The Conflicting Accounts

Care and reporting first. Confirm both injured people are treated and obtain exposure details - concentration, duration, and decontamination performed. Then fix the reporting clock in your chronology: an in-patient hospitalization must be reported to the occupational regulator within 24 hours; a fatality within 8. The chemical release likely also triggers environmental notification to the national response center and state and local emergency planning authorities. Assign one person to own the notification log with timestamps.

Secure the scene before anyone 'fixes' it. Tag out the unloading point. Photograph and bag the failed coupling and hose section - do not let maintenance replace it and return the line to service before the hardware is preserved. Capture the distributed control system trends, alarm history, gate and badge logs, and any perimeter monitoring, and place them under a documented hold. Start a chain-of-custody record.

Fix the team before the first interview. The supervisor who has already written 'employee failed to follow procedure' cannot lead or sit in on the operator's interview, and the operator's close friend should not conduct it either. Both may contribute technical knowledge, but interviewing must be done by someone with no stake and no disciplinary role. Add a maintenance representative, a peer operator, and someone trained in causal analysis.

Interview within 24 to 48 hours, separately, before any group discussion. Ask 'walk me through your shift from the start of the unload,' not 'did you follow the procedure?' Get the physical sequence, what he was looking at, what he was told, and which revision of the procedure he had in hand.

Emergency response critique: the six-minute alarm delay needs a cause - detection lag or response lag? The shower working while the eyewash sat out of service for eleven days under a paper tag is a separate failure with its own owner, and it is an imminent hazard that must be corrected today.

Direct cause: the coupling separated under pressure during transfer. Establish the mechanism physically - wrong coupling type for the service, worn or missing gasket, cams not fully engaged, no whip check or breakaway, hose past its test date, over-pressurization. This is hardware and it is knowable; do not skip it in favor of the human story.

Contributing causes: the procedure was revised three weeks before the event and communicated through a ten-minute toolbox talk with no sign-off, no competency check, and no verification that anyone was working to the new revision. If the revision changed the valve sequence, pressure limits, or coupling type, then the operator may have been doing exactly what he was trained to do - under the old document. That is a management-of-change and training-system failure. Also contributing: no secondary containment or drain isolation at the unload point, and no independent verification step before transfer began.

Latent/system causes: an eyewash permitted to stay out of service for eleven days with only a paper tag implies a work-order and verification system that cannot see safety-critical equipment status. A hose and coupling inspection program that does not exist, or exists on paper only, is the same class of failure. Alarm response time of six minutes implies detection coverage or response roles that were never tested.

Why 'employee failed to follow procedure' fails as a finding:

• It is a conclusion reached before evidence, by a person with a disciplinary role, and it will contaminate every interview that follows.
• It stops the analysis at the last event instead of asking why the error was possible, why nothing caught it, and why the system made it easy.
• It is almost certainly contradicted by the procedure revision timeline, which is a documented, datable fact.
• It guarantees the corrective actions will be 'retrain and discipline,' which addresses nothing that caused this release and predicts the next one.

Keep the question open: not 'did he follow the procedure' but 'which procedure was in his hands, and who verified it.'

Actions, each with an owner and a test of effectiveness:

1. Restore and sustain emergency equipment. Repair the eyewash today; then weekly activation and annual inspection with results logged in the CMMS, not on a paper tag. Owner: maintenance supervisor. Verification: 100 percent weekly compliance for 90 days, audited by sampling, plus zero unplanned outages longer than one shift.
2. Redo the procedure change through management of change. Reissue with a formal review, a competency check by observed demonstration for all unloaders, and a sign-off per person. Owner: operations manager with EHS. Verification: demonstration records for every unloader, plus supervisory observation of three unloads per person over 90 days.
3. Hose and coupling integrity program. Standardize on breakaway couplings with whip checks where appropriate for the service, set a pressure-test interval, tag and record every hose. Owner: engineering. Verification: inspection records complete at 100 percent for two consecutive quarters; zero coupling failures.
4. Secondary containment and independent verification at the unload point. Owner: engineering. Verification: physical confirmation and a dry-run drill with the unloading crew.
5. Separate investigation from discipline. Adopt a written just-cause decision guide so that a supervisor's preliminary opinion never becomes the finding. Owner: plant manager. Verification: review of the next five investigations for whether causes were established before outcomes were assigned.

Avoiding the retrain trap: the trap is treating a knowledge deficit as the cause when the evidence points to a document-control and change-management failure. Retraining the operator would have failed here because the operator was plausibly trained to the old revision. Test every action against the question: if we complete this and nothing else changes, does the release mechanism disappear? Retraining alone does not pass that test. Re-issuing the procedure through change control, verifying competency, and fixing the hardware does.

Verify implementation, not just completion. At 30, 60, and 90 days, check that the actions were implemented as intended - the eyewash is actually being activated, the demonstrations actually happened - rather than that a spreadsheet row turned green.