The stop-work that didn't stop the work

The job looked routine. Chlorine was weeping from a drain valve in the methyl diisocyanate plant — what BASF called a fugitive emission. Four workers, two BASF employees and two contractors, held a safe work permit to deal with it the simple way: retighten the bolts on the valve by hand. A small job, a small leak, a permit that matched.

Then one of the contractors actually looked at the valve. It was dilapidated — visibly degraded, not the component a permit assumes. And he did the thing every safety induction, every poster, every leadership talk asks for: he invoked his stop-work authority, and he brought the concern to one of the BASF employees. The defence the entire system is built around fired exactly as intended.

What happened next is the entire lesson. The BASF employee went to get a supervisor's opinion. Somewhere in that exchange — between the contractor, the employee, and the supervisor who was not standing at the valve — there was a miscommunication about whether or not to continue. And so the work continued. No one cancelled the stop in a deliberate, recorded decision. It simply evaporated in the space between three people.

The leak persisted after the bolts were retightened by hand. So a contractor reached for an impact wrench — a power tool delivering short bursts of high torque. The vibration was enough: the corroded connections on the valve's bonnet failed, and chlorine released in volume. In the evacuation, one worker could not effectively transition to his escape air supply, was exposed to the toxic vapour, and was admitted to hospital.

Every site has stop-work authority on paper: a card in the wallet, a poster in the control room, a line in the induction. The card is not the mechanism. The mechanism is what happens in the ninety seconds after someone says "stop" — who hears it, who is allowed to overrule it, and what the system does while the answer is still being worked out.

At Geismar, while the answer was being worked out, the work kept moving. That tells you the default: when the situation was ambiguous, the system continued. That default — what happens by inertia when no one has yet said a clear "stop" or "go" — is the single most important and least examined feature of any stop-work system. It decides the outcome of every genuinely uncertain moment, which is to say every moment that actually matters.

Look at the asymmetries stacked against that stop. A contractor raises a concern to a client's employee — already a step up a power gradient. The employee defers to a supervisor — another step. The supervisor is not at the valve and cannot see what the contractor sees. And every cost of stopping is concrete and immediate — a delayed job, a schedule, a client relationship — while the cost of continuing is invisible until a bonnet fails. The structure made deference the path of least resistance. The contractor did his part; the system was built so that his part was not enough.

This is not a BASF problem. I have watched the same evaporation on sites across West Africa and the Gulf: the person closest to the hazard names it clearly, and the authority to act on it sits two or three conversations away, with someone who never saw what they saw. The hazard is judged by the people furthest from it. That is the design flaw — and it is almost universal.

The permit authorised hand tools. Hand tools failed to stop the leak. The impact wrench was the workaround — and reaching for it was an entirely normal human response to a job that would not close and a leak that would not stop. For an investigator, every workaround marks a precise point where the plan met reality and lost. The impact wrench was not the cause of the release. It was the symptom of a job that should have stopped three steps earlier — and a signal, in real time, that no one was trained to read as one.

The valve was inspectable. The corrosion was findable. The CSB notes that had BASF inspected the valve before authorising the job, the extent of the corrosion could have been identified, and the unit could have been shut down to replace the valve rather than repair it live. So the stop-work failure and the mechanical-integrity gap are the same failure seen twice. The system had two chances to stop the job before anyone touched the valve: at the pre-job inspection that did not happen, and at the contractor's raised hand. It took neither.

Do not wait for a release to learn whether your stop-work works. Run these five tests on the transaction itself.

1. Trace the handoff path — Map exactly who a raised stop-work reaches and how many handoffs stand between the person at the hazard and the person who can authorise "continue." Every handoff is a place the stop can dissolve.
2. Name the default — When the answer to "should we continue?" is unclear or pending, does work stop or continue? If you cannot answer instantly, your default is "continue" — which means you have stop-work suggestion, not stop-work authority.
3. Remove the override asymmetry — A contractor's stop must not require a client employee's agreement to take effect. The stop is effective the moment it is raised; restart requires positive authorisation, not merely the absence of an objection.
4. Treat workarounds as stop signals — Train supervisors that the appearance of an unsanctioned tool or method — the impact wrench on a hand-tighten permit — is itself a trigger to stop and reassess. The plan has already failed; the workaround is the evidence.
5. Close the inspection loop — A permit to work on safety-critical equipment requires a current condition check of that equipment. Authorising a repair on an uninspected, visibly degraded component is a stop-work failure waiting to happen.

Applied to Geismar, this catches the event three times over: at the missing pre-job inspection, at the contractor's raised concern, and at the appearance of the impact wrench. Three available stops. None taken. A functioning stop-work system needed to win only once.

The question is never "do our people have stop-work authority?" They almost always do, on paper. The question is what happens to a stop the instant it is raised: who is allowed to overrule it, how many handoffs it must survive, and whether silence means stop or go. Audit the transaction, not the card. The contractor at Geismar did everything right. The system was built so that everything right was not enough.

"A stop-work that has to win an argument is not authority — it is a request."