Industrial Accidents 2.1 Accidents
2.4 The Importance of Accidents
2.4.1 Seveso disaster
The Seveso incident is among the most tragic of known industrial incidents. The level of the recorded consequences was so significant and shocking as to radically change the approach to process safety within the industrial community, promoting the birth of specific European regulations, currently known as “Seveso directives”.
On Saturday 10 July 1976, in a chemical plant near the town of Seveso, near Milan, a bursting disc on a chemical batch reactor ruptured. The plant produced 2,4,5 trichlorophenol (TCP) (a product used to make herbicide) from 1,2,4,5 tetrachlorobenzene and caustic soda, in the presence of ethylene glycol. Dioxin (2,3,7,8 tetrachlorodibenzodioxin or TCDD) is not normally formed (except in negligible amounts). But that day the reactor got too hot and a runaway reaction occurred.
The reason why the reactor became too hot is now explained. Italian Law required the plant to shut down for the weekend, regardless of the possibility of being in the middle of a batch. This is what happened at the weekend of the incident, when the reaction mixture was at 158°C (the temperature at which the exothermic uncontrolled reaction was believed possible is 230°C). Regardless of the chemical concepts related to that specific process, it is now known that the exothermic
reaction can start at 180°C, proceeding slowly at this stage. The reactor was heated by an external steam coil, where the steam was provided at a temperature of 190°C. Because of the interruption to operation for the weekend, the turbine, from which exhausted steam was taken to feed the steam coil, was on a reduced load. The
consequence was a temperature of the exhaust steam of about 300°C.
Obviously, the temperature of the liquid inside the reactor could not be greater than its boiling point at the operating pressure (about 160°C). This caused the following temperatures at the Seveso reactor (Figure 2.31):
Below the liquid level: gradient of temperature with 300°C outside the reactor wall and 160°C inside; and
above the liquid level: the wall was at 300°C.
Figure 2.31 Temperatures at the Seveso reactor.
Source: Adapted from [35]. Reproduced with permission.
Once the steam was isolated, the part of the wall reactor below the liquid level was in touch with the cooler liquid inside, while the part above the liquid level remained hotter. Thanks to radiation, the heat was transferred from the upper wall to the surface of the liquid. In 15
minutes the temperature of the liquid rose to 180–190°C, triggering a slow exothermic reaction. A runaway reaction occurred then after about seven hours.
The runaway would not have occurred if:
Italian laws left sufficient autonomy to the company management to complete the batch, having the weekend provision;
the batch was not stopped at an unusual stage; and
a HAZOP (a hazard identification technique further discussed in this book) had been conducted and a “more temperature” deviation had been analysed.
As a consequence of the runaway, dioxin formed and pressure rose resulting in the bursting of the rupture disc. The plant did not have a catchpot where to collect the discharge of the reactor, therefore about 6 tons, including about 1 kg of dioxin, were released over the
surrounding area [37]. The emission was limited thanks to a foreman who opened the cooling water supply to the reactor coils, alerted by the noise of the vent. The dense white cloud dispersed in the
atmosphere, reaching considerable altitude. The release lasted for twenty minutes about, and during the next days the lack of
communication between the company and the authorities, called to manage this type of situation, leaded to much confusion. No human victims of dioxin were registered, even if many people fell ill (250 people developed the skin disease chloracne and about 450 suffered bursts by caustic soda). Moreover, 26 pregnant had abortions
attributable to the toxic substance and thousands of animals, living in the contaminated area (17 km2 contaminated and about 4 km2
declared uninhabitable – see Figure 2.32), died while others were slaughtered to avoid the ingress of dioxin inside the food chain.
Figure 2.32 A photograph of the signs used to forbid access into the infected areas in Seveso.
The incident investigation showed a series of failing in technical measures [38]:
Operating procedures. The production process was interrupted, but without any agitation or cooling. This caused the reactants to continue their reaction. Also, according to the plant procedures, the charge was acidified after the distillation, reversing the original sequence prescribed by the original method of distillation patent;
Relief/Vent systems. The rupture of the bursting disc was set at an excessive pressure (3.5 bar). With a lower pressure set, venting would have occurred at a less hazardous temperature;
Control Systems. The overall system for monitoring fundamental parameters and providing automatic control was inadequate;
Reaction/Product Testing. The awareness of the company about the thermal stability of the reaction was only partial;
Design Codes – Plant. There was no individual protection layer to destroy, or at least collect, the toxic material once vented;
Secondary Containment. No secondary receiver was installed to recover the toxic materials, in contrast to the bursting disc
manufacturer recommendations; and
Emergency Response/Spill Control. Information about the hazards associated with the toxic materials was not provided by the
company. Moreover, the communication between the company and the local authorities to manage the emergency was poor.
Following this incident, the European authorities promoted the Seveso directive to prevent similar accidents. As reminded by [1], the Seveso Directive III came into authority in 2012 and its objective is the
control of major accident hazards involving dangerous substances.
With respect to Seveso II, Seveso III introduces the Safety
Management System (SMS), as a new tool to be included in a Major Accident Prevention Policy. In particular, the SMS should deal with the following issues:
Organization and personnel (responsibilities and training);
hazard identification;
operational control (adoption of procedures);
Management Of Change (MOC);
emergency planning;
monitoring performance, with process safety performance indicators (see Paragraph 2.5); and
audit and review.
Therefore, the safety report has to demonstrate that SMS has been put into effect and measures taken to have an acceptable risk. The
effectiveness of the Seveso Directive has also been evaluated and a positive contribution to improve the safety levels has been recorded, without affecting the competitiveness of European companies.
Despite the severity of the incident, the real cause of the accident still remains partially remains undetected and different mechanism
hypotheses were proposed. Because of these doubts, the Seveso incident can be seen as a “black swan” incident [39], having the
following three peculiarities: it was not expected; it had an extremely high impact; it has been explained and predictable after its occurrence.
The interested reader may find additional information in [39], where the incident is further analysed with three different methods.
In Figure 2.33, a simplified conceptual Bow Tie of Seveso incident is shown. The Bow Tie technique is discussed in Chapter . At this stage, it is sufficient to say that it is a method to graphically collect the causes, including the failed preventing safeguards, on the left side; the main event at the centre; the failed protecting safeguards on the right side together with the resulting consequences.
Figure 2.33 Simplified conceptual Bow Tie of Seveso incident.
Source: Adapted from [39]. Reproduced with permission.