They Thought It Was a Bubble

▶️ Prefer to watch? Every story’s a short video → https://www.youtube.com/@GetSafetyIntel · 📣 Got a near-miss? Share it anonymously (QR + link at the bottom).

The alarms were screaming rupture. The control room a thousand miles away read them as a bubble in the line — and over the next seventeen hours pumped in most of the oil that would foul thirty-five miles of a Michigan river. Nobody died here. But this is the cleanest case study we’ve got of a truth that will save your plant: the board is not the truth, and the person closest to the work sees it going wrong first.

At 5:58 on the evening of Sunday, July 25, 2010, a 30-inch pipeline called Line 6B tore open in a wetland near Marshall, Michigan. It was carrying diluted bitumen — dilbit, heavy tar-sands crude cut with light solvents so it’ll flow. Where it ruptured, it emptied into Talmadge Creek, and Talmadge Creek carried it into the Kalamazoo River.

Here’s the part that turns a pipe failure into a teaching case. Line 6B was run from a control room in Edmonton, Alberta. When it ruptured, the leak-detection alarms did exactly what they were built to do — they fired, flagging a loss of pressure. But the operators had a ready explanation on the shelf: “column separation,” a harmless vapor bubble that shows up when you shut a line down. They’d seen the pattern before. They believed the screen over the pipe. So they didn’t shut it in and lock it out — they tried to get the oil moving. Twice over the next seventeen hours the crew restarted Line 6B and pumped against a hole in the ground. The NTSB later found that roughly 81 percent of everything that spilled went out during those two restarts, after the line was already broken.

For seventeen hours, the people whose whole job was to see this did not see it. What finally caught it was a man who wasn’t even on the Enbridge payroll — a local utility worker in Marshall who walked up on the morning of July 26, saw oil pouring through the creek, and called it in. The person standing over the creek beat the entire leak-detection system. That’s not a coincidence. That’s the shape of nearly every one of these.

Root cause on the metal: the NTSB tied the rupture to corrosion-fatigue cracks that grew under disbonded, failing pipe coating. Enbridge had records of crack-like defects on that very stretch five years earlier and left them in the ground. The Board’s language when it published its report in 2012 was blunt — a “complete breakdown of safety at Enbridge,” “pervasive organizational failures,” a control-room crew it compared to “Keystone Kops,” and a federal regulator whose oversight it called weak. That’s not a story about two bad operators on a Sunday. It’s an organization that had normalized ignoring its own shut-down rule, inside a system that made “keep it running” the path of least resistance.

Name it and cite it. In the U.S., a hazardous-liquid line like 6B lives under 49 CFR Part 195. Two pieces of it are written all over this day. First, 195.452 — integrity management — the requirement to actually find and fix cracks and corrosion on lines that run near water and people, not file the inspection and move on. Enbridge had the data and didn’t act on it; that’s the element that failed on the steel. Second, 195.446 — Control Room Management — the rule that governs alarm handling, operator workload, and shift-change communication, and that carries the principle behind the “ten-minute rule”: if your controller can’t confirm the line is NOT leaking, you shut it down. That rule was on the books before Marshall. Marshall is the case that proves, line by line, why every word of it matters — the same way Bhopal proved PSM. And don’t miss the workers you can’t see in the headline: the cleanup that followed was HAZWOPER work under 29 CFR 1910.120 — hundreds of people in the water and the muck around benzene, running air monitoring and PPE, because a pipeline failure a mile away became their exposure.

Translate it to the floor. You may never touch a pipeline. Doesn’t matter — you live with the same two traps every shift. The first is a screen that lies. The operators trusted the board, and the board had an innocent story for a deadly signal. You’ve got the same trap: a level gauge reading “empty,” a pressure sensor that’s “always a little flaky,” a green light that says the valve is shut. When it matters, you verify at the equipment — put a hand on it, drop a meter in it, walk the line and look. The second trap is the ready excuse. “Column separation” was a real phenomenon that became a reflex answer, a way to explain away an alarm without leaving the chair. Every crew has one — “that sensor always does that,” “it’ll settle out,” “give it a minute.” The discipline is to make the alarm earn the benign explanation, not the other way around. And build in the permission Enbridge didn’t use for seventeen hours: when you can’t prove it’s safe, you stop. A line you shut down and restart costs money. A line you keep pumping into a hole costs a river. The person closest to the work — the operator with a hand on the valve, the one who smells it before the board does — has to be allowed to call it, and thanked when he does.

The Full EHS Picture. This one is the whole triangle at once, which is exactly why it belongs here. (E) Environmental — more than 840,000 gallons of dilbit, over a million by some estimates, into Talmadge Creek and the Kalamazoo River; the largest inland oil spill in U.S. history at the time. And dilbit doesn’t behave like the oil people picture floating on top — the heavy bitumen sank to the river bottom, which meant years of dredging submerged oil, not just skimming a sheen. Cleanup ran past $1 billion. Enbridge ultimately paid a $62 million Clean Water Act civil penalty and committed over $110 million in system-wide prevention as part of a $177 million federal settlement — for years the largest Clean Water Act oil-spill penalty short of Deepwater Horizon. (H) Health — the light solvents in dilbit flash off as benzene and other volatiles. Residents along the creek reported headaches, nausea, and respiratory trouble; Michigan’s health agency, working with the federal ATSDR, documented more than 320 people with symptoms consistent with that exposure, and a voluntary evacuation cleared homes nearest the spill. Add the cleanup crews breathing that same air for months. Tie it together — one set of ignored cracks and one control room that trusted the screen made a safety failure, a public-health event (evacuations and 320-plus sick people), and an environmental disaster (a poisoned river dredged for years) — three faces of the exact same decision to keep the oil moving.

A pipeline just paid $27 million — and the cause rhymes with Marshall. On July 10, 2026, EPA, the Justice Department, and the state of Kansas announced a settlement with South Bow, owner and operator of the Keystone Pipeline, over the December 2022 rupture in Washington County, Kansas. That failure dumped nearly 13,000 barrels — about 543,000 gallons — into Mill Creek, the largest discharge in Keystone’s history; crude ran an inch thick, bank to bank, for three and a half miles, and killed or harmed more than 2,700 animals. South Bow will pay a civil penalty north of $26 million, spend an estimated $40 million on prevention, and put $3 million toward Kansas restoration. Investigators traced the rupture to a weld flaw and bending stress that had gone undetected for years. So what for safety leaders: sixteen years after Marshall, the headline is nearly identical — a known-type flaw left in the line, a creek paying for it, the Clean Water Act writing the check. Integrity management isn’t paperwork. It’s the difference between finding the crack and funding the settlement.

Heat enforcement is live right now — and acclimatization is the trigger. There’s still no final federal heat standard as of late July 2026; it’s stalled in review. But OSHA’s Heat National Emphasis Program is very much running — renewed in April 2026, extended out to 2031, and covering 55 high-risk industries. On any day the Weather Service posts a heat advisory, compliance officers can walk a jobsite and inspect, and the fastest way to earn a General Duty Clause citation this summer is a new or returning worker doing hard labor in full sun with no ramp-up. So what for safety leaders: you don’t need Washington to finish the rule to do the things that keep people upright — water in reach, mandatory rest in shade or AC, and a real acclimatization schedule for anyone in their first week back. Peak summer is when the body count builds. Run the fundamentals today.

Night shift at a bulk fuel terminal. An operator is running a transfer between two big tanks off the control board — routine, done it a hundred times. Partway through, the board shows a small mismatch: the receiving tank isn’t gaining quite as fast as the sending tank is dropping. The leak-detection threshold is set loose enough that it doesn’t trip, and the operator has a ready explanation — meter drift, temperature, the gauge on that tank always reads a hair slow. He lets it run. Out in the yard, a worker walking back from a lineup check catches a whiff of product and spots a thin sheen creeping from a flange on the transfer line. He calls the board and says stop. They stop. It’s a weeping gasket — a slow loss to the containment, caught before it reached the drain to the creek.

Easy, lazy verdict: the operator “ignored a discrepancy.” Now stand where he stood. The board gave him a small, ambiguous number and a menu of innocent reasons it might be wrong — and every one of those reasons had been true before. The detection threshold was set so wide it never argued with him. He did what the system trained him to do. The fix isn’t “care more.” It’s tighten the leak-detection threshold so a real loss can’t hide inside “meter drift,” make “confirm in the field before you explain it away” the standard move, and — this is the whole thing — make sure the yard worker who said stop gets thanked in front of the crew, not razzed for costing an hour. That’s Marshall shrunk down to one flange on one night: a board with an innocent story, and a person downstream who trusted his nose over the screen. The difference is this crew listened in ten minutes instead of seventeen hours.

Got a fail or a near-miss? Hit reply, or scan the QR below — we’ll feature it anonymously — no names, no company, no blame. Just the lesson, so the next crew doesn’t learn it the hard way.

Today, pick the one alarm or gauge on your process that your people “know” is usually crying wolf — the sensor with the ready excuse. Then ask the crew one question: when that thing trips, what do we actually do to confirm it’s nothing before we decide it’s nothing? If the honest answer is “we just know,” you’ve found your column separation. Write down the field check that proves it — the hand on the pipe, the meter in the tank, the walk down the line — and make that the rule. Enbridge had seventeen hours and a room full of alarms and still talked itself out of the truth. You can build a plant that checks instead of assumes.

🎬 Rather watch than read? Every Safety Intel story is a short video on YouTube → https://www.youtube.com/@GetSafetyIntel — subscribe so you never miss one. 📸 Share YOUR near-miss (100% anonymous): https://scantoconfess.com — or just scan the QR above. 📤 Forward this to a crew member who needs it today.

Please stay Safe & Hydrated!!!