The cheapest lesson in this business is the one somebody else already paid for.
On 13 August 2026 the US Chemical Safety Board published an investigation update on the hydrogen sulfide release that killed two workers and seriously injured four at the Catalyst Refiners facility in Institute, West Virginia, on 22 April. It is an update, not a final report. The Board’s work on incompatibility, decommissioning hazard analysis, disposal procedures, monitoring and governance is still open. There is already enough on the record to be useful, and a year spent waiting for the final report is a year spent running the same exposure.
What happened
The plant had ceased production. It was decommissioning silver and ethylene oxide catalyst refining operations. The wastewater pretreatment system was still running.
Employees pumped roughly 80 gallons of a calcium chloride coagulant and roughly 275 gallons of a sodium trithiocarbonate metal precipitant into a wastewater receiving tank, then began transferring diluted nitric acid from a tote into the same tank. The reaction produced hydrogen sulfide and a visible fog. The pump operator lost consciousness. A supervisor who responded lost consciousness. Two more employees who went in to help were overcome and died. Twenty-two people were decontaminated, four of them responders, and eighteen were transported for evaluation.
There was no written procedure for disposing of those chemicals through the wastewater treatment system.
The line that matters
The CSB found four full face respirators on site, not all of them fitted with filters rated for the hazardous gas. It found no personal gas monitors provided or required.
And it found this: respirator use was no longer required after the facility transitioned from production to decommissioning.
Read that as an STO person, because it is the same failure shape. A requirement was attached to the operating state. When the operating state ended, the requirement ended with it. The chemical inventory, the incompatibility set and the confined exposure did not end. They were still sitting in tanks, totes and a live effluent system, and they were now being deliberately moved around by people who had in effect been told that the phase they were in was less hazardous than the one they had just left.
The hazard does not leave with the product.
This is not one company’s failure
If it were an outlier it would be a sad story and not a lesson. It is not an outlier. The same shape runs all through the public record, and the common factor every time is a transition: a state where a plant is neither running normally nor properly stopped, and where the management system quietly stops covering the work.
Valero McKee, Sunray, Texas, 2007. A propane mix control station had been taken out of use in the 1990s after a control change. It was isolated by closed block valves, never blinded, never removed, still connected to a high pressure process. Water accumulated in the idle section, froze, cracked the piping and released a propane cloud that ignited. The CSB finding is worth putting on a wall: the refinery conducted no formal management of change review of this idled control station, and the 2006 process hazard analysis did not identify it as a dead leg. Idle for fifteen years, and still lethal.
Williams Olefins, Geismar, Louisiana, 2013. Heat was introduced during a non routine operation to a standby propane reboiler that had been isolated from its pressure relief device by block valves. The vessel ruptured. Two people were killed and 167 injured. No hazard analysis had been performed for the specific non routine operation being conducted that day.
Packaging Corporation of America, DeRidder, Louisiana, 2017. During a planned annual outage, contractors did hot work on piping above a foul condensate tank that was isolated but still in service, holding roughly ten feet of liquid under a twenty foot vapor space. Turpentine had accumulated because a valve in the recovery line had been shut for about three months, and outage cooling helped draw air in. The tank exploded and three contractors died. The mill had never conducted a process hazard analysis on the non condensable gas system, and PSM applied to only two processes at the site. The tank that killed three people was not one of them.
LyondellBasell, La Porte, Texas, 2021. An acetic acid unit was shut down because the unit next door was shut down. The reactor system still held about 164,000 pounds of acetic acid mixture at 130 psig and 238 degrees Fahrenheit. A contract crew removing a pneumatic actuator to prepare an isolation point took pressure retaining components off a valve that was in live service. Two contractors died. They had been given no procedure and no instructions for the task.
Georgia-Pacific Naheola, Pennington, Alabama, 2002. Sodium hydrosulfide entered the mill’s process sewer, met acidic conditions, and generated hydrogen sulfide that escaped from a sewer manway near a truck unloading area. Two contractors died and eight more people were affected, including the paramedics who moved them. The sewer had never been evaluated as a place where incompatible streams could meet.
That last one produced a CSB safety bulletin cataloging 45 sodium hydrosulfide incidents between 1971 and 2004, with 32 deaths and 176 injuries, and one line every planner should be able to recite: always treat sewers as extensions of the process, and do not add wastes without analyzing for compatibility with other sewer contents.
The Board’s wider reactive hazards study found the same thing structurally. Of 167 serious reactive incidents it examined, 36 percent came down to chemical incompatibility, and more than 65 percent of the equipment involved was ordinary storage and process equipment rather than a reaction vessel. The reaction almost never happens where the drawing says the reactor is.
The second body
Look again at Institute. The first casualty was the operator. The people who died were, in part, the people who went in after him.
That is not a coincidence and it is not a training failure by the people who ran in. It is what happens when nobody in the area is carrying a monitor, because then the only signal that something is wrong is a colleague on the ground, and the only available response is to go and get him.
At DuPont La Porte in 2014, four died in a methyl mercaptan release. Two of the four were responders. One was the brother of one of the first victims, and he was fatally overcome while donning his breathing apparatus. Operators had not been issued personal detectors, and the building alarms were set at 25 ppm against a recommended exposure limit of 0.5 ppm.
At Valero Delaware City in 2005, during a fall maintenance turnaround, a contractor went into a nitrogen purged reactor. His foreman pushed a ladder down the manway and climbed in after him. Both died within minutes. When a meter was finally lowered in, it alarmed immediately.
At Aghorn Operating in Odessa in 2019, an operator was overcome by hydrogen sulfide in a pump house. His wife came to the site looking for him, walked in, and died as well. The fixed detection system was not functioning, and personal monitors were not in use.
The CSB’s nitrogen bulletin puts a number on it. Across 85 workplace asphyxiation incidents, roughly ten percent of the fatalities were people attempting a rescue. The rescue instinct is not a defect to be trained out. It is the reason the detection and the rescue plan have to be in place before the first person goes down, because after that the decision gets made by somebody who is running.
Why the system permits it
Open 29 CFR 1910.119 and read the list of operating phases that written procedures must address:
- Initial startup
- Normal operations
- Temporary operations
- Emergency shutdown
- Emergency operations
- Normal shutdown
- Startup following a turnaround, or after an emergency shutdown
Seven phases, and every one of them ends by pointing at a plant that runs again. There is no phase for being down. There is no phase for being emptied, cleaned, decontaminated, disposed of or dismantled. The words decommissioning, demolition, idle and mothballed do not appear in the standard at all.
The coverage itself has not lapsed. PSM defines a process as any activity involving a highly hazardous chemical, including use and storage, so a unit that is down but still holds inventory above a threshold quantity is still a covered process, and hydrogen sulfide is a listed chemical at 1,500 pounds. That is a reading of the regulatory text rather than an OSHA interpretation, and we would welcome being pointed at one. The point stands either way. What runs out at the transition is not the legal coverage. It is the procedural imagination. The standard asks for procedures covering every phase it can think of, and it cannot think of this one.
Two things are worth setting against that. The UK regulator says the opposite in a single sentence: operating procedures should be provided for decommissioning of hazardous plant in the same way as for commissioning, and those procedures should be subject to hazard review and risk assessment. And CCPS published a guidelines volume in 2025 on preparing process equipment for maintenance and return to service, which is a good book and which is, by its own title, about coming back.
What this means for an STO
Here is the translation, and it is not subtle. An STO, meaning a shutdown, turnaround or outage, is a planned, funded, scheduled trip through exactly the phase nobody writes procedures for.
Every hazard that governed the unit while it was operating is still on site the day it comes down, and several new ones arrive with it. Opened equipment. Temporary hoses and blinds. Decontamination and neutralization chemistry, which is real chemistry with real incompatibilities. Chemical cleaning waste going somewhere. Effluent and sewer routing carrying things it does not normally carry. Confined spaces that were vessel internals last week. Hot work near residual inventory. And several hundred people, many of them contractors, on their first day at the site.
The difference between an STO and the Institute incident is not the hazard. It is that we usually get away with it, because the event is temporary and everybody knows a restart is coming. Decommissioning removes the restart, and with it removes the last reason anybody was holding the line.
So carry the requirements in explicitly rather than inheriting them by assumption. Six items belong in scope, and every one of them is cheap next to a fatality:
- A written chemical basis for every non production chemical step. Decontamination, neutralization, passivation, chemical cleaning, catalyst handling and disposal. Which chemicals, in what order, into what, and what they are compatible with. Where a step has no written procedure, that is a finding, not a detail. This belongs in scope challenge, not in a field decision on the day.
- The effluent system treated as process. Name every stream going to the sewer, drain, sump or receiving tank during the event, and analyze it against everything else that will be in there. The CSB has been saying this since 2004 and it is still the most commonly skipped analysis in a shutdown.
- Atmospheric monitoring specified per task and per person, not per facility. A fixed detector on a wall is a facility control. What kills people in transitions is a personal exposure somewhere the facility design never anticipated.
- Respiratory protection tied to the residual hazard, not to the operating state. If a requirement is being relaxed because a unit is down, that is a management of change, and it needs a written technical reason, a name against it and a date.
- A rescue plan that assumes there will be a rescuer. Who is permitted to enter, with what on their face, and who physically stops everyone else. Assume the first responder will be a colleague who is already running.
- Management of change applied to the state change itself. Going down is a change. Being idle is a change. Coming apart is a change. If the MOC log has no entry for the transition, the transition was never assessed.
None of these six needs a new system. They need somebody to own them before the event, which is what an independent assurance review is for, and a closeout review afterward so the next event inherits the answer rather than rediscovering the question.
The point of reading somebody else’s
Most organizations only ever run a look-back on their own events. That means the price of every lesson is paid in their own units, with their own people. It is a reliable way to learn and an expensive one.
The CSB publishes these so the rest of us do not have to buy the lesson at full price. Reading them properly is one of the highest return hours available in this industry, and almost nobody spends it. The final report on Institute will land in a year or two. The lesson is available now.
If your next event includes decontamination, chemical cleaning, catalyst handling or any disposal into the effluent system, the question worth asking on Monday is a short one. Who has written down what those chemicals are compatible with, and who checked?
Sources
US Chemical Safety and Hazard Investigation Board, investigation update, Catalyst Refiners, Inc., Institute, West Virginia, 13 August 2026. CSB, Valero McKee Refinery Propane Fire, 2008. CSB, Williams Olefins Plant Explosion and Fire, case study, 2016. CSB, Packaging Corporation of America Hot Work Explosion, 2018. CSB, LyondellBasell La Porte, final report, 2023. CSB, Georgia-Pacific Hydrogen Sulfide Poisoning, 2002. CSB, Sodium Hydrosulfide: Preventing Harm, safety bulletin no. 2003-03-B. CSB, Improving Reactive Hazard Management, hazard investigation no. 2001-01-H, 2002. CSB, DuPont La Porte, final report, 2019. CSB, Valero Delaware City nitrogen asphyxiation, case study, 2006. CSB, Aghorn Operating Waterflood Station, 2021. CSB, Hazards of Nitrogen Asphyxiation, safety bulletin no. 2003-10-B. OSHA, 29 CFR 1910.119 and Appendix A. HSE (UK), COMAH Safety Report Assessment Guide, plant modification and change procedures. CCPS, Guidelines for Preparing Process Equipment for Maintenance and Return to Service, 2025.