A control-system change can create a physical process hazard long before anyone touches a wire. A newly released U.S. Chemical Safety and Hazard Investigation Board (CSB) report illustrates why automation teams must evaluate the live process state, human-machine interface (HMI), and protective logic together—not merely confirm that a command executes as intended.
What the investigation established
On June 4, 2025, an explosion and fire occurred at the Shell Polymers Monaca ethane cracking facility in Pennsylvania. In its September 16, 2026 final investigation announcement, the CSB reported approximately $95 million in property damage and evacuation of 15 employees; no fatality or serious injury was reported.
The CSB found that two motor-operated isolation valves were inadvertently opened simultaneously, permitting flammable cracked gas to backflow into a furnace firebox containing lit pilots. The resulting ignition caused the explosion. The engineer assigned to the task had not previously performed it and had limited process knowledge. Three nearly identical valves appeared on one HMI logic screen, with tags differing primarily in their final digits. The facility had relied on administrative measures rather than configuring available engineered protections against the backflow scenario. These are CSB findings, not speculation about the engineer’s intent or an allegation that a software defect caused the event.
Five controls for automation and OT project execution
- Define the process consequence before the command. In the project execution plan and planning JHA, identify what each valve, output, bypass, force, or logic change can physically enable—including reverse flow and unintended startup.
- Evaluate all six risk factors. Review Task (command sequence), Human Factors (familiarity and workload), System State (isolations and operating mode), Energy (pressure, heat, flammables, electricity), Logic (interlocks and permissives), and Site/Environment (personnel and adjacent operations). These six factors are a proposed assessment framework, not a CSB-mandated checklist.
- Make the pre-job briefing an active verification. Confirm device identity, expected indications, process conditions, operator authorization, communication protocol, and stop-work triggers. Use independent confirmation for consequential valve or safety-system actions.
- Control change and recovery. Record the approved sequence, simultaneous-state hazards, safeguards, hold points, backup/rollback strategy, and the person authorized to restore operation. Stop and reassess if the live state differs from the planned state; do not assume rollback is safe without evaluating current conditions.
- Verify the result and close the loop. Check actual field/process response—not only HMI feedback—then document discrepancies, removed forces or bypasses, restoration of protective functions, and lessons for future jobs.
The critical distinction: procedures versus engineered safeguards
Briefings, JHAs, and second-person checks help, but cannot replace a practical engineered safeguard where a credible catastrophic scenario requires one. The CSB specifically recommended reviewing process hazards controlled only by administrative measures and implementing inherently safer or engineered protections for high-consequence scenarios. For integrators, this means escalating a hazardous HMI or control-logic condition to the owner/operator and responsible engineering authority instead of assuming better instructions alone will resolve it.
Separate regulatory obligations from good practice. Where servicing exposes workers to unexpected energization or stored energy, OSHA 29 CFR 1910.147 may apply according to its scope and exceptions. An HMI stop or ordinary PLC command is not automatically an energy-isolating device; OSHA’s PLC interpretation addresses the narrow circumstances in which a PLC-based alternative measure may be considered for qualifying minor servicing. Process-risk assessment and the six-factor framework above are recommended management practices, not newly enacted OSHA requirements.
A useful question for the next commissioning meeting
What hazardous process state could exist if two individually valid commands are issued in the wrong order—or at the same time? If the answer is serious, verify that the engineered protection is effective in the actual operating mode before authorizing the work.
Read more safety insights at https://ursafetypro.com.
Primary sources: CSB investigation page; CSB final report announcement (September 16, 2026); OSHA 29 CFR 1910.147; OSHA PLC interpretation.
Discover more from SAFETY TRAINING & CONSULTING SERVICES
Subscribe to get the latest posts sent to your email.
