Opening Isolations Safely: What Two 2026 CSB Reports Teach About Permits, Procedures and Change

A process plant spends most of its hours in steady operation. Some of its most serious incidents begin in the hours when it is not: during cleaning, maintenance, isolation, or the return of equipment to service. Two final reports published by the U.S. Chemical Safety and Hazard Investigation Board (CSB) in August and September 2026 describe events of this kind. In one, workers were washing a valve on a coke oven gas line. In the other, an engineer was bringing a cracking furnace out of its isolated state after cleaning. Jobs like these appear every week on the maintenance schedules of refineries, smelters, chemical plants and power stations in Indonesia.

This article reads the two reports for what they say about permit-to-work, isolation and management of change (MOC), and how an organisation can test whether its own systems would catch the same hazards.

Background: where the permit, the isolation and the change meet

Three elements of a process safety management system meet when someone opens a line or restores a unit to service. The permit-to-work defines which work is authorised, by whom and under which precautions. The isolation plan separates equipment from energy and hazardous material, and later puts it back. MOC asks whether a change in the plant, the procedure or the people alters the risk.

HSE UK guidance on permit-to-work systems, HSG250, treats the permit as one part of a wider safe system of work that determines how a hazardous job will be done safely. It warns against reading the permit as a simple authorisation slip (Health and Safety Executive, 2005). Its companion, HSG253, sets out a risk-based approach to selecting isolation methods. It distinguishes positive isolation, proven isolation and non-proven isolation, and it treats reinstatement after the work as part of isolation management (Health and Safety Executive, 2006).

In the United States, the OSHA standard on hazardous energy requires an energy control program with written procedures, training and at least annual inspection of those procedures (Occupational Safety and Health Administration, n.d.-b). The OSHA process safety management standard requires safe work practices for lockout/tagout and the opening of process equipment or piping, and a written MOC procedure for changes to chemicals, technology, equipment and procedures (Occupational Safety and Health Administration, n.d.-a). CCPS guidance on MOC extends the same discipline to changes that are easy to overlook, including changes in how a task is performed (Center for Chemical Process Safety, 2008).

Indonesian requirements point in the same direction. Peraturan Pemerintah Nomor 50 Tahun 2012 requires an occupational health and safety management system (SMK3) for companies with at least 100 workers or with a high hazard potential. The assessment criteria in its second annex include documented work procedures and a permit-to-work system for high-risk tasks. SNI ISO 45001:2018 asks organisations to control planned temporary and permanent changes that affect safety performance, including changes to work processes and procedures (Badan Standardisasi Nasional, 2018).

Indonesian field studies suggest that the systems exist while gaps appear at particular steps. A qualitative study at a fuel terminal found that the lockout/tagout flow was generally applied well, although one stage of lock installation was not carried out as the procedure required (Hidayah et al., 2024). A study of hot work permits on a water distribution pipeline project judged the permit process to be working, yet the authors recorded 11 near misses and 25 nonconformities in hot work during the project. They recommended digital permits and more supervisors, so that gas testing could reach every work area (Febria et al., 2025).

Recent findings: two CSB reports in 2026

Clairton: a cleaning method that never had a procedure

On 11 August 2025, an explosion occurred at the U.S. Steel Clairton Coke Works in Pennsylvania. Two workers died and eleven people were injured, five of them seriously. Property damage was estimated at USD 52.5 million. The CSB released its final report on 10 August 2026 (U.S. Chemical Safety and Hazard Investigation Board, 2026a, 2026c).

According to the CSB, workers were washing the seats of a cast-iron double disc gate valve, manufactured in 1953, with pressurised water. Water trapped between the closed gates exceeded the valve's pressure capacity, the valve failed, and coke oven gas was released and ignited. The facility had no written procedure for this operation, although employees had used pressurised water to clean valve seats on an ad hoc basis for at least three years, under the direction of a supervisor regarded at the site as its water washing expert. The CSB found that neither the company nor its cleaning contractor identified or addressed the hazard of applying water at a pressure above the valve's design rating.

The recommendations include a written procedure for washing valve seats with pressurised water, siting evaluations for occupied buildings and a comprehensive process safety management system for the coke oven gas processes. The contractor was asked to write and train its workers on procedures for cleaning piping that contains flammable or toxic gas.

Monaca: removing double isolation for the first time

On 4 June 2025, Furnace 5 at the Shell Polymers Monaca ethylene plant in Pennsylvania exploded and caught fire. The CSB released its final report on 16 September 2026 (U.S. Chemical Safety and Hazard Investigation Board, 2026b, 2026d). The furnace was being returned to service after its coke trap had been cleaned. A process control engineer who had never performed this task before inadvertently opened, at the same time, two motor-operated valves that had been used to isolate the furnace. Opening both valves created an unintended flow path, and flammable cracked gas flowed back from the downstream quench tower into the firebox, where it met lit pilots and ignited.

The CSB news release states that the company relied on 11 administrative controls to prevent backflow, all of which depended on people following procedures. Hazard analyses had identified backflow as potentially fatal. Engineered controls supplied by the process licensor were available but had not been configured for use while double isolation was being removed. The CSB also cited the design of the human-machine interface, which made the furnace valves difficult to tell apart. The company estimated property damage at about USD 95 million. The CSB recommended that the company review hazard analyses of catastrophic scenarios that rely only on administrative controls, and maintain an engineered control that prevents backflow in all modes of furnace operation.

A common thread

The CSB did not frame either case as an MOC failure; the reading here is ours. Both events happened outside steady operation, and in both the safety of the job rested on individuals: an informal in-house expert in one case, a first-time performer in the other. The hazard was also knowable beforehand. At Clairton it sat in the valve's design rating. At Monaca it was already in the hazard analysis. The missing step was the one that turns such knowledge into a control for the individual job.

Recommendations: closing the gap at the job level

The steps below apply wherever maintenance and isolation take place on hazardous processes or machinery.

• List non-routine tasks that have no written procedure. Ask supervisors and contractors which jobs are done "the way we have always done it". Each one is a candidate for a procedure and a task-level risk assessment such as a JSA.
• Treat a new method, tool or medium as a change. A pump with higher discharge pressure, a different cleaning agent or a new contractor deserves at least a documented risk review.
• Plan de-isolation as carefully as isolation. The isolation certificate should state the reinstatement sequence, who performs each step, how each step is verified, and which interlocks or engineered controls must be active along the way.
• Check familiarity when the permit is issued. Add one question to the permit or the pre-job briefing: has the person carrying out each critical step done it before on this unit? If not, arrange direct supervision or a walkthrough before the work starts.
• Review high-consequence scenarios that rely only on administrative controls. This mirrors the CSB recommendation and can be applied at any facility. For each scenario, ask whether an engineered safeguard exists, including one already supplied by a licensor or vendor but left unconfigured.
• Make design limits visible to whoever plans the job, contractors included: design pressure, material and age of the equipment.
• Audit permits at the job site, contractor work included. Compare a sample of open permits with what is happening in the field, not only with the file.
• Rehearse isolation and reinstatement away from live plant, so that sequencing errors are made and corrected without exposure.

How Nusa Safety's services relate

Simulation helps with the training side of these lessons. In LOTO Simulator, trainees read the permit to work, identify energy sources, isolate, apply locks and tags, release stored energy, verify zero energy, hand over to the work team, and finally restore energy in a sequence that is also assessed. Field decision tests record how a trainee responds to a request such as skipping a gas test. PSM Simulator asks players to recognise abnormal conditions on a live P&ID, report them in HAZOP terms, and classify human factor cases as slips, lapses, mistakes or violations.

To track PHA recommendations to closure, such as a review of scenarios that rely only on administrative controls, APEX Risk holds HAZOP, JSA and other assessments alongside a corrective action register.

On the consulting side, Technical Guidelines and SOP Development covers written procedures for non-routine tasks, isolation and reinstatement. A Process Safety Management Review tests whether permits, isolation and MOC work in practice, and a Machine Safety Assessment examines guarding and energy control on production equipment. Teams can build task-level assessments for their own jobs in a Risk Assessment and JSA Workshop, and simulators can be adapted to a site's own equipment through Digital Safety Simulators. To discuss a specific facility, please contact us.

Conclusion

The two CSB reports describe different plants and hazards with a similar weak point. Permits and isolations existed, but they did not reach the specific method in use or the specific person carrying out the step. A site can test itself with three questions about any job planned for next week. Is there a written method for it? Has anything about the method, the equipment or the people changed since it was last done? Does the reinstatement plan rely on memory, or on verified steps and engineered protection? Where an answer is uncertain, look again before the permit is signed.

This article is general information and does not constitute legal advice; for questions on how specific regulations apply to your organisation, please consult a qualified lawyer.

References

1. Badan Standardisasi Nasional. (2018). SNI ISO 45001:2018 Sistem manajemen keselamatan dan kesehatan kerja, persyaratan dengan panduan penggunaan. BSN.
2. Center for Chemical Process Safety. (2008). Guidelines for the management of change for process safety. Wiley.
3. Febria, A. H., Sartika, I., Ani, N., & Wartini. (2025). Implementasi hot work permit sebagai upaya pencegahan kecelakaan di proyek jaringan distribusi utama SPAM Wosusokas Segmen 3. Sehat Rakyat: Jurnal Kesehatan Masyarakat, 4(3). https://doi.org/10.54259/sehatrakyat.v4i3.5224
4. Health and Safety Executive. (2005). Guidance on permit-to-work systems: A guide for the petroleum, chemical and allied industries (HSG250). HSE Books. https://www.hse.gov.uk/pubns/books/hsg250.htm
5. Health and Safety Executive. (2006). The safe isolation of plant and equipment (HSG253, 2nd ed.). HSE Books. https://www.hse.gov.uk/pubns/books/hsg253.htm
6. Hidayah, N., Rahmawati, A., & Nisa, R. (2024). Analisis penerapan lockout/tagout (LOTO) sebagai upaya pencegahan kecelakaan kerja di PT. Pertamina Patra Niaga Fuel Terminal Cikampek. Afiasi: Jurnal Kesehatan Masyarakat, 8(3). https://doi.org/10.31943/afiasi.v8i3.303
7. Occupational Safety and Health Administration. (n.d.-a). 1910.119 Process safety management of highly hazardous chemicals. U.S. Department of Labor. https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.119
8. Occupational Safety and Health Administration. (n.d.-b). 1910.147 The control of hazardous energy (lockout/tagout). U.S. Department of Labor. https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.147
9. Peraturan Pemerintah Nomor 50 Tahun 2012 tentang Penerapan Sistem Manajemen Keselamatan dan Kesehatan Kerja.
10. U.S. Chemical Safety and Hazard Investigation Board. (2026a). Fatal coke oven gas explosion at U.S. Steel Clairton Coke Works (Report No. 2025-03-I-PA). https://www.csb.gov/assets/1/6/us_steel_clairton_investigation_report_publication_copy.pdf
11. U.S. Chemical Safety and Hazard Investigation Board. (2026b). Furnace explosion and fire at Shell Polymers Monaca, Monaca, Pennsylvania [Investigation report]. https://www.csb.gov/assets/1/6/shell_investigation_report_publication.pdf
12. U.S. Chemical Safety and Hazard Investigation Board. (2026c, August 10). U.S. Chemical Safety Board issues final report on August 2025 fatal coke oven gas explosion at U.S. Steel Clairton Coke Works [News release]. https://www.csb.gov/us-chemical-safety-board-issues-final-report-on-august-2025-fatal-coke-oven-gas-explosion-at-us-steel-clairton-coke-works/
13. U.S. Chemical Safety and Hazard Investigation Board. (2026d, September 16). U.S. Chemical Safety Board releases final investigation report on 2025 explosion and fire at Shell Polymers Monaca facility in Pennsylvania [News release]. https://www.csb.gov/us-chemical-safety-board-releases-final-investigation-report-on-2025-explosion-and-fire-at-shell-polymers-monaca-facility-in-pennsylvania/