DDR logo
H
H
o
o
m
m
e
e
A
A
p
p
p
p
r
r
o
o
a
a
c
c
h
h
S
S
e
e
r
r
v
v
i
i
c
c
e
e
s
s
 
 
&
&
 
 
P
P
r
r
i
i
c
c
i
i
n
n
g
g
I
I
n
n
s
s
i
i
g
g
h
h
t
t
s
s
A
A
b
b
o
o
u
u
t
t
C
C
o
o
n
n
t
t
a
a
c
c
t
t
DDR logo
H
H
o
o
m
m
e
e
A
A
p
p
p
p
r
r
o
o
a
a
c
c
h
h
S
S
e
e
r
r
v
v
i
i
c
c
e
e
s
s
 
 
&
&
 
 
P
P
r
r
i
i
c
c
i
i
n
n
g
g
I
I
n
n
s
s
i
i
g
g
h
h
t
t
s
s
A
A
b
b
o
o
u
u
t
t
C
C
o
o
n
n
t
t
a
a
c
c
t
t
DDR logo
DDR logo

Bhopal Chemical disaster

Bhopal Chemical disaster

Bhopal gas disaster memorial plaque commemorating victims of the 1984 Union Carbide disaster.
Bhopal gas disaster memorial plaque commemorating victims of the 1984 Union Carbide disaster.

Bhopal's failure was never closed, 1984 to 2025

More than half a million people were exposed to the toxic cloud that spread across Bhopal overnight on 2 to 3 December 1984. Survivors say around 8,000 died in the first week alone, and more than 150,000 people are still living today with the respiratory disease, cancers and birth defects it caused. The groundwater beneath the abandoned plant remains contaminated with mercury at levels found, in one test, to be up to six million times what is considered safe. As of January 2025, more than a million tonnes of hazardous waste were still sitting on the site, forty years after the leak that put them there.

By the night of 2 December 1984, six separate safety systems at the pesticide plant were switched off. Not one of them had failed. Each had been disabled, weeks or months apart, by a different person making a decision that looked reasonable in isolation.


Why this matters

  • Organisations running safety-critical or high-consequence operations rarely fail through one bad call. They fail because several different kinds of decision each go quietly wrong,at different levels, at different times, and nobody is holding all of them at once.

  • A commercial assumption set early and never retested, a moment of highest consequence nobody was positioned to see whole, a group of people carrying the risk with no say in how it was managed, and a resolution decided in principle but never fully carried out: these are four separate failure types, not one failure described four times.

  • When something like this becomes public, the response that follows is usually legal and financial. Which of these failure types actually produced it is rarely examined, which is why more than one of them can keep recurring for decades, largely unnoticed.

with no say in how it was managed, and a resolution decided in principle but never fully carried out: these are four separate failure types, not one failure described four times.-When something like this becomes public, the response that follows is usually legal and financial. Which of these failure types actually produced it is rarely examined, which is why more than one of them can keep recurring for decades, largely unnoticed.


The case

The assumption nobody retested. The plant was losing money by the early 1980s and had already been marked for eventual closure. That single fact shaped everything that followed. Cutting a maintenance budget, reassigning a coolant supply to another part of the site, running with a scrubber on standby rather than in use: each of these was a small, reasonable-looking economy inside a business already winding down. Nobody ever went back and asked whether "run it as cheaply as possible until it closes" was still the right call as the safety margin visibly narrowed. The commercial conviction was set once, early, and simply carried forward on autopilot. This is a Strategic Conviction failure: a founding premise fixed at one point in time and never returned to as the facts underneath it changed.

The night itself. By 2 December 1984, six separate safety systems were switched off. Not one had failed outright; each had been disabled, weeks or months apart, by a different person. The refrigeration unit that kept the plant's stock of methyl isocyanate cold had been shut down in June, its coolant drained for use elsewhere. The temperature alarm was disconnected around the same time and never reset to the higher running threshold, so there was no automatic warning as the tank quietly grew hotter than anyone realised. In October, a batch of off-specification gas went into the main storage tank instead of the reserve tank kept for exactly that situation. The flare tower, the last line of defence, had been out of service for weeks. On the night itself, a shift change left the incoming operator with no record of how fast the tank's pressure had been climbing, only a single reading that happened to sit inside the normal range. Each choice had its own rationale. None of the people who made them were reckless or careless in their own piece of the system. What none of them had was a place, before it was too late, from which the pattern across all six was visible to someone with standing to act on it. This is a Decision Posture failure: the clearest possible view of the risk never reached anyone with the authority to act on it, while there was still time to do something about it.

Who was never in the room. The workers and the families living closest to the plant's fence line had no visibility into any of this, and no say in it either. The local government, aware the plant was deteriorating, chose not to press the point, wary of the cost of confronting the area's largest employer. The people who stood to be harmed and the people positioned to prevent it were never the same people, and nobody closed that gap. Forty years later, the same absence repeated in a different form: when 337 tonnes of the plant's waste were finally moved for incineration in January 2025, they went to Pithampur, a town that had no part in the original decision and no say in inheriting the risk. Residents protested. They were owed that much. This is a Stakeholder Reality failure: the people who would carry the consequences were never the people the decision was tested against.


Bhopal disaster timeline chart showing events and unresolved consequences from 1984 to 2025.

Decided, and still not done. In 1986, an American judge ruled the case belonged in Indian courts rather than his own. Over the following decades, fresh evidence and new plaintiffs kept arriving in front of that same ruling, and each was measured against the frame set in 1986. When lawyers produced sworn declarations in 2014 placing an American engineer inside the plant's original design, evidence that didn't exist at the time of the ruling, it was weighed against that same frame anyway, and the case was dismissed. A parallel story ran through India's own courts: the Supreme Court fixed compensation at US$470 million in 1989, a figure survivor groups considered inadequate from the outset. In 2010, the Indian government petitioned to reopen it, seeking well over a billion dollars more. That petition took thirteen years to be heard. In March 2023, a five-judge bench dismissed it, closing the door on further compensation. Then,on 3 December 2024, a court ordered the site cleared within four weeks, the first real movementon the ground in decades, and on 1 January 2025 that 337 tonnes left the site against more than a million tonnes still sitting on it. Three separate courts, four separate decades, three separate moments where the right decision was reached on paper. None of them was carried through at the scale the decision itself called for. This is an Execution Integrity failure, repeated three times over forty years: what gets decided and what actually gets done were never the same thing.

Four different decisions failed in four different ways: a conviction never retested, a risk nobody held whole before it was too late, a set of people never given a voice in what was decided over them, and a resolution never carried through once it was reached. Bhopal shows all four across one case precisely because none of them is the same failure wearing a different name. Something was learned, in one of the four. Hazard and operability studies, formal management-of-change procedures, and permit-to-work systems became standard across the chemical industry afterwards, specifically because of what happened here: that is Decision Posture, addressed, at least in part. Strategic Conviction, Stakeholder Reality and Execution Integrity were not. Forty years on, three of the four gaps are still open.


How this carries forward

  • A commercial assumption set once, under one set of conditions, needs a deliberate point of return: something that forces it back onto the table as conditions change, rather than letting it run on unexamined. That is a Strategic Conviction discipline.

  • Whoever is closest to a risk needs a way of surfacing the pattern across small, individually reasonable decisions to someone with standing to act, before the accumulation becomes irreversible. That is a Decision Posture discipline.

  • Whoever carries the consequences of a decision is owed a way into how that decision gets made, or at minimum a way of being heard before it lands on them. Distance between the two is itself a risk factor. That is a Stakeholder Reality discipline.

  • A decision made in principle, a settlement fixed, a court order issued, is not the same thing as the decision carried out. The gap between the two deserves its own owner and its own scrutiny. That is an Execution Integrity discipline.


The close

The compensation remains contested. The site is still not clean. And forty years on, three of the four gaps that let the leak happen are still the ones nobody has closed: an assumption nobody returns to, a group of people never in the room, and a decision that gets made without ever quite getting finished. The lesson was never really about methyl isocyanate. It is about which of those three gets fixed before the next version of this happens somewhere else, and which one, like Decision Posture here, only gets addressed after the damage is already done.If any part of this looks familiar from inside your own organisation, I am always glad to talk it through.


Further reading


Built through AI with DDR's governed process. Research, drafting, and fact-structuring are AI-assisted. Every factual claim is checked against its source before it's used. The judgement, the checks, and the argument are mine. I take ownership of all of it. Before anything goes out, I read it in full, slowly, System 2 engaged, not skimmed, checking it says what I actually mean, not just what reads well. If a piece can't survive that check, it doesn't go out.