Failure Knowledge Database - 100 Selected Cases

Explosion of Chemical Plant in Seveso, Italy【July 10, 1976

Seveso, Italy】

Mitsuo Kobayashi (Graduate School of New Frontier Sciences, University of Tokyo).
Masamitsu Tamura (Graduate School of New Frontier Sciences, University of Tokyo)

At about 12:37 on S aturday July 10th, 1976, a runaway reacti

on occurred a t achemical plant manufacturing 2,4 ,5-trichlorophenol sodium salt by al kaline hydrolysisof tetrachlorobenzene in the suburbs of Milan in the northern part of Italy.

The pressure rise caused by the ru naway reaction de stroyed the rupture disk, andthe contents were discharged into the atmosphere, forming a mushroom-like cloud. The
mushroom cloud diffused to the sou th by the no rth wind that was blowing at the time,and it contaminated a vast area of a bout 1800 hectares. It is thought that 30 to 40kg of
2,3,7,8-tetrachlorodibenzo para dioxin (TCDD), a deadly poison, was contained in thismushroom cloud. The toxicity of TC DD is about 100000 tim es that of sodium cyanide.

1

Failure Knowledge Database - 100 Selected Cases

For several days, no cou ntermeasures were taken towards the leaked material, w hichfell down to the ground as a white crystal

and was left as it was. As a result, in

addition to the contamination of the 1800 hectares of land, victims of diseases such as
cancer, chronic dermatitis, neuropathy, and deformed babies were estimated to be over
220,000, and over 80,000 do mestic animals were killed. Th e abortion rate of pregnant
women in the Seveso district from April to June in the following year reached 34%. The
contaminated soil was buried underground in two large newly dug holes. The volume ofone of them was 150,00 0m3 and that of the ot her was a half. The h oles we re t hen
enclosed by p olyethylene she et and cove red wi th non-cont aminated soil. Finally , t hehole was covered with a 1 m thick layer of concrete, thus it was sealed completely.
The acciden t was caus ed by just a small

violation of op eration inst ruction. The

existence of a runaway reaction at a lower temperature than the expected temperature
was a major cause of the accident. It was not known atreaction cou ld occur at such a lowthat time that a runaway

temperature. Th ere had been over 14 exp losion

accidents related to TCDD caused by TCP (2,4,5-trichlorophenol) manufacturing plantsof the same product, and each accid ent caused enormous damage to h uman health. It
was already known at t he time tha t usually slight amount s of TCDD were f ormed i n
the reaction.
The damage of the accident was ext ensive, and there appear to b e three points that
led to the t errible d isaster. Th e fir st p oint is that the op erators d id not obser ve t hestandard operation method. Th e se cond p oint is that the reacto r wa s constru cted
without any knowledge of the possibility of a runaway reaction, so no countermeasuresfor preventing an abnormal temperature rise were taken. Furthermore, in the design ofthe safety equipment, no consideration was given to the protection of the environment.
The third p oint is that the re commendation and later the order fo r ev acuation of thelocal inhabitants were delayed. The identifi cation of th e leakage material was carriedout by Givaudan Co., the parent company . It took the company five days to recognize
the existence of d ioxin, and furt hermore, as thec ompany sp ent more ti me onreconfirmation, they d id not inf orm th e l ocal gov ernment of the exi stence of d ioxin
until 10 days after the accident. As a result, the damage greatly increased.
As a result of this accid ent, th e E C es tablished the EC Governing Boa rd Directive(called the Seveso Directive) in 1982, which is intended to prevent
industrial activities from occurring as

major accidents inwell as to minimiz e th e d amages to hu man

health and to the environment.
Rupture d isk: a board shap ed p ressure r elief d evice that i s mount ed on the v essel

2

Failure Knowledge Database - 100 Selected Cases

directly or through the piping.
1.

Event
The leakage accident occurred just before noon on July 10th, 1976. The rupture diskof the r eactor is d esigned to rup ture when th e pressure increases due to uncontrolled
reaction and so on, s o that the leak age was a planned phenomenon. However, a large
amount of dioxin TCDD, a deadly poison, wa s contained in the leaked material, whichcaused larg e-scale h ealth d amage and envi ronmental poll ution, because the material
was spread widely by the wind. The plant managers were not aware of the existence of
TCDD in th e material, so the countermeasures were delayed and the h ealth damages
were increased.

The accident occurred at a pl ant of a sm all chemical factory , Icmesa Co., in theSeveso district, the suburbs of Milan, Italy . This company is a subsidiary of the Sw iss
company Givaudan Co., and Givaudan Co. is a subsidiary of the well-known chemicalmanufacturing enterprise Hoffmann-La Roch e & Co . A.G. . Th e plant of Icm esa Co.
produced 2,4,5-trichloro phenol (TC P). TC P is then p rocessed for p roducing p roducts
such as m edicated soap , c osmetics, and sha mpoos. Th e main reacti on for mula of theprocess of p roduction method that was d eveloped by Givaud an is shown in Fig. 2. At
the time, i t was thought that t

he reaction did no t ge nerate any pro blems attemperatures of 200 ℃ or less; however , the poisonou s dioxi n TCDD wa s formed at atemperature of 230 ℃ by the reacti on shown in Fig.3. A maximum of 1 0 ppm of TC DD
is generated in the reac tion p rocess, but it is not clear wh ether the fac tory m embers
were aware of this fact.
Removal of a solvent after the reaction was performed successively in a reactor with athermal ja cket andan agitator. A ccording to the op eration instructi ons,

tetrachlorobenzene is generally heated to between 135 and 160℃. A hydrolysis reactionof the tetrachlorobenzene with a sodium hydroxide solution is carried out. Then xylene
is added, an d the generate d water is separated by azeotropi c distillation at 160 ℃. The
remaining xylene is separated by distillation, and finally, the solvent ethylene glycol is

3

Failure Knowledge Database - 100 Selected Cases

recovered t o 50% by

reduced-pressure distillation. In

addition, the operation isterminated by cooling the product down to b etween 50 and 60 ℃ by adding wate r. The
processing o peration after th ese st eps is not clear. In a c ertain report, i t is desc ribedthat the r emains wer e co oled with jacket water feeding and agitation if the remai ns
were left in the bottom of the reactor.
In the operation of the batch that was invo lved in the accident, the fi nal ethylene
glycol separation of the distillat ion process did not reach the design ated recovery rateof 50%; instead the operator stopped the process after the recovery of only about 15 %.
Furthermore, the ad dition of water f or co oling the product was not carriedout.

Therefore, the final t emperature of the product was 158℃, which is much higher than
the normal range of 50 to 60℃. However, this temperature is still considerably lower
than the dangerous temperatureof 230 ℃. After th e op erator finishe d the s eries ofreactions, he stopped the agitation and cooling process, turned off the power supply of
the temperature recorder, and left t he site. After that, the plant was no long er in t hecondition of being monitored.
The rup ture d isk of the reacto r op erated at 12:37, and the contents of

the reactor

became a foggy mushroom cloud, which was spread out and diffused to the south by thewind, resulting in the pollution of an area of about 1800 hectares.
2.

Course2.1. Operation course leading to the leakage
At 16:00 on Friday July 9th, the batch reacti on which caused the accident started. At
04:45 in the early morning of the next day , the reaction an d distill ation processes forthe batch finished, and heating of the batch w as ter minated by stop ping the flow ofsteam. N ext, the agitation of thereactor was stop ped, the pressure wa s return ed toatmospheric pressure, and then th e operator went home. After that, th ere was n obody
at the plant.
The rupture disk of the reactor suddenly operated at 12:37, and the rea ctor contents
began to leak.
2.2. Course after the leakage
On July 10th, the technical manager of th e fact ory warn ed the lo cal r esidents that
“TCP has leaked from the plant. The leaked material has a strong odor, but it does notcause any actual harm. However, it would be b etter not to eat any pro duce from yourgarden until the results of an accurate analysis are obtained”.
On Monday July 12th, the first signs of he alth hazard appeared, and by July 14th,

4

Failure Knowledge Database - 100 Selected Cases

the local hospitals were flooded with patients. However, because the cause of the healthproblems was unknown, the doctors were unable to treat the patients.
On Thursday July 15th, the laboratory in the parent company, Givaudan Co., found ahigh concentration of TCDD in the leaked material, but th ey did n ot a nnounce th eir
findings to anyone outs ide the company , including the l ocal government until thelaboratory reconfirmed the existence of TCDD on Tuesday July 20th.
On Saturday July 24th, a local government officer ordered a co mpulsory evacuationfrom the A area where the pollution was most severe (Fig.1). On Tuesday July 29th, thelocal government expanded the evacuation area (the A area).
3. Ca use
Violation of instruction became a tr igger of the accident, the rup ture d isk op erated,
and the content fluid l eaked fr om the r eactor. It was not known w hat was in thematerial that had leaked, so after the leakage, nothing was done to improve t

hesituation. Furthermore, even after t he laboratory of Givaudan C o. found the TC DD in
the leaked material, they did not notify the local government of the existence of TCDD
until they reconfirmed it. Ther efore, the initial c ountermeasures were greatly delayed,
resulting in a large expansion of the damage.
3.1. Cause of operation of the rupture disk and leakage of contentsa) The t rigger of th e acci dent was theoccurrence of a r unaway reaction. It wasthought that the runaw ay reaction would not occur at a temperature less than

230℃ and so the conditions of the reactor were believed to be safe, b ecause th e
operator st opped the operation a t 158 ℃ . However , it was found in research
conducted later that an exothermic reaction actually occurred at temp eratures as
low as 180 ℃. What could have caused the re actor to r ise to 180℃? One possibility
is the following. The operator stopped the agitation wh en he stopped the operation
at 158℃. The reactor heating jacket was heated by superheated steam of 1.2MPaG,
190℃. The supply valve of the steam was cl osed when th e operation was stop ped.
However, the superheated steam r emaining in the jacket would have continued toheat the liquid near the jacket surf ace and could have caus ed the temperature to
rise to over 180℃ locally. The st opping of the agitation also made to the local

temperature rise. A n e xothermic reaction began in the liquid that was heated toover 180 ℃ and expanded throughout the reac

tor. How ever, the v olume of thejacket was very small, so it was questi onable if there was enough steam remaining
in the jacket to heat

the liquidmaterial to 180 ℃ . According

5

to the"LossFailure Knowledge Database - 100 Selected Cases

Prevention in the Process Ind ustries (2nd E dition) Appendix 3 Seves o", tu rbine
exhaust was used for t he jack et st ream. Wh en the turbin e load d rops, the st eam
temperature can reach 300℃. Th erefore, th e t emperature o f the tu rbine exhaust
fluctuates with the turbine l oad, and it is necessary to take measures to maintainthe t emperature at a c onstant value wh en tu rbine exhaus t is us ed in a p rocessapplication. Jud ged fro m th e d escription of L oss P revention, th e d esign of t hesteam was mistaken. I n ad dition, because the agitation was stopped, the liquidmaterial cl ose t o th e w all surface was easily heated. No one notic ed the h eating,because th e ther mometer was tur ned off. Th e op erator operated th e p rocess
without sufficient care, resulting in a

deviation from th e stand ard op eration

method. It i s thought t hat the combination of this d eviation fr om the stand ard
operation m ethod with the p rocess d esign error of th e st eam sup ply led t o th e
accident.
b) The safety device was inadequate. The rupture disk was mounted as a pressure risecountermeasure of the re actor. Also, the pr essure of the rupture disk ha d been set
by factors f or other operations, an d the p ressure setting was too hig h for the
runaway reaction that caused this acci dent. Therefore, th e p rocess t emperaturerose, and the for mation of d ioxin increased . To make matters wors e, the leakedmaterial was d ischarged into the atmosp here f rom th e rap ture d isk. O n gene ral
principles, the outl et of a p ressure relief d evice, such as a rupture d isk or oth er
safety valves, sh ould be direct ed to a safe place . If po ssible, it is desirable thatdischarge is d ischarged only after the combustion treat ment or detoxification
treatment.
c) The related companies d id not refer to the other accidents that had occur red before
this accident. There were at least fourteen similar accidents at TCP manufacturing
plants. The d amage to the co mpany’s employee from the deadly poison TCDD was
extensive, a nd it is thought thatthe contrav ention of i nstructions might nothappen either, if study and education had been conducted more seriously. Anothercause is considered to be overlooked the possi bility that an exothermi c reaction
could occur at a temperature of less than 230 ℃. Even though the possi bility was
only confirmed in research conducted later, it is still a problem.

6

Failure Knowledge Database - 100 Selected Cases

3.2. Cause of expansion of damage
Icmesa Co., which caused th e a ccident, did not have the f acilities req uired for theidentification of the leakage material, so it was identified in the laboratory of Givaudan
with the help of Hoffmann-La Roche & Co. A.G. Co., which was the parent company ofthe parent company of Icmesa. The existence of a large amount of dioxin in the leakage
material was confirm ed by the first sample

from the Icmesa plant, bu t they did n ot

notify the l ocal g overnment of th e findings, because th ey wanted t o confirm t hepolluted range and quantity of TCDD. The quantity of dioxin in the samples whichwere s ent s uccessively did not decr ease 10 days after the accident. Fu rthermore, t hepresence of TC DD was proven by o ther exp eriments. At last they notified the local
government, resulting in the evacuation. Although the reason for the information delay
was concern for an unn ecessary panic, the delay caused a great exp ansion of d amage.
From the beginning, the company ca using the accident was not aware of the existenceof the TC DD; it re cognized only th e leakage of TC P. A s the accid ent h appened at theweekend, th e co mpany could not e stablish an effective system for dea ling with t heaccident.

7

Failure Knowledge Database - 100 Selected Cases

4.

Process of cause elucidation
It had already been proven at the timethat a runaway reaction occurs over 230 ℃,

and that one m olecule of TC DD is formed fr om two m olecules of TCP s odium by th eremoval of t wo m olecules of sod ium chlorid e w hen th e r eaction te mperature exceeds
200℃. It had also been proven that there is TCP sodium salt that is an intermediate of
the TCP manufacturing process in the liquid when the distillation stops. Therefore, thekey to the elucidatio n of the cause was to show why the te mperature increased over
230℃.
After the accident, two Italian chemists prepared sodium of TCP. They analyzed thechemical system bythermogravimetric an alysis (TG) and differential scanningcalorimetry (DSC), and they found that a weak exothermic reaction might be caused attemperatures of 180 to 200 ℃. Furt hermore, th ey found th at an exoth ermic reacti on
could occur even at 180 ℃ by isothermal thermal analysis. In addition, they measured
the time require d to ge nerate an explosion by ARC (Acc elerating Rate Calo rimeter)
analysis. The results were as follow s: a little longer than eight hours at 180 ℃, a little
shorter tha n eight hours at 190 ℃ and about five hours

at 200 ℃. In short , it wasproven that a runaway reaction can be cause at the temp erature of 180 ℃, thoug h it
had been thought b efore the accident that a runaway reaction cannot be caused at thetemperatures lower than 230℃.
Note; TG, D SC and isothermal th ermal an alysis are methods for meas uring whatkind of exo thermic be havior oc curs in thechemicals. A RC is a methodformeasuring whether or not the ch emical causes a runaway reaction by measuring
the rate of temp erature change. Th ey are generally called “thermal a nalysis”,
which incl ude themethods a nd d evices for analyzing the temperaturedependency of dangerous reactions of chemicals.
The reason that the reactor reached 180℃ is described in the “ Causes” section.
5. Immediate Action
Since the ac cident itself was only t hat "the ru pture d isk o perated and leaked ", an dsince there was not an operator at the site, any immediate action was not taken. Somemaintenance staff wh o heard the s ound of the rup ture d isk op eration ran to th e s ite
and injected the cooling water into the jacket, but they could not stop the rupture disk
operation. T he only action was that the t echnical manager of the facto ry warned th e
local residents that “TCP has leaked from th e plant. It would be better not t o eat any
produce from your garden”.

8Failure Knowledge Database - 100 Selected Cases

6. Countermeasure
There are many reports and articles that refer to the Sev eso Directive and the Basel
Convention entitled “C onvention on the C

ontrol of T ransboundary Move ment ofHazardous Waste and Th eir Disp osal”. B ut he re, inst ead of the famous t wo
declarations, countermeasures to prevent a re currence of the accident will be discussed
below.
a) The u nderstanding of the p rocess should b e d eepened. In p articular, thr oughimproved in vestigation and researc h on a reac tion, kn owledge of th e abnormal
reaction mechanisms w ill be satisfactory . Besides, it is necessary that not only
“in-house” i nformation but also inform ation f rom other companies and fromexperts of other fields related to similar reactions will be used.
b) The material that is formed as a by-product or as a prod uct of an abnormal

reaction ma y be a high ly toxic ch emical comp ound includ ing el ements such as
nitrogen, su lfur, o r p hosphorus, even if th e main p roduct of th e p rocess is n ot
toxic. It is necessary to be careful about all of the materials that may be formed in
the process including the products of abnormal reactions.
c) The d irection of the e mitted gas from p ressure rel ease devices such a s a safetyvalve and a cap acity of p rocessing devices should be careful ly considered. Safet ydevices such as safety valves or rupture disks are the devices for discha rging thecontents of a vessel so t hat the vess el and piping will not be destroyed when thepressure ris es over a particular design value. However, if the discharged gas
causes harmful effects on humans and the su rrounding environment, then th esafety device has no mean ing. Suff icient processing methods and a processing
capacity for ensuring th at the discharged material does not cause bad effects onhumans and the environment are necessary. At least, a flare stack, absorber, andother basic devices should be equipped with a suitable capacity.
d) Operations that deviate from the standard operation method should not be done.
Accidents often occur when some changes are made to the operation method. The
operation method instructions are often made under the principle of “safety first”,
even if all of the possibilities which migh t occur could not be considered. It isdangerous to change th e operation procedure without caref ul consideration, andsufficiently prudent investigations and study will be necessary if a change ismade.
e) Th e rela ted companies sh ould establish a cooperative system with the l ocal
government and neigh borhood inhabitant s for the notification of

9potential

Failure Knowledge Database - 100 Selected Cases

danger and the recommended countermeasures.
7. Knowledgea) Ideally, a chemical p lant should be d esigned and the op eration manual s hould
be prepared after all of the reactions that occur in the reactor and vessels areclarified. However , in reality the knowledge may no t be pe rfect, and so me
unknown parts may remain. Investig ation and study for collecting information
should be made during designing and oper ating, the results should be reflectedin the operation and equipment. Besides, instructed technical details must not
be changed thoughtlessly.
b) The enterprise that sold the t echnology may b e responsible to some extent forthe safety of the plant which is cons tructed and op erated d epending on th etechnology. In particular , if theplant owner is a subsidiary or acompany t hat has less capital and a low
responsibility of the parent ent

ffiliated

er t echnical level , it is theerprise to ca rry out sufficient information

services and guidance required to avoid an accident.
c) The local administration must recognize the potential area of contamination on
the assumption that a catastrophe happens, make a plan for the evacuation of
the local inhabitants, and prepare fac ilities for medical treatment beforehand,when there are facilities that handle

toxic substances in the regi on. The

enterprise must act positively to f urnish information to public and cooperatewith the local administration.
d) There is a l arge p ossibility that a mistake in the t emperature cont rol of thesteam can o ccur. Although the imp ortance of th e p rocess d esign is ap t to beneglected, neglect of the process design can result in a large catastrophe.
8. Influence of Failure
Although there were no immediate deaths, many people were affected by the leakedmaterial for a long time after the

leakage accident. Th e v ictims of di seases such as

cancer, chronic dermatitis, neuropathy , and the birth of deformed babies have been
estimated as over 220,000 people. A n abortion rate of pregnant women between April
and June of the next year reached 34%. The results of investigation that was continued
over ten years after th e accident showed the higher mortality and morbi dity rate th anthat in another area.
The soil-polluted area was about 18 00 hectare. Contaminated soil was removed, thensoil dressing was done with10

new topsoil. The contamina ted soil was buried in aFailure Knowledge Database - 100 Selected Cases

150000m3 large newly

dug hole and a half-si

zed hole, the holes wereenclosed bypolyethylene sh eet, and the hol es w ere c overed with non-contaminated soil and a 1 m
layer of concrete. Over 80,000 domestic animals were killed.
Considering the enormity of thedamage, in June 1982 the EC issued an EC

governing board order, what is call ed “Seveso Directive”. The directive was revise d in1987 and 1 988. The EC put thisorder out in ord er to prevent major accidents by

manufacturing activities as well as to reduce the bad effects on the environment. Later,
the United Nations p roposed the Basel C onvention, whi ch forbid s the transfer ofhazardous wastes between countries and th e d isposal o f wastes in South Pol e. The
Basel Convention was adopted by all 116 nations that participated in the conference in
1989.
References*Ikuo Fukuyama, “Seveso accident afterwards”, Yobo Jiho, 176,19-25(1994)*Ikuo Fukuyama, “Leakage accident of dioxin in Seveso, Italy”, “Important industrial
accident of the world”, p40-43,84-85(1993), Ja

pan Loss

Insurance

Association(1993)*Ikuo Fukuyama, “Seveso Accident”, SE series Learn from accidents, p10-13, Safety
Engineering(1987)*Yoichi U ehara. T erushige Ogawa, “T echnical Hand book for Fi re an d E xplosion
Protection”, p 8-11, Techunosisutemu(1998)*Yoichi Uehara, “Cause of the Seveso accident”, J.Japan Soc.for Safety Engineering,26, 340-345(1987)*Environmental impact sanitation. Chemical industry of the world. p 55-58 (1976)*Frank P. Lees, ” Loss Prevention in the Pr ocess industries 2nd Ed ”,
Seveso. Butterworth-Heinemann(1996)

11

Appendix 3.