Andy Garcia · freelance dev
FRENES
Back to the blog
Engineering

A Paper Mill Tank Failed and 11 Workers Died. Ten Months Earlier, It Was Rated Not Fit for Service.

October 20, 2026 7 min read

On August 28, 2026, the US Chemical Safety and Hazard Investigation Board (CSB) published an update on its investigation of the tank failure at the Nippon Dynawave Packaging (NDP) pulp and paper mill in Longview, Washington. According to the update, on Tuesday, May 26, at about 7:09 a.m., a 1.2-million-gallon storage tank known as G Tank failed and released about 900,000 gallons of white liquor, a caustic solution stored at about 200°F. It flooded a courtyard and the ground floors of the buildings around it, where maintenance crews were waiting for their morning meetings. Eleven employees died. Three were seriously injured. Five more employees and a firefighter were hurt but did not need to be admitted to a hospital.

The update is interim. The first item on the CSB's own list of open work is "determining the failure mode and cause(s) of the tank failure." NDP said the same evening that the update "failed to include important facts and context regarding actions taken by NDP and the timeline of events," and that it is "not a final determination of the facts or cause." It added that, because the investigation remained ongoing, it would not comment on individual findings or documents. I stay with what the update documents.

I build software, not tanks, as CTO of a LegalTech company, and every system I run produces findings someone has to act on. I read the update because of one detail: ten months before the failure, the tank's condition had been measured, written down, and rated at the top of the inspector's scale.

What the tank held, and where it stood

White liquor breaks down wood into pulp. NDP's safety data sheet, quoted by the CSB, lists 8 to 15% sodium hydroxide, 3 to 10% sodium sulfide and 3 to 10% sodium carbonate in water, with a pH of about 13. At 200°F, about 93°C, it is also scalding: the update notes that water at 150°F can cause third-degree burns within seconds.

G Tank was built in 1987 to the 1984 edition of API 650, the standard for welded storage tanks: 40 carbon-steel plates welded into five rings, called courses, each made of eight 26-foot plates. By my arithmetic, that is a ring about 208 feet around, 66 feet (20 meters) across; with the roughly 45-foot shell height on the CSB's chart, that is consistent with the 1.2 million gallons. There was no secondary containment to catch a spill. The tank stood in a courtyard ringed by buildings whose ground floors held maintenance shops, break rooms and locker rooms. A former engineer of Weyerhaeuser, the mill's owner until 2016, told the CSB it went there because "that was the available area."

Why the bottom of a tank matters most

Liquid pushes outward harder the deeper it is. At the bottom of a 45-foot column of plain water, the pressure is about 19.5 pounds per square inch, or 1.3 bar. That sounds small, but the wall resists it as a ring in tension, which grows with pressure and diameter. On a ring 66 feet across, my arithmetic gives roughly 7,700 pounds of force, about 3.5 tonnes, pulling apart every inch of wall height near the floor. The stress in the steel is that force divided by the wall's thickness: lose half the steel and the stress doubles.

That is why a tank wall is built in steps. The CSB's Figure 4 shows G Tank's original design thickness going from about 0.94 inch in the bottom course to about 0.63 inch in the top two. The calculated minimum safe thickness (what is needed to hold the liquid's pressure and carry the tank's weight, among other factors, per a calculation in API 653) steps down from about 0.59 inch to about 0.10.

It also explains the middle option between repair and business as usual: with less liquid above it, a course carries less pressure. The CSB calls running a tank at a reduced level, capacity or other process variable derating, and notes that API 653 has guidelines for lowering the allowable liquid level of a tank thinner than the minimum.

What the July 2025 inspection found

In July 2025, NDP's inspection contractor examined the tank from the outside, visually and with ultrasonic thickness testing, which measures steel by timing an echo through it. Reading the CSB's chart of the result, the average thickness in the second course, 8 to 16 feet up, sits around 0.3 inch, against a minimum of about 0.5 and an original design of about 0.83. The average thickness was below the minimum from roughly 6 to 21 feet up. The update does not say what thinned the steel.

The report recommended an internal inspection and repairs to courses 1, 2 and 3. It stated that the tank was "[n]ot fit for continued service" unless repaired, with a "[h]igh likelihood/consequence of failure." The excerpt in Figure 5 shows a three-level scale, and all three findings in it sit at priority 1, the top. The first, on course 2, adds that it is "likely that the entire shell course should be replaced." The third is quieter: "[m]inimal design information is known," specifically the material of construction and the joint efficiency of the shell welds, and the owner should obtain design documentation "in order to perform more accurate minimum thickness calculations." Even the threshold was uncertain, and the inspector said how to fix that.

Ten months, two more measurements

NDP, the update says, scheduled additional inspections "while continuing to operate G Tank normally." The same contractor inspected the outside again in October 2025 and February 2026. Both times, large portions of the shell remained thinner than the calculated minimum. Between July 2025 and the failure, NDP did not inspect the tank internally, repair the shell, take it out of service or derate it.

"Our investigation is examining why the tank remained in service without either being repaired, or operated under reduced conditions," said CSB supervisory investigator Mark Wingard. The update does not answer it. A spokesperson for the workers' union, the Association of Western Pulp and Paper Workers, said the update "raises urgent questions about how technical findings and recommendations concerning the tank were communicated, evaluated and incorporated into decisions about its continued operation," while noting that it does not establish a specific cause.

The morning of May 26

The update gives this timeline. At about 1:55 a.m., a process upset in the digester, the vessel where white liquor cooks the wood chips, forced it out of service. At about 4:08 a.m., the flow from G Tank to the digester was stopped completely. White liquor kept arriving from the units that regenerate it, at a reduced rate. By about 6:22 a.m., the tank was about 90% full. Around 7:00, employees arrived for their shift and went to the maintenance shops. At about 7:09, the tank failed.

Seventeen employees were on the ground level. The wave crushed vehicles, destroyed a roll-up door and a wall, and entered the shops. All eight people in the electrical shop and an operator in the courtyard died, as did two of the eight in the mechanical shop. The radio call to the plant's volunteer medical responders did not say that white liquor had been released. One responder waded into a pool of it to reach a colleague, believing it was water, and was seriously burned.

The CSB lists the operating conditions before the failure among the areas it is examining. The update does not say that the rising level caused the failure, and neither do I.

What I take from it

A paper mill is not a codebase, and nothing in the software I run compares to eleven deaths. But a measured problem at the highest severity that stays open for months is a shape every engineering team will recognize. As analogies, here is what I would check in mine:

  1. Give the top severity a forced exit. A critical finding should end in one of three states, with an owner and a date: fixed, taken out of service, or running reduced. Open is not a state.
  2. Treat a repeat measurement as a shorter clock. When a second scan confirms a critical finding, the deadline should move closer, not reset.
  3. Define your derate in advance. For a tank, a lower fill limit. For software, a read-only mode, a lower rate limit, a feature switched off.
  4. Watch the buffers. When the digester stopped, inflow continued and the level rose; what role that played is for the CSB to say. A queue in front of a stopped consumer does the same. Know which buffer fills first, and what is weak inside it.
  5. Name the hazard in the alert. The radio call did not; an incident message should say what is leaking and what not to touch.

OPB reported in September that Washington state agencies did not regulate above-ground chemical tanks at paper mills; companies inspected their own, and a state senator said he would propose oversight in the January 2027 session. Whatever becomes of it, this tank had already been measured, reported and ranked.

The measurements did their job three times. Why they did not change how the tank was run is the question the CSB said in August it is examining, and the one worth asking of our own systems before something fails.

Sources

A project like this one?

I design and deploy products like this. Let's talk.

Let's talk