One Minute of Warning

Watch: New safety breakdowns every week on YouTube — youtube.com/@GetSafetyIntel

Share: Got a near-miss you can't put your name on? We publish them anonymously. QR + link at the bottom.

It was Labor Day. The Pennsylvania Railroad was moving a nation at war, and the Congressional Limited out of Washington was so full they ran it in sections. The advance section — sixteen cars, listed in the record as Passenger Extra 4930 East — came north through Philadelphia in the early evening carrying servicemen, families, and holiday travelers.

About a mile west of Shore tower, at Frankford Junction, the enginemen on a yard engine looked up and saw fire and smoke coming off the left side of the passing train. They went straight to the telephone and called the operator at Shore.

The train had already gone by.

Roughly one minute after they saw it, the left front journal on the front truck of car No. 7 — Pennsylvania Railroad coach 1860 — broke. At 6:06 p.m., at 56 mph in territory good for 70, the seventh car came off the rail and took the train apart against the signal gantries. Seventy-nine people were killed. The Interstate Commerce Commission counted 129 injured; other contemporary accounts put it lower. Practically all of the dead were in car No. 7 and car No. 8.

Now the part that should keep you up.

That journal had been repacked on June 16, 1943. It was inspected at Washington before the train left, and the inspection found nothing. Investigators later pulled the broken end and ran the metal: it had reached something on the order of 1,400 degrees Fahrenheit. The bearing had lost all of its lining metal. And when the ICC took the axle, the wedge and the bearings apart looking for the reason, its report says examination failed to disclose anything that would have caused the overheating.

The Commission's finding is one sentence: "It is found that this accident was caused by a broken journal."

Investigation No. 2726 contains no recommendations.

What actually failed.

Not the inspector at Washington. He looked, and the defect that killed 79 people was not visible to a man with a lamp and a hammer at the moment he looked.

Four things failed, and none of them is a person.

The failure mode was progressive and internal. A journal bearing does not fail the instant it goes bad — it heats, wipes its lining, cooks its lubricant, and announces itself for miles, from the inside, where nobody was looking.

The inspection was a snapshot of a moving condition. A pre-departure check tells you the state of an asset at one instant. It cannot tell you the rate of change, and rate of change was the whole story.

Detection depended on a human eye and a phone call. The only sensor on that train was a man on another locomotive who happened to look up at the right second. That is not a detection system. That is luck with a job title.

And there was no way to turn the warning into a stop. Even given instantly and correctly, it could not get in front of a train doing 56 mph. Detection with no reachable intervention is not a control. It is a witness.

The HOP read.

Human and Organizational Performance says error is a consequence, not a cause — and here nobody even had to make an error. Every person in this story did their job. The packer packed. The inspector inspected. The enginemen saw smoke and acted within seconds. The system still killed 79 people, because it had exactly one barrier between a degrading bearing and a mass-casualty derailment, and that barrier was somebody's eyesight.

That is a brittle system: it works right up until the moment it is asked to work fast.

And notice what the ICC did with it. Cause: broken journal. Recommendations: none. The file closed on the component and left the failure mode in service. Eighty years later a bearing on the 23rd car of a Norfolk Southern train ran hot across northeastern Ohio and put East Palestine on the evening news. Same failure mode. Better sensors. Still inside the window.

How far inside? In its final report on the February 3, 2023 derailment, the NTSB documented that bearing passing three wayside detectors: 38 degrees above ambient, then 103, then 253 — against railroad criteria that called for stopping to inspect between 170 and 200 and setting the car out above 200. The alarm was not wrong. It was last.

(current as of September 6, 2026 — verify current text at ecfr.gov before you build a program on it)

Rail freight equipment condition and inspection sit under FRA's freight car safety standards at 49 CFR Part 215, and after East Palestine the FRA issued Safety Advisory 2023-01 on the use and maintenance of hot bearing wayside detectors, supplemented twice.

But you probably don't run a railroad, so here is the same lesson in the standards you do own.

29 CFR 1910.119(j) — Process Safety Management, mechanical integrity: written procedures, trained people, and inspection and testing of process equipment on a schedule following recognized and generally accepted good engineering practice. Then read 1910.119(j)(5), which is the whole ballgame: equipment deficiencies outside acceptable limits must be corrected before further use, or in a safe and timely manner when necessary means are taken to assure safe operation. "We measured it and kept running it" is not in there.

40 CFR 68.73 carries the parallel mechanical-integrity duty under EPA's Risk Management Program.

And the floor-level versions, the ones your crews actually touch: 29 CFR 1910.178(q)(1) — any powered industrial truck not in safe operating condition is removed from service, with (q)(7) requiring the examination before it's placed in service. 29 CFR 1910.184(d) — damaged or defective slings are removed from service immediately. 29 CFR 1910.179(j) — frequent and periodic crane inspections, precisely because a crane degrades between them.

Every one of those rules exists because somebody learned that a thing which passed inspection can still be on its way to failing.

And underneath all of it, 29 U.S.C. 654(a)(1) — the General Duty Clause — which does not care whether a specific standard names your equipment.

Environmental. In 1943 a broken bearing spilled steel and people. Run the same failure mode through a modern consist and it spills vinyl chloride, and the emergency becomes an air-and-water event measured in ZIP codes. The transfer to your site is direct: asset integrity is environmental compliance. The tank shell, the flange, the transfer hose — that is your containment, and containment failures are reportable events before they are anything else.

Health. The acute story is burns and crush injuries. The one people skip is what happens to the crews who pulled others out of an overturned coach and went back to work Tuesday. In 1943 nobody had language for it. You do — and your CISM or EAP callout is either a written step in your emergency plan or something you'll improvise badly on the worst night of somebody's career.

Safety. Covered above, and it reduces to one sentence: the failure was invisible, the inspection was a snapshot, and the warning arrived inside the failure window.

1. Washington: they measured the tank three times and kept it in service.

On May 26, 2026, a 1.2-million-gallon atmospheric storage tank failed catastrophically at the Nippon Dynawave Packaging mill in Longview, Washington, releasing roughly 900,000 gallons of caustic white liquor at about 200°F. Eleven employees were killed. Three were seriously injured; five more employees and a firefighter had minor injuries. In an August 28, 2026 investigation update, the CSB reported that a July 2025 inspection — ten months before the failure — found the tank's carbon-steel shell had thinned below its minimum safe thickness and was not fit for continued service, and that further inspections in October 2025 and February 2026 confirmed the same condition. CSB Chairperson Steve Owens said the tank "was not promptly removed from service or properly repaired."

So what for safety leaders: this is Frankford Junction with the opposite problem. In 1943 the data did not exist. In 2026 the data existed three times and nothing moved. Ask yourself the uncomfortable version of the question: what is on your inspection records right now, flagged, that is still running? If a measurement can be filed without triggering a decision, the measurement is decoration.

2. Wisconsin: the same hazard, twice, five weeks apart.

OSHA announced on August 20, 2026 that it cited IPMF LLC, operating as NaturPak, after two incidents at its Janesville, Wisconsin plant. On February 12, 2026 and again on March 18, 2026, pressurized industrial kettle lids opened under pressure and released steam, hot liquid, and product onto workers. Three workers died and others were burned or hospitalized. Reporting on the citations describes serious violations for thermal and pressure hazards, falls, and lack of emergency water access; repeat violations tied to lockout/tagout and training; and an other-than-serious citation for failing to notify workers of permit-required confined spaces. Proposed penalties totaled $364,100 across the two inspections.

So what for safety leaders: five weeks is the number to sit with. The first event is the wayside detector reading. If your corrective actions from a serious incident cannot be completed, verified, and physically confirmed inside five weeks, you are relying on the same luck that put a second crew in front of the same kettle.

3. Pennsylvania: silica, and the word "willful."

In an August 26, 2026 news release, OSHA cited General Shale Brick Inc., doing business as Watsontown Brick Company, after a February 12, 2026 inspection at its Watsontown, Pennsylvania plant, alleging employees were exposed to respirable crystalline silica above allowable limits. Reporting on the citations lists three willful, four serious, one repeat and one other-than-serious violation, with proposed penalties of $496,528, touching regulated areas, exposure monitoring, medical exams and respirator fit testing. The inspection came through OSHA's site-specific targeting and its silica emphasis program.

So what for safety leaders: health hazards degrade like bearings do — silently, internally, and on a schedule nobody feels. Exposure monitoring is your wayside detector. If you have sampling data and no matching engineering control, you have written the government's case for willfulness in your own handwriting.

Shared blamelessly, because that's the only way anyone learns from it.

A millwright is walking the line at shift change and stops next to a pump he passes forty times a day. Something is off. Not a noise anyone would write up — the pitch is just a little higher than it was Thursday. He puts a hand near the bearing housing and pulls it back. Hot. Not smoking, not seized. Hot.

The pump is on a monthly vibration route and it passed eleven days ago. Production is mid-run. Nobody wants to hear it. He calls it anyway, they swap to the spare, and the teardown finds the inboard bearing wiped and the housing bore already scored. Two more days and it fails with the seal — and the seal was on hot caustic.

The HOP read: the monthly route did its job perfectly and was still useless, because eleven days ago the pump was fine. The condition that mattered developed between data points — same as a journal repacked in June and broken in September. What caught it was a person with enough exposure to that machine's normal state to notice a small deviation from it, and enough psychological safety to interrupt a run over a hunch he couldn't put a number on.

Two questions worth more than the vibration program: can "it feels wrong" become a work order at your site without the person needing to be right first? And what happens to that millwright if they tear it down and the bearing is fine? If the answer is anything but "we thank him," you have quietly priced the next catch out of the market.

Got a fail or a near-miss? Hit reply, or scan the QR below — we'll feature it anonymously — no names, no company, no blame. Just the lesson, so the next crew doesn't learn it the hard way.

Pull your open inspection findings today — mechanical integrity, thickness readings, vibration exceptions, crane and sling tags, exposure sampling, whatever your site generates — and sort them by the date they were raised, not by priority.

Then find every one older than 90 days still open on running equipment, and for each, answer out loud: what is holding this asset in service, and who decided that?

That is the whole distance between today's two stories. At Frankford Junction the data did not exist and 79 people died. At Longview the data existed three times and eleven people died. One of those is a technology problem from 1943. The other is a decision problem, and it is sitting on your desk this morning.

Watch: youtube.com/@GetSafetyIntel

Share your near-miss, anonymously: scantoconfess.com — or scan the QR above. No names, no company, no blame.

Forward this to one person on your crew. The lesson only works if it travels.

Please stay Safe & Hydrated!!!