 October 26, 2019, the Aghorn Operating Incorporated Water Flood Station near Odessa, Texas. One Aghorn employee succumbed to toxic hydrogen sulfide gas that had escaped through a damaged pump. His spouse was also fatally injured by the hydrogen sulfide gas while searching for him at the facility after he didn't return home. The Aghorn Water Flood Station is used as part of a process to extract oil from underground reservoirs in West Texas. Oil extraction starts at an oil well, where pump jacks are used to lift oil from underground reservoirs. Reservoirs in West Texas also contain hydrogen sulfide, a toxic gas which comes to the surface with the oil that is extracted. The oil comes out of the ground with some water in it. To remove the water, the mixture is fed to a tank battery. As the oil and water mixture sits in the tanks, the water separates from the oil. The oil is then transported for further processing. The water is pumped through pipelines to the water flood station. It is now called produced water because it can contain residual oil and other contaminants such as toxic hydrogen sulfide gas. At the water flood station, the produced water flows into a large storage tank called a suction tank. The water then enters a building called the pump house. There, pumps are used to pressurize the produced water and inject it back into the oil field through injection wells. The injected water increases reservoir pressure and displaces the oil, allowing a larger quantity of oil to be extracted. At the time of the incident, there were two pumps in the pump house. The pump house also contains a control room from which employees run the station. Typically, the station is not continuously occupied. Instead, an aghorn employee called a pumper visits twice per day to record meter readings and inspect equipment. If there is an equipment problem and a pumper is not at the station, an alarm system triggers an automated phone call to the pumper. It is then the pumper's responsibility to acknowledge the alarm and go to the station to determine what is causing it. The station was also equipped with a hydrogen sulfide detection and alarm system that would trigger a separate automated phone call to the pumper on duty if it detected dangerous levels of the toxic gas. The system would also illuminate a rotating red beacon light on top of the pump house. But the CSB found that this critical detection and alert system was not functional on the night of the incident. At 6.38 p.m. on October 26th, the water flood station's control system activated an oil level alarm on a pump. Five minutes later, the phone system called an aghorn pumper, alerting him of a pump malfunction of some kind. The pumper drove to the water flood station. The hydrogen sulfide beacon light was not illuminated when the pumper arrived at the water flood station or at any time for the rest of the night. The pumper parked near the water flood station, leaving his personal hydrogen sulfide monitor inside his truck. The pumper went into the control room where the control system indicated the alarm was for pump number one. The pumper prepared for work on pump number one. The pump, which could automatically start when enough water was available to pump to the injection wells was still connected to its power source. The pumper did not de-energize the pump. The pumper then walked to the pumps. He closed pump number one's discharge valve and partially closed the pump's intake valve. While the pumper was near the pump, he was overcome and fatally injured by toxic hydrogen sulfide gas. After the incident, the CSB found that a plunger on the pump had shattered, which had allowed water containing hydrogen sulfide to escape from the pump into the pump house where the pumper was working. Due to limitations of available evidence, the CSB was unable to determine whether the pump failure and water release occurred before the pumper arrived at the facility or if the pump automatically turned on while the pumper was closing valves. After several hours, when the pumper did not return home, his spouse drove with their two children to the station to check on him. She entered the water flood station facility and searched for him. She soon found him on the floor in the pump house. She then was also overcome and fatally injured by the toxic hydrogen sulfide gas. A short time later, emergency responders approached the pump house. They detected a very strong smell of hydrogen sulfide. This required them to set up the command post outside the front gate of the facility and wear self-contained breathing apparatus. They found the pumper and his wife deceased inside the pump house and water spilling from pump number one. The responders rescued the two children who were inside the spouse's car. Working with Aghorn employees, they were able to stop the water release the following morning. One of the six safety issues identified was that the pumper was not equipped with his company-issued personal hydrogen sulfide detection device inside the pump house on the night of the incident. When the pumper's personal hydrogen sulfide detector was located in his work truck, it was found to be in an alarm state, meaning it had detected dangerous levels of hydrogen sulfide. The potential for a hydrogen sulfide release was a known hazard at the water flood station as indicated by the posted signage and a safety pamphlet provided to all employees. However, there was no evidence that Aghorn management required use of personal hydrogen sulfide detectors or adequately trained employees that equipment malfunctions could indicate a toxic hydrogen sulfide release. The second safety issue CSB investigators discovered is that at the time of the incident, Aghorn did not have any written lock-out-tag-out policies or procedures but relied on verbal procedures without formalized training. On the night of the incident, the pumper did not properly perform lock-out-tag-out to de-energize the pump before performing work on it. Instead, he started to close the pump's valves while the pump was still configured to be automatically operated by the control system. As a result, the control system automatically turned the pump on and water containing hydrogen sulfide was able to escape from the pump when the discharge valve was closed. The third safety issue identified by the CSB was that ventilation inside the pump house was inadequate, leading to fatal concentrations of hydrogen sulfide gas within the building. The CSB found that the pump house could be ventilated by two bay doors, exhaust fans, and natural vents on each of the four outside walls. Due to the limitations of available evidence, the CSB was unable to confirm whether the exhaust fans were operational at the time of the incident. The two bay doors were approximately 60% open but this was not enough to adequately ventilate the building. And the CSB's investigation could not find any evidence that Aghorn assessed the pump house to ensure it could be properly ventilated despite the potential for a hydrogen sulfide release to occur inside. The fourth safety issue noted by the CSB was the lack of a robust safety management program at Aghorn. Comprehensive safety management practices include risk identification, assessment, mitigation, and monitoring of design, procedures, maintenance, and training. Safety management practices are an essential element of protecting workers and non-employees from toxic gases at chemical plants. At Aghorn, there were no operational training, testing, and maintenance procedures or records other than items such as a cell phone use policy and a pamphlet on the hazards of hydrogen sulfide. These items were not sufficient to prepare employees for potential encounters with hazards inherent to their work. The CSB identified a fifth safety issue at Aghorn which was a non-functioning hydrogen sulfide detection and alarm system. Some of the facilities detectors were set to a testing mode which prevented them from sending an alarm signal and other sensors that were correctly set up were unable to send a signal to the control room. As a result, the pumper was not warned of the toxic hydrogen sulfide either through a telephone alert or illumination of the red pump house beacon light. And finally, the sixth safety issue discovered by the CSB at Aghorn was deficient site security. Per Aghorn's informal policy, when an Aghorn employee is working at the facility, the access gates are normally left unlocked on the night of the incident. This practice allowed the pumper's spouse to drive directly to the water flood station and enter the pump house where she was also fatally injured. As a result of its investigation, the CSB made the following recommendations to Aghorn Operating Incorporated for safety improvements at all water flood stations where the potential for exposure to dangerous levels of toxic hydrogen sulfide gas exists. These include mandate the use of personal hydrogen sulfide detection devices. Develop a site-specific, formalized, and comprehensive lockout-tagout program for each facility. Commission an independent and comprehensive analysis of each facility to examine ventilation and mitigation systems. Develop and demonstrate the use of a safety management program that includes a focus on protecting workers and non-employees from hydrogen sulfide. Ensure that hydrogen sulfide detection and alarm systems are properly maintained and configured, and develop site-specific detection and alarm programs and associated procedures. Ensure that the hydrogen sulfide detection and alarm system designs employ multiple layers of alerts unique to hydrogen sulfide. And develop and implement a formal, written, site-specific security program to prevent unknown and unplanned entrance of those not employed by Aghorn. The CSP also recommended that OSHA issue a safety information product that addresses the requirements for protecting workers from hazardous air contaminants and from hazardous energy. And the agency made a recommendation to the Railroad Commission of Texas to develop and send a notice to all oil and gas operators that fall under jurisdiction that describes the safety issues outlined in the CSP's report.