Flint: how a skipped corrosion inhibitor poisoned a city

Here is an uncomfortable observation from two decades of chasing defects: nobody in Flint shipped a bad part. The plant dosed what was on its treatment sheet. The pipes sat where they had sat for a century. For months the compliance maths came back green. The failure sat upstream of all of it — someone swapped the raw material, and nobody revalidated the process it runs through. In every plant I have worked in, that conversation ends at the change-control gate before lunch.

The situation

Flint was under a state-appointed emergency manager, paying millions a year for treated Detroit water while a new regional pipeline was built. Rather than keep buying through the two-year gap, officials fired up the city's old plant on Flint River water — projected savings of roughly $5 million.

The physics was unforgiving. Detroit's water had carried a corrosion inhibitor for decades, and a stable mineral scale lined the inside of the lead service lines. The river runs heavy with chlorides. Federal rules anticipated exactly this: change the source, re-optimise corrosion control. The plant never dosed orthophosphate. The river water dissolved the scale, and the network itself became the contaminant.

How it unfolded

Residents complained within weeks: brown water, odour, rashes. Summer 2014 brought boil-water advisories; January 2015 a violation for disinfection by-products. Each was managed as a communications problem. General Motors saw something else — in October 2014 its Flint engine plant stopped using city water because chlorides were corroding machined parts. The machines got better complaint handling than the families did.

Early in 2015 the state's own sampling found high lead in homes; two exceedances were struck from the compliance calculation so the city would pass. Marc Edwards's team at Virginia Tech ran the independent testing the regulator should have run: a 90th-percentile lead level of 27 ppb against a 15 ppb action level, one home above 13,000 ppb. Paediatrician Mona Hanna-Attisha showed children's blood-lead levels rising after the switch; the state doubted her before conceding. Flint reconnected to Detroit water in October 2015. The denial had run about 18 months.

Root-cause anatomy

Technically, this was classical corrosion engineering ignored: high chloride load, low buffering, no orthophosphate passivation — three variables any water-chemistry course flags as scale-destabilising. Push that water through legacy lead infrastructure and leaching is not a risk; it is a schedule.

The organisational anatomy is familiar to anyone who has survived a cost programme. Governance whose single metric was money. A regulator that misapplied its own corrosion-control rule. Nobody owned the only question that matters — what changes downstream when the input changes? Under IATF 16949 I could not move a resin lot without requalification paperwork. Flint changed the entire feedstock of a public utility on a purchasing decision.

Where the quality system failed

Score it as a PFMEA and the numbers are obscene. Lead in children's drinking water: severity 10, no debate. Occurrence near-certain, because the inhibitor was the control barrier, and it left with the source change. Detection 9 or 10 — compliance sampling was engineered to pass, using pre-flushing, slow-flow draws and discarded exceedances. That is not detection; it is audit evasion, and it has an exact automotive equivalent: a supplier pre-screening the samples it sends to the customer's laboratory. The Lead and Copper Rule became the inspection the system was built to defeat.

The CAPA gate failed just as hard. Discoloured-water complaints, boil advisories, by-product violations — each a quality signal arriving through the voice-of-customer channel, each answered with reassurance. Eighteen months of complaints is a QRQC case study in reverse.

Money not spent on process control is not saved; it is converted into liability at a terrible exchange rate.

What would have caught it

Start at the gate. A source change is an engineering change: a requalification protocol covering pH, alkalinity, chloride, sulphate and inhibitor residual, with pipe-loop corrosion testing before first supply. Then dose the inhibitor — orthophosphate at about $100 a day, daily residual monitoring, the control the federal rule already assumed. The whole prevention programme fits on one page.

Then build the sampling to detect rather than to pass: first-draw samples, randomised sites, third-party split samples, raw data published. A plan that cannot fail you cannot save you. And make complaints a leading indicator — discoloured-water reports per thousand accounts, with a threshold that stops distribution. The signal was there from week one.

My take

I have never treated a litre of drinking water; I have signed off plenty of raw-material changes, and the discipline transfers exactly. Across two decades in automotive and aerospace I learned that an input is never just an input — change a steel grade, a coolant, a plating chemistry, and you own every downstream interaction until the data releases you. At Witte and at SNOP we requalified on thinner pretence than a new river, because the PFMEA said so, not because an auditor was visiting.

The 18-month denial is the part I recognise most. Every customer escalation I have closed had an early window where honesty was cheap — data plus humility, and the incident ends. Once that window closes, every reassurance draws down trust at compound interest.

Flint's officials stood beside jugs of brown water and called it safe. Comfort without data is only delay.

Flint is still digging up its pipes, street by street, years into a programme nobody budgeted. The settlement closed at $626 million. The deepest cost — a generation of children with lead in their blood — does not settle at all. Corrosion control was about a hundred dollars a day. When someone proposes changing an input and skipping the revalidation, be clear about what is actually being decided: not whether to spend the money, but whether to spend a hundred a day now or finance the failure for decades.