the normal storage pressure and the rupture pressure, it is clear that membrane stresses will be very low. TANK SAFETY FEATURES A Nitrogen line was connected to the tank to transfer the product by inert pressurization of the headspace. This could also be used to maintain a positive pressure inside the tank and thus prevent the ingress of unwanted liquids. The tank was fitted with a pressure relief valve and rupture disc. The vent line from the valve exhausted into a scrubbing tower filled with caustic soda (NaOH). This would neutralize the MIC to form Sodium Isocyanate. Any residual gas from the scrubber was sent to a 30 m tall flare stack where it would be burned off. There was an external coiled jacket on the vessel through which coolant (freon / chloroform) was recirculated. This was to keep the vessel contents at 0 C and thus prevent any adverse exothermic reactions occurring. Tanks were not to be filled above the 50 % mark so that in the event of dangerous chemical reactions occurring, solvents could be pumped in to quench the reactions. The operating philosophy was that the tanks should only hold the minimum amount of MIC necessary for Sevin production; they were not to be used for stockpiling.

ACCIDENT DESCRIPTION Pipe Cleaning Procedure As part of routine procedures, the pipes leading from the MIC distillation column to the storage tanks were regularly flushed with pressurized water. MIC and any associated products can be quite corrosive and could form corrosion deposits in the pipe. These deposits would contaminate the MIC in the tanks and could initiate unwanted reactions. During cleaning, valves in the product lines were to be closed and a blank placed in the product line leading to the storage tank to prevent contamination. However the valves, although closed, were not sealing properly because of corrosion and the maintenance crew forgot about the blank. It appears that about 1000 kg of water plus metal debris entered tank 610. Assuming all the previously described safety features were operative, this should not have been a catastrophic occurrence. Schematic view of pipe washing procedure indicating location of the relevant valves and pipe blank.

IN-OPERATIVE SAFETY FEATURES The plant had been operating at a loss for the previous year due to lower than expected demand for the product. The plant was not running continuously but intermittently. A cost cutting programme of work had been implemented: The refrigeration system had been turned off about six months previously to save on operating costs; this was the prime protection system. The caustic scrubbing tower was inoperative and the flare had been partly dismantled. Valves on the Nitrogen line were defective due to unsatisfactory maintenance. Lax operating routines meant that tanks were allowed to be filled above the 50 % mark. TANK EXOTHERMIC REACTION Tank 610 contained 42 tonnes of MIC. Exothermic chemical reactions between the water and MIC began in the tank. Gases including Methyl Amine, Carbon Dioxide, Phosgene and others were amongst the products of these reactions and they pressurized the vessel. Corrosion of the tank walls would also have been exacerbated and the released iron may have catalyzed further runaway reactions. The pressure rose from the normal storage pressure of 0.14 bar g, up to 2 bar g and then onto 3.5 bar g and beyond. The temperature rose from ambient (20 C) up to 60 C and beyond. The MIC liquid in the tank began to boil vigorously and MIC vapour, under pressure traveled up the pipes leading from the tank. A small leak of MIC developed at a valve in one of the lines. The tank began to rumble and creak in its concrete casing. The main safety valve blew at a pressure in excess of 3.5 bar g and a jet of MIC traveled up the scrubbing tower and escaped out the top. The tank itself expanded with the heat, burst the concrete casing and was ejected upwards to topple over. A second pipe then ruptured releasing a second geyser of MIC.

From a mechanical point of view it is worth noting that the tank itself did not rupture.

CONCLUSIONS There were a number of clear contributory factors that caused this disaster. 1] Factory Siting A plant producing a variety of very dangerous compounds was sited: a) too close to a residential area b) on the wrong side with respect to the prevailing wind. 2] Large Product Inventory Total storage capacity of MIC was in excess of 150 m3. When dealing with such toxic products, the amount at hand should always be minimized. 3] Abandonment of Safeguards Economic problems and the resultant pressure to save money lead to the shutting down of vital safety systems. If the factory was uneconomic it would have proved a more sensible option to shut it down. 4] Medical Unpreparedness Not enough information on the toxicity of the factorys products and lack of knowledge of treatment in the local hospitals. The factory should have been much more pro-active in liasing with the municipal authorities in preparing an emergency evacuation plan.