Industrial disaster case studies: Bhopal, Piper Alpha, Exxon Valdez and Buncefield

Why study industrial disasters?

Major accidents are rare at any one site, so most people never see one. Case studies are how an industry passes on lessons that each workplace would otherwise have to learn the hard way. The four below are among the most studied in process safety training, and each was examined by an official investigation or a public inquiry.

They matter in Malaysia because the same hazards are here: storage of flammable and toxic chemicals, offshore production, tankers in busy straits and fuel depots near towns. Installations that handle large quantities of hazardous substances fall under the Occupational Safety and Health (Control of Industrial Major Accident Hazards) Regulations 1996 (CIMAH), which require the operator of a major hazard installation to prepare a report on industrial activity (the CIMAH report) and an on-site emergency response plan, and submit them to DOSH. The day-to-day controls that prevent major accidents, such as permits to work, isolation, alarm response and handovers, apply to far more sites than that.

The summaries below are for learning. They rely on published investigation reports and do not make findings about anyone's legal responsibility.

Bhopal, India, 1984: barriers switched off

In the early hours of 3 December 1984, a toxic gas cloud was released from a pesticide factory in Bhopal. Thousands of people died within hours and hundreds of thousands were injured, many in the dense housing next to the plant. It is widely described as the world's worst industrial accident.

What happened. A storage tank (E610) holding about 40 tonnes of methyl isocyanate (MIC) came into contact with water, setting off a runaway reaction. How the water got in is still disputed: the official Indian scientific report favoured water entering through a common vent line during a filter washing job, while a report commissioned by the company proposed sabotage.

What failed. Whatever the route, a review in the Institution of Chemical Engineers' Loss Prevention Bulletin notes that the protective systems, had they worked as designed, could have prevented or greatly reduced the disaster:

• The tank was filled to over 80%, against a design of under 50%.
• The refrigeration system was not working, so the reaction ran hot without the early warning that cooling and reliable temperature gauges would have given.
• The vent gas scrubber, which could have neutralised escaping gas, was turned off.
• The flare, designed to burn off released gas, could not work because a connecting pipe had been removed for maintenance.
• The water spray could not reach the height of the vent stack.

The plant had been losing money and was winding down, with cuts to staffing, maintenance and training. Lesson: when a plant is being run down, the hazard in the tanks is not. Safety-critical systems must stay in service, and the community around a site belongs in its emergency plan. The Bhopal 1984 case study lets staff walk through that night in a 3D scene.

Piper Alpha, North Sea, 1988: the permit that went missing

On 6 July 1988 a series of explosions and fires destroyed the Piper Alpha oil and gas platform about 110 miles from Aberdeen. Of the 226 people on board, 165 died, along with two rescuers: 167 in all. The public inquiry led by Lord Cullen reported in November 1990 and made 106 recommendations.

What happened. A condensate pump had a pressure relief valve removed for maintenance, and a blank flange had been fitted loosely in its place, out of sight of the pump. The work was not finished by the end of the day shift, and the permit was suspended. That evening the running pump failed and the night crew restarted the spare, unaware the relief valve was missing. The flange leaked, the gas cloud ignited, and the fire was then fed by pipelines from connected platforms that took a long time to shut in.

What failed, according to the inquiry:

• Permit to work. The pump repair and the relief valve job were on separate permits that did not cross-reference each other and were kept in different places. Permits were often suspended or closed without the job site being checked.
• Shift handover. The relief valve work was not mentioned at handover or in the logs.
• Fire protection. The diesel fire pumps had been set to manual because divers were in the water, so the deluge never started. Many sprinkler heads in the affected module were known to be blocked.
• Emergency response. Many crew went to the accommodation as trained and waited for instructions that never came; 81 died there from smoke. Drills and induction training had lapsed.
• Management. Earlier warnings about the permit system and about a large gas fire were not acted on.

Lesson: isolation, permits and handovers are safety-critical systems in their own right. The inquiry led to the UK offshore safety case regime and moved offshore safety enforcement to the Health and Safety Executive. Replay the night in the Piper Alpha lesson.

Exxon Valdez, Alaska, 1989: fatigue on the bridge

Just after midnight on 24 March 1989, the tanker Exxon Valdez, loaded with about 1.26 million barrels of crude oil, grounded on Bligh Reef in Prince William Sound. No one was injured, but about 258,000 barrels of oil spilled from eight ruptured cargo tanks, causing catastrophic damage to the environment.

What failed. The US National Transportation Safety Board (NTSB) found that the probable cause was:

• the failure of the third mate to properly manoeuvre the vessel because of fatigue and excessive workload;
• the failure of the master to provide a proper navigation watch because of impairment from alcohol;
• the failure of the ship's operator to provide a fit master and a rested and sufficient crew;
• the lack of an effective Vessel Traffic Service, because of inadequate equipment and manning, training and management oversight; and
• the lack of effective pilotage services.

Lesson: fatigue and staffing are organisational decisions, not personal weaknesses. Crewing levels, working hours and fitness for duty belong in the risk assessment, and outside checks such as traffic control only help if they are properly resourced. The disaster also drove changes to tanker design and oil spill law. See it from the bridge in the Exxon Valdez case study.

Buncefield, England, 2005: the alarm that could not sound

At about 06:01 on Sunday 11 December 2005, a vapour cloud exploded at the Buncefield oil storage depot in Hertfordshire. There were no deaths, but over 40 people were injured. The fire, the largest seen in peacetime UK, engulfed more than 20 tanks and burned for several days. The UK Competent Authority for major hazards (HSE and the Environment Agency) set out the root causes in Buncefield: Why did it happen? (2011).

What happened. Tank 912 was filling with petrol overnight. At 03:05 its automatic tank gauge "flatlined": it stopped showing the rising level although the tank kept filling. Because the reading stayed below the alarm settings, none of the three gauge alarms went off. The independent high-level switch, meant to stop the filling and sound a final alarm, also failed. By 05:37 petrol was spilling from the tank roof, forming a vapour cloud about 360 metres across that ignited when the fire alarm started the firewater pump.

What failed.

• Known faults ignored. The gauge had stuck 14 times since the tank returned from maintenance in August 2005, and this was not recorded or fixed.
• A barrier left inoperable. The high-level switch needed a padlock to keep its test lever in the working position. The supplier did not explain this to the installer, the maintenance contractor or the operator, so the padlock was not fitted.
• Workload and handover. Supervisors worked long 12-hour shift blocks with many filling operations to monitor, and handover was short.
• Containment. Bunds and drains leaked, letting fuel and firefighting water reach groundwater.

The report concluded that operating was the primary focus and process safety did not get the attention, resources or priority it required. Lesson: an alarm you cannot trust is not a barrier. Test independent protection, record and fix every fault, and design containment for the worst case. Walk the depot in the Buncefield case study.

The common lessons: permits, maintenance, alarms and culture

Read side by side, the reports point to the same handful of failures. Use them as a checklist for your own site.

For a more recent example, the US Chemical Safety Board's investigation of the 2005 Texas City refinery explosion found that a tower was started up despite known problems with its level transmitter and high-level alarms, that earlier abnormal startups had not been investigated as near misses, and that most of the 15 people killed were in or around trailers placed within 150 feet of the blowdown drum and vent stack. It is covered in the Texas City case study.

When something does go wrong at your site, the same discipline applies at small scale: investigate to the root cause and fix it. See our guide to root cause analysis in incident investigation.