# Bhopal & Texas City MOC Autopsy: Root Cause Analysis, Normalization of Deviance & Process Safety Culture in API Facilities

The most destructive disasters in process safety history rarely result from a single sudden equipment breakdown. Instead, they stem from systemic organizational failures: unauthorized process modifications, unreviewed temporary bypasses, neglected maintenance backlogs, and the gradual Normalization of Deviance.

This technical autopsy analyzes the root cause mechanisms of two landmark industrial disasters—the 1984 Bhopal MIC Release and the 2005 BP Texas City Explosion—and translates their lessons into an actionable Management of Change (MOC), Pre-Startup Safety Review (PSSR), and Process Safety Culture framework for pharmaceutical API facilities.

# 1. Case Study 1: The Bhopal MIC Disaster (1984) & MOC Failure Mechanics

# 1.1 Incident Chronology & Process Setup

On 2-3 December 1984, over 40 metric tons of methyl isocyanate ($\text{MIC}$) gas leaked from Tank 610 at the Union Carbide plant in Bhopal, India, killing over 3,800 people immediately and causing permanent health injuries to over 500,000 citizens.

+----------------------------------------------------------------------------+
|                    BHOPAL DISASTER CASUALTY CHAIN                          |
|                                                                            |
| 1. Water Ingress into MIC Tank 610 (500 L Water)                           |
|                               |                                            |
| 2. Hydrolysis & Exothermic Polymerization Surge (T > 200°C, P > 4 bar)     |
|                               |                                            |
| 3. All 4 Installed Protective Barriers Inoperative / Bypassed              |
|    - Tank Refrigeration Unit (Chilled glycol) -------> Off-Line            |
|    - Caustic Scrubber Column (15% NaOH) -------------> Out of Service      |
|    - Vent Flare Stack -----------------------------> Line Blinded           |
|    - Water Curtain Spray System -------------------> Insufficient Height   |
|                               |                                            |
| 4. Catastrophic Release of 42 Tons MIC Gas into Bhopal Atmosphere          |
+----------------------------------------------------------------------------+

# 1.2 Unmanaged Operational Changes & Root Causes

1. Large Stored Inventory: Storing $42\text{ metric tons}$ of highly toxic, volatile $\text{MIC}$ ($\text{BP} = 39.1^\circ\text{C}$, $\text{IDLH} = 3.0\text{ ppm}$) in a single underground tank violated basic Inherently Safer Design (ISD minimization) principles.
2. Unreviewed Refrigeration Shutdown: Management shut down the Freon refrigeration system (designed to maintain $\text{MIC}$ at $0^\circ\text{C}$) to cut operating costs, allowing tank temperatures to hover at $20^\circ\text{C} - 24^\circ\text{C}$.
3. Bypassed Safety Layers: The vent gas scrubber was out of service for routine maintenance; the flare line had been disconnected for piping modification without a temporary bypass; and the water curtain lacked pressure to reach the relief stack.

# 2. Case Study 2: BP Texas City Explosion (2005) & Normalization of Deviance

# 2.1 Process Setup & Incident Sequence

On 23 March 2005, an explosion at the BP Texas City refinery killed 15 workers and injured 180 others during the restart of an Isomerization Raffinate Splitter unit.

[ Overfilling Raffinate Splitter (Fluid Height > 40 m) ]
                        |
                        v
[ High Level Alarm Ignored (Chattering Transmitter / Bypassed) ]
                        |
                        v
[ Liquid Hydrocarbon Overflows to Atmospheric Blowdown Drum ]
                        |
                        v
[ Geysering Geyser Spray Out Top of Stack & Vapor Cloud Ignited by Truck Engine ]

# 2.2 The Baker Panel Cultural Autopsy

The independent Baker Panel Investigation identified critical cultural and governance breakdowns that apply directly to API plant processing:

1. Confusing Personal Safety with Process Safety: BP leadership tracked low Lost Time Injury Frequencies ($\text{LTIF}$) and declared the site "safe," while latent process safety risks (corroded pipes, non-functional instruments, overdue PHA action items) escalated unchecked.
2. Normalization of Deviance: Overfilling the splitter tower during startup had occurred on 4 prior occasions. Operators accepted high level alarms as "normal behavior" rather than a dangerous process deviation.
3. EEMUA 191 Alarm Flooding: Operators received over 1,200 alarms per day (averaging 1 alarm every 70 seconds), leading to alarm fatigue and ignoring critical high-level trips.

# 3. The 8-Stage Management of Change (MOC) Workflow

API facilities must enforce a strict stage-gate MOC workflow for all hardware, chemical, procedural, software, and organizational changes:

[1. Initiate Change Request] ──> [2. Multidisciplinary Hazard Review] ──> [3. Technical Approvals] ──> [4. Implementation]
                                                                                                               │
[8. Post-Startup Review] <── [7. Close-Out & Records] <── [6. Pre-Startup Safety Review (PSSR)] <── [5. SOP & Training Update]

# 3.1 The 8 Workflow Stages

1. Initiation: Document proposed change, technical rationale, and temporary vs. permanent designation.
2. Multidisciplinary Hazard Assessment: Evaluate impact on HAZOP, P&ID, relief valve capacity, ATEX zoning, and GMP validation status.
3. Formal Technical Approvals: Sign-off from Process Safety Lead, Engineering Manager, Production Head, and QA.
4. Physical Implementation: Execute modification strictly per approved engineering drawings.
5. Documentation & SOP Update: Issue revised redlined P&IDs, standard operating procedures, and execute operator training.
6. Pre-Startup Safety Review (PSSR): Field physical audit confirming construction matches approved design.
7. System Close-Out: Verify all action items are completed and temporary bypasses removed.
8. Post-Implementation Review: Audit process performance after 90 days of operation.

# 4. Pre-Startup Safety Review (PSSR) 12-Point Audit Checklist

Before introducing hazardous chemicals into any new or modified API process train, the PSSR team must physically verify:

• 1. P&ID Alignment: As-built field installation matches approved redlined P&IDs.
• 2. Pressure Testing: Hydrostatic or pneumatic pressure test certificates complete for all lines.
• 3. Relief Sizing Verification: Relief valves ($\text{PSV}$) installed match calculation datasheets.
• 4. Electrical Grounding: Resistance to ground $R_g < 10\Omega$ verified on all vessels and piping.
• 5. Instrument Calibration: Temperature, pressure, level transmitters calibrated ($4-20\text{ mA}$).
• 6. Interlock Proof-Testing: SIS safety trips (1oo2 / 2oo3 loops) function-tested end-to-end.
• 7. MOC Sign-Off: All technical action items from MOC review closed out.
• 8. Materials of Construction: Positive Material Identification ($\text{PMI}$) verified for Hastelloy/GLR.
• 9. Utility Commissioning: Nitrogen purge, cooling water, chilled brine, steam online and leak-free.
• 10. SOP Availability: Approved operating instructions available in control room.
• 11. Personnel Training: Shift operators and maintenance techs trained and logged.
• 12. Emergency Readiness: Safety showers, SCBA sets, and gas detectors operational.

# 5. Leading vs. Lagging Process Safety Metrics (CCPS / API RP 754)

# 6. Applicable Engineering Standards & Codes

• CCPS Guidelines for Management of Change: Center for Chemical Process Safety.
• API RP 754: Process Safety Performance Indicators for the Refining and Petrochemical Industries.
• OSHA 29 CFR 1910.119(l) & (k): Management of Change & Pre-Startup Safety Review.
• EEMUA Publication 191: Alarm Systems - A Guide to Design, Management and Procurement.

# Historical Background & Foundation

# Management of Change (MOC) in Pharma: Why It Fails and How to Prevent It

One of the leading causes of industrial process safety incidents is the failure of the Management of Change (MOC) process. Modifications to piping, instrumentation, software control logic, or operating conditions can introduce unforeseen hazards if not systematically reviewed before execution.

In this guide, we review the critical failure mechanisms of MOC systems on chemical and pharmaceutical sites, establish the structural requirements for a robust process design review, and trace a detailed case study of a P&ID change comparison.

# 1. P&ID Modification: Existing vs. Proposed Review

A classic MOC requirement occurs when modifying existing piping configurations to add safety layers. For example, when adding a new Safety Instrumented System (SIS) shutdown valve to prevent runaway reactions, engineers must markup the changes on the P&ID for review.

Below, we contrast the existing configuration against the proposed P&ID modification markup (encircled in the modification cloud):

# 2. Why MOC Fails: The Root Causes

• The "Replacement in Kind" Trap: Engineers often bypass MOC reviews by claiming a change is a "replacement in kind." For instance, replacing a carbon steel pipe with stainless steel (MOC change) or changing a valve trim (altering Cv) are not replacements in kind and must undergo MOC review.
• Software Logic Bypasses: Making quick code edits to PLC/DCS interlocks during startup bypasses safety layers without hazard review.
• Missing P&ID Updates: Failing to mark modifications on P&IDs, leaving operators and maintenance staff with outdated information.
• Lack of Training: Executing a mechanical modification without training the operators on how the new interlocks or valve alignments change their standard operating procedures (SOPs).

# 3. The 5-Step MOC Review Workflow

A robust MOC process must proceed through these critical gates:

1. Initiation: Define the change, the technical justification, and whether it is a replacement in kind.
2. Multidisciplinary Review: Evaluate safety impacts across Process, Safety, Piping, Electrical, and Automation disciplines. Focus on wetted materials compatibility, relief valve load additions, and electrical classification.
3. Pre-Commissioning Audit: Verify that all piping hydrotests, instrument loop checks, and P&ID updates are completed.
4. Training & Documentation: Train operators on the new process steps and update standard operating procedures (SOPs) and maintenance logs.
5. PSSR & Closeout: Complete the Pre-Startup Safety Review checklist before introducing chemicals.

# 4. Case Study: Safety Valve Modification on a Batch Reactor

# Existing Design:

A bulk pharmaceutical intermediate reactor used a single control valve (TCV-101) to regulate the flow of highly exothermic reagent. Over time, the valve trim suffered from stiction, eventually sticking fully open during a batch, which resulted in a near-miss runaway. The plant manager requested the immediate installation of an automated safety shutdown valve.

# The MOC Process:

Because this was not a replacement in kind, an MOC review was initiated. The process safety team performed a hazard review on the proposed changes shown in Figure 3.2:

1. Piping Review: The addition of the solenoid valve (XV-101) increased piping line weight. Stress analysis required adding secondary piping supports to the line to prevent stress cracks under thermal cycling.
2. Safety Review: The valve was specified as Fail-Closed (FC). This ensures that if the facility loses power or instrument air, the valve shuts by spring force, immediately terminating reagent dosing and keeping the reactor in a safe state.
3. Instrument & Electrical Review: The solenoid coil was specified with an Ex-d flameproof junction box to comply with the Zone 1 hazardous area classification of the suite.
4. Verification: All operators completed training on the new interlock bypass keys, and the redlined P&IDs were updated in the site document repository before Gate C (Ready-For-Startup) sign-off.

# 5. Reference Standards Used

• OSHA 29 CFR 1910.119 (l): Management of Change element.
• CCPS Guidelines for the Management of Change for Process Safety: Center for Chemical Process Safety.
• ISA-84.00.01: Safety Instrumented Systems Management of Change.

# Applicable Engineering Standards & Codes Used

The engineering methodologies, design correlations, and safety criteria detailed in this article adhere to the following international standards and industry codes:

• ASME Boiler and Pressure Vessel Code (BPVC) Section VIII Division 1 & 2: ASME Boiler and Pressure Vessel Code (BPVC) Section VIII Division 1 & 2
• API 620 & API 650: Welded Tanks for Oil, Chemical and Liquid Storage
• TEMA Class R, C & B: Tubular Exchanger Manufacturers Association Standards
• DIN EN 13445: Unfired Pressure Vessels European Standard
• IS 2825: Code for Unfired Pressure Vessels (Bureau of Indian Standards)