I’ve seen some people try to use the Microsoft outage as blame for a hotel pool in Germany that pumped too much chlorine into its water. Just because that hotel configured poison warnings for email does not fault the email. Everyone and their dog knows email is never guaranteed delivery. It is not a reliable alarm.
The pool belongs to Hotel Ling Bao at Phantasialand in Brühl, and fifteen guests were hurt there on Friday. Let’s dive in.
The main duty to protect those guests belonged to the hotel. Section 37 of the Infection Protection Act requires pool water that poses no risk to human health, and the federal environment agency’s guidance applies that requirement at all times and in every part of the pool. One state health office’s guidance on DIN 19643 also has the pool operator measure free chlorine by hand three times a day and compare the result with the instruments. Thats the real story here.
A hotel can hand the task of watching the water to a machine. The hotel duty to stop the dose, close the pool and warn the guests does not change hands just because an email service was setup. But people are reporting that the hotel handed the task to a monitoring system using email. It sends a message when chlorine is outside the normal range. Their message depended on Outlook.
But also consider the danger of a false negative configuration. No email means no poison by hotel operator design, despite no email being possible for a million other reasons. A positive system would have sent an email to confirm safe levels, such that a delivery failure would itself be an alarm.
The first to know that this backwards and faulty hotel arrangement had stopped working was the public. Microsoft reported the Outlook outage shortly before 1 p.m. Eastern on Thursday, which is early evening in Brühl. So the hotel in theory knew they had no alarms running. German television covered it from 7 a.m. on Friday. From Thursday evening the hotel safety alarm was disabled, accordong to public notice by the vendor.
The second step of this design failure was a missing fail safe. On Friday the automatic dosing system failed unsafe, meaning it pumped too much chlorine into the pool. The monitoring system even tried to issue an alarm by email. WDR reports that the alarm had gone out by mail long before anyone human noticed and measured the poison.
The third step was the guests entered the poisonous pool and then thirteen of them reported irritated airways. Their complaints brought about 30 firefighters and ambulances from four neighbouring towns, and the count rose to fifteen. Four went to hospital and one stayed for observation with moderate injuries.
The staff running the pool somehow were the last to know, when they were supposed to be the first. Every one of the fifteen guests was hurt after the email outage became public on Thursday evening. Their complaints came after the machine had sent its email alarms. WDR’s report gives no time for that alarm and says nothing about the hand measurements on Friday. Those two facts will show how long the pool stayed open with too much chlorine in it and whether the hand tests were done.
Phantasialand told WDR, when asked, that the Microsoft outage was the cause. Nonsense. Microsoft had no duty to the guests in that pool, not least of all because it was just an email service provider. The hotel retains the duty and should be held accountable for a warning that depended on email. And held accountable for how they responded to email outages.
A safer design is easily available. One German controller manual describes an upper alarm value that halts chlorine dosing by itself, because a failed measuring cell can cause dangerous overdosing. That fail-safe cut-off works beside the pump. It doesn’t need a faulty alarm to a human. The danger of a faulty alarm design was also known in Germany. A DGUV study of 187 chlorine gas releases in German baths counted 91 with injuries, and one of its examples is a dosing fault message that was left off the panel at the permanently staffed post.
It is a known harmful design with a history of harms, being allowed to harm again. German law lets the hotel choose faulty messages for poison prevention, a predictable disaster. When you really think about that, Germany once had a word for gassing people in baths. Of all countries they should be the place to have the prevention part figured out. Nobody seems able to remember, however. That surely has something to do with the slipping obligation of never forget? Perhaps some alarm mail from 1932 has not yet been delivered?
Section 37 is silent on how an alarm travels, meaning here was not at all. The ordinance that would have set binding monitoring rules for pool water failed in the Bundesrat in 2003. So the duty to self-regulate poison in large baths has stayed with the operator ever since, and so has the design of alarms that would prevent people getting sick or dying.