Alarm Bypassed, Gauge Drifting, No Call: Investigating a Toluene Release
At a chemical blending facility, a 2-inch carbon-steel transfer line failed at a weld during a night-shift transfer, releasing an estimated 180 gallons of toluene onto the concrete containment area. The operator discovered the release by smell and stopped the pump. The tank's level gauge had been reading 15% low for at least three weeks; the high-high level alarm had been bypassed six months earlier during a maintenance outage and was never restored, and the bypass was recorded in a spreadsheet rather than in the management-of-change system. A contractor splashed his forearm, rinsed at the eyewash for 90 seconds, was driven to a clinic by his supervisor, treated and released, and returned to the site to finish his shift. No evacuation or shelter-in-place was ordered; the site emergency plan requires notification of the shift supervisor and the incident commander, and neither was paged. The maintenance superintendent's draft report states: root cause is contractor failure to follow procedure and operator error in monitoring tank level; corrective action is retraining and discipline for the operator. The release was not reported to any regulator. The facility stores 400,000 lb of toluene and is covered by OSHA PSM.
1. Critique the draft report. What would a defensible root-cause analysis have found instead?
Read the worked answer
The draft commits the classic single-cause error: it stops at the two people closest to the release and assigns blame. It also treats symptoms as causes.
A structured method - barrier analysis or a logic tree, not a five-whys that terminates at human error - would identify several independent causal factors, any one of which, if removed, would have prevented the release:
- Alarm bypass without management of change. The high-high alarm was disabled for six months and tracked in a spreadsheet. 29 CFR 1910.119(l) requires that changes to process safety information and to safety-critical equipment be managed, reviewed, and authorized; a spreadsheet is not an MOC system. The bypass should have had an expiry, a compensating measure, and an authorization.
- Mechanical integrity failure. The level gauge drifted 15% low for at least three weeks. 1910.119(j) requires inspection and testing of instrumentation, and a documented drift of that magnitude should have triggered calibration and a work order.
- Weld failure root cause. Was the line subject to corrosion, vibration fatigue, or erosion? The metallurgy and inspection history determine whether this is a one-off or a fleet-wide problem.
- Emergency response failure. Neither the shift supervisor nor the incident commander was paged, contrary to the site plan. Detection was by smell, meaning no gas detection was in the release path.
- Operator workload and shift staffing during a night transfer with a known-faulty gauge.
Discipline and retraining address none of these, and the operator had no way to know the level was wrong.
2. What regulatory obligations apply to this event, and which notifications were missed?
Read the worked answer
Several distinct obligations attach, and the site appears to have missed the time-critical one.
Release reporting. Toluene is a CERCLA hazardous substance with a reportable quantity of 1,000 lb. 180 gallons at roughly 7.3 lb per gallon is approximately 1,300 lb - above the RQ. That triggers immediate notification to the National Response Center (generally within 15 minutes of knowledge) and to the state and local emergency planning committees under EPCRA section 304. Nothing was reported. This is the most urgent gap and should be corrected immediately, with counsel involved.
PSM incident investigation. Under 1910.119(m), the employer must investigate a release that could reasonably have resulted in a catastrophic release, initiate the investigation within 48 hours, assemble a team that includes contractor participation, and produce a report with findings and recommendations that are tracked to resolution. The superintendent's four-line draft does not meet this.
PSM emergency planning. 1910.119(n) requires an emergency action plan with procedures for handling small releases and for notifying the public and emergency responders. The plan existed and was not executed - a training and drill deficiency, not a documentation one.
Injury recordkeeping. Determine whether the contractor's treatment constituted medical treatment beyond first aid under 29 CFR 1904.7. Flushing a skin surface is listed as first aid; a prescription, sutures, or further treatment would change that. Contractors are recorded on the host employer's log if they are supervised day to day (1904.31). This was not a fatality, in-patient hospitalization, amputation, or loss of an eye, so the 8-hour and 24-hour reporting rules under 1904.39 are not triggered.
3. What emergency preparedness deficiencies does this expose, and what would you fix first?
Read the worked answer
The release was small enough to be survivable and large enough to expose every layer of the response system as untested.
Deficiencies:
- Detection depended on human smell. There was no fixed gas detection or low-level alarm in the transfer area. Relying on odor means detection occurs after exposure has begun.
- A safety-critical alarm was bypassed with no compensating measure, so the last automated barrier before release was gone.
- The notification chain was not executed. The plan named the shift supervisor and incident commander; neither was paged. Either the plan is not trained, or the paging mechanism is not usable at 03:00 - both must be tested.
- No decision criteria existed for evacuation versus shelter-in-place for a flammable, toxic release on a night shift.
- Contractor integration failed. The contractor was not briefed on alarms, muster points, or the eyewash location, and returned to work after a chemical splash with no re-entry authorization.
- Eyewash use was 90 seconds. ANSI Z358.1 requires a 15-minute flushing capability, and the injured worker should have been flushed for the full duration and evaluated for toluene dermatitis and systemic absorption.
Fix first, in this order: restore or permanently remove the bypass with a documented MOC decision and compensating measures; install detection with alarm in the transfer area; test the paging and notification chain with an unannounced drill on night shift within 30 days; then rewrite the plan around the drill's actual failures, not around what the plan assumed.