The CSB's Shell Monaca final report: a backflow hazard the PHA named, then left to eleven administrative controls

On 16 September 2026 the U.S. Chemical Safety Board released its final investigation report on the 4 June 2025 explosion and fire at the Shell Polymers Monaca facility in Monaca, Pennsylvania. Flammable cracked gas backflowed into the firebox of an ethane cracking furnace — Furnace 5 — contacted lit pilots, and ignited. The explosion ruptured the firebox wall, the fire that followed prompted the evacuation of 15 workers, and Shell estimated roughly $95 million in property damage plus an estimated 5,100 pounds of ethylene and combustion products released. No one was killed or seriously injured, and Furnace 5 was repaired and returned to service about seven months later. The full report is worth reading, because the failure is built entirely from things a hazard study normally believes it has already handled.

What happened

The Monaca plant cracks ethane to ethylene across a unit of seven furnaces. The process lays down coke, which collects in coke traps designed to keep it from travelling downstream. During a spring 2025 outage Shell decided — for the first time ever — to clean the coke traps on all seven furnaces. By the time Furnace 5’s trap cleaning finished on 3 June, four of the other furnaces were already back in cracking mode, so the downstream system was live.

As Furnace 5 was being returned to service, a process control engineer inadvertently opened both of the motor-operated valves (MOVs) that had been isolating the furnace from downstream equipment. Opening both at once created a flow path that let flammable cracked gas backflow from the downstream quench tower into the firebox. It reached the lit pilots and ignited roughly six minutes later.

The two findings, read as a study checklist

The CSB’s report turns on two primary safety issues, and each maps onto a decision a HAZOP or LOPA team actually makes.

The first is the reliance on administrative controls. Shell’s own process hazard analyses had identified cracked-gas backflow as a potentially fatal hazard — the study saw the scenario. What the design then leaned on was eleven administrative controls to prevent it, every one of them depending on workers and managers following procedures correctly. The CSB found that the furnace technology licensor had supplied engineered controls capable of blocking backflow, but Shell had not configured them for use during the removal of the furnace’s double-isolation state. In the CSB’s framing, an engineered safeguard that was available and appropriate was left on the shelf while a stack of procedural safeguards carried a catastrophic scenario. The transferable question for facilitators and revalidation teams is direct: where a study credits multiple administrative controls against a scenario the team itself has rated as potentially fatal, is that stack quietly substituting for an inherently safer design or an engineered safeguard that exists and could be implemented? The CSB’s first recommendation to Shell is exactly this — review the hazard analysis for potentially catastrophic scenarios that rely solely on administrative controls, and implement inherently safer designs or engineered safeguards where appropriate.

The second is the human-machine interface. The HMI displayed three nearly identical valves on a single logic screen, distinguished mainly by the final digit of their tag. That design contributed to the engineer manipulating the wrong valve and opening the hazardous flow path. This is the layer that HAZOP nodes rarely reach and that human-factors and alarm/HMI reviews are supposed to catch: whether the operator-facing display makes safety-critical valve identity unambiguous, especially for near-identical assets in the same service. The report also notes that the engineer assigned to the task had never performed it before and had limited process knowledge — a reminder that “operator action” credited as a safeguard assumes a specific competence and familiarity that the task assignment has to actually deliver.

The through-line

CSB investigator Owen Trippany’s summary is the line to keep: the incident “demonstrates the importance of using engineered safeguards to control serious process hazards in all modes of operation, rather than relying solely on procedures and worker actions.” The mode matters here — this was a non-routine return-to-service after a first-of-a-kind cleaning campaign, exactly the transient condition where isolation is being removed and where studies most often assume steady-state protection. The CSB’s second recommendation asks Shell to implement and maintain an engineered control against furnace backflow across all modes of operation, with input from the technology licensor and recognised industry practice.

For anyone scoping or revalidating a study, the Monaca report is a clean worked example of two habits worth pressure-testing: that identifying a fatal hazard is not the same as controlling it, and that a safeguard column full of “operator follows procedure” entries deserves a second look whenever an engineered alternative already exists in the design package.