On 16 September 2026 the U.S. Chemical Safety and Hazard Investigation Board (CSB) released its final investigation report, “Furnace Explosion and Fire at Shell Polymers Monaca” (No. 2025-05-I-PA), on the explosion and fire of 4 June 2025 at the Shell Polymers Monaca facility in Monaca, Pennsylvania. Flammable cracked gas flowed backwards from a downstream quench tower into the firebox of an ethane cracking furnace, Furnace 5, reached lit pilots and ignited roughly six minutes after an engineer inadvertently sent an open command to the wrong one of two motor-operated isolation valves. About three minutes after that command, the engineer opened the other valve as planned, and both were open. Fifteen employees were evacuated. The board’s chairman said no one was killed or seriously injured; the furnace went back into service about seven months later.
The job that led there was new to the site. In late March 2025, during an outage of the ethane cracking unit, Shell inspected the coke trap of Furnace 1 and in early April decided that the coke traps of all seven furnaces needed cleaning. According to the CSB, none of them had ever been cleaned before. Furnaces 1, 2, 4 and 7 were done first. By the time the Furnace 5 trap was finished on 3 June, Furnaces 1 to 4 were in ethane cracking mode, so Furnace 5 was being returned to service next to a running unit.
The sequence as the CSB describes it in its final report and news release of 16 September 2026. © Vardix Group
One engineer, three look-alike valves
Among the contributing factors, the CSB names the assignment of a process control engineer who had never performed the task before and had limited process knowledge; reliance on ineffective administrative controls; and a human-machine interface that made the furnace valves hard to tell apart. The safety system’s screen showed three nearly identical valves on a single logic screen, with identification tags that differed mainly by their final digit. According to the report, the engineer meant to open the tower-side valve and sent the command to the furnace-side one. The alarm that followed carried descriptor text identical to the tower-side alarm except for the last digit of the valve number, and the console operator, who knew which valve was planned, acknowledged it, assuming it was for the tower-side valve.
This serious incident highlights the importance of ensuring that the personnel who are assigned to critical tasks actually have the experience to do them, as well the need to have a process control system that is easy to understand and clearly communicates essential information to the people operating it.
Eleven controls, all on paper
Every control Shell had against backflow while an isolation valve was open was administrative: 11 in all, each depending on people following procedures. The report finds that all 11 failed because employees had not been adequately trained beforehand and lacked awareness of them or the ability to comply. The furnace technology licensor had supplied engineered controls able to prevent backflow, but they were not configured for the removal of double isolation. The two recommendations follow from that and both call for engineering: review the hazard analysis for potentially catastrophic scenarios that rely solely on administrative controls and implement inherently safer designs or engineered safeguards where appropriate; and, using input from the licensor and recognized industry practices, implement and maintain an engineered control against cracked-gas backflow into a furnace in all modes of operation. On the screen and on who opens the valves, the CSB makes no recommendation because Shell has already acted: the furnace valves are now operated from a local field control panel, new safety-system logic keeps the tower-side valve closed if the furnace-side one is opened by mistake, and a new procedure has been issued with training.
Nothing below replaces that. A rehearsal is itself an administrative measure, and the CSB did not assess simulation or rehearsal in this case.
| Finding | What the CSB asked for |
|---|---|
| Backflow prevented only by 11 administrative controls, all of which failed | Review the hazard analysis; for potentially catastrophic scenarios that rely solely on administrative controls, add inherently safer design or engineered safeguards where appropriate |
| Licensor’s engineered controls not configured for the removal of double isolation | An engineered control against cracked-gas backflow in all modes of operation |
| Look-alike valves and alarms on one screen; a first-time task given to an engineer with limited process knowledge | No recommendation: Shell had already moved valve operation to a local field panel, added safety-system logic and issued a new procedure with training |
Where a model of the unit fits
Engineered safeguards deal with the hazard. What remains is the person who, on a given day, has to carry out a sequence the site has rarely or never performed, with neighbouring equipment live. There is no way to practise that on the real unit. In our view this is where an interactive model of a plant’s own equipment and of its control screen earns its place: the person assigned can step through the isolation and de-isolation sequence, see which valve opens which flow path, and do it before the day rather than on it. The same replica of the screen is a simple way to check whether tags that differ by one digit can be told apart under time pressure.
This is the kind of work our 3D Application Development team takes on: interactive 3D applications, including digital twins and simulation tools, which can be built around a particular plant’s equipment. Such a model shows a sequence; it does not certify that someone is competent to run it, and it does not stand in for the safeguards the CSB asked for.
Left column paraphrases the CSB final report and news release; right column is VARDIX’s assessment. © Vardix Group
A question for the next outage plan
Distributors and integrators who work with refineries, petrochemical and chemical plants can hand a plant manager a document they can look up themselves, by name and number, and ask about their own outage plan: which jobs on it nobody on shift has done, and how the people assigned are prepared for them now. Shell is named here only as the subject of the CSB report; it is not a VARDIX customer.