DPC Enterprises Glendale Chlorine Release

📋 Incident Summary

On November 17, 2003, chlorine gas was released at DPC Enterprises Incorporated in Glendale, Arizona, during the transfer of liquid chlorine from a railroad tank car to a highway tanker truck. Sixteen people were medically evaluated, and approximately 1.5 square miles of surrounding neighborhoods were evacuated. No fatalities occurred.

During the transfer process, a transfer hose was overpressured when two valves were opened simultaneously, causing liquid chlorine to be driven through the scrubber system and out an improperly closed vent. The scrubber was equipped with an alarm that should have alerted operators to the overpressure condition — but the scrubber alarm had been routinely disabled by workers as a matter of common practice because it triggered frequently and was considered a nuisance. The alarm was silenced, and no one detected the chlorine release until it reached the community.

The CSB found that DPC Enterprises had allowed its scrubber alarm to be routinely disabled without management knowledge or authorization. No alarm management policy prevented operators from silencing safety-critical alarms. The culture of routine alarm defeat reflected a broader management failure to identify and correct hazardous safety shortcuts that had become normalized over time. The incident is a textbook example of how normalization of deviance can convert a safety system into a non-functional one.

🔎 Key Findings

Finding 1

Scrubber Alarm Routinely Disabled by Workers

The scrubber alarm designed to detect chlorine release conditions had been routinely silenced by workers as a matter of common practice because it triggered frequently. Management was unaware this was occurring.

Finding 2

Normalization of Alarm Defeat

Defeating the scrubber alarm had become a normalized safety shortcut among operators. No management policy, procedure, or audit had detected or corrected this practice.

Finding 3

Simultaneous Valve Opening Caused Overpressure

The release was initiated when two valves were opened simultaneously during the tank car-to-truck transfer, creating overpressure in the transfer system and driving liquid chlorine into the scrubber and out of an improperly closed vent.

Finding 4

Chlorine Release Reached Community Before Detection

Because the scrubber alarm had been silenced, the chlorine release was not detected at the DPC facility until it had already reached surrounding neighborhoods, triggering evacuation of 1.5 square miles.

Finding 5

No Alarm Management Policy

DPC had no policy governing alarm management, alarm defeat authorization, or the conditions under which safety-critical alarms could be inhibited, silenced, or bypassed.

Finding 6

Community Evacuation Required

Approximately 1.5 square miles of surrounding residential and commercial areas were evacuated as a result of the chlorine release, demonstrating the community impact potential of toxic gas releases at transfer facilities.

🔍 Root Causes

Normalization of Deviance in Alarm Management

The fundamental failure was the normalization of routine scrubber alarm defeat — a safety-critical alarm had been effectively removed from service through worker practice, without management awareness or authorization.

Absent Alarm Management Policy and Oversight

DPC had no alarm management program, no policy on alarm inhibiting, and no management oversight mechanism that would have detected the routine defeat of the scrubber alarm.

Simultaneous Valve Opening Procedure Inadequacy

The operational procedure that allowed simultaneous opening of two valves during chlorine transfer did not adequately protect against overpressure of the scrubber system.

No Consequence for Normalizing Safety Shortcut

The absence of any management audit or observation process meant the normalization of a dangerous safety shortcut went undetected and uncorrected for an extended period.

☑ CSB Recommendations

→ DPC Enterprises

Implement a formal alarm management program that prohibits defeating, silencing, or bypassing safety-critical alarms without documented management authorization and a defined time limit.

→ DPC Enterprises

Revise chlorine transfer procedures to prevent simultaneous opening of valves that can create overpressure in the scrubber system, and verify procedures are followed through direct supervision.

→ EPA / OSHA

Issue a safety bulletin on chlorine transfer facility alarm management practices, specifically addressing the hazard of routine safety alarm defeat and the need for management oversight of alarm status.

→ Chlorine Institute

Update chlorine facility safety guidelines to include specific requirements for alarm management, alarm defeat authorization, and periodic audit of alarm system functional status.

💡 Lessons Learned

⚠ Safety alarms that are routinely silenced are not safety systems — they are turned off. A culture where safety-critical alarms are regularly disabled without management knowledge is a culture where the safety system has been decommissioned.

⚠ Normalization of deviance — the gradual acceptance of safety shortcuts as normal practice — is one of the most insidious process safety hazards. Once a shortcut is normal, no one perceives it as a shortcut.

⚠ Management must actively verify that safety systems are functioning as designed. The only way to discover that a safety alarm has been routinely silenced is to go and look — not to assume it is working.

⚠ Alarm management is not just about alarm settings and priorities — it is about ensuring that when an abnormal condition occurs, the alarm system provides meaningful and actionable information to the people who need it.

⚠ Community evacuation following an industrial toxic release demonstrates that process safety failures are not confined to the facility fence line. Facilities with toxic release potential have an obligation to their communities.

PSM Elements: SOP · TRN · INC · EP · PHA

🔨 Safety Meeting Toolbox Talk

Topic: Alarm Defeat, Normalization of Deviance & Safety Culture

💬Have we ever audited whether safety-critical alarms in our facility have been routinely inhibited, silenced, or bypassed by operators as an accepted practice?

💬Do we have a formal alarm management policy that prohibits defeating safety-critical alarms without documented authorization, a defined time limit, and a compensating safeguard?

💬When safety systems or alarms trigger frequently enough to be considered nuisances, do we investigate and fix the root cause of the nuisance — or do we allow operators to silence them?

💬Does our facility have a management walk-around or safety observation program that would detect when safety shortcuts have become normalized practice in the field?

💬Are there any other operational practices in our facility that were once considered deviations but have become so common they are now accepted as normal?

✎ Team Action Items

✓Identify all safety-critical alarms in your area and audit whether any have been routinely inhibited, silenced, or bypassed without documented authorization — if yes, this is an immediate corrective action

✓Review your alarm management policy — confirm it explicitly prohibits routine defeat of safety-critical alarms and requires management authorization for any planned alarm inhibit

✓Ask front-line operators to identify any safety shortcuts or deviations that have become common practice in their work area — this is the fastest way to detect normalization of deviance

✓Conduct a safety walk-around specifically focused on whether safety systems — alarms, detectors, interlocks — are confirmed to be in their intended functional state

🔗 PSM Failures Behind This Incident

This incident traced to breakdowns across 5 PSM elements (SOP · TRN · INC · EP · PHA). Each represents a documented gap that process safety documentation and consulting can close before a similar event occurs at your facility.

Operating Procedures (SOPs)

Operators cannot reliably hold safe operating limits without clear, current, enforced procedures. Deviation from acceptable operating conditions — a root cause here — is a direct consequence of SOP failure.

Supporting documents in our library →

Training & Operator Competency

Workers must understand process hazards — not just the steps on the page. Training records, refresher frequency, and verified competency are all OSHA PSM requirements that gaps here violated.

Supporting documents in our library →

Incident Investigation

Near-misses and prior incidents almost always signal the exact failure mode that eventually becomes fatal. When investigation is absent or superficial, those warnings go unheeded until consequences arrive.

Supporting documents in our library →

Employee Participation

OSHA PSM requires workers to be meaningfully involved in hazard analyses and procedure development — not just trained on the finished product. Active participation catches gaps that management alone misses.

Supporting documents in our library →

Process Hazard Analysis (PHA)

A structured PHA or HAZOP study exists to identify exactly these scenarios before they occur. When PHA is absent, superficial, or overdue for revalidation, hazards operate unseen until they kill someone.

Supporting documents in our library →

SafeGuard PSM

Process Safety Management Consulting & Document Library

📂

PSM Document Library

32 ready-to-deploy PSM documents covering all 14 OSHA elements — procedures, checklists, and audit templates built for facilities operating under 29 CFR 1910.119.

Browse the Library →

📊

Free PSM Health Score

Find out where your PSM program stands across all 14 OSHA elements. Our free health score surfaces your biggest gaps in under 10 minutes — no account required.

Check Your Score →

📞

Consulting Services

PHA facilitation, PSM program builds, compliance audits, and OSHA inspection support. Transparent flat-fee pricing — no retainer required to get started.

View Pricing →

📋 Explore the full incident library: All 132 CSB Case Studies →