What the CSB Required — and What CROS Already Does
On May 31, 2017, at approximately 11:00 p.m., a smoldering nest inside a corn milling process ignited, propagated through interconnected dust collection ductwork, and produced a series of explosions that collapsed multiple buildings at Didion Milling's Cambria, Wisconsin facility. Five employees were killed and fourteen more were seriously injured.
The CSB's six-year investigation found thirteen separate safety issues — process hazard recognition, dust hazard analysis, engineering controls, structural design, fugitive dust management, management of change, incident investigation, process safety information, audits and inspections, emergency preparedness, PPE, process safety leadership, and a regulatory gap — all shared one root cause.
Every one of those failures reflects an organization not able to reliably retain, retrieve, or act on what it already knew. Didion had experienced prior smoldering incidents and its own auditors and OSHA had flagged the hazard. The knowledge existed somewhere in the organization but it wasn't governed — not tracked, owned, or retrievable when it mattered.
"Didion's inadequate safety management systems for combustible dust failed to mitigate the potential hazards of the process. Didion inadequately managed changes to process equipment, failed to maintain critical safety information, and failed to incorporate lessons learned from prior incidents."
The thirteenth root-cause issue in the CSB's finding — "a regulatory gap" — is easy to skim past, but it shouldn't be, because combustible dust does not appear on OSHA's list of Highly Hazardous Chemicals under the Process Safety Management standard (29 CFR 1910.119, Appendix A). PSM's mechanical-integrity provisions — the regime that would normally require a documented Safety Instrumented System lifecycle, including SIL determination and scheduled proof testing — didn't apply to Didion's Cambria facility because dust hazards fall outside PSM's scope entirely.
In the absence of a mandatory functional-safety regime, Didion's obligations ran through voluntary NFPA consensus standards — NFPA 61, 68, 69, and 652, since consolidated into NFPA 660 — enforceable only indirectly, through OSHA's General Duty Clause. Adopting and maintaining a voluntary standard was left entirely to Didion's own initiative. Nothing in federal law compelled the detection and suppression systems R3 and R8 later required; nothing compelled revalidating a Dust Hazard Analysis on a schedule until the CSB recommended one after the fact.
OSHA has carried an open recommendation for a dedicated combustible dust standard since 2006 — first issued by the CSB following the Combustible Dust Hazard Investigation, later elevated to the CSB's "Most Wanted" list — and it remains unimplemented as of this writing. Didion operated, and was investigated, inside the exact regulatory space that recommendation was written to close.
Of the nine recommendations the CSB issued to Didion in December 2023, R5 reads like a product specification for CROS:
"Incorporate recording any paper-based process safety information into Didion's existing electronic records management system so that the information can be reliably retained, retrieved, and analyzed in the event of a catastrophic incident."
Retained. Retrieved. Analyzed. In the event of a catastrophic incident. The CSB issued a federal recommendation that describes CROS' Living Model — Nous.
The other eight recommendations are the same governance gap, each mapping directly to a CROS capability in addressing management of serious incidents:
what changed and who approved it — Metron;
what was learned from the last near-miss — Mneme;
whether the required control still exists and still works — Phronesis;
and whether the response doctrine activates when the room is full of smoke instead of staying archived in a binder — Praxis / Taxis.
CROS doesn't arrive at a facility as generic software and start logging whatever comes in. It arrives as an architecture — six faculties — built to organize a taxonomy: hazard categories, industry overlays, process classifications. The first work is encoding the organization into that architecture: converting Didion's actual equipment inventory, process hazards, regulatory overlays, and stakeholder structure into the Living Model.
Every faculty in the mapping below depends on that encoding step having already happened. Nothing in the table detects, governs, or activates anything until the organization itself has been modeled.
For a facility like Didion, encoding means the abstractions in R1 through R9 become a specific, queryable structure:
Holds and makes immediately retrievable the entirety of Didion's process safety information: actual dust collection ductwork layout, its bucket elevator inventory, its DHA findings by building, its deflagration venting design — the specific facility, encoded as structured state instead of a folder of PDFs and inspection notes.
Is configured against the regulatory overlay that actually applies to this facility class — grain milling and food processing, OSHA 1910.272, NFPA 61/652/654 (consolidated into NFPA 660) — so a finding maps to the standard Didion is actually required to meet, not a template borrowed from a different industry or a generic checklist.
Implementation means ingesting the organization's own incident history — prior smoldering fires, near-misses, audit findings that never closed — so patterns can be detected across events and prior to a serious incident.
Needs a baseline from which to detect drift. That baseline is the encoded standard — the DHA, the MOC record, the required engineering control — compared against the encoded current state. With the encoding, daily operations are tracked against the baseline, measuring the facility's Doctrine Delta.
Activates Didion's actual Emergency Response Plan (ERP), mapped to Didion's actual building layout, alarm system, and evacuation routes — the doctrine that specific facility would need at 11:00 p.m. on a smoldering night.
The CSB recommendation points to this encoding process: take an organization's scattered, paper-based knowledge and make it a structured, retrievable model of that specific organization. That's the work CROS does. When the ductwork inspection interval comes due, Metron surfaces it as an open, owned finding. The inspection either closes the record or generates a new finding. Either way, the record exists and it's auditable.
One boundary is worth stating plainly, given how much of this mapping touches engineering controls: where a recommendation calls for a detection, suppression, or isolation system that doesn't yet exist — R1g, R3, R4, and R8 all do — that system becomes a Safety Instrumented Function once built, with its own engineering lifecycle under standards like IEC 61511: SIL determination, proof-test intervals, PFDavg verification. CROS doesn't perform that engineering, and doesn't claim to. It governs whether the resulting control exists, is current, and was proof-tested on schedule — the same governed-record function it performs everywhere else in this mapping. Designing and verifying the safety instrumented function itself is a distinct discipline, typically handled by independent functional safety engineers working to that lifecycle.
The table below maps all nine CSB recommendations — including the nine sub-elements of R1 — to the specific gap the CSB documented and the CROS faculty that closes it.
| Rec. | CSB Requirement | The Gap at Didion | Faculty | How CROS Closes It |
|---|---|---|---|---|
| R1a | Management of Change for combustible dust | MOC program existed for food safety, but never evaluated dust hazards — changes went live unassessed. | Metron | Every change is a logged, owned, closeable record — not a form that exists but doesn't gate anything. |
| R1b | Process Safety Information management | PSI was scattered and paper-based; deflagration design data didn't exist where anyone could use it. | Nous | The Living Model holds current PSI as structured, retrievable state — not an archive nobody opens. |
| R1c | Management of Audits & Inspections | OSHA and the insurer flagged the hazard repeatedly. Findings didn't survive management turnover. | Metron | Findings are assigned an owner and tracked to closure — the record outlives the person who filed it. |
| R1d | Fugitive Dust Management | Food-safety housekeeping standards were substituted for dust-hazard housekeeping — the wrong standard, applied consistently. | Metron | Governs the standard itself, not just the checklist — flags when the applied standard doesn't match the hazard. |
| R1e | Incident Investigation | Prior smoldering fires (including one two days before the explosion) were not investigated to root cause. | Mneme | Incident history feeds forward automatically — nothing closes without becoming institutional memory. |
| R1f | Dust Hazard Analyses | No DHA had ever been performed, despite NFPA guidance in place since 2015. | Nous Metron | DHA existence and revalidation status is a tracked state, not a calendar item someone has to remember. |
| R1g | Engineering Controls for combustible dust | No deflagration venting, suppression, isolation, or containment anywhere in the interconnected system. | Metron | Required controls are a governed inventory — gaps are visible findings, not silent absences. |
| R1h | Personal Protective Equipment | No flame-resistant clothing requirement, despite a prior flash-fire burn injury on record. | Metron | PPE requirements are tied to hazard data, not habit — and the linkage is auditable. |
| R1i | Emergency Preparedness | Conflicting radio traffic and no facility-wide notification meant employees never got the evacuation order. | Praxis Taxis | Doctrine is activated at the point of performance, not archived in a binder no one opens mid-crisis. |
| R2 | Ductwork inspection & testing program (transport velocity) | No routine measurement of transport velocity; material settled and accumulated inside ducting for years. | Metron | Inspection cadence is enforced state, not a maintenance calendar dependent on human follow-through. |
| R3 | DHA revalidation every 5 years | No revalidation mechanism existed because no DHA existed to revalidate. | Metron | Revalidation triggers automatically — no reliance on institutional memory to remember a five-year clock. |
| R4 | Structural design & venting for the rebuilt facility | Original structures had no deflagration venting; design adequacy was never independently verified. | Nous | Structural PSI is retrievable and current — adequacy can be checked against the record, not asserted from memory. |
| R5 | Electronic PSI records (paper → retrievable system) | Paper-based information couldn't be retrieved, cross-referenced, or analyzed under pressure. | Nous | This is the CROS thesis stated as a federal recommendation: retained, retrievable, analyzable — at minute zero. |
| R6 | PPE hazard analysis + flame-resistant garments | PPE selection wasn't grounded in a documented hazard analysis. | Metron | PPE requirement and its supporting hazard analysis are one governed record, not two disconnected files. |
| R7 | Update & train on Emergency Response Plan | The ERP existed on paper but wasn't operational — no alarm system, no clear shutdown or evacuation trigger. | Praxis Taxis | The response doctrine is what activates during the event, tested and current, not a document exercise. |
| R8 | Pre-deflagration detection & suppression adequacy | No detection system existed to alert employees before a smoldering condition became an explosion. | Phronesis | Detects the Doctrine Delta between what protection should exist and what's actually in place — before it matters. |
| R9 | Process safety leadership & culture program | Leadership showed normalization of deviance and no deference to expertise — a culture problem with no metric. | Phronesis Metron | Culture assessments become governed findings with owners, not sentiment captured once and forgotten. |
Four figures below are disclosed, on the record, from DOJ, DOL, and CSB filings. The rest are estimates, built from named benchmarks and flagged as such throughout. Nothing in the estimated column should be read as a verified Didion figure.
| Cost Category | Amount | Status | Basis |
|---|---|---|---|
| Criminal fine | $1.0M | Disclosed | DOJ plea agreement, Sept. 2023 |
| Criminal restitution to victims | $10.25M | Disclosed | DOJ plea agreement, Sept. 2023 |
| OSHA civil penalty settlement | $1.8M | Disclosed | U.S. Dept. of Labor, Dec. 2023 |
| Initial property damage | $15.37M | Disclosed | CSB investigation report, Dec. 2023 |
| Facility reconstruction (total capital) | $60M–$100M | Estimate | Order-of-magnitude for a 6-story, multi-building "state-of-the-art" rebuild (2017–2019). CSB's $15.37M is immediate post-incident damage, not total rebuild capital. |
| Legal & defense costs (2017–2026) | $8M–$15M | Estimate | Aggregate benchmark for a ~9-year matter: 9-count federal indictment, company + 6 individual defendants, trial, sentencings, parallel OSHA and CSB proceedings. |
| Lost production / business interruption (~20-month shutdown) | $35M–$70M | Estimate | Revenue-per-employee benchmark for a comparable commodity dry-corn mill (~124 employees). Actual economic loss to Didion is likely materially lower on a margin basis, net of insurance recovery and volume shifted to its other sites. |
| Workers' compensation (5 fatalities, 14 serious injuries) | $4M–$8M | Estimate | Wisconsin's statutory WC death and permanent-disability schedule at 2017–2019 indemnity rates. Separate from, and smaller than, the $10.25M criminal restitution, which functions as additional court-ordered compensation. |
This range excludes reputational cost, insurance-premium impact, the five prison and probation sentences handed to individual managers, and any civil litigation beyond the criminal restitution order. It also excludes whatever Didion has spent since August 2025 rebuilding a record the CSB would actually accept — the direct cost of the verification gap described below. The numbers reflect the compounding cost of an organization that couldn't retrieve what it knew, spread across nine years and every line item above.
The Didion case proved the CROS thesis in 2017 and again, in real time, in the three years it took to close these recommendations. The mechanism of that delay is itself a problem that CROS solves.
The CSB releases its final report and nine recommendations to Didion.
Didion sends the CSB a letter stating it had taken steps to meet its separate 2023 settlement with OSHA ($1.8 million, over a dozen citations). Didion's position: those changes already addressed the CSB's concerns.
The CSB publicly states Didion has implemented none of the nine recommendations, and that the changes made under the OSHA settlement differ from what the CSB actually asked for. Didion disputes this, maintaining the improvements were already made. Both organizations are describing the same eighteen months — and neither can produce a governed record the other will accept as evidence. This compliance failure is a failure of record retrieval — R5. Two parties, one set of facts, no shared system of record either side can point to and say: here is what changed, when, and who verified it.
Following the public dispute, Didion works with the CSB for a full year to produce documentation the agency can actually verify: a combustible dust management program addressing safety culture, dust hazard analyses supported by outside experts, engineered safeguards matched to the facility's hazards, and improvements to continuity of operations, emergency response, and PPE.
The CSB confirms all nine recommendations implemented — roughly 32 months after they were issued, and only after a year spent doing what could have been continuous from day one: producing a verifiable, governed record of what was done.
The 2017 explosion is the acute version of the failure: knowledge existed but wasn't governed, so it didn't reach the people who needed it prior to and during a live emergency. The 2023–2026 recommendation saga is the chronic version of the same failure: the organization and its regulator each had a private account of what had been done, and neither account was retrievable, current, or verifiable by the other side.
CROS closes both versions of the gap with the same architecture. Nous holds the current state so it's retrievable under pressure. Metron converts a reviewed finding into a governed compliance record the moment it's confirmed — not a claim in a letter, a record with an owner, a timestamp, and a closure trail. Phronesis flags the delta between what was promised and what's actually true before a regulator has to find it for you.
Didion had people, knowledge, and plans. It had an ERP, a management-of-change process, and — after 2023 — nine specific instructions for exactly what to fix.
What it didn't have, at any point in this story, was a retrievable, current, governed operational record — one an employee could act on during a smoldering fire, or one a company and a federal regulator could both point to and agree on three years later.
Five people died in the first version of that gap. It took 32 months and a public dispute to close the second version. Every recommendation in this report — all nine, twenty-two sub-elements — traces forward to the same architecture: a governed record that proves what the organization knows, when it knew it, and whether it's still true.
CROS is an operational intelligence system, designed for high-consequence industrial operators — chemical, oil & gas, manufacturing, and critical infrastructure — so that what an organization knows about its own hazards, controls, and commitments stays retrievable, current, and provable, under audit and under pressure. Built around six operational faculties — Nous, Mneme, Phronesis, Metron, Praxis, and Taxis — CROS turns scattered process safety information into a governed system of record, so that a recommendation, once closed, stays closed.
Book a Walkthrough →U.S. Chemical Safety and Hazard Investigation Board, Investigation Report 2017-07-I-WI, "Fatal Combustible Dust Explosions at Didion Milling Inc." (December 2023); CSB Recommendation Status Updates; CSB news releases dated August 2025 and August 12, 2026, "U.S. Chemical Safety Board Closes Didion Milling Recommendations." U.S. Department of Justice, Office of Public Affairs, plea agreement announcement (September 2023). U.S. Department of Labor / OSHA settlement announcement (December 2023). 29 CFR 1910.119 (Process Safety Management of Highly Hazardous Chemicals) and Appendix A. CSB Combustible Dust Hazard Investigation, Recommendation 2006-1-H-1, and related "Most Wanted" designation. Wisconsin Dept. of Workforce Development, Worker's Compensation insurance rate letters and Wis. Stat. § 102.52. Figures marked ESTIMATE are order-of-magnitude analyst estimates for illustrative purposes, not disclosed Didion financial data. CSB, DOJ, DOL, and OSHA materials are public-domain works of the U.S. federal government.