On June 4, 2025, at 2:21 p.m., flammable cracked gas back flowed into the firebox of Furnace 5 at the facility and then ignited and exploded. Furnace 5 ended up severely damaged by the explosion, and an ensuing fire led to the evacuation of 15 employees who were in the area, according to the report.
Shell estimated this incident resulted in $95 million in property damage.
At the Monaca facility, Shell converts ethane to ethylene via a high-temperature reaction in its ethane cracking unit, which has seven furnaces, called Furnace 1 through Furnace 7. A byproduct of this reaction is a solid carbon residue, called coke, which deposits into a large vertical pipe, called a coke trap, to prevent it from moving through the rest of the process.
Before the incident, Shell determined the coke traps of all seven of its furnaces needed cleaning. The company never cleaned the coke traps ever since the facility opened in 2022.
Closed MOVs
To clean the Furnace 5 coke trap, Shell isolated the furnace by closing two motor-operated valves (MOVs) in series between the furnace and a quench tower.
On the day of the incident, Shell was returning Furnace 5 to operation after cleaning its coke trap. During the return to operation, a process control engineer (PACO engineer), who had never previously performed the task involved in this procedure, inadvertently opened a valve during the start-up sequence, leading to an unintended flow path of flammable cracked gas between the downstream quench tower and Furnace 5.
At the time, four of the other seven furnaces were actively producing cracked gas, and the flammable cracked gas back flowed from the quench tower to the furnace. Just 6 minutes after the PACO engineer sent the inadvertent open command to the valve, cracked gas entered the firebox, contacted the lit pilots, and ignited.
The explosion ruptured a firebox wall in Furnace 5.
As a result, Shell estimated 5,100 pounds of ethylene and combustion products released. Seven months after the blast, Furnace 5 ended up repaired and returned to service.
Aftermath of the explosion at the Shell Polymers Monaca facility in June 2025.
Source: CSB
Although many factors contributed to the incident, CSB’s report addressed the two primary safety issues:
Reliance on Administrative Controls
Shell relied on 11 controls the facility had in place it believed should have prevented the explosion but failed to. However, each of these controls was a purely administrative control that relied on management’s and workers’ awareness of what Shell’s policies required and their compliance with them.
In its process hazard analyses (PHAs), Shell identified the backflow of cracked gas as a potentially fatal explosion hazard when an isolation valve was open during the coke removal process.
However, instead of implementing engineered controls to prevent backflow while the furnace was in the double-isolated state, Shell chose to rely solely on administrative controls. Additionally, although the furnace technology licensor, Selas Linde North America, provided engineered controls to prevent backflow into the firebox using a local field control panel, Shell did not set up the control panel so the panel could end up used when removing the double isolation of the valves from the furnace.
Human-Machine Interface (HMI)
Shell’s HMI for operating furnace MOVs combined three nearly identical valves on a single logic screen. Although the valves ended up identified by unique tags and remained positioned separately, they differed only by the last digit of the tag name, and the logic screen was not sufficiently intuitive or clear to facilitate valve identification.
The furnace MOV interface in the safety system lacked clear labeling, adequate separation of complex logic, and safeguards such as confirmation steps, thereby increasing the likelihood of human error. Industry standards such as ANSI/ISA 101.01-2015: Human-machine interfaces for Process Automation Systems call for structured displays, error-avoidance methods, and task analyses.
Without implementing available interface standards guidance, the PACO engineer assigned to bring the furnace back into operation unintentionally created a hazardous flow path that allowed flammable cracked gas to enter a furnace with lit pilots.
With all that in mind, CSB determined the cause of the incident was the inadvertent simultaneous opening of both motor-operated valves used to isolate the furnace.
Opening both valves created a path for cracked gas to backflow and accumulate in the furnace’s firebox, where an existing flame ignited the flammable vapors, resulting in the explosion.
Contributing to the incident was assigning a PACO engineer with limited process knowledge to manipulate the valves, as well as Shell’s use of ineffective administrative controls to prevent the backflow hazard and subsequent explosion.
Simplified process flow diagram of Furnace 5 while isolated for non-entry maintenance to clean the coke trap. Red valves represent closed MOVs and green valves represent open MOVs.
Source: CSB
Also contributing to the incident was the safety instrumented system logic human-machine interface Shell used at the time of the incident to open the motor-operated valves, which combined all three valves on a single diagram without clear labels to distinguish them.
Timeline
In late March 2025, workers opened the coke trap of Furnace 1 and inspected it during a March-April ethane cracking unit outage. Coke was visible almost up to the manway. Shell decided in early April 2025 the coke traps of all seven furnaces needed cleaning, as more coke accumulation could pose operational challenges. None of the coke traps in any of the furnaces had ever been cleaned prior to this time. The coke traps of Furnaces 1, 2, 4, and 7 ended up successfully cleaned for the first time during the ethane cracking unit outage.
Furnace 5 was the next coke trap to undergo the cleaning process.
On May 30, 2025, workers shut down Furnace 5 to clean its coke trap for the first time since it began operating. During the night shift on May 31, 2025, Shell completed the required energy isolation. At this time, Furnaces 1, 2, 3, and 4 were in ethane cracking mode. The next day, Furnace 6 shut down.
Furnace 7 was in hot steam standby mode (HSSB) on June 4, the day of the incident . Both the furnace-side and tower-side MOVs for Furnace 5 closed as part of the energy isolation plan for the coke trap cleaning.
The isolation occurred by closing both MOVs, isolating the steam to the cavity between the double gates of each MOV, and opening a bleed valve between the two MOVs to ensure any cracked gas would not flow back to the furnace.
Furnace Not Isolated
Because cleaning the coke trap would not require anyone to enter the furnace, Shell did not isolate the furnace for entry. With the furnace-side MOV closed to isolate the furnace from the quench tower, the decoking MOV was open.
Shell wanted to avoid repeating a prior experience with furnace refractory damage and left the furnace pilots on to keep the temperature above the atmospheric dew point and prevent condensation. Additionally, Shell expected the flammable cracked gas to end up isolated from the furnace throughout the coke trap cleaning and the return to ethane cracking mode.
While the furnace was in pilot-only mode, a group of alarms automatically suppressed, including those for high furnace firebox pressure, high carbon monoxide concentration, and high methane concentration in the furnace. These alarms ended up suppressed by design to help manage alarm floods and nuisance alarms.
Over the next three days, workers cleaned out the Furnace 5 coke trap. Furnace 5 coke trap cleaning concluded on June 3, and at 1:40 p.m. on June 3, power restored to both the furnace-side and tower-side MOVs on Furnace 5 to begin returning the furnace to ethane cracking mode.
Start Back Up
On June 4, 2025, Shell’s operations department continued activities to bring Furnace 5 back to service and removed the energy isolation from the coke trap cleanout. Operations planned to transition Furnace 5 from an isolated, pilot-only mode to HSSB. Shell’s furnace start-up procedure did not apply to transitioning out of pilot-only mode, so there were no specific steps for operators to follow, even though the pilots were already lit.
During a morning meeting, the Operations Production Specialist (known as a P-Spec at Shell) assigned the task of opening the tower-side valve to the PACO engineer. However, the PACO engineer had never performed this process before. There also was no discussion about operations or the PACO engineer issuing a safety instrumented system (SIS) bypass form to command the tower-side MOV open.
By noon on June 4, 2025, operations was ready to open the tower-side valve so that the Furnace 5 start-up could continue. The PACO engineer asked an instrument technician to unlock the SIS. At 2:04 p.m., the SIS ended up unlocked, and the PACO engineer was able to control the MOVs.
To complete the assigned task, the PACO engineer used a Shell-approved, written job aid to command the tower-side valve to open. The job aid required the use of a human-machine interface (HMI) screen to manipulate the logic in order to issue an open command to the tower-side valve. A PACO engineer would use this HMI to override the SIS. However, operators would not use it during day-to-day operation of the ethane cracking unit.
Read Only
The PACO engineer was attempting to issue an open command to the tower-side valve but the SIS was not responding so they asked a nearby process control engineer for assistance. That process control engineer, who had commanded open valves before, immediately noticed the SIS was in “read-only” mode and informed the PACO engineer the SIS would need to be in “debug” mode to accept the open command.
The job aid’s instructions were ambiguous on when to unlock the SIS and enter the debug mode.
Furnace-side and tower-side 36-inch motor-operated valves after an ethane cracking furnace.
Source: Shell, annotated by CSB
The furnace-side MOV was at the top of the HMI screen that displayed the three Furnace 5 MOVs, with the tower-side MOV located at the bottom of the screen and the decoking MOV located between the two
The HMI screen for the MOVs in the SIS required a user to scroll down to navigate from the furnace-side MOV to the tower-side MOV. The MOV SIS logic blocks ended up identified by descriptions that differed only in the last digit for each valve: 511 for the furnace-side MOV, 512 for the decoking MOV, and 513 for the tower-side MOV.
When the PACO engineer entered “debug” mode, the HMI screen for the MOVs in the SIS refreshed and automatically started back at the top. As a result, while the PACO engineer previously had been looking at the tower-side MOV logic, which was at the bottom of the screen, the PACO engineer’s attention was now instead focused on the furnace-side MOV logic at the top of the screen.
Different Set Up
In other words, the upper third of the SIS screen was now visible to the PACO engineer, rather than the lower third. Instead of looking at the tower-side MOV at the bottom of the screen, the PACO engineer was now looking at the similar logic furnace-side MOV at the top of the screen.
At 2:14 p.m., the PACO engineer inadvertently sent a command for the furnace-side MOV to open, instead of sending the command to the tower-side MOV. When the furnace-side MOV began opening, an alarm activated to indicate the MOV was in an unexpected state. However, the descriptor text displayed for the furnace-side MOV alarm was identical to that for the tower-side MOV alarm, again except for the last digit of the valve number.
The console operator acknowledged that alarm. Because the console operator was aware the PACO engineer planned to open the tower-side valve, the console operator assumed incorrectly the alarm was for the tower-side valve and did not pursue corrective actions.
Approximately two minutes later, the PACO engineer noticed the tower-side MOV was not moving.
Because the PACO engineer believed (incorrectly) the furnace-side MOV was already in the open position prior to issuing the open command, the PACO engineer concluded the open command did not cause the MOV valve to change position and accordingly removed the command from the SIS logic. About 1 minute later, the PACO engineer scrolled back to the bottom of the HMI screen and sent a command to open the tower-side MOV, as initially planned.
MOVs opening
At 2:20 p.m., the ethylene control room console operator noticed the furnace-side MOV was open and the tower-side MOV was opening. The ethane cracking unit console operator immediately went to the engineering workstation and told the PACO engineer to close the tower-side valve, which by this point was 78 percent open and continuing to open.
Once the furnace-side valve was open and with the tower-side valve in the process of opening, an unintended flow path started. The path allowed cracked gas from the higher-pressure header to backflow into the lower-pressure Furnace 5 firebox.
It takes approximately four minutes for one of Shell’s MOVs to travel from fully closed to fully open. Consequently, the cracked gas and steam in the header from the other furnaces continued to backflow into the Furnace 5 firebox for approximately 2.5 minutes.
During this time, the Furnace 5 Induced Draft (ID) fan on the furnace stack was operating in speed control mode, and the rate of backflowing ethylene into the firebox exceeded the fan’s exhaust rate, causing the furnace to accumulate flammable cracked gas.
A console operator had placed the ID fan in speed control around 9:20 a.m. on June 3, 2025, after the fan’s motor control firmware updated during the coke trap cleaning. It was common operating practice to manually ramp up the ID fan to higher speeds using a speed controller as the furnace was entering service, and then transition the fan to a pressure controller.
Pressure Building
With a structural limit of 0.01 psig, the furnace walls initially contained and confined the accumulating gas in the firebox. However, the furnace was not designed to contain an internal explosion.
By 2:20 p.m. on June 4, 2025 – roughly just 6 minutes after the PACO engineer had sent the inadvertent open command to the furnace-side MOV – an estimated 641 pounds of cracked gas had accumulated in the Furnace 5 firebox, came in contact with the lit pilots, and ignited, resulting in an explosion that blew out of the furnace’s walls, resulting in a loss of containment of the cracked gas and combustion products, and a subsequent fire.
The Shell site Emergency Response Team at the facility responded and began firefighting efforts, which continued until 4 p.m. Firefighting water runoff ended up captured by a collection system and sent to Shell’s wastewater treatment plant.
The explosion resulted in a release of hazardous chemicals and substantial property damage. Shell estimated 515 pounds of non-combusted cracked gas and approximately 4,600 pounds of combustion products from combusted cracked gas released.
Although there were no injuries, Shell evacuated 15 employees in the ethane cracking unit (ECU) area due to the fire. A contractor became trapped in the ECU elevator next to Furnace 5 and ended up rescued. Additionally, multiple other Shell employees were in the area around Furnaces 4, 5, and 6.
Following the incident, Furnaces 4 and 6 went offline to allow for assessment, while the other furnaces remained in ethane-cracking mode. After inspections, Furnaces 4 and 6 were safe for operation.
On December 1, 2025, OSHA issued three citations from the June 4 incident, with a proposed penalty of $26,480.
Recommendations
CSB’s recommendations to Shell Polymers Monaca include:
- Review the Shell Polymers Monaca Ethane Cracking Unit process hazard analysis to identify process deviations addressed solely with administrative controls. Implement an inherently safer design or an engineered control for any scenario identified that could result in a fatality, serious injury, or substantial property damage.
- Based on licensor input and good industry practices, such as ANSI/ISA-61511-2-2018 / IEC 61511-2:2016, Functional Safety – Safety Instrumented Systems for the Process Industry Sector – Part 2: Guidelines for the application of IEC 61511-1:2016 and Part 3: Guidance for the Determination of the Required Safety Integrity Levels, implement and maintain an engineered control to prevent backflow of cracked gas into a furnace during all modes of furnace operation.
Click here to view the full CSB report.