Process Safety · Lesson 51 · 8 min read

An Inspection Finding Must Change the Operating Decision

Inspection is not the final barrier. The barrier is the safe decision made from the evidence. When a competent assessment shows that equipment no longer meets its accepted operating basis, normal production, additional inspection or a future repair plan cannot by themselves make continued service safe.

The hazard mechanism: degraded strength meets changing load

A tank, vessel or pipe contains material because its remaining strength is adequate for the actual pressure, liquid head, temperature, support loads and credible transients. Corrosion, cracking, erosion or another damage mechanism can reduce that margin. A change in level or operating condition can then apply a load the degraded boundary can no longer carry.

Atmospheric tanks deserve the same discipline as pressurised equipment. A large liquid inventory produces hydrostatic load, and a sudden shell failure can release a fast-moving wave of hot, toxic, corrosive or flammable material. People, occupied buildings, escape routes and emergency responders may be exposed even when the tank operates at low pressure.

Official investigation update: clear evidence preceded failure

The U.S. Chemical Safety Board's August 2026 investigation update describes the 26 May 2026 catastrophic failure of a 1.2-million-gallon atmospheric tank at Nippon Dynawave Packaging Company in Longview, Washington. About 900,000 gallons of hot, highly caustic white liquor were released. Eleven employees were fatally injured and three were seriously injured.

The CSB reported that external inspection in July 2025 identified significant shell thinning below the calculated minimum safe thickness. The contractor recommended internal inspection and repair and stated that the tank was not fit for continued service unless repaired. Later external inspections again found substantial areas below minimum thickness. The tank was not internally inspected or repaired, removed from service, or operated under reduced conditions before the failure.

The CSB investigation remains ongoing, so this article does not claim a final root cause. The established facts already provide a practical lesson: repeating measurement does not resolve an unacceptable condition. The organisation must convert the finding into a controlled operating decision.

Official CSB surveillance footage of the G Tank failure. The video documents the actual event; the generated training images in this article do not.

Inspection evidence needs a decision path

HSE guidance for flammable-liquid tanks calls for planned formal examinations plus routine visual inspection, a system to record defects and initiate appropriate remedial action, and examination by a competent person. It also says examination scope and frequency should reflect service, maintenance history and known or potential damage mechanisms, with records kept for examinations, tests, modifications and major maintenance.

That chain must end in a decision. The responsible technical authority should state what the finding means for fitness for service, operating limits, further examination, repair and return to service. Operations then needs a clear status it can apply: continue within an accepted basis, operate under formally approved restrictions, or remove the equipment from service. Unclear ownership leaves a dangerous gap between inspection and control.

Hypothetical FPSO example: a cargo-tank finding cannot wait

Hypothetical example—not a documented incident: An FPSO cargo-tank survey identifies local shell readings below the installation's approved acceptance basis. A follow-up inspection is proposed for the next campaign, but no competent assessment has accepted the tank for current service or defined a reduced level.

The operations supervisor does not treat the next inspection date as permission to continue. The tank is declared impaired through the approved process. Inventory movement and nearby activities are controlled while integrity specialists confirm the data, assess the damage mechanism and define the safe disposition. If continued service is not positively justified within documented limits, the tank is removed from service using the approved plan. The example does not prescribe a universal thickness, fill limit or repair method.

Critical controls

Verified data: confirm equipment identity, measurement locations, calibration, coverage, material and the conditions under which readings were obtained. Resolve suspect data promptly, but do not use uncertainty as a reason to assume the favourable case.

Competent assessment: compare the finding with the correct design and fitness-for-service basis. Include the credible damage mechanism, remaining strength, operating envelope, loading sequence and consequence of failure. A single reading or generic limit is not a complete assessment.

Explicit disposition: record who accepts continued service, the technical basis, operating restrictions, expiry or review point, monitoring, repair plan and conditions that require shutdown. If the basis is not established, the barrier remains unresolved.

Exposure control: consider inventory reduction, occupied-area restrictions, simultaneous work, escape routes and emergency response while the condition is open. Administrative controls do not restore steel, but they can reduce exposure while the safe disposition is implemented.

Leadership actions

Leaders should require critical inspection findings to remain visible until the physical condition and operating basis are both resolved. Production pressure, repair cost or a history of stable operation cannot overrule competent evidence. Repeated inspections should answer a defined technical question, not defer action.

Management review should test whether similar equipment shares the same damage mechanism, whether decision rights are clear, and whether overdue recommendations have accumulated. A sound assurance process tracks the finding from detection through assessment, operating control, repair and verified return to service.

Three practical actions

• Trace one critical finding: select an open integrity recommendation and identify its current disposition, accountable technical authority and approved operating limits.
• Challenge the evidence gap: ask whether repeat inspection is resolving uncertainty or merely delaying repair, derating or shutdown.
• Verify restoration: require repair records, examination acceptance and updated equipment status before removing restrictions.

Takeaway and team discussion

Key takeaway: inspection creates protection only when the evidence changes the operating decision before the equipment fails.

Discussion question: which current inspection finding on our installation has the greatest consequence if its assumed operating basis is wrong, and who has formally accepted that basis?

Continue in the Process Safety hub, and connect this lesson with mechanical-integrity evidence, controlled temporary repair and hidden corrosion risk.

Verified primary references

1. U.S. CSB: Fatal Tank Failure at Nippon Dynawave Packaging Company—August 2026 investigation update.
2. U.S. CSB: official investigation update news release.
3. U.S. CSB: official G Tank surveillance video page.
4. UK HSE HSG176: Storage of flammable liquids in tanks—inspection, defect-action, competent-examination and recordkeeping guidance.

Published and sources checked 2 November 2026. Educational discussion only: apply the installation's approved safety case, integrity-management system, competent-person assessment, fitness-for-service method, operating limits and impairment procedures. No universal thickness, fill limit, inspection interval, derating factor or repair method is supplied.

Discuss this article in the comments →

Register interest in future HSSE email updates