Jherrod ThomasThe Lion of Functional Safety™

October 13, 2026 · 9 min read

IEC 61511-1 §8 / §9OSHA 1910.134 / 1910.119 (l)CSB Catalyst Refiners Update

When Waste Was the Process Nobody Analyzed: Catalyst Refiners' Fatal Hydrogen Sulfide Release Through an IEC 61511, OSHA 1910.134 and Reactive-Hazard Lens

The plant had stopped making product. Silver reclamation was over, most process equipment was gone, and the only thing left running was the wastewater pretreatment system. That is exactly why this one matters: every hazard study the site ever did described a plant that no longer existed, and the work that killed two people was the one job nobody had analyzed. This post reads the CSB's update as a statement of which artifacts were absent.

The investigation is ongoing. The CSB has issued no recommendations and no root cause. Everything below is the CSB's interim description of what happened, and my reading of which engineering artifacts would have intercepted it.

The public record

The event. On April 22, 2026, workers at Catalyst Refiners, Inc., a subsidiary of Ames Goldsmith Corporation in Institute, West Virginia, were disposing of chemicals left on site during decommissioning. The CSB's update, issued August 13, 2026, says they put about 80 gallons of A-50 (a calcium chloride coagulant) and 275 gallons of M-2000A (a sodium trithiocarbonate metal precipitant) into a wastewater receiving tank, then started pumping diluted nitric acid from a tote into the same tank (CSB, August 13, 2026).

The sequence. The CSB's detailed update gives the timeline. About five inches of acid into the tank, the materials reacted and produced a fog. The pump operator unplugged the air hose, walked outside and passed out. At about 9:23 a.m. the relief shift supervisor walked toward the tank and lost consciousness. At about 9:28 a.m. an employee collapsed near the tank, and a second employee who pulled the supervisor away then collapsed too. Those two died; four others were seriously injured. A one-mile shelter-in-place was issued at 10:04 a.m. and lifted at 2:23 p.m. (CSB investigation update, PDF).

The chemistry. Chemistry World reports that the M-2000A safety data sheet describes the solution as incompatible with strong acids, and that the company "had no recorded procedure for disposing of this combination of substances" (Chemistry World). The CSB notes that hydrogen sulfide at 100 ppm is immediately dangerous to life or health, and that it is heavier than air and stays near the ground. The tank was open-top, 6 feet tall, 9 feet in diameter, 2,227 gallons.

The protective gaps. The CSB found four full-face respirators on site, at least three fitted with 3M 2091 P100 particulate filters that do not protect against hazardous gases. Workers told the CSB respirator use was no longer required once the site moved from production to decommissioning, and the company did not provide or require personal gas monitors. CSB Chairperson Steve Owens: "we are concerned that Catalyst Refiners did not require employees to wear respirators during decommissioning" (ISSSource, August 19, 2026).

The oversight context. Federal records show the facility was cited in 2018 and not inspected again before the fatal incident, in a state where six federal OSHA inspectors cover roughly 60,000 workplaces, per the AFL-CIO figures reported in May (Insurance Journal / Mountain State Spotlight, May 22, 2026). I note that and move on; regulatory staffing is not an engineering control, and a site cannot outsource its hazard analysis to an inspector.

The standards lens

I have not seen a public record establishing whether this site was covered by OSHA's Process Safety Management standard, and I will not assume it. The point is that the disciplines inside these standards apply to a decommissioning crew whether or not a regulator's threshold was crossed.

IEC 61511-1 §8, process hazard and risk assessment. The clause expects hazards to be identified for the process in its foreseeable operating modes, with the initiating causes, consequences and existing protection written down. Decommissioning and waste disposal are operating modes. If the analysis covers "normal operation, startup, shutdown" and stops there, the mode that ran on April 22 had no hazard row, and therefore no safeguard was ever allocated to it.

IEC 61511-1 §9, allocation of safety functions to protection layers. Even a plain mixing of two bulk liquids is an allocation problem: which layer prevents the incompatible pair from meeting, and how independent is it from the layer that already failed? Here the layers were a procedure that did not exist, PPE that did not match the hazard, and monitors that were not issued. Three layers with three different failure states is not defense in depth, it is a list of missing items.

OSHA 29 CFR 1910.134(d), respirator selection. The selection logic requires a respirator suited to the hazard; a P100 particulate filter does not remove a gas. A respirator program that was switched off when the production mode ended could not have selected anything.

OSHA 29 CFR 1910.119(l), management of change (where PSM applies), and the general MOC discipline where it does not. Moving from production to decommissioning changes materials, quantities, people and permitted tasks. That is a change. Its trigger should have forced the question "what is now the highest-energy thing we will do with the chemicals we still have?"

Reactive-hazard screening. The CCPS guidance on chemical reactivity evaluation exists for this exact failure: build the compatibility matrix for every chemical on site, including residuals and wastes, before anyone moves a tote. The M-2000A SDS already said "incompatible with strong acids." The information was on paper. It was not in a matrix tied to a task.

A worked snippet: decommissioning-mode hazard row and FMEA

This is a reconstruction of the rows that should have existed. Likelihoods and ratings are illustrative, not measured, and I label them as such.

HAZOP-style row for the decommissioning mode

| ID | Mode | Deviation | Cause | Consequence | Existing safeguard (per CSB record) | Gap | |---|---|---|---|---|---|---| | DH-01 | Waste disposal via pretreatment | Other than: wrong material added | Strong acid added to tank containing trithiocarbonate | H2S generation above 100 ppm in open-top tank, fatal exposure | SDS statement "incompatible with strong acids" | No written procedure, no compatibility check, no permit | | DH-02 | Waste disposal via pretreatment | More of: acid into loaded tank | Transfer order set by shift supervisor verbally | Rapid reaction, fog within about five inches of acid addition | None identified | No sequence control, no stop criterion | | DH-03 | Rescue response | No detection: gas not sensed | No personal gas monitors, no fixed H2S sensing identified | Second and third victims enter the atmosphere | Fire alarm pulled after collapse | No atmospheric trigger for stop-work or rescue |

FMEA excerpt (Action Priority, not RPN)

| Failure mode | Effect | S | O | D | AP | Action | |---|---|---|---|---|---|---| | Incompatible pair brought together in one tank | Toxic gas release | 10 | 5 | 8 | H | Physical segregation: separate tanks, dedicated hoses and unique fittings per chemical class | | Respirator cartridge does not match hazard | No protection when needed | 10 | 5 | 7 | H | Gas-rated cartridges tied to a task-based selection chart | | No personal gas detection | Late warning, rescuers become victims | 10 | 6 | 9 | H | Issue personal four-gas monitors for any task with a reactive-pair waste | | Verbal task sequence | Order of addition not controlled | 8 | 6 | 7 | H | Written, signed-off sequence with hold points |

Fault tree, top event

TOP: Worker exposed to H2S above 100 ppm during waste transfer
 +-- OR
     +-- H2S generated in tank
     |    +-- AND
     |         +-- Trithiocarbonate (M-2000A) present in tank
     |         +-- Strong acid added to tank
     |              +-- No compatibility check before transfer
     |              +-- No written disposal procedure
     +-- Worker not protected
          +-- AND
               +-- No gas-rated respirator in use
               +-- No personal gas monitor issued
               +-- No stop-work trigger on first sign of fog

Derived requirements (excerpt)

These are the requirements I would write for a decommissioning-mode hazard record. Numeric thresholds are illustrative design values for discussion, set well below the 100 ppm IDLH the CSB cites.

What the headline really tells us

The headline says a chemical reaction killed two workers. The record says something narrower and more fixable: a site that knew, from its own SDS, that the precipitant did not tolerate acid, and that kept strong acid and the precipitant in the same building, never asked what task would put them in one tank. The missing artifact is not a sensor or a bigger respirator. It is a hazard analysis for the mode the plant was in on the morning of April 22, with a compatibility matrix tied to tasks and a procedure that makes the safe order of operations the only order. Decommissioning is not a quieter version of production. It is the mode in which the people who know the plant best are leaving and the chemicals nobody wants are still on the floor.

Sources

Jherrod Thomas — The Lion of Functional Safety™