Andy Garcia · freelance dev
FRENES
Back to the blog
Engineering

Shell Relied on 11 Safeguards Against a Furnace Explosion. Every One Depended on a Person.

October 20, 2026 7 min read

On September 16, 2026, the US Chemical Safety and Hazard Investigation Board (CSB) published its final report on the explosion of Furnace 5 at Shell Polymers Monaca, an ethane cracker about 30 miles northwest of Pittsburgh. On June 4, 2025, flammable gas flowed backward into the furnace's firebox, met the lit pilot flames and exploded. No one was killed or seriously injured, the CSB says. Fifteen employees were evacuated, Shell estimated the damage at $95 million, and the furnace restarted on January 22, 2026.

The CSB found that the cause was "the inadvertent simultaneous opening of both motor-operated valves" that isolated the furnace. The rest of the report matters more. Shell's own investigation team listed 11 controls the site had relied on to prevent or mitigate this. The CSB found that every one of them depended on people knowing a rule and following it, and that all 11 failed.

I am not a process engineer. I read the 70-page report as someone who ships software, because at the center of it is a screen.

Why the gas flowed backward

Monaca's furnaces heat ethane mixed with steam to 1,545 °F, about 840 °C, until the molecules crack into ethylene, hydrogen and byproducts. Monaca has seven furnaces in parallel. Their gas is cooled and merged into one stream that feeds a quench tower running at about 5 psig, 5 pounds per square inch above atmospheric pressure (roughly 0.34 bar).

Each furnace outlet has two 36-inch motor-operated valves in series: a furnace-side valve, then a tower-side valve. The firebox of a furnace that is not producing sits near atmospheric pressure, below the pressure of that merged stream, and gas goes from high pressure to low. Open both valves while other furnaces are producing, and the merged stream flows back into the idle one. On June 4, four of them were producing.

A firebox is not a pressure vessel. The CSB gives Furnace 5's walls a structural limit of 0.01 psig, about 69 pascals, the pressure at the bottom of 7 millimeters of water. They could confine accumulating gas, not an explosion. Ethylene burns in air between 2.7% and 36% by volume, and Shell had left the pilots lit during the maintenance, against its own isolation plan, to keep the furnace warm and avoid condensation.

Six minutes

Furnace 5 had been double-isolated since May 31 so its coke trap could be emptied for the first time since the plant started up in November 2022. Both valves were closed and a bleed valve opened between them. The local field panel could not reopen the tower-side valve. Only a process control engineer could, by overriding the safety instrumented system (SIS) from an engineering workstation next to the control room.

At the June 4 morning meeting, that task went to an engineer who had never done it. The written job aid listed its steps out of order, so the SIS stayed read-only until a colleague explained that it needed "debug" mode. Entering that mode refreshed the screen, which jumped back to the top.

All three valves of Furnace 5 shared that one scrolling screen: the furnace-side valve at the top, the decoking valve in the middle, the tower-side valve at the bottom. Their logic blocks were identified as 511, 512 and 513. At 2:14:28 p.m., the open command went to 511.

An alarm fired: valve in an unexpected state. Its text was identical to the tower-side valve's alarm except for the last digit. The console operator knew the tower-side valve was being opened, assumed that was it, and acknowledged.

About two minutes later, the engineer saw the tower-side valve was not moving, concluded (wrongly, the CSB says) that the furnace-side valve had already been open, removed the command and, at 2:17:50, opened 513. Around 2:20, a console operator saw the furnace-side valve open and the tower-side one opening, by then 78% of the way. The close command went out at 2:20:39. The induced-draft fan on the stack, left in speed control mode after a firmware update, could not exhaust the gas as fast as it came in. At 2:20:45 in the report's timeline, roughly six minutes after the first command, an estimated 641 pounds (about 290 kg) of cracked gas in the firebox reached the pilots.

Eleven controls, and interlocks set up for other modes

Shell's list of 11 reads like what a careful team writes down. A policy that only one valve be open when leaving lockout. A policy on ignition sources, while the pilots burned. Operator responses to the firebox pressure, carbon monoxide and methane alarms, all suppressed by design in pilot-only mode; the CO alarm, the report notes, would have sounded about 90 seconds before ignition. The response to the valve alarm, acknowledged as the wrong valve. An SIS bypass form with a mitigation plan, which staff believed did not apply to engineers; the CSB found no such exemption in the policy. An exclusion zone policy, not triggered because leaving maintenance did not count as a start-up.

None of this was a surprise. Shell's 2023 hazard analysis had identified reverse flow across these valves as a scenario that could cause multiple fatalities. It relied on two administrative controls, the methane alarm and a start-up procedure, and judged that engineered controls would be "grossly disproportional to the risk reduction." On June 4, the alarm was suppressed and that procedure was not in use.

The engineered control also existed. The licensor, Selas Linde, had built two interlocks into the field panel: a sequenced key interlock, and a SIL 2 interlock that closes the furnace-side valve when it detects the low pressure of backflow. But one outlet valve is industry practice, and Shell had asked for two. The design team assumed only one would be closed at a time, and the panel's logic covered operating modes such as decoking, not the removal of a double isolation. Reprogramming the panel sat on a list of improvement projects; others were ranked higher and funded. Meanwhile the engineer-and-override route had worked 19 times.

Since then, Shell has made all three valves operable from the field panel, added SIS logic that keeps the tower-side valve closed if the furnace-side valve is opened by mistake, retired the job aid, and taken engineers out of the task. The CSB still issued two recommendations: an inherently safer design or an engineered control for every scenario in the hazard analysis that relies only on administrative controls and could cause a fatality, serious injury or substantial damage; and an engineered anti-backflow control for all modes of operation, based on licensor input and practices such as IEC 61511. When the report came out, both were listed as open, awaiting Shell's response.

What I take from it

These are analogies: a web app does not explode, and nothing I build carries this hazard. But the shape of the failure is familiar.

  1. A procedure is a control that runs on a person. For the scenario you know is catastrophic, put the control in the system. A runbook line saying "never run this against production" is a procedure; code that refuses to is an interlock. With Claude Code, a prompt asking the agent to be careful is a procedure; a permission rule that denies a command is closer to an interlock.
  2. Safeguards built for normal modes go quiet in rare ones. The interlock covered decoking, not leaving a double isolation, and the alarms were muted by mode. Maintenance, restores and break-glass scripts are where checks go missing. List those paths and test them.
  3. Name things for the person under pressure. Shell's own HMI specification asked for descriptions "as comprehensive as possible," within 40 characters, and gave "CRACKED GAS DRYER A" as an example. "FURNACE-SIDE MOV" is 16. The ISA-101 standard quoted by the CSB says a command acting directly on the process should not be possible "from a single inadvertent input action." A confirmation that restates the target in words costs one click.
  4. Nineteen clean runs are not a safety case. The CCPS guidance cited by the CSB warns against "it has not happened before so it will not happen now."
  5. When the real fix is on the backlog, write down what stands in for it, and train people on it. Here it was 11 controls that, per the CSB, staff had not been adequately trained on.

The report has limits. The CSB is not a regulator, and its conclusions cannot be used as evidence in damage suits. It does not stop at the engineer's error: it quotes James Reason on people at the interface as "the inheritors of system defects." And it does not say procedures are useless, only that they should not be the sole defense against a potentially fatal event.

One detail stayed with me. Shell determined that had the console operator followed the approved response to the valve alarm, a field operator would have been sent to check the furnace-side valve, possibly toward the explosion.

A procedure tells people what not to do. An interlock still works on the day nobody read it.

Sources

A project like this one?

I design and deploy products like this. Let's talk.

Let's talk