11 Workers Died After a Tank Deemed ‘Not Fit for Continued Service’ Remained in Operation

Respect for the victims comes before analysis

Eleven workers lost their lives. Others suffered severe burns, families were affected and the Longview community was changed by the event. This case study does not use tragedy as spectacle. Its purpose is to handle official evidence carefully and turn what is already documented into lessons that may protect other people.

The U.S. Chemical Safety and Hazard Investigation Board investigation remains open. This article therefore separates confirmed facts, technical analysis and unresolved questions. It does not claim a final cause or assign criminal responsibility.

Direct answer: what does this accident teach?

Inspection alone does not prevent catastrophe. When equipment is described as “not fit for continued service”, the finding must lead to an effective operating decision: repair, internal inspection, removal from service, derating or another technically supported control.

For G Tank, the hazard was not invisible. Loss of thickness had been measured, the condition documented, and the report had warned of a high likelihood and consequence of failure. The central lesson is the dangerous gap between finding a defect and controlling it.

What happened at Nippon Dynawave

At about 7:09 a.m. on 26 May 2026, a 1.2-million-gallon atmospheric storage tank catastrophically failed at Nippon Dynawave Packaging's pulp and paper mill in Longview, Washington. Approximately 900,000 gallons of white liquor were released.

The release killed 11 employees. Three other employees were seriously injured; five employees and one firefighter sustained injuries that did not require inpatient hospitalisation. The tank had been built in 1987 from 40 welded carbon-steel plates arranged in five shell courses and had no secondary containment to capture spills.

The CSB is still examining the failure mode and cause, mechanical integrity practices, inspection and repair decisions, management of change, project management, hazard evaluation and emergency response.

The operating timeline before the failure

At about 1:55 a.m., a process upset took the digester unit out of service. White liquor flow from G Tank to the digester slowed and stopped completely at about 4:08 a.m., while liquid from the recausticizers continued entering the tank at a reduced rate.

The level rose to approximately 90% by 6:22 a.m. Employees arrived around 7:00 a.m. and waited for morning meetings in the electrical and mechanical maintenance shops around the courtyard. The tank failed at approximately 7:09 a.m.

This sequence describes process conditions and exposure; it does not establish the final cause. That determination belongs to the ongoing investigation.

What white liquor is—and why the release was so severe

White liquor is a strongly alkaline solution used in the Kraft process to separate lignin from cellulose fibres. According to information summarised by the CSB, it consisted mainly of water, sodium hydroxide, sodium sulfide and disodium carbonate, with a pH around 13.

The liquid was stored at approximately 200°F, about 93°C. It was therefore a very large inventory that was both hot and highly caustic, capable of causing serious burns to skin, eyes and the respiratory system.

White liquor should not be confused with concentrated black liquor from another stage of the process. The official update describes white liquor as caustic; this article does not classify it as flammable.

The decisive detail: the hazard had already been identified

In July 2025, about ten months before the incident, an external visual inspection and ultrasonic thickness testing found significant thinning in the lower shell regions below the calculated minimum safe thickness.

The inspection contractor recommended internal inspection and repair of shell courses 1, 2 and 3. The report said G Tank was “not fit for continued service” unless repaired and recorded a “high likelihood/consequence of failure”.

External inspections in October 2025 and February 2026 again identified large areas below the calculated minimum. According to the CSB, the tank was not internally inspected or repaired, removed from service or derated before the accident.

What minimum safe thickness means

Minimum safe thickness is not a generic number. It is the amount of material needed for an atmospheric tank to contain the liquid head, support the tank's weight and withstand the other loads included in the calculation.

The evaluation accounts for dimensions, construction material, stored substance and operating conditions. The CSB cites API 653 for calculations and guidance on inspection, repair, alteration and reconstruction of atmospheric tanks.

A reading below the calculated minimum does not prove immediate failure at a predictable time. It does mean that continued operation at normal conditions requires a formal, technically defensible response.

This was not simply a lack-of-inspection case

There was an inspection, measurements and a critical finding. Reducing the event to “insufficient inspection” would hide a more important systemic issue: technical information did not become an effective barrier before the tragedy.

Mechanical integrity is a decision system connecting design basis, history, inspection, maintenance, operations, engineering, risk, budgets, shutdowns and verification of corrective action. A report cannot control the hazard it describes on its own.

An organisation may have capable professionals and sophisticated tools and still fail if critical recommendations enter a backlog without a deadline, accountable owner, safe interim condition or authority to stop work.

Normalisation of deviance and continued operation

A known defect may gradually feel tolerable when equipment continues to operate without immediate failure. Each apparently normal day can be misread as evidence that the condition remains acceptable.

Absence of failure does not demonstrate remaining margin. It may only mean that a critical combination of degradation, inventory, loading and exposure has not yet occurred. Repeating external inspections without changing the condition is not the same as reducing the identified risk.

Governance must prevent production schedules from replacing engineering criteria. The more severe the finding, the clearer the stop authority, deadline, interim controls and senior accountability must be.

When should equipment be taken out of service?

No universal answer can replace engineering judgment. A decision should consider the applicable fitness criterion, extent and mechanism of degradation, measurement uncertainty, hazardous inventory, consequences, people exposed and available controls.

A properly supported assessment may sometimes define a reduced liquid level, capacity, temperature or other variable—derating. In other cases, removing the equipment for internal inspection, repair or replacement is the only defensible response.

Continued operation should never happen by inertia. Its technical basis, limits, monitoring, deadline, accountable authority and contingency plan must be explicit.

What the emergency response revealed

After the failure, the company radioed its medical emergency response team. According to the CSB, the message did not specify that white liquor had been released. A responder entered the liquid believing it was water and suffered serious chemical burns while trying to rescue an employee.

Emergency response is not only willingness to help. Identifying the substance, communicating the scenario, establishing control zones, checking structural conditions and preventing unprotected entry are part of rescue itself.

A courageous but uninformed response can create another casualty. Chemical inventory, alarms, incident command and responder protection must be connected before an emergency occurs.

Five practical mechanical integrity lessons

The case supports practical principles without anticipating the CSB's final causal findings.

• Inspection without an action plan, deadline and closure evidence is information—not control.
• Critical recommendations require governance proportional to their possible consequences.
• Fitness-for-service criteria cannot be set aside merely because equipment is still running.
• Operations, maintenance, inspection, engineering and leadership need a shared view of criticality.
• Emergency plans must identify the released agent and protect responders from secondary exposure.

What Brazilian companies can learn

The accident occurred in the United States and must be evaluated under evidence and rules from that jurisdiction. For Brazilian companies, the lesson lies in integrating mechanical engineering, occupational risk management, maintenance, management of change, emergency response and technical authority.

Brazil's risk-management documents do not replace equipment integrity criteria. Engineering reports likewise do not replace exposure assessment, access control, occupied-building placement and preparation for major releases.

Changes in level, product, temperature, capacity, process, surrounding occupancy or structural condition must reach operating decisions. When disciplines work in isolation, dangerous gaps remain between equipment and exposed people.

Would this automatically be a Brazil NR-13 case?

Not necessarily. Official sources describe G Tank as an atmospheric storage tank, not a boiler or pressurised vessel. Washington L&I also stated that it was not regulated by the state's boiler and pressurised storage tank programme.

In Brazil, NR-13 applicability depends on the regulation's scope and the equipment's actual characteristics, content, dimensions, pressure and configuration. The word “tank” alone is not enough to determine coverage.

The broader lesson is not to force a U.S. accident into a Brazilian rule. It is to ensure that every high-consequence asset has integrity criteria, responsibilities and decision controls proportionate to its risk.

Checklist: is a critical technical warning receiving the right response?

These questions do not replace engineering criteria; they audit governance between the finding and the decision.

• Has the issue only been identified, or is effective treatment underway?
• Are accountability, deadline, criticality and interim conditions formally defined?
• Does the asset still meet minimum integrity criteria?
• Is internal inspection, repair, reassessment, replacement or derating required?
• Is continued operation technically defensible, and for how long?
• Have operations, maintenance, engineering and occupational safety received the same information?
• Is the recommendation tracked through verified closure?
• Have emergency scenarios and occupied areas been reassessed?
• Do responders know the substance, operating limits and protective resources?
• Is the decision—and its technical basis—documented?

Conclusion: knowing the risk is not enough

The greatest failure is not always failing to see a hazard. Sometimes it is seeing it, measuring it, documenting it and continuing as though the information changed nothing.

The final causal conclusion belongs to the ongoing CSB investigation. What official records already establish is that shell thickness was below the calculated minimum, internal inspection and repair were recommended, the tank was described as unfit for continued service without repair, and later measurements kept the condition visible.

Mechanical integrity starts with technical evidence, but it becomes protection only when an organisation turns evidence into a decision.