Case file
- What happened: In September 1937 the S.E. Massengill Company of Bristol, Tennessee, shipped a raspberry-flavoured “Elixir Sulfanilamide.” The solvent was diethylene glycol (DEG), an industrial chemical. No toxicity test of any kind preceded the sale.
- Scale: At least 105 dead, many of them children, from acute kidney failure across more than a dozen US states. Roughly 240 gallons were produced; inspectors traced most of it through railway express records.
- Root cause: Not the antibiotic. The carrier. DEG dissolved the drug and tasted pleasant, and no gate, process or law required anyone to ask what else it did.
- The bill: 105-plus lives, a misbranding fine for the company – and a public reckoning that produced the Federal Food, Drug, and Cosmetic Act of 1938, the first US law to demand safety evidence before sale.
Here is an uncomfortable observation from two decades of PFMEA reviews: the room will argue for three hours about the active ingredient and wave the carrier through on a nod. Weld penetration gets a severity debate. The rust-preventive oil gets silence. In 1937 that silence had a body count. A company shipped a product whose active was safe, whose solvent was lethal, and whose test records held no question capable of telling the two apart. Reread this one before you sign a release.
The situation
Sulfa drugs were the antibiotic triumph of the 1930s, and the market wanted them as liquids – palatable, spoon-dosed, sellable to the parents of sick children. Sulfanilamide dissolves poorly in water, so Massengill's chief chemist, Harold Watkins, went looking for a solvent. Diethylene glycol carried the drug, took the raspberry flavour and looked handsome in the bottle. The company's testing covered flavour and appearance. Nothing covered toxicity, because nothing had to.
The Pure Food and Drug Act of 1906 policed adulteration and mislabelling. It said nothing about proving a formulation safe before sale. Competitors were rushing out sulfa liquids; the only constraint on the recipe was the chemist's own judgement.
How it unfolded
Shipments left Bristol in September 1937. Within weeks, physicians in Tulsa, Oklahoma, reported patients dying of kidney failure after taking the elixir, and the American Medical Association's laboratories identified DEG as the poison. The FDA of 1937 had no power to order a recall. It seized the product under the 1906 Act as misbranded – an “elixir” by definition contains alcohol, and this one contained none. That technicality was the entire legal handle.
Inspectors worked backwards through express-company ledgers, telegraphing thousands of physicians and druggists; nearly all of the roughly 240 gallons were recovered, though not before at least 105 people, many of them children, died over days of progressive uraemia. The owner maintained publicly that the firm had broken no law. He was right. Watkins died in 1939 before standing trial, and Congress passed the Federal Food, Drug, and Cosmetic Act in June 1938, requiring safety evidence before marketing.
Root-cause anatomy
Technically, the failure mode sat in an excipient. DEG is a potent kidney toxin; it destroyed the victims' tubules while the sulfanilamide went about its harmless work. Chemically elegant, pharmacologically lethal – and not exotic. DEG's renal toxicity already sat in the medical literature. The information existed. No process existed to reach for it.
Organisationally, this was a new-product launch run like a recipe change. Test scope was set by custom – taste, clarity, stability – not by hazard. The DEG arrived as an industrial chemical with no specification beyond grade, no qualification, no toxicological dossier. Management treated legality as the ceiling of responsibility rather than the floor. Every one of those failures is still walking around factory floors today.
Where the quality system failed
The failures stack, and each has a modern name. PFMEA: had one existed, the excipient row would score severity 10 and detection 10; no control referenced toxicity, because the document never asked about non-actives. Supplier quality: a lethal material bought on price and availability, no CoA interrogation, no question about what it does inside a human body.
Change control: a brand-new formulation released as routine business – no phase gate, no evidence before first shipment. Audit scope: the 1906 Act could verify labels, not safety; the state proved the name on the bottle wrong and stopped there. And the CAPA gate. The only corrective action with the power to fix this system was federal legislation. When your CAPA requires an act of Congress, you did not have a quality system.
There are no inactive ingredients – only ingredients nobody has interrogated yet.
What would have caught it
Everything that would have stopped this was cheap in 1937 and remains cheap today:
- A release gate for the formulation, requiring a hazard dossier for every component at delivered dose – active and excipient alike, no exception for “just the solvent”. A one-hour literature check owned by a name would have ended the project on its own: DEG's toxicity was published.
- A minimal animal study. Investigators later demonstrated the kidney damage with simple, short feeding tests – days of work, trivial cost, set against 105 lives.
- Supplier qualification demanding a pharmacopoeial or certified grade, with the supplier answering for toxicity data, not just purity.
Modern vocabulary: excipient qualification, design review with mandatory toxicology, first-article scrutiny of the formulation as delivered. Detection cost: pennies. Failure cost: a hundred and five people and the credibility of an industry.
My take
I was not in Bristol in 1937 and never saw its paperwork. I have chaired its modern equivalents. PFMEA reviews where the team spent a morning on weld-nugget diameter while the forming lubricant had quietly changed supplier and been requalified by nobody. Cleaning agents swapped on cost. Films chosen on price. Carrier solvents in coatings inherited from a data sheet nobody opened. In automotive and aerospace the carrier rarely kills the end user the way DEG did, but the mechanism of blindness is identical: interrogation lands on the visible function and skips the thing that merely carries it. Building a quality function from the ground up for a 900-person plant taught me: gates are only expensive until you price the alternative. My standing instruction in any PFMEA I chair is blunt – if a component touches the product, it gets a severity argument, including the ones that do “nothing”.
What this means on your floor
- Interrogate the carrier with the same rigour as the active: every solvent, lubricant, film, adhesive and process chemical gets a hazard line in your analysis.
- Audit scope is a decision about what you refuse to see – put safety inside it, not just conformance.
- No evidence, no release. A gate without a required deliverable is a doorway, not a gate.
- Qualify suppliers of “inactive” materials as if they were actives. Consequences never check the ingredient list first.
Sulfanilamide never killed anyone in 1937 – the assumption of safety did. The 1938 Act replaced that assumption with a demand for evidence before the market, which is precisely what a release gate does inside a plant. When nothing requires the question, the question does not get asked, and “inactive” ingredients carry fully active consequences. Ask it yourself, at a gate you control, before history asks it for you.
