Failure of water pumps caused a chain reaction of higher and higher temperatures and some radioactive gas began to escape into the surrounding area.

The worst accident in the history of U.S. commercial nuclear power generation occurred at 4:00 A.M. on March 28, 1979. It happened at the Three Mile Island installation near Middleton, Pennsylvania, when the plant experienced a failure in the nonnuclear section. The two main water pumps stopped running and a chain reaction followed. Before long radioactive gas escaped into the surrounding area and the governor of Pennsylvania ordered preschool children and pregnant women to stay away from an area within five miles of the nuclear installation.

There are dozens of nuclear power plants operating in the United States, providing electrical power to more than half of the nation’s states. An accident in any one of them sends alarms across the country. Hence, when something went wrong with the installation at Three Mile Island in Pennsylvania in March of 1979 it cast a shadow on every nuclear plant in the rest of the country. The companies that operate these plants knew that these power generators have backup systems to cope with accidents and they also knew that if these systems failed there could be a serious tragedy. The Three Mile Island event was what one expert called a common mode accident. By that he meant an event that bypasses all the backup systems either because of its rarity or because an operator interferes with the safety systems by disconnecting them.

The basic rule in nuclear generators is to have duplicate safety systems for all the important operations so that failure of one will not cause irreparable damage before repairs can be done. These duplicate systems were installed in the Three Mile Island plant but because nuclear power generators were still relatively new at the time not every eventuality was provided for. The heart of the power generator is the fuel cell that is heated by nuclear fission. This heat is used to generate electricity. However, the heat generated by the fuel cell can rise to uncontrollable levels if it is not kept at a safe level and cooling water is the agent that regulates this temperature. A common-mode accident would be an event that cuts off the supply of cooling water. None of all the other safety systems matter if this were to happen; the power plant would be out of control.

The fundamental weakness that gave rise to the common-mode accident at Three Mile Island was the competence of the plant workers. These maintenance people who looked after the installation day and night were well trained for keeping everything in good order, for conducting routine adjustments and repairs on equipment, and for reporting anything that was abnormal. They had spent a year in a training course. Some of them had previous experience on nuclear-powered submarines. They were not qualified nuclear engineers and they had no training for coping with complex emergencies, nor were they supposed to. The automatic systems were designed for these emergencies but, as it turned out, they could not anticipate every eventuality.

The pipes that provide water to the fuel cells have to be cleaned periodically to remove impurities and the workers had been attending to this for some time when one of the pipes became blocked. While trying to clear the pipe, one man accidentally cut off the main flow of water to the fuel cells and, true to form, the power plant shut down. The workers heard some loud noises that confirmed it. This happened around 4:00 A.M. on March 28, 1979. Within a few seconds of the shutdown emergency, water supplies would normally have gone into operation just as the designers had planned and the plant would be ready to start up again. This was the theory and, indeed, all the systems seemed to work as intended, except that a pressure surge due to the sudden cut-off of water popped open a relief valve. This valve should have returned to normal when operations resumed but instead it got stuck in the open position allowing two hundred gallons of water to escape from the reactor core every minute.

The problem was compounded by an error when the operators cut off the emergency water pumps. They had misunderstood what was happening and thought that the reactor core was receiving too much water. They also opened a drain line and this released still more water from the reactor core. These actions stemmed from a lack of information about how much water was in the core at any time. There was no instrumentation to provide this data. In the absence of this information they had been instructed to check the levels in another water tank and conclude that if it were full then the water around the fuel cells would be adequate. Within a few minutes, temperatures within the core rose sharply, the remaining water turned into steam, and the nuclear core fuel rods overheated and began to disintegrate. Three hours later as the plant manager arrived, a state of emergency was declared. Radioactive material and water continued to escape.

No “meltdown” took place as happened at Chernobyl in the Ukraine. That is, nuclear fuel did not “melt” through the floor beneath the containment or through the steel reactor vessel. However, a substantial amount of fuel did melt. Radioactivity in the reactor coolant increased dramatically. Radioactive gas began to spread through small leaks. It reached all parts of the plant and went out into the surrounding environment. Two days after the accident, Governor Thornburgh of Pennsylvania ordered a precautionary evacuation of preschool children and pregnant women from within a five-mile zone around the plant. People living within ten miles were urged to stay inside and keep their windows closed. These measures lasted for about a week until the situation at the plant was completely under control and the danger from radiation was eliminated.

Detailed studies of the consequences of the accident were conducted by a number of government agencies and several independent agencies. The general conclusion was that the average exposure to about two million people in the area was 1 millirem. This corresponds to one-sixth of the amount of radiation one would be exposed to in the course of having a full set of chest x-rays. Besides, the natural levels of radioactivity in and around the Three Mile installation are a little over one hundred millirem per year. Clearly, the average amount of radiation was trivial and the maximum that anyone was likely to experience was one hundred millirem. A consensus gradually emerged over the possible long-term damage. It was a risk of one additional cancer death over a time period of thirty years.

In the months that followed, although questions were raised about possible adverse effects from radiation on human, animal, and plant life in the area, none could be directly related to the accident. Thousands of environmental samples of air, water, milk, vegetation, soil, and foodstuffs were collected and monitored by various groups. Today, the damaged reactor is permanently shut down and the reactor coolant system has been decontaminated. Radioactive liquids have been treated, most components shipped to a licensed low-level waste disposal site, and the whole location carefully monitored. Costs of cleanup have been running at 70,000 dollars annually ever since the accident.

Causes of the Three Mile Island accident continue to be debated to this day. The main factors appear to have been a combination of personnel error, design deficiencies, and component failures. There is no doubt that the accident permanently changed the nuclear industry. Public fear and distrust increased. This was the most serious in U.S. commercial nuclear power plant operating history, even though it led to no deaths or injuries to either plant workers or members of the nearby community. It brought about sweeping changes in emergency response planning, reactor operator training, human factors engineering, radiation protection, and many other areas of nuclear power plant operations. Reactor operator training was high on the list of reforms. All electric utilities expanded their training for personnel who work at and support nuclear plant operations.

The cleanup of the damaged nuclear reactor took nearly twelve years and cost almost a billion dollars. The work was challenging technically and with regard to the handling of radiation. Plant surfaces as well as the water used in the cleanup had to be decontaminated. One hundred tons of damaged uranium fuel was removed from the reactor vessel without any harm being done to the workers involved. Waste nuclear material was sent to Richland, Washington, for storage. After the cleanup, reactor number two in the Three Mile Island Plant was placed on long-term monitored storage. It was kept completely free from number one in that, though unaffected by what had happened, it had also been shut down at the time of the accident. The Three Mile Island number one unit was restarted in 1985 and has been working efficiently and safely ever since.

The National Nuclear Academy was instituted to accredit the training of plant staff for all programs. Utilities purchased simulators for the training of personnel who work in the main control rooms. Training reforms centered on protecting a plant’s cooling capacity, whatever the triggering problem might be. In the 1979 accident, operators turned to a book of procedures to pick those that seemed to fit the event. In the new training operators are taken through a set of “yes-no” questions to ensure, first, that the reactor’s fuel core remains covered. Then they determine the specific malfunction. This is known as a “symptom-based” approach for responding to plant events. Underlying it is a style of training that gives operators a foundation for understanding both theoretical and practical aspects of nuclear installations.

The Ocean Ranger was stationed at sea 170 miles east of Newfoundland. Because of inadequate preparations for windstorms 84 lives were lost.

The Ocean Ranger, an oil-drilling rig stationed in the North Atlantic 170 miles east of Newfoundland, Canada, encountered a one hundred mph storm on 15 February 1982. Storm waves swept over the uppermost deck and the rig began to list. A few hours later, in darkness, it sank and eighty-four lives were lost. All rescue efforts failed. It weighed 16,500 tons and was the largest self-propelled, semi-submersible, offshore drilling unit in the world at the time. It was launched in 1976 and spent its first three years off the Alaskan coast in the Bering Sea, then was moved to a position off the coast of New Jersey in 1979 where it spent a year before moving again, this time to Ireland. In 1980 it was moved once more, to the Grand Banks, a relatively shallow area near Newfoundland, Canada.

The Ocean Ranger carried a crew of eighty-four and drew oil from the seabed in 250 feet of water. Sixty-nine members of the crew were Canadians. This part of the Atlantic Ocean has large reserves of oil but they are hard to recover because of bad weather. The main supports for flotation and stability were two large pontoons that floated well below the level of the waves. Each was four hundred feet in length, sixty feet wide, and twenty feet in height. They carried most of the everyday needs of the oil drilling rig, ballast water tanks and water for the oil drills, fuel oil tanks, and various pumps, motors, and control valves. Rising from the pontoons to the lower and upper decks were eight watertight tubular cylinders, some forty feet in diameter and others twenty-five feet. Some of these contained the hundreds of feet of chain for the twelve anchors, each weighing twenty-three tons. In one of them, quite close to the waterline, was the control room, often referred to as the brain of the rig. It was here that damage was experienced on the night of the accident.

The top deck of the rig was seventy feet above the surface of the ocean and measured two hundred by one hundred and eighty feet. Beneath it was the lower deck on which stood the oil drilling equipment. Balance and buoyancy of the whole vessel were maintained from the control room. Water allowed into a pontoon or removed from it was all that was needed to cope with a list in any direction. An operator was always on duty in the control room. A foreboding of things to come was experienced on one occasion. Captain Clarence Hauss, who had taken charge of the rig only eight days earlier, took responsibility for the control room for a short time in place of the regular operator. A slight list occurred and Hauss tried to make the proper correction. He pressed the wrong button and things began to get worse for a few scary moments until someone made the necessary correction.

This experience was typical of the nonpreparedness for emergencies among all the crew. The correct action for Captain Hauss was clearly marked on the control panels. However, he had no way of knowing that there had been earlier problems with the operation of the valves on the pontoons. They were accustomed to behave erratically and brass rods had been installed to make the valves work the way the operator wanted whenever an error was noted in their response to the controls. This was not all that was wrong. Representatives of the oil company had little contact with the daily operations of the rig. They failed to notice that the routine inspection of safety equipment and procedures had not been carried out and the vessel therefore did not have a valid certificate of inspection at the time of the accident. There were no survival suits available on board, essential equipment for anyone operating in the freezing waters of the North Atlantic.

Men were hired to work on the rig but were given almost no training and never had the kind of regular boat drill for emergencies that are standard in other vessels. One man who had been on board when Captain Hauss made the mistake told how the crew was immediately called to emergency stations. Everyone was awakened at six in the morning by an announcement telling him to get warm clothing, put his lifejacket on and go at once to the lifeboat station. Two hours went by before the rest of the men responded and finally sixty-five people arrived at this man’s lifeboat that was only capable of carrying fifty-five. This approach on the only occasion when he had to cope with an emergency made him wonder how anyone could escape if a crisis occurred in the middle of the night in the midst of a violent storm.

Late on the evening of February 14, 1982, a violent storm reached the Ocean Ranger. Winds built up to one hundred miles an hour and the crew on the lower deck removed the drilling pipe as a precaution. Waves rose to forty feet. By removing the drilling pipe the vessel was free to move and would present less resistance to the wind. One wave broke a porthole in the control room and some water came in. Three hours later, the operator reported to shore that all had been repaired and there was no more water on board. However, damage had been done to the electrical system and two hours after that report lights went out and electricity failed in the control room. The ballast pontoons could no longer be controlled. Standby ships are supposed to be within two or three miles of an oil-drilling rig at all times in order to assist in case of an emergency. Because of the storm, the ship that was supposed to be on hand for the Ocean Ranger drifted eight miles away. When a call for help came from the rig about an hour after midnight this ship was unable to give immediate help.

The Ocean Ranger listed ten degrees and an emergency was declared. When the standby ship did arrive an hour later and tried to make contact with one of the lifeboats that had been launched, the boat collapsed and the men were thrown into the sea. The reality of the situation was that neither the Ocean Ranger nor the assisting vessel had any competence for the crisis that arose. An hour later the oil rig capsized and sank taking the rest of the crew down with it. It took two years for their family members to receive some sort of financial settlement for their loss. Ultimately, they did not receive a large amount of money, and legal fees absorbed 30 percent of it, but on the whole it provided for the needs of their children until they were through school.

The Ocean Ranger disaster was a great loss to the growing offshore oil industry. The Royal Commission that considered the disaster reported that the engineering design was inadequate and unreliable, especially in relation to the control room. That heart of the vessel should have been able to resist the wave strength it encountered and should not have had its electricity system knocked out. The Commission also criticized operations generally, stressing that management arrangements were very weak. Finally, the absence of any system of inspection by either Canadian or U.S. government agencies was listed as a glaring error.

A good example of the way things should have been done can be seen in the Hibernia, a new high tech offshore drilling rig that was built subsequently and placed where the Ocean Ranger had been. The Hibernia was fitted with eight lifeboats, each able to carry seventy-two. Each lifeboat was equipped with launching systems and three life raft systems, thus providing an evacuation capacity for three times the number of personnel on the rig at any one time. Beyond all of this redundancy it was also possible to evacuate personnel directly from the rig to a standby vessel without resorting to launching lifeboats or life rafts into the sea. Today there are three oil-drilling rigs at work off the east coast of Canada, Hibernia, Terra Nova, and White Rose but the new reality, made all the more urgent in the wake of the tragedy of Sikh terrorism in 1985, is more about external dangers than about coping with the weather.

New regulations were introduced in 2007 to ensure that no potential terrorist, whether by submarine, surface vessel, or airplane, could approach one of these rigs without being thoroughly checked. These regulations had to be able to override the various local security provisions of the different provinces on Canada’s east coast. Information on potential terrorism, for security, has to be limited to a small number of people. Thus the people with knowledge of threats had to be free to act on preventive action with or without the agreement of local authorities. Rules of this kind were already in place on oil-drilling rigs off the coasts of the United States and Australia but it took some time for Canada to make similar arrangements. The long history of inter-provincial battles over rights led to delays before the new rules were put in place.

All seven astronauts were killed and the accident gave rise to new, stringent, regulations about decisions on launching.

Shortly before noon on January 28, 1986 the space shuttle Challenger lifted off from the Kennedy Space Center at Cape Canaveral. Seven people were on board, five of them astronauts and two civilians. In less than one minute into the flight a fire broke out and the shuttle tore away from the flaming booster rockets to plummet ten miles in free fall into the ocean. All seven died instantly on impact if not before.

By 1986, space travel had become almost routine. Americans had flown beyond the bounds of gravity more than fifty times and their safe return from every mission was now taken for granted. The Challenger shuttle had already been in space on a number of missions and was about to take off on one more in January of 1986. This time two civilians were going to accompany five astronauts. Christa McAuliffe, a teacher, was one of the two and a great deal of attention had been focused on her because of the role she was to play.

Classrooms around the nation were getting ready to receive signals from space. McAuliffe was to conduct two fifteen-minute lessons, describing the spacecraft and the duties of each of the seven on board. She called the first lesson the ultimate field trip. Her second lesson would go into more details of the experiments being conducted, pointing out at the same time the future scientific, commercial, and industrial benefits that would come from these activities. Behind the educational values were the hopes that this kind of activity would build broader public support for NASA’s shuttle programs.

Challenger was to have lifted off on January 20 but all kinds of delays cropped up over the following week. Again and again flight plans had to be canceled, sometimes just a few hours before takeoff. There were various reasons for the cancellations. Additional training for the astronauts was one unexpected stall. A second was a desert storm in Africa that made an emergency landing site unusable so the launch had to wait until that location was back to normal. Ships at stand by to pick up the booster rockets after they are jettisoned were grounded by high winds on one occasion. Once, an hour before launch, a sticky bolt prevented the removal of an exterior-hatch handle. All seven were in the shuttle at this time and the delay forced another cancellation.

Finally, on January 28, everything was in place for liftoff; everything, that is, except that temperatures had dropped below freezing on the previous night. There were serious concerns among the engineers who designed the o-rings, the seals that prevent leaks between sections of the rocket boosters. They were unanimous in their decision to stop the launch. These o-rings are sensitive to very cold weather because low temperatures might make them shrink and cause a leak of the highly flammable fuel. NASA’s management team, distressed by the week’s delay, pressured the o-ring manufacturer to let the Challenger go. They succeeded. NASA was anxious to get the shuttle aloft in order to measure the ultra-violet spectrum of Halley’s Comet before it moved too far away from the earth.

The liftoff sequence is always an impressive sight. Thousands come to Cape Canaveral to watch from a safe distance every time a new mission is about to be launched. The huge volume of fuel expended in getting the spacecraft into orbit leaves no room for mistakes. Once ignited the two booster rockets burn uncontrollably until all their fuel is gone. They then separate from the shuttle and plunge into the sea where they are picked up by NASA’s recovery ships. At T minus three minutes Columbia was ready to go. Its internal electrical system was operating independently. Captain Dick Scobee had completed his examination of all systems on board and given the green light to mission control. Two and a half minutes later powerful jets of water were directed at the launch pad to dampen the roar of takeoff and so prevent sound waves damaging the underside of the spacecraft.

America’s twenty-fifth space shuttle mission was a perfect launch, but almost immediately a tiny puff of smoke was caught on NASA’s cameras. At T plus forty-five seconds the puffs of smoke were more than just noticeable. The shuttle crew felt their craft being jostled and wondering what was wrong switched immediately to their emergency air. Thirty seconds later the shuttle was enveloped in a fireball and all control was lost. The boosters flew away from it in opposite directions. The crew cabin was now a free moving object with the seven astronauts inside. With the momentum of the trajectory it sped upward several thousand feet then plunged downward toward the ocean. Three minutes later it hit the water at two hundred miles an hour, killing all seven instantly. The crew cabin disintegrated and sank.

About an hour later, a lone parachute was observed coming down with a booster nose cap rather than the whole booster attached to it. Over the weeks following the tragedy no identifiable remains of the astronauts’ bodies were recovered from the sea but substantial pieces of wreckage did turn up. Recovery vessels found a twenty-five-foot-long section of the shuttle’s fuselage, parts of the shuttle’s wings, and a door from a cargo hold. One or two voice recorders from Columbia were recovered from the sea. They contained only trivial amounts of data. After their initial shock and reactions the astronauts were unaware of events until flames exploded around them, destroying all power and communications.

The impact across the nation and around the world was instant and massive. Classrooms in many states waited for their lessons from space so when the tragic news arrived whole communities were in shock. President Reagan was due to present the annual state of the nation address to Congress on the evening of the twenty-eighth and undoubtedly he planned to speak about the teacher in space. It was he who suggested to NASA that a teacher be the first civilian to go aloft. Christa McAuliffe’s comment about her career, “I touch the future. I am a teacher,” fitted perfectly into his state of the union speech. That speech was delayed for a week. Messages of sympathy arrived from nation after nation. One from Soviet Party Chief Mikhail Gorbachev was particularly significant because of the fierce competition existing between the United States and the Soviet Union in space exploration.

A final ceremony to honor the seven astronauts was held at the Johnson Space Center in Texas where the seven had lived and trained. It was attended by six thousand NASA employees, ninety Senators and Congressmen, and about two hundred relatives of those who died. President Reagan and his wife met family members and then the president spoke about the human cost, not the errors. His comments included the following: “The future is not free. Human progress is a struggle. America was built on heroism and noble sacrifice like our seven-star voyagers.” In addition to the ceremony in Texas, a Space Shuttle Challenger Memorial was placed in Arlington National Ceremony on March 21, 1987. It marked the common grave of the astronauts’ remains which were recovered but could not be identified.

The Challenger disaster could have been prevented. Engineers from the company that manufactured the o-rings tried to convince NASA to delay the launch and wait for better weather. Future designs, future methods, and future procedures were affected. A new ethic was reestablished at NASA. There would never again be a rejection of majority engineering advice and the final decision in cases of doubt would be taken by an astronaut.

Union Carbide’s factory was built to provide insecticide for India’s farmers so they would not lose crops. When demand for insecticide dropped Union Carbide began to cut costs wherever it could and, in the process, created circumstances that led to the disaster.

In the early hours of December 3, 1984, tons of poisonous gas escaped from Union Carbide’s factory at Bhopal, India. Methyl isocyanate, a highly toxic substance, was being processed here to produce insecticide for farmers. The nighttime gas leak caught people still in their beds. Eight thousand were killed and another quarter million injured, some very seriously. The problem began late on the evening of December 2 when water entered one of the big storage tanks containing methyl isocyanate at some stage of conversion. A chemical reaction was triggered and both temperature and pressure rose quickly. Officials at the plant knew what was happening and could also see that pressure was going to build up until something gave way but they were unsure about what to do.

A warning siren was available to warn local residents of any danger but workers were slow in turning it on. Shortly after midnight, the storage tank was breached and gas shot outward. Even then, no siren was sounded for an hour. By that time an area of more than fifteen square miles was contaminated and thousands were dying. Bhopal was a city of 800,000 people, mostly Moslems, which had tripled in size over the previous twelve years, largely due to the arrival of Union Carbide’s pesticide plant in 1969. The first ten years of the plant were highly successful and adequate safety precautions were in place.

Indian chemical engineers were taken to the United States for training and then brought back to their own country to oversee operations and train new staff. By the beginning of the 1980s it was a different story. Huge losses had overtaken the company, partly due to lack of demand for pesticides. The green revolution, the use of new and better grains for seed, was yielding a surplus of food and there was less need to buy expensive pesticides in order to reduce losses from insects.

As profits slumped, cost cutting measures appeared. Instead of sending their chemical engineers to the United States for training, men who had taken some university science were given a four-month crash course locally and then handed major responsibilities within the plant. These people were not qualified chemical engineers so they could be paid less, thus reducing the budget for staff. For people at this level of responsibility it was usually $30 a month. The level of training steadily deteriorated with each group of new workers. Additional workers were frequently needed because the best-trained chemical engineers often left for better pay and greater security elsewhere.

Men were hired to work in the very sensitive and highly toxic Methyl Isocyanate (MIC) Unit with limited training and little practical experience. This was the unit that had been a highly controversial addition to the plant. It was added in 1980 for the same reason that lay behind other decisions of that time—it was cheaper. Bhopal was the only Indian plant to use this chemical and the company’s U.S. plant in West Virginia was the only other one using it. In addition to the risks associated with MIC, instead of the safer yet more expensive chemicals used at all the other Indian plants there was the challenge of adding one more building to the Bhopal installation to store MIC.

Local government leaders knew that Union Carbide’s factory should never have been built where it was. It was too close to areas of concentrated settlement and, since it first opened, more and more people moved to places close to the plant. The local officials were faced with a big addition because Union Carbide decided it would save a lot of money if large quantities of MIC were stored at the site instead of frequent additions of small amounts being added from time to time.

The city administrator was insistent. He asked the company to set it up farther out, away from the populated areas in order to avoid tragedies like the one that hit Mexico City only a few weeks earlier and killed large numbers of workers whose homes were close to the plant. In the debate that ensued, the company won out and the city administrator lost his job. He said it was not due to the position he took over the MIC unit but others wondered if that was really true.

Symptoms of the victims who were exposed to the poisonous gas took different forms depending on distance from the factory. They included immediate irritation, chest pain, breathlessness, and if no help was at hand the problem developed into asthma, pneumonia, and finally cardiac arrest. Almost nothing was known by those affected as to what to do in a tragedy of this kind. Had they known, simple protective measures were possible. If, for example, a wet cloth is placed over nose and mouth until help arrives, many lives can be saved.

The accident shocked the world and Union Carbide, the United States parent company, was particularly concerned because it operated a facility of the same kind in West Virginia. Some months later on, in August of 1985, that same plant experienced a leak like the Bhopal one but fortunately safety measures were in place to prevent widespread damage. For the people of Bhopal, similar safety measures were almost nonexistent. The failure to anticipate the developing leak was only the beginning. An analysis conducted in January of 1985 revealed that safety measures were totally inadequate.

A refrigerator designed to prevent dangerous chemical reactions in storage tanks had been shut down, ostensibly as a cost-cutting move. Had this been in place the buildup of pressure and the resultant leak would never have happened. A mechanical vent scrubber to detoxify escaping gas with caustic soda was not working. A network of waterspouts for neutralizing toxic gas was also inoperative, and so was another safety installation, a high-flare tower that would burn off dangerous gases high in the air. These conditions together with evidence of unreliable instruments throughout the plant confirmed the investigators’ findings. Bhopal’s security was totally inadequate.

Bhopal had experienced as many as six smaller accidents in the previous three years, all of them related to gas leaks, most frequently chlorine, a part of the methyl isocyanate manufacturing process. This particular gas is best known because of its use as poison gas in World War I. Chlorine comes from simple salt. Once broken away from its partner sodium, chlorine becomes a heavier-than-air gas, and an unstable chemical. It will recombine easily with carbon, and with material in the bodies of living things. But the chemical combinations formed by chlorine are known to cause cancer and other diseases. A single accident at a chlorine plant has the potential to kill hundreds of thousands of people. The accident at Bhopal killed 8,000 and injured a quarter million more.

Fallout from the accident was felt across the chemical industry. Safety audits and new regulatory standards became a primary focus of government and industry. Nongovernmental agencies increased their public awareness campaigns to ensure there would never again be another Bhopal. Concerns about technology transfers, the relations between economic and environmental issues, and the interests of labor all led to intense debate over public policy. In India, The Disaster Management Institute was formed to provide long-term planning in order to prevent future industrial accidents. The chemical industry responded with the formation of The Center for Chemical Process Safety to develop management strategies for the industry.

Poisonous gas spilled from a Union Carbide plant at Institute, West Virginia, in August of 1985, sending 130 people to hospital. The cause of the accident was almost identical to the one that was caused by the same company on a much bigger scale in India. New equipment had just been installed to make the plant safer but something went wrong. The lessons from Bhopal had not yet been learned. The plant at Institute produced the pesticide Temik from MIC just like Union Carbide’s operation in India.

Before the Bhopal tragedy the company transported MIC to other plants across the United States. After Bhopal, public concern forced the company to convert MIC to a less toxic chemical, aldicarb, before shipping it to other locations. This concern was heightened when the cause of the accident was known. The very same thing that went wrong in India was repeated when a valve failed and aldicarb heated up, bursting the container and escaping outside.

Within twenty minutes of the accident Union Carbide notified local emergency services. Fifteen minutes later the gas reached the town of Institute. People were warned to stay indoors but many were caught outside. These suffered from irritations to eyes, nose, throat, and lungs. It appeared that aldicarb had broken down into more volatile irritants in the course of being heated up before it escaped. The runaway reaction was identical to what happened in India. Fortunately, in West Virginia, action to correct the problem was quick and effective.

Some concern remained after the accident, particularly since its cause had been directly related to the installation of a new warning system designed to prevent the kind of thing that happened at Bhopal. The new system, known as “Safer,” analyzed wind speed and weather conditions on a continuing basis in order to predict the movement of escaping gas in case of a leak. Unfortunately, once again, even at the headquarters of the chemical company’s operation, the new safer system failed to work.

Through neglect of the advice of geological experts, this dam was built on unstable ground that failed when the dam was filled with water.

Discussions about a dam on the Teton River began in the early years of the twentieth century. It would provide additional water resources, flood control, and electrical power. Discussions intensified in the 1930s and again in the 1960s. Then in 1964 the U.S. Congress gave approval for a dam, but construction was delayed for a decade by objections from environmentalists and geologists. By October 3, 1975, construction of the dam was completed and filling began. Eight months later it collapsed and eighty billion gallons of water burst out, devastating everything before it. Eleven lives were lost, 180 square miles flooded, and damages of $400 million incurred.

The project would provide additional water resources to 111,210 acres of land in the Fremont–Madison Irrigation District, local and downstream flood control benefits, water to operate a 16,000 kilowatt power plant, and major recreation developments. Groundwater pumping in dry years would supplement the water supply when surface flows were inadequate. Design called for a 130-foot-high earth-fill structure with a crest length of 3,100 feet including spillway, and a crest elevation of 5,332 feet. The total capacity of the reservoir created by the dam would be 200,000 acre-feet.

For about ten years objections from various groups delayed the start of construction. Environmentalists argued that the dam would destroy seventeen miles of the Teton River, a popular haunt of trout fishermen, and remove 2,700 acres of deer and elk habitats. The response to these concerns by the Bureau of Reclamation, the U.S. government agency responsible for the project, was that the benefits from flood control and irrigation would more than compensate for these losses. The objections from geologists were quite different. They insisted that the rock on one side of the proposed dam was weaker than on the other and that a dam on such a site was a formula for disaster. Later events proved them right.

It seems that even as recently as the 1970s, the critical roles of geologists and geology were still seriously underestimated. These neglects were the main causes of the failures of St. Francis Dam in California in 1928 and Vaiont in Italy in 1963. From these tragedies came strong recommendations that geological expertise needs to be given the highest priority in all designs of dams, especially in places where the rock is extensively faulted and where there is a history of earthquakes.

The Teton Dam site was a location where both of these conditions were found. The consistent claim of geologists was that one side of the dam was weaker and, therefore, when compacted by the weight of water it would rupture. This in turn would create a leak, progressively eroding the earth structure. Those responsible for the construction of the dam minimized this risk.

A U.S. Geological Survey (USGS) team sent a memo to the Bureau of Reclamation in January of 1973, after construction of the dam had begun, expressing immediate concern for the safety of the project. One member of that team, Harold J. Prostka, returned to the site after the tragedy and pointed out that the site of the dam was in a geologically young and unstable area. He then identified numerous fractures and faults at the site.

Other geologists added their comments in the aftermath of the dam failure. Dr. Robert Curry, a professor of geology at the University of Montana, testified that poor site selection and an inadequate approach to design and construction led to failure. He noted that the Bureau of Reclamation’s regional study in 1961 dealt with site hazards in a broad manner, barely mentioning permeability. Curry was quite sure that the data on which Congress authorized the Teton Basin Project was inadequate.

Dr. Marshall Corbett, a geologist from Idaho State University, agreed with Curry that the site selection for Teton Dam was wrong. He pointed out that good site selection was important, but the good dam sites had long been used up. Steven S. Oriel, another USGS geologist, voiced concern about the inadequacy of scientific information about the site of the dam. In a final report to the Department of Interior these fears of geologists were confirmed. The report concluded that the design of the dam failed to take adequate account of the foundation conditions and the characteristics of the soil. Following the years of delay, work on the dam was speeded up in the 1970s. This included speeding up the rate of filling from one foot per day to two.

The reservoir was completely filled during the months of October and November of 1975. Generator installation followed a month later and then the spillway three months after that. On June 1, 1976, Teton Reservoir contained ten million cubic yards of water with surface dimensions of 3,100 feet by 1,700. The dam, an earth structure, stood 130 feet high. Barely had the work of construction been completed before questions of stability surfaced.

Early on the morning of the June 5, 1976, the first signs of trouble appeared. A hole was seen to be leaking water near the right abutment at 7:30 A.M. and the flow of water was increasing but no one felt the problem was serious. This sort of thing was seen as normal in a new dam. A second leak appeared at 10:00 A.M. and one hour later a whirlpool formed inside the reservoir. A couple of bulldozers were brought in and loads of loose rocks were pressed into the area of the leak. It soon became clear that there was a huge eroded area beneath the leak. Both bulldozers sank down into it and the drivers were just able to escape in time. By the middle of the day no one was in any doubt about the danger. Warning messages were sent out to all places downstream.

Three minutes before noon the dam collapsed and a high wall of eighty billion gallons of water swept down the canyon of the Teton River, taking power and telephone lines, power station and pumping plant, and everything else in its path. Millions of cubic yards of mud and rocks were taken away in the flood and these added greatly to the power of the water when the flow encountered any obstruction. Residents downstream acted as quickly as they could and were able to evacuate the towns of Sugar City, Teton, and Newdale in half an hour. The water rushed through the can- yon, largely bypassing Teton, St. Anthony, and Newdale because they were on high ground.

Outside of the canyon the water spread to a width of about eight miles and sped along at ten to fifteen miles per hour. The rushing water hit the town of Wilford and obliterated it, literally wiping it from the map. Sugar City, between the two forks of the Teton River, received the full force of a fifteen-foot-high wall of water crashing down on it. Rexburg was the largest city in the immediate flood area, most of it on the valley floor. The debris-laden water swept past a log mill on the outskirts of town, adding large logs to the flotsam. The logs acted as battering rams, and along with the rushing water, severely damaged buildings throughout the city.

In the evening of June 5, officials of the Mormon church that owned Ricks College, unaffected because of its location on higher ground, offered to help. It supplied food and housing to anyone affected by the flood and Ricks College became a temporary home for many flood victims. On June 6, President Ford declared Bingham, Bonneville, Fremont, Madison, and Jefferson counties federal disaster areas. The water rushing out of Teton Reservoir threatened the venerable American Falls Dam that lay downstream on the Snake River. In an effort to save it, the outlets were opened to full bore in the hope of emptying it in time.

It had to release more water that it ever had to do in the past in order to receive more water than ever before. Concern focused not only on the American Falls Dam, which was an old structure, but also on the smaller dams farther downstream. Water reached the dam on June 7, and fortunately it was able to absorb the full volume of the Teton Dam’s flow. When the waters receded, the extent of damage began to be assessed. Eleven deaths were attributed to the dam failure and subsequent flood. Final estimates were approximately one billion dollars. After the flood, repair of damages became the first priority. The Federal Emergency Management Administration (FEMA) was one of the first on the scene. By August 6 all the emergency repairs were completed and the remaining tasks handed over to standing local authorities.

On the twenty-fifth anniversary of the failure of Teton Dam, the Regional Director of the U.S. Bureau of Reclamation spoke of the things that happened in the intervening years. Teton became a new point of departure in the work of the Bureau, profoundly changing all aspects of its work. The Reclamation Safety of Dams Act of 1978 was a beginning, providing funds to analyze and modify structures likely to be unsafe. Thirteen dams in the Pacific Northwest have already been modified under this program. Beyond the 1978 Act, there were many other changes introduced as lessons were painfully learned from the mistakes at Teton.

Since 1976, independent peer reviews are required for all studies of dams and for all designs and design changes. Redundant measures to control seepage and piping (tunnel erosion of soil), special treatment of fractured rock foundations, and frequent site visits by design engineers during construction have become essential parts of the planning and construction of dams anywhere in the nation. Furthermore, dams must be inspected annually and in detail every three years. Every six years dam performance must be assessed under different load conditions, that is with varying volumes of water in the reservoir. The results are measured with new instruments that have already been installed at dams, replacing the uncertainty of visual inspections.

The devastation that followed the failure of Teton Dam is a part of the U.S. Bureau of Reclamation’s institutional history but the lessons learned from it are now being lived out all over the country. When the area around Tacoma, Washington, was hit with a 6.8 earthquake on February 28, 2001, it immediately triggered on-site visual inspections of thirty-two reclamation sites, all within a radius of 316 miles from the earthquake’s epicenter. There were no reports of damage to dams and no hydroelectric power operations were affected. Further inspections will be carried out on these dams in the springs of the succeeding two or three years, as they experience differential volumes of water, to ensure that the earthquake did not weaken them.

A landslide within the Vaiont Dam in northern Italy displaced a massive volume of water from the dam that flooded the valley below.

On October 9, 1963, between 10 and 11 P.M., a massive wave of water crashed over the top of the Vaiont Dam destroying everything in its path and killing 2,600 people. At a speed of 70 mph a massive slide of 350 million cubic yards of rock and ruble from one mountain had collapsed into the dam, displacing huge volumes of water that, like a tsunami, then descended into the valley below. It was the worst disaster of this kind in history and was caused by inadequate geological investigations prior to construction.

More than once in modern society events serve as reminders of what we know but fail to put into action; namely, that those who choose to forget the past are doomed to relive it. The Vaiont Dam failure is one more example where knowledge of earlier cases like the St. Francis and Teton dam failures could have prevented failure at Vaiont. The flaws in all three of these dam failures were the same—the absence of adequate geological assessments before work on the dams began.

Even as construction went ahead at Vaiont there were signs of trouble in the steep mountainsides on either side of the Piave River valley, the site of the dam. Instead of delaying construction until thorough geological studies were completed, engineers decided to use a trial and error method, measuring the rates of rock movements on both sides of the valley in relation to water levels. They finally arrived at what they considered a stable condition and went ahead with the project.

The Piave River flows through limestone mountains in the Italian Alps, about sixty miles north of Venice, near the towns of Longarone and Castello Lavazzo. The purpose of the dam was to provide hydroelectricity for Milan and other big industrial cities of the north. The heights of the surrounding mountainous ranged from 7,200 feet to 8,200 feet. The valley floor was steep on both sides and so a very high dam was necessary.

It had to be almost nine hundred feet above the valley floor, the second highest in the world. Limestone rock is formed in layers and if the cohesion of the layers is weakened by water, or by changes in pressure from neighboring rocks, landslides are possible. Planners knew this and were also aware that landslides had taken place in the past in the very spot where the dam was being built.

Construction was completed by 1960. As the finished structure began to fill with water, and sides of the dam were being monitored for any slide movements, engineers noticed that the amount of water and rate of filling affected the stability of rocks and soils on both sides of the valley. People began to notice large cracks in the earth near the top of one of the mountains bordering the dam.

The thousands of villagers who lived in the valley below were far from being at ease with the nine hundred-foot-high edifice looming above them. For three years following completion in 1960 there was a significant element of fear pervading the homes and villages beneath the dam.

Some of the technicians who were involved in maintenance work on the project also expressed continuing concern over the danger from landslides. They pointed out that the mountainsides were dry and inclined to crumble because there was no vegetation to hold the soil in place. Their fear was that a heavy storm or some large rocks hitting the reservoir could cause water to cascade over the top of the dam into the valley.

From such a height even a small flow of water could be disastrous. Concerns mounted as slippage along the face of the mountains became more and more evident. The technicians sent a report on this to the relevant government department in the country’s capital city, Rome. While waiting for a response from Rome there was a sudden change in the weather. After weeks of dry, hot conditions there came heavy rain and high wind.

By early October of 1963 the mountainsides changed dramatically as they became saturated with water. The groundwater table in the area also rose, saturating the ground and decreasing its strength. Slow creep of the valley sides was noticed in September. By October 8, the day before the disaster, these movements reached an alarming rate of sixteen inches a day. The last measurements on the ninth indicated double that rate over some areas.

Animals sensed the danger and began moving away. Engineers became alarmed and lowered the water level but even as they did so the reservoir level continued to rise because soil and rocks were entering the lake in increasing quantities. Thus the water in the dam was being displaced by the slow creep of an impending landslide.

Late in the evening of October 9 a large block of rock, soil, and de- bris—a mile wide and more than a mile long, and about a thousand feet thick—roared down the mountainside into the reservoir displacing huge quantities of water. A gigantic three-hundred-foot wave was generated and this mass of water, like a tsunami, swept over the top of the dam and down into the valley. The dam remained in place but destruction in the valley was catastrophic. The water rushed down the valley like a solid wall hundreds of feet high, destroying everything in its path.

Village after village and one home after another all disappeared leaving behind a mass of mud mixed with bodies and bits of building materials. Some people farther down the valley heard the sound of the approaching wave as if it were a tornado and managed to get out of its way in time. They knew at once what had happened. Longarone, the largest community, experienced the greatest amount of damage.

A day later, onlookers compared the scene with the two-thousand-year-old ruins of Pompeii, the only other event they could recall that caused comparable devastation. That event happened more than two thousand years earlier. In Longarone, as in all the other places along the Piave Valley, records of local residents were lost because the official buildings were destroyed, so it took some time to assess the loss of life. Gradually, as survivors met, the full toll became clear. There were 2,600 dead. Even as the enormous scale of the tragedy was being grasped there was more terror. On October 15, there was another slide of rock into the reservoir. This time, authorities were fully prepared. An evacuation plan was in place and buses quickly carried people to safety.

In the technical inquiry that followed, it was determined that the area was geologically unsuitable for a dam. In addition, the building work that took place further weakened the surrounding mountainside, thus making slips inevitable. Nine men were accused of gross negligence. Five years later, on the night before their trial, the leader of the nine took his life. The others received sentences ranging from fines to years in prison. One final outcome was that authorities launched a series of investigations into all dams in Italy’s alpine region.