CSB Safety Study:

No. 2024-01-H
Remote Isolation of Process
Equipment

Introduction
Over the last several years, the U.S. Chemical Safety and Hazard Investigation Board (CSB) has reviewed
and investigated numerous incidents where the consequences of these occurrences escalated following
a loss of containment due to the lack of effective remote isolation equipment. These incidents resulted in
serious injuries, fatalities, environmental contamination, and severe damage to facilities.

In the CSB’s report on its investigation of the many years, the guidance has not been consistently
November 2019 explosions and fires at the TPC followed. Therefore, the CSB has concluded that
Group chemical plant in Port Neches, Texas, the remote isolation requirements are needed in both
CSB concluded that improved requirements in both industry standards and federal regulations to help
industry guidance documents and federal regulations mitigate the consequences of these highly destructive
are necessary to help prevent the recurrence of and dangerous events involving the release of highly
highly destructive and dangerous events involving flammable or toxic materials. As a result, the CSB is
the release of highly flammable or toxic materials issuing three safety recommendations in this Safety
that cannot be isolated. The CSB stated that it would Study: one each to the American Petroleum Institute
“conduct further analyses of incidents involving (API), the U.S. Environmental Protection Agency
lack of remote isolation capability to determine the (EPA), and the U.S. Occupational Safety and Health
appropriate course(s) of action to recommend to Administration (OSHA), as follows:
industry groups and regulatory agencies.” 1 As a
result, the CSB initiated this Safety Study to review
American Petroleum Institute (API)
the incidents investigated by the CSB and determine
the action needed to address identified gaps and 2024-01-H-R1
deficiencies in both industry guidance and federal Develop a new publication or revise an existing
regulations. publication or publications that should be applicable
to various facility types such as refineries, chemical
Based on this review, the CSB has found that although and petrochemical facilities, terminals, etc. with major
good industry guidance has been available for

1. CSB. Investigation Report: Popcorn Polymer Accumulation, Pipe Rupture, Explosions, and Fires at TPC Group Chemical Plant Butadiene Unit. December 2022.
https://www.csb.gov/philadelphia-energy-solutions-pes-refinery-fire-and-explosions-/ (accessed July 1, 2024).
Figure 1. Intercontinental Terminals Company (ITC) fire involving Tank 80-8 on March 17, 2019. (Credit: ABC 13 Houston)

process equipment and atmospheric storage tanks, The evaluation should be included in hazard
that details conditions that necessitate the installation assessments, hazard reviews, and process
of remote isolation devices [use “shall” instead hazard analyses.
of “should” language] that may be automatically
activated or remotely activated from a safe location,
Occupational Safety and Health
particularly during an emergency. When establishing
Administration (OSHA)
these conditions refer to the guidance published
by CCPS entitled Guidelines for Fire Protection 2024-01-H-R3
in Chemical, Petrochemical, and Hydrocarbon Update the Process Safety Management (PSM)
Processing Facilities, Sections 8.1.10 and 8.1.11. At standard by expanding the Process Hazard Analysis
a minimum, the conditions should address major (PHA) requirements under 29 CFR 1910.119(e)(3)
process equipment and atmospheric storage tanks, to include an evaluation of the need for remote
material volumes/weight as well as flammability, isolation devices for major process equipment that
corrosivity, and toxicity. can be remotely activated from a safe location or
automatically activated during a release.
U.S. Environmental Protection This Safety Study also issues an important and
Agency (EPA) necessary call to action for facilities with highly
2024-01-H-R2 hazardous chemicals. To prevent future incidents,
these facilities must assess whether remote isolation
Update the Risk Management Program (RMP) rule
should be applied to major process equipment even
by expanding the requirements of 40 CFR Part 68
in the absence of formal requirements in industry
to include an evaluation of the need for remote
standards and federal regulations – and if so, install
isolation devices for major process equipment that
effective remote isolation equipment in a location
can be remotely activated from a safe location
that is safe for workers to activate it. By systematically
or automatically activated during a release.

2 CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment

evaluating process equipment and applying remote the naphtha storage tank, it could have been closed
isolation equipment to mitigate loss-of-containment much sooner and likely would have helped limit the
events, companies can save lives; protect workers, spread of the fire, from a much safer distance, without
communities, and the environment; and safeguard jobs requiring firefighters to unnecessarily risk their lives.
and critical infrastructure vital to our nation’s economy.
In 2019, the CSB investigated an incident at the very
same refinery, then called the Philadelphia Energy
Lack of Remote Isolation - History Solutions (PES) Refinery. Although nearly 44 years had
Repeats Itself passed, the CSB found that once again the lack of
On August 17, 1975, a 75,000-barrel oil storage remote isolation equipment at the refinery increased
tank overfilled and ignited at the Gulf Oil Company the severity of the incident. On June 21, 2019, a pipe
(Gulf) refinery in Philadelphia, Pennsylvania, one of elbow in the PES hydrofluoric acid (HF) alkylation
the largest petroleum refineries in the U.S. at that unit ruptured, and a large vapor cloud – composed
time, causing two explosions and a massive fire. of roughly 95 percent propane, 2.5 percent HF,
Firefighters worked all day to control the fire and and other hydrocarbons – engulfed part of the unit.
were eventually forced to fight the fire while standing The vapor cloud ignited two minutes after the start
in a mixture of water and foam that contained of the release, causing a large fire and subsequent
hydrocarbons. The level of the flammable mixture explosions. During the incident, over 5,000 pounds
rose throughout the day, until it finally encountered an of highly toxic HF were released, a 38,000-pound
ignition source, causing a sudden fire that engulfed vessel fragment launched off-site and landed on the
several firefighters. The tragic incident resulted in other side of the Schuylkill River, and an estimated
the deaths of eight Gulf firefighters, injuries to seven property damage loss of $750 million resulted. In its
Philadelphia firefighters and four Gulf firefighters, and investigation of the incident, the CSB found that there
more than $10 million in damage.2 were no remotely operated emergency isolation
valves installed in the HF alkylation unit that could
During the incident, a damaged naphtha storage tank have stopped the release.5 The CSB concluded that
was feeding the fire by releasing between 500 and had this safety equipment been available, the release
600 gallons of liquid naphtha every minute.3 Because of hydrocarbons from the pipe elbow would have
the tank was not equipped with a remote isolation been minimized and the subsequent explosions could
valve, firefighters had to take extreme efforts to access have been prevented. Instead, the incident ultimately
and close the valve on the tank manually. According led to the closing of the facility. In its 2020 report “100
to an article published in the Ottawa Citizen on August
19, 1975, firefighters had to push
a rowboat through a tank dike
that was flooded with hot crude
oil, foam, and water as the fire
burned around them in order
to reach the tank so that they
could manually close the valve
(shown in Figure 2). Officials
told the Ottawa Citizen that the
firemen sprayed water on the
small boat and on the tank to
lower temperatures, which were
estimated to be as high as 700
degrees Fahrenheit.4 Had a Figure 2. Image of firefighters working to close valve on storage tank. Courtesy of the Special
remotely operated emergency Collections Research Center. Temple University Libraries. Philadelphia, PA.
isolation valve been installed on

2. Robert Burke, “Remembering the Gulf Oil Refinery Fire.” Firehouse. https://www.firehouse.com/rescue/article/10465196/eight-firefighters-died-in-1975-tragedy-in-phila-
delphia (accessed March 13, 2024).
3. “Six firefighters die in oil refinery blaze”. Ottawa Citizen. August 19, 1975. https://news.google.com/newspapers?id=naIyAAAAIBAJ&sjid=ku0FAAAAIBAJ&p-
g=4127%2C574720 (accessed March 13, 2024).
4. Ibid.
5. CSB, “Investigation Report: Fire and Explosions at Philadelphia Energy Solutions Refinery Hydrofluoric Acid Alkylation Unit.” https://www.csb.gov/csb-releases-final-re-
port-into-2019-pes-fire-and-explosion-in-philadelphia/ (accessed March 13, 2024).

CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment 3

Largest Losses in the Hydrocarbon Industry,” Marsh JLT to the development of voluntary standards and
Specialty6 (Marsh), a global insurance broker and risk industry guidance specific to the remote isolation
adviser, ranked the PES incident as the third-largest of process equipment. However, these chemical
refinery loss to occur worldwide since 1974.7 incidents continue to occur. Based upon the CSB’s
investigations and findings surrounding these
incidents, the CSB concludes that reliance on existing
Lack of Effective Remote Isolation
industry guidance concerning remote isolation alone is
Capabilities: The Main Issue
not sufficient. While strengthening voluntary standards
The fact that two loss-of-containment incidents at is important, the CSB has concluded that regulatory
the same facility more than 40 years apart could requirements associated with remote isolation of
not be safely isolated and as a result drastically process equipment are necessary.
escalated, highlights the key concern. The CSB
continues to investigate incidents where the lack
of effective remote isolation is a critical factor in the
It is critical that facilities in the U.S. that use or
incident severity. Many companies in the chemical
store large quantities of hazardous chemicals
industry have not fully recognized that the effective
evaluate and improve upon their remote
remote isolation of equipment is critical to quickly
isolation capabilities. A key opportunity to
stopping releases of hazardous materials and can
evaluate remote isolation needs is during the
reduce not only worker injuries but also damage to
Process Hazard Analysis—a systematic review
facilities and the environment and risks to surrounding
that is required by U.S. regulations to evaluate
communities. Having the ability to safely, quickly, and
process hazards and their safeguards.
effectively isolate a release ultimately saves lives,
protects jobs, and safeguards critical infrastructure.
These two Philadelphia incidents alone resulted in
the deaths of eight firefighters, multiple injuries, more
Select CSB Investigations Involving Lack
than $760 million in property damage, damage to the
environment, and the closing of the facility.
of Remote Isolation Equipment
Although the need to provide workers with
Whether the associated equipment is referred to effective remote isolation equipment has been
as remotely operated emergency isolation valves, well-established, many facilities in the U.S. chemical
remotely operated shutoff valves, emergency industry remain vulnerable. The CSB investigated six
isolation valves, emergency block valves, or some incidents – four of them in 2019 alone – in which the
other name, the topic of remote isolation of process lack of remote isolation contributed to the increase in
equipment is neither a technically complex issue for severity and led to a fatality, serious worker injuries,
the chemical industry, nor a new one. Unfortunately, extensive property damage to facilities and nearby
history often has repeated itself, sometimes at the homes, severe environmental consequences, and in
very same facility as demonstrated above, even some cases, company bankruptcy. These incidents
though experience has shown that without proper are discussed below.
remote isolation capabilities to allow a release to
be stopped from a safe location, an incident can The CSB made important recommendations
escalate from a relatively minor loss of containment stemming from the investigations, described in
to a large-scale chemical release, sometimes the incident summaries below, that resulted in
resulting in raging fires and explosions that fatally improvements to industry standards and the creation
injure workers, destroy facilities, and drastically of best practice guidance. The summaries will
impact surrounding infrastructure and communities. demonstrate that despite these improvements, based
upon the fact that loss-of-containment incidents
The CSB has reviewed and investigated several continue to escalate due to a lack of safe remote
chemical incidents involving hazardous chemical isolation capabilities, the current remote isolation
releases that could not be quickly isolated, and industry standards alone are insufficient.
the agency has issued recommendations that led

6. Marsh is a leading insurance broker and risk advisor that provides industry-focused brokerage, consulting, and claims advocacy services, leveraging data, technology,
and analytics to help reduce its clients’ total cost of risk.
7. Marsh JLT Specialty. “100 Largest Losses in the Hydrocarbon Industry.” 26th ed., March 2020 (Online]. https://www.marsh.com/en/industries/energy-and-power/in-
sights/100-largest-losses-2024.html (accessed June 11, 2024).

4 CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment

1. Formosa Plastics Propylene Explosion
OCTOBER 6, 2005

On October 6, 2005, a release of

highly flammable liquid propylene
and a subsequent vapor cloud
explosion occurred at the
Formosa Plastics Corporation,
USA, (Formosa) complex in Point
Comfort, Texas, after a forklift
towing a trailer collided with a line
containing the highly flammable
liquid propylene at the facility.
Sixteen workers were injured,
the process unit was heavily
damaged, and a nearby school
was evacuated.
The CSB investigated the
incident8 and found that
operators were unable to reach
the manual valves capable of
stopping the release due to
an advancing vapor cloud that
forced them to retreat. For the
same reason, the operators Figure 3. Photo included in the CSB Formosa Investigation Report.
This photo shows the forklift involved in the incident.
were also unable to reach the local control station to
quickly turn off the pumps supplying propylene. The
CSB concluded that had a remotely operated valve did it consider whether local isolation valves would
been installed upstream of the pumps supplying the be accessible or whether remotely operated isolation
propylene, the propylene flow could have been halted devices would be necessary in the event of a loss of
and the incident likely would have ended quickly, containment.
possibly even before ignition occurred. The CSB also
concluded that had remote control of the pumps been The CSB recommended that the Center for Chemical
possible from the control room, the propylene flow Process Safety (CCPS) incorporate guidance for
could have been quickly reduced, potentially reducing remote equipment isolation into the next revision
the severity of the incident. of the CCPS’s Guidelines for Hazard Evaluation
Procedures. In response, the CCPS developed
The CSB noted that remotely operated isolation new guidance called Remote Isolation of Process
valves can mitigate consequences of large accidents Equipment.9 This guidance document provides
and stated that companies should address isolation that “[t]he need for guidance on remote isolation of
philosophy as part of the hazard review process. While equipment to minimize loss of containment and its
Formosa had addressed isolation of minor leaks, the consequences is clear.” The CCPS guidance document
company’s written hazard analysis did not consider a addresses remote isolation as a way to mitigate
catastrophic loss of containment within the unit. Nor the release of hazardous material when there has

8. For a copy of the CSB’s case study on the incident see https://www.csb.gov/formosa-plastics-propylene-explosion/ (accessed February 1, 2023).
9. J. Murphy, “Remote Isolation and Shut Off,” Center for Chemical Process Safety/AIChE. Available at https://www.aiche.org/ccps/remote-isolation-and-shut (accessed
January 24, 2023).

CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment 5

been a loss of containment. The
CCPS notes that remote isolation
of hazardous material can be
accomplished with the appropriate
location of remotely operated
emergency block valves (EBVs).
The CCPS recommends the
use of remotely operated EBVs
because they can be operated
safely away from where the loss
of containment may occur. The
CCPS guidance also provides the
following important direction:
• Remotely operated EBVs
should be located such that
major process equipment
or unit operations can be
isolated in the event of a loss
of containment – examples
include at loading/unloading
lines in hazardous service;
at the inlet and outlet of
compressors and reactors;
Figure 4. Photo included in the CSB Formosa Investigation Report.
at the inlet of pumps from This photo shows Formosa Emergency Response Team equipment.
vessels with 10,000 pounds
of flammable material; at major lines entering or
leaving a system of vessels containing more than
10,000 pounds of flammable chemicals, which
operate together to perform a unit operation such
as distillation, refrigeration, or reaction; and at the The CCPS notes that remote isolation of
battery limits for pipelines containing hazardous hazardous material can be accomplished with
materials; the appropriate location of remotely operated
• Each chemical process should be evaluated so that emergency block valves (EBVs). The CCPS
EBVs are properly located; recommends the use of remotely operated EBVs
• Automated activation through EBVs provides a more because they can be operated safely away from
immediate response to potential danger, eliminates where the loss of containment may occur.
potential operator error, and results in more rapid
isolation; and
• Advantages of manual activation include avoidance
of false trips and avoidance of the potential failure
of an automatic device.
The CSB closed its recommendation to the CCPS as
an “acceptable action” in November 2008.

6 CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment

2. Valero McKee Refinery Propane Fire
FEBRUARY 16, 2007

On February 16, 2007, a propane fire erupted at the stated that although the American Petroleum Institute
Valero McKee Refinery in Sunray, Texas, injuring (API) Recommended Practice (RP) 2001, Fire Protection
four workers and causing the total shutdown and in Refineries, discussed the use of isolation valves in
evacuation of the refinery. The CSB investigated the emergencies, including considering access to valves
incident10 and found that the fire began following during fires, it did not provide specific guidance on
a leak in the propane deasphalting (PDA) unit and the design, location, and use of ROSOVs for the rapid
spread quickly, in part because of the rapid collapse isolation of LPG processes during emergencies.
of a major pipe rack carrying flammable hydrocarbons.
The CSB recommended that the API revise API RP
Some of the rack’s support columns had not been
2001 and API RP 2030, Application of Fixed Water
fireproofed.
Spray Systems for Fire Protection in the Petroleum
The CSB also found that the rapidly expanding Industry, to require that conformance with these
fire prevented field operators from closing manual recommended practices would include the design,
isolation valves or reaching local pump controls to installation, and use of ROSOVs and interlocked
isolate the high-pressure propane being vented to equipment controls to enable the safe and rapid
the atmosphere. Control room operators were unable emergency isolation of process equipment containing
to shut off the flow of propane because there were highly pressurized flammables. In response to the
no remotely operable shut-off valves, or ROSOVs,11 in CSB’s recommendation, the API updated its 2012
the PDA unit. The CSB stated that ROSOVs should be version of RP 2001 by adding Section 5.4.3.4.2 on
used in areas, such as
the PDA unit, where fast
and effective isolation
is needed to reduce
the impact of major
hazardous releases.
In this case, the lack
of remote isolation
significantly increased
the size and duration
of the fire, resulting
in extensive damage
to the PDA unit, the
main pipe rack, and an
adjacent process unit.
The CSB also found that
the McKee Refinery’s
process hazard analysis
(PHA) failed to identify
and address the need
for ROSOVs in the PDA
unit to rapidly isolate
Figure 5. Photos included in the CSB Valero McKee Investigation Report. This photo is courtesy of the
LPG releases. The CSB
Associated Press.

10. For a copy of the CSB’s final investigation report on the incident, see https://www.csb.gov/valero-refinery-propane-fire/ (accessed April 28, 2020).
11. ROSOVs, also called emergency isolation valves, are equipped with actuators and are configured to be quickly and reliably operated from a safe location, such as a
well-sited control room.

CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment 7

ROSOVs, which states the following:
Where a review establishes
a need, remotely operated
shutoff valves (ROSOV) should
be considered during the PHA
and FHA [fire hazard analysis]
processes. Use of these and
other isolation valves should
be included in emergency
procedures. However, use of
automatic (fire or heat actuated)
self-closing valves should
be used only after a hazard
analysis or MOC review to
determine whether inadvertent
activation may cause undesired
consequences. This review
should confirm the automatic
valve system is inherently safe
by a rigorous process safety Figure 6. Photo included in the CSB Valero McKee Investigation
review since closure of the valve in a nonfire Report. This photo as taken approximately 90 seconds after ignition
(from surveillance video).
situation or at the wrong time in a fire event
may have undesirable consequences, such as
causing excessive pressure in a process system “a review” that “establishes a need” and “the PHA
or preventing the orderly shutdown sequence of and FHA processes” is unclear. Incidents continue
equipment or transfer of product from tanks or to occur where there has been a release of large
vessels during an emergency. The review should quantities of hazardous chemicals with no means
include a determination of the safest alternative for workers to safely isolate the leak remotely. The
(“open” or “closed”) on loss of power if ROSOV change in API RP 2001 was a positive and necessary
are used. Discussion of emergency valves (ROEIV step, but the standard has not yet achieved incident
[remotely operated emergency isolation valve], consequence mitigation. As a logical and reasonable
EIV [emergency isolation valve], EBV [emergency ‘next step’ in the advancement of process safety,
block valve], ROSOV) can be found in API 553 and
API RP 2001 should specify detailed conditions for
UK HSE Information Sheet CHIS2.
when remote isolation devices are required for major
Based on the addition of this language to API RP 2001, process equipment that can be promptly activated
in July 2016 the CSB closed its recommendation to from a safe location or automatically activated during
the API as Acceptable Alternative Action,” noting that an accidental release.
although the guidance is voluntary, it provides more
information on the installation and use of ROSOVs for
process units with pressurized flammables. According
to the CSB, had Valero McKee followed such practices,
the uncontrolled fire likely would have been contained. Incidents continue to occur where there has
been a release of large quantities of hazardous
Although the CSB closed its recommendation to the chemicals with no means for workers to safely
API, some language in Section 5.4.3.4.2 nevertheless isolate the leak remotely. The change in API
still needs to be revised. API RP 2001 states, “Where a RP 2001 was a positive and necessary step,
review establishes a need, remotely operated shutoff but the standard has not yet achieved incident
valves (ROSOV) should be considered during the consequence mitigation.
PHA and FHA processes.” The distinction between

8 CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment

3. Intercontinental Terminals
Company Tank Fire
MARCH 17, 2019

On March 17, 2019, a large fire erupted at the the city of LaPorte. In addition, the local community
Intercontinental Terminals Company, LLC (ITC) bulk experienced serious disruptions, including several
liquid storage terminal located in Deer Park, Texas. shelter-in-place orders due to benzene-related air
The fire originated in the vicinity of Tank 80-8, an quality concerns. A shelter-in-place was issued for
80,000-barrel aboveground atmospheric storage the entire City of Deer Park, and local schools and
tank that contained a blend of naphtha and butane, a businesses either closed or operated under modified
flammable liquid typically used as a feedstock or blend conditions. A portion of a major highway in the area
stock for the production of gasoline. ITC was unable was also closed. ITC estimated that property damage
to isolate or stop the release of naphtha product from resulting from the incident exceeded $150 million.
the tank, and the fire continued to burn, intensify,
The CSB found that Tank 80-8 and the other
and spread to an additional 14 tanks located in the
aboveground storage tanks located in the tank farm
same containment area. The fire caused substantial
were not equipped with remotely operated emergency
property damage, including the destruction of fifteen
isolation valves, or ROEIVs, that would allow for quick
80,000-barrel aboveground atmospheric storage
and reliable operation from a safe location. The
tanks and their contents. The fire burned for three
butane-enriched naphtha product that was released
days, until it was extinguished on March 20, 2019. This
from Tank 80-8 via a failed pump could not be
incident also significantly impacted the environment.
remotely or automatically isolated, and it fueled the fire
A containment wall around the tanks was breached
that intensified around the tank.
and released an estimated 21 million gallons of
hydrocarbon and petrochemical products, firefighting In general, the need for this type of remote isolation
foam, and contaminated water into Tucker Bayou and equipment would have been identified through hazard
adjacent water, sediments, and habitats. From there, assessments, such as those required by the OSHA
the released materials flowed into Buffalo Bayou, and Process Safety Management (PSM) standard and the
on to the Houston Ship Channel and surrounding EPA Risk Management Program (RMP) rule, as well
waters. Because of the contamination, a seven-mile as insurance company audits and/or corporate risk
stretch of the Houston Ship Channel was closed, as evaluations. Unfortunately, because of an exemption
were several waterfront parks in Harris County and related to atmospheric storage tanks, the PSM

Figure 7. Photos included in the CSB ITC Investigation Report. The photo on the eft shows the initial ITC tank fire that ignited at Tank 80-8 on March
17, 2019 (Credit: HCFMO). The photo on the right shows the ITC fire involving Tank 80-8 as it progressed on March 17, 2019 (Credit: ABC13 Houston).

CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment 9

Figure 8. Photo included in the CSB ITC Investigation Report. This photo shows an overhead view of the First & Second 80’s tank farm containment
wall failure that allowed materials to enter the surrounding waterways on Friday, March 22, 2019. (Credit: ITC).

standard did not apply to the tanks in the tank farm. early in the response, enabling a single pump seal
The EPA RMP rule also did not apply due to ITC’s failure to escalate to a catastrophic incident. As a
characterization of the flammability of the butane- result, the CSB recommended that ITC install ROEIVs
enriched naphtha product.12 at the Deer Park Terminal configured to “Fail-Closed”
for all atmospheric storage tanks that contain highly
An insurance audit conducted for the ITC Deer Park
hazardous chemicals or liquids with a flammability
terminal in October 2018 indicated that storage tanks
rating of National Fire Protection Association (NFPA)-3
located in another area of the terminal were equipped
or higher.
with electric motor operated valves (MOVs). These
MOVs were programmed to close automatically, and In addition, the CSB provided a key lesson for the
the feed pumps were programmed to shut down industry:
automatically, under certain scenarios. Although ITC Companies that handle large volumes of
had equipped twelve of the fifteen 80,000-barrel flammable or highly hazardous substances should
storage tanks in the impacted tank farm with ROEIVs, assess their capability to remotely isolate these
Tank 80-8 was not one of them. Also, ITC did not substances in the event of a loss of containment.
equip these tanks with shut-off valves that would fail Aboveground atmospheric storage tanks that
closed,13 for example by installing fusible link valves, contain large volumes of these substances should
programming logic, or other protective measures to be equipped with remotely operated emergency
help ensure that these valves would automatically isolative valves (ROEIVs) so that releases can be
close in the event of a power outage, fire, or other mitigated quickly and remotely from a safe location.
event. The CSB concluded that ITC’s decision not The ROEIVs should be equipped with fusible links
to equip Tank 80-8 with ROEIVs contributed to or configured to automatically close in the event of
emergency responders’ inability to control the fire a power outage or other event (“Fail-Closed”).

12. As a result of these findings, the CSB issued the following recommendations to OSHA and EPA:
CSB Recommendation No. 2019-01-I-TX-R7 to OSHA:
Eliminate the atmospheric storage tank exemption from the PSM standard.
CSB Recommendation No. 2019-01-I-TX-R8 to EPA:
Modify 40 CFR §68.115(b)(2)(i) to expand coverage of the RMP rule to include all flammable liquids, including mixtures, with a flammability rating of NFPA-3 or higher.
13. “Fail closed” means that a device or system is set to shut down and prevent further operation when failure conditions are detected.

10 CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment

4. KMCO, LLC Fatal Fire and Explosion
APRIL 2, 2019

On April 2, 2019, a flammable isobutylene vapor

cloud exploded at the KMCO, LLC (KMCO) facility The CSB found that when the y-strainer
in Crosby, Texas. The event resulted in one fatality ruptured, KMCO’s workers lacked the ability
and two serious injuries. The incident occurred to isolate the isobutylene release from a safe
while KMCO operations staff were making a batch of location, such as from within the blast-resistant
sulfurized isobutylene, a lubrication additive product. control room. Had KMCO workers been able
At 10:41 a.m., a fist-sized piece of metal broke away to close the actuated block valve installed just
from the body of a three-inch cast iron y-strainer in upstream of the y-strainer from the control
the batch reactor’s liquid isobutylene supply piping. room, the amount of isobutylene released and
KMCO’s operations staff moved other workers out the subsequent harm to workers could have
of the immediate area and entered the release been greatly reduced.
area and manually closed valves. This stopped the
flow of isobutylene, but more than 10,000 pounds
of it had already been released and a vapor cloud
formed. The vapor cloud suddenly exploded, killing
one of two operators who were within the cloud and The CSB found that when the y-strainer ruptured,
seriously burning the other operator and a nearby shift KMCO’s workers lacked the ability to isolate the
supervisor. The explosion also substantially damaged isobutylene release from a safe location, such as from
portions of the KMCO facility. News outlets reported within the blast-resistant control room. Had KMCO
that the explosion shook nearby homes and was workers been able to close the actuated block valve
heard throughout the surrounding community. installed just upstream of the y-strainer from the control
room, the amount of
isobutylene released and
the subsequent harm to
workers could have been
greatly reduced. The
CSB noted that a 2010
report developed from
insurance underwriting
purposes had advised
KMCO that the lack of
remote isolation capability
had the potential for
a significant incident
and recommended
that KMCO expand its
existing PHA program
to include the analysis
of the largest flammable

Figure 9. Photo included in the CSB KMCO Investigation Report. The photo shows a life flight helicopter that
responded to the incident to transport injured workers. (Credit: ABC).

CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment 11

liquid release sources and commit to the
installation of fire-safe, remote-actuated
automatic isolation valves in strategic process
areas, especially those involving isobutylene
(as well as ethylene oxide and propylene
oxide). At the time of the April 2019 incident,
however, KMCO had not addressed this
recommendation for its isobutylene system.
Neither KMCO’s 2014 PHA nor its 2015 PHA
included any discussion of remote isolation
or recommendations to equip the isobutylene
system with remote isolation valves.
Following this incident, KMCO filed for
bankruptcy, and the company is no longer
in business. Consequently, the CSB did not
make any recommendations to KMCO.14
However, the CSB provided the following key
lesson for industry:
The goal of keeping workers safe and
the goal of quickly isolating releases
to minimize the consequences of an
incident should not be mutually exclusive.
Both can be achieved by applying
robust safety systems and establishing
effective emergency response programs.
Providing remotely operated emergency
isolationvalves in strategic locations can
allow workers to stop a release quickly
from a safe location.

Figure 10. Photos included in the CSB KMCO Investigation Report. The photo shows
an aerial view of the fire.

14. Altivia Oxide Chemicals, LLC (Altivia) purchased the Crosby, Texas, facility in 2020 and informed the CSB that the process involved in the incident would be dismantled
as part of Altivia’s efforts to install two new oxide reactors and start production by the end of 2020. As a result, the CSB did not issue any recommendations to Altivia
either. Nevertheless, the CSB urged Altivia to read this report closely and understand the factors that led to the incident at the KMCO facility and the lessons stemming
from it. The CSB also stated that if hereafter Altivia reinitiates the process or any equipment involved in this incident, the company should ensure that the facts, condi-
tions, and circumstances that caused the incident—and contributed to its severity—are not repeated.

12 CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment

5. Philadelphia Energy Solutions
Refinery Fire and Explosions
JUNE 21, 2019

On June 21, 2019, a pipe elbow ruptured in the explosions occurred shortly thereafter. Roughly 40
Philadelphia Energy Solutions (PES) hydrofluoric minutes into the release, a refinery worker was able
acid (HF) alkylation unit, resulting in a large vapor to manually turn on the water pump that supplied
cloud – composed of roughly 95 percent propane, the HF mitigation water cannons, which then allowed
2.5 percent HF, and other hydrocarbons – that the cannons to spray water to help suppress the
engulfed part of the unit and ignited two minutes after released HF. PES estimated that roughly 676,000
the start of the release, causing a large fire. Three pounds of hydrocarbons and over 5,200 pounds of

Figure 11. Photos included in the CSB PES Investigation Report. The photos show video stills of the explosions (Credit: NBC10
Philadelphia).

Figure 12. Photo shows an aerial view of the fire at the PES refinery. (Credit: CBS Philadelphia.)

CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment 13

Figure 13. Photo of fire erupting at the PES refinery. (Credit: CNN).

highly toxic HF were released during the event. Five

workers experienced minor injuries. The incident
resulted in an estimated property damage loss of The CSB found that there were no ROEIVs
$750 million and ultimately led to the facility closing. installed in the HF alkylation unit to remotely
The CSB found that there were no ROEIVs installed and automatically isolate the large hydrocarbon
in the HF alkylation unit to remotely and automatically sources adjacent to the failed elbow. The
isolate the large hydrocarbon sources adjacent to CSB concluded that had PES installed such
the failed elbow. The CSB concluded that had PES valves, the release of hydrocarbons from the
installed such valves, the release of hydrocarbons pipe elbow would have been minimized and
from the pipe elbow would have been minimized subsequent explosions would have been
and subsequent explosions would have been prevented.
prevented.15 Based on these findings, the CSB issued
a recommendation to the API to update API RP 751
Safe Operation of Hydrofluoric Acid Alkylation Units
to require, among other things, installation of ROEIVs
on the inlet(s) and outlet(s) of all HF containing vessels,
and hydrocarbon containing vessels that meet defined
threshold quantities. This recommendation remains
open at the time of this Safety Study.

15. CSB. “Investigation Report: Fire and Explosions at Philadelphia Energy Solutions Refinery Hydrofluoric Acid Alkylation Unit.” https://www.csb.gov/csb-releases-final-re-
port-into-2019-pes-fire-and-explosion-in-philadelphia/ (accessed March 27, 2024).

14 CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment

6. TPC Group Port Neches Explosions
and Fire
NOVEMBER 27, 2019

On November 27, 2019, a series of explosions occurred This large C4 Processing Plant has a large single
at the TPC Group (TPC) Port Neches Operations (PNO) area where crude C4 products are distilled,
facility, located in Port Neches, Texas, after highly extracted, reacted, and distilled again into
flammable butadiene was released from the process different product streams. Across the units,
unit. The explosions caused extensive facility damage, the plant reports there are no emergency
which included a process tower that propelled through motorized shutoff valves except for a few within
the air and landed within the facility, multiple other the Tank Farm. Engineering has estimated
process towers that fell within the unit, and fires that depressurization to take up to 10 to 12 hr. in
burned for more than a month within the facility. The some sections of the process unit. Due to the
butadiene unit was destroyed, forcing the facility to minimal distance between process blocks across
the Gantry ways, access for manual firefighting
cease butadiene production operations indefinitely.
is fair, at best. Emergency isolation will help limit
Two TPC employees and a contractor reported minor
the size of a release. This could greatly aid in
injuries, and at least five local residents reported
manual firefighting efforts and prevent more
injuries. The explosion damaged nearby homes and
processing areas getting involved. Also, by
buildings, and media reports indicated that the blast
reducing the fire area, property damage and the
was felt up to 30 miles away. The explosion also led to time to complete repairs will also be reduced.18
reduced usage of the Sabine-Neches Waterway, the
nation’s third largest waterway by cargo volume and a FM Global recommended that TPC “improve remote
major economic driver in the U.S. The incident caused isolation capabilities within the tank farm and within the
$450 million in on-site property damage and $153 process units.” The FM Global report stated that TPC
million in off-site property damage to nearby homes should “[i]solate the incoming and outgoing lines of
and businesses.16 columns, exchangers, tanks, and vessels with holdups
in excess of 1,500 gal. (roughly 10,000 lb[s].).”19
The CSB found that a dangerous substance known as
popcorn polymer, which can form in processes with The CSB concluded that had the TPC PNO
high-purity butadiene, accumulated in a temporary butadiene process been equipped with remote
dead leg17 in piping at the facility that was created isolation valves, it is possible that (1) the feed to the
when a process pump was taken out of service for column upstream of the release could have been
maintenance. During the offline period, popcorn stopped shortly after the release began, minimizing
polymer developed and exponentially expanded in the size of the initial vapor cloud, and (2) any
the dead leg piping section until the pressure in the secondary releases caused by the initial explosion
piping increased to the point that the piping ruptured, could have been mitigated early in the incident.
releasing butadiene from the process unit. Stopping the release(s) through the use of remotely
operated valves could have prevented some of the
The CSB noted that in April 2016, in connection with subsequent explosions and fires, thereby minimizing
a review of the facility, the insurance company FM the damage caused by the incident.
Global had observed that the butadiene process unit
was not equipped with ROEIVs and stated: The CSB analyzed API RP 553, Refinery Valves and
Accessories for Control and Safety Instrumented

16. CSB. Investigation Report: Popcorn Polymer Accumulation, Pipe Rupture, Explosions, and Fires at TPC Group Chemical Plant Butadiene Unit. D ­ ecember 2022.
https://www.csb.gov/philadelphia-energy-solutions-pes-refinery-fire-and-explosions-/ (accessed March 27, 2024).
17. A dead leg is a piping segment is open to the process but does not have flow through it (for example due to a closed valve in the segment, preventing flow).
18. CSB Investigation Report. TPC. December 2022; pp 46-47. https://www.csb.gov/tpc-port-neches-explosions-and-fire/ (accessed May 7, 2024).
19. Id at 47.

CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment 15

Figure 14. Photos included in the CSB TPC Investigation Report. The photo on the left shows the explosion. The photo on the right also shows the
explosion at 1:48 p.m. on November 27, 2019, which propelled one of the unit towers into the air. (Credit: Huntsman Corporation).

Systems, which provides recommendations for been equipped with “Type D” EBVs, the feed to the
emergency block valves (EBVs). TPC had relied on Final Fractionator A column could have been stopped
this standard at its facility. RP 553 defines EBVs as “a shortly after the release began, potentially minimizing
means of isolating flammable or toxic substances in the size of the initial vapor cloud, and any secondary
the event of a leak or fire”20 and classifies EBVs into releases caused by the initial explosion could have
four types: been stopped early in the incident. Stopping the
releases by using ROEIVs could have prevented some
• Type A: “A manually operated fire-safe block valve
of the subsequent explosions, thereby minimizing the
installed at the equipment. This type of valve is
damage caused by the incident.
installed when ignition is not expected in the event
of a leak.” Although the CSB did not issue any recommendations
• Type B: “This fire-safe block valves should be relating to ROEIVs, the CSB provided a key lesson for
installed at minimum of 7.6 m (25 ft) from the leak industry in its investigation report:
source when ignition is expected. The Type B valve Companies that handle large inventories of
is manually operated and is limited to sizes up to flammable or toxic material should assess their
and including [8 inches in diameter] …” capability to remotely isolate these inventories
• Type C: “The Type C valves is a power-operated in the event of a loss of process containment.
Type B valve. The valve should be power-operated Manual and locally controlled emergency block
if larger than [8 inches in diameter]. … Controls are valves (“Type A,” “Type B,” and “Type C,” as
accessible from the valve location.” defined by API RP 553) serve no reliable function
• Type D: “This is an EBV with remote controls. There in catastrophic incidents, since the valves often
is no restriction as to where the valve may be cannot be safely accessed during these events,
thereby preventing the ability to isolate equipment
located, but the controls should be a minimum of
and stop releases. Equipment that handles large
12 m (40 ft) from the leak source and should be out
inventories of flammable or toxic material should
of the fire zone.”21
be equipped with “Type D” remotely operated
The CSB noted that API RP 553 does not detail emergency isolation valves so that hazardous
conditions for which a Type D (remotely operated) EBV releases can be quickly and remotely stopped
is required and concluded that had the TPC facility from a safe location.22

20. API RP 553. Refinery Valves and Accessories for Control and Safety Instrumented Systems. October 2012; p 94.
21. Id at 7.
22. CSB Investigation Report. TPC. December 2022; p 50.

16 CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment

Conditions that Necessitate Remote Isolation
While API RP 553
and RP 2001 apply to Is it flammable or No
petroleum refineries, combustible?
the incidents discussed
above demonstrate Yes
that remote isolation
guidance and Is it Yes No
Is it toxic
requirements should be <2,000 gal.? or corrosive?
addressed in a variety
of operations at a No Yes
variety of facility types
and industry segments Is it operating
No
that have major at an elevated
pressure?
process equipment and
atmospheric storage
tanks.
Moreover, although the Is it operating No Is it No
near flash pt. or a fire sensitive
API does not establish liquefied gas? area?
criteria for when remote
isolation is needed, the Yes Yes
CCPS does. In 2003,
the CCPS produced
guidance for remote Valve Required Valve Not Required
isolation equipment
in its book Guidelines Figure 15. Remote Isolation Decision flow chart. Credit: CCPS.
for Fire Protection in
Chemical, Petrochemical, and Hydrocarbon Processing
remote isolation equipment should have been
Facilities.23 In the book, the CCPS provides general
provided. The CSB applied this tool, which has been
guidance on when to provide remote isolation
available since 2003, to the other incidents discussed
capability. For example, the CCPS states:
in this Safety Study, all of which occurred after 2003.
Equipment such as pumps, compressors, tanks, The CSB determined that had the tool been applied
and vessels associated with large inventories of to each facility’s system that experienced the loss of
flammable gas or liquid (>5,000 gallons) should containment, effective remote isolation equipment
be provided with equipment emergency isolation should have been provided. Had appropriate remote
valves to stop the flow of material if a leak isolation equipment been provided, the major
occurs.24 consequences of all the incidents would likely have
In addition to general guidance, however, the CCPS been significantly mitigated. The CSB believes that
provides a flow chart as an example of a tool that many more incidents could be mitigated by facilities
companies can use to determine whether remote applying this tool or a similar tool to their systems
isolation equipment should be installed, and where. 25 during hazard reviews to determine the need for
This chart is illustrated in Figure 15 above. effective remote isolation capabilities from a safe
location.
The CSB found in its KMCO investigation that had
this tool been applied to KMCO’s isobutylene system,

23. CCPS, Guidelines for Fire Protection in Chemical, Petrochemical, and Hydrocarbon Processing Facilities. New York: Center for Chemical Process Safety. 2003.
24. Id at 123.
25. Id at 267.

CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment 17

National Transportation Safety Board
Recommendation on Remote Isolation
The CSB is not the only federal investigative agency equivalent technologies, and establishes minimum
that has examined the role that a lack of remote performance standards for the operation of those
isolation capabilities plays in the severity of an valves to mitigate the public safety and environmental
incident. On September 9, 2010, a 30-inch-diameter consequences of pipeline ruptures.28 The final rule
segment of an intrastate natural gas transmission became effective on October 5, 2022, but it does not
pipeline known as Line 132, owned and operated address all the NTSB recommendation requirements.
by the Pacific Gas and Electric Company (PG&E), The NTSB notes on its website that PHMSA plans to
ruptured in a residential area in San Bruno, California. take several additional actions to address the gaps
PG&E estimated that 47.6 million standard cubic in the rulemaking and satisfy the intent of the NTSB’s
feet of natural gas were released. The gas ignited, recommendation, including:
resulting in a fire that destroyed 38 homes and
• Updating PHMSA’s special permit conditions
damaged 70 others. Eight people were killed, many
were injured, and many more were evacuated • Creating a new directive on valves; and
from the area. The National Transportation Safety • Requiring operators to inform PHMSA of the
Board (NTSB) investigated the incident and found number of valves installed on their systems to
that the lack of either automatic shutoff valves or protect high consequence areas and class 3 and
remote-control valves on the line contributed to 4 segments, and how they are monitored and
the severity of the accident.26 As a result, the NTSB operated for emergency closure.
issued Recommendation P-11-011 to the Pipeline and As a result, the NTSB has classified the
Hazardous Materials Safety Administration (PHMSA): recommendation as “Open – Acceptable Alternate
Response.”29
Amend Title 49 Code of Federal Regulations
192.935(c) to directly require that automatic
shutoff valves or remote control valves in high
consequence areas and in class 3 or 4 locations
be installed and spaced at intervals that consider
the factors listed in that regulation.27
On April 8, 2022, PHMSA published a final rule titled
“Pipeline Safety: Requirement of Valve Installation
and Minimum Rupture Detection Standards”
amending the Federal Pipeline Safety Regulations
(49 CFR parts 190 through 1999). Among other
provisions, the new rule requires the installation of
rupture-mitigation valves, also known as remote
control or automatic shut-off valves, or alternative
Figure 16. Police photo of San Bruno Pipeline fire.

26. For additional information on this incident, visit https://www.ntsb.gov/investigations/Pages/DCA10MP008.aspx (accessed May 9, 2024).
27. For additional information on this recommendation, visit https://data.ntsb.gov/carol-main-public/sr-details/P-11-011 (accessed May 9, 2024).
28. 87 Fed. Reg. 20940. https://www.federalregister.gov/documents/2022/04/08/2022-07133/pipeline-safety-requirement-of-valve-installation-and-minimum-rupture-detection-stan-
dards (accessed May 9, 2024).
29. See https://data.ntsb.gov/carol-main-public/sr-details/P-11-011 (accessed May 0, 2024).

18 CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment

Guidance on Remote Isolation by the U.K. Health
and Safety Executive
Per this Safety Study, the CSB also examined the 1. Associated Octel Company Chemical
topic of remote isolation on a global scale. The United Limited Release and Fire
Kingdom (U.K.) has implemented regulatory guidance
On February 1, 1994, a release of reactor solution
on this topic, which could be an example for future
from a recirculating pump near the base of an ethyl
U.S. regulations.
chloride (EC) reactor vessel occurred at the Octel plant
Following a series of serious incidents where the in Ellesmere Port, Cheshire, England.33 The reactor
lack of remote isolation played a key role in the solution was highly flammable, corrosive and toxic,
severity of each incident, the U.K.’s Health and Safety and a white cloud soon enveloped the facility. Almost
Executive (HSE), which regulates workplace safety, two hours later, after various unsuccessful attempts
developed robust guidance for facilities that use or to isolate and mitigate the leak, the flammable
store hazardous chemicals to assess whether remote vapors of the reactor solution ignited, resulting in a
isolation is needed, along with detailed steps for major fire.34 The incident caused extensive damage
implementation. to the plant, requiring a complete rebuild. The HSE
investigated the incident and concluded that it had
In 2004, the HSE developed guidance entitled
escalated rapidly because the facility was unable to
Remotely operated shutoff valves (ROSOVs) for
stop the initial release. The manually operated valves,
emergency isolation of hazardous substances
which could have isolated the inventories in the
to assist facilities in assessing whether there is a
three process vessels, were very difficult to access
need for a ROSOV30 on an existing or new piece
during the emergency because of their location.
of equipment and provide detailed steps for
According to the HSE, “These problems could have
implementation. The HSE noted that the development
been prevented and the inventories rapidly isolated if
of this guidance was influenced by the investigation
remotely operated shut off valves (ROSOVs) had been
of an incident at the Associated Octel Company
installed.”35 As a result of this finding, the HSE issued
Limited (Octel) at Ellesmere Port, Cheshire, England,
Lesson 5, which states:
in February 1994, as well as the investigation of a
fire in the fluidized bed catalytic cracking unit at As part of their comprehensive risk assessments,
the BP Grangemouth Refinery in Scotland in June companies in control of chemical process plants
2000.31 Both of these incidents are described below. at major hazards sites should critically review the
According to the HSE, this guidance was necessary provision of remotely operated shut off valves
because “[i]n an emergency, rapid isolation of vessels (ROSOVs) at both storage and process vessels
is one of the most effective means of preventing a in which significant inventories of dangerous
loss of containment or limiting its size.”32 substances are held.36

30. HSE defines a ROSOV as a “valve designed, installed and maintained for the primary purpose of achieving rapid isolation of plant items containing hazardous substances in the
event of a failure of the primary containment system (including, but not limited to, leaks from pipework, flanges, and pump seals). Closure of the valve can be initiated from a point
remote from the valve itself. The valve should be capable of closing and maintaining tight shutoff under foreseeable conditions following such a failure (which may include fire).
HSE. “Remotely operated shutoff valves (ROSOVs) for emergency isolation of hazardous substances: Guidance on good practice.” 2004; p 4. https://www.hse.gov.uk/pubns/priced/
hsg244.pdf. (Accessed May 7, 2024).
31. HSE. “Remotely operated shutoff valves (ROSOVs) for emergency isolation of hazardous substances: Guidance on good practice.” 2004; p 4. https://www.hse.gov.uk/pubns/priced/
hsg244.pdf. (Accessed March 13, 2024).
32. Ibid.
33. Octel is a chemical manufacturing company. The prime activity at this site has been the production of motor fuel anti-knock compounds.
34. HSE. “The chemical release and fire at the Associated Octel Company Limited: A Report of the Investigation by the Health and Safety Executive into the Chemical Release and Fire
at the Associated Octel Company, Ellesmere Port, Cheshire. 1st February 1994.” p 1. https://www.hse.gov.uk/comah/sragtech/caseoctel94.htm (accessed June 11, 2024).
35. Id at 40.
36. Ibid.

CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment 19

In addition, the HSE issued Lesson 6: significant process inventories in order to minimize
the consequences of an uncontrolled leak and to
HSE, in conjunction with other interested parties,
allow for remote emergency shutdown of ancillary
should develop and publish additional guidance
on the provision of ROSOVs and other methods of equipment, such as pumps.39 The HSE also
mitigating risks on process plant.37 recommended that BP review its philosophy on
remote isolation and its implications for other plants
on the Complex.40
2. BP Grangemouth Fire
Following its investigation the HSE developed and
Between May 29, 2000, and June 10, 2000, three
released its ROSOV guidance.41 The guidance states
incidents occurred at the BP Grangemouth Complex
that facilities should assess the need to fit a ROSOV
(“the Complex”) in Scotland. The public expressed
“wherever there is the potential for a major accident
concern to the HSE due to the frequency and pattern
as a result of loss of containment of a hazardous
of these three incidents, as well as their potential to
substance, the consequences of which could be
be more serious. The HSE investigated the incidents
significantly reduced by rapid isolation.”42 According
and on August 18, 2003, released a Major Incident
to the HSE, manual valves “should never be used in
Investigation Report.
situations where the employee effecting the isolation
The HSE found that the Fluidized Catalytic Cracker would be placed in danger.”43 The potential for a major
Unit (FCCU) at BP Grangemouth was shut down on accident, according to the document, depends on a
May 29, 2000, following a power distribution failure. range of factors, including:
On June 10, 2000, during start-up procedures that
• The nature and properties of the substance;
began the day before, there was a significant leak of
hydrocarbons from the FCCU, creating a vapor cloud • The quantity of substance released;
that ignited, resulting in a serious fire. The fire was • The size and nature of populations at risk and their
extinguished several hours later. HSE determined that proximity to the plant; and
the leak was a result of the fracture of a tee branch • The presence of other plant equipment including
pipe due to fatigue failure. This resulted in the release confining structures and other hazardous
of highly flammable liquid at elevated temperature inventories (escalation potential).44
and pressure, which found an ignition source nearby
Ultimately, according to the HSE, the decision of
and ignited. The HSE concluded that the failure of
whether to implement remote isolation is based on an
the tee-piece connection pipework was likely caused
assessment of:
by a combination of the incorrectly fitted tee-piece
connection, the inadequately supported pipework, and • The likelihood that the major accident will occur;
the cyclic stresses caused by the increased start-up/ and
shutdown activity on the plant. This eventually led to • The consequences (in terms of the extent and
fatigue and failure of the piping.38 severity of harm to people).45
As a result of its investigation, the HSE recommended,
among other things, that prior to restart BP install
ROSOVs to allow for rapid remote isolation of

37. Ibid.
38. HSE. “Major Incident Investigation Report: BP Grangemouth Scotland, 29th May – 10th June 2000; A Public Report Prepared by the HSE on Behalf of the Competent Authority.” August
18, 2003; pp 58-59.
39. Id at 62.
40. Id at 63.
41. HSE. “Remotely operated shutoff valves (ROSOVs) for emergency isolation of hazardous substances: Guidance on good practice.” 2004. https://www.hse.gov.uk/pubns/priced/
hsg244.pdf. (Accessed March 13, 2024).
42. HSE. “Remotely operated shutoff valves (ROSOVs) for emergency isolation of hazardous substances: Guidance on good practice.” 2004; p 13. https://www.hse.gov.uk/pubns/priced/
hsg244.pdf. (Accessed March 13, 2024).
43. Id at 14.
44. Ibid.
45. Ibid.

20 CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment

Global Perspectives on Remote Isolation
The concept of installing remote isolation equipment every piece of equipment which might leak; rather, they
at chemical facilities is not new and has been should be installed only when the chance of a leak is
examined at length by highly regarded process safety significant, or the potential consequences are serious.49
experts around the world. For example, in a 1969 Kletz noted three situations that should be considered:
safety newsletter, process safety pioneer Trevor Kletz
1. The equipment is particularly likely to leak; for
discussed three accident reports where explosions
example, very hot or cold pumps.
had fatal consequences.46 One accident occurred in
Africa, one in Germany, and one in the United States. 2. The equipment is less likely to leak, but if it does
Among other things, Kletz, who worked as a safety leak, a very large quantity of material will run out
advisor at Imperial Chemical Industries (ICI) at the time, and there is no way to stop it; and
called out two important lessons from these reports:
3. The equipment is less likely to leak, but if it does
• The need for automatic gas detectors in places so, the leak will be very large.50
where leaks are likely to occur; and
Additionally, Sam Mannan, a world-renowned expert
• The need for remotely operated isolation valves, so on chemical process safety and the former executive
that leaks can be isolated from a safe location.47 director of the Mary Kay O’Connor Process Safety
In 1975, Kletz wrote another safety newsletter for Center (MKOPSC), wrote in 2012 that the operation
Chemical Engineering Progress48 entitled “Emergency of emergency isolation valves should be sufficiently
Isolation Valves for Chemical Plants,” which noted that it remote so that the operator can close them readily
was impractical to install emergency isolation valves for in an emergency, without having to approach a gas

46. Trevor Kletz, “Imperial Chemical Industries Heavy Organics Division, Safety Newsletter Introduction” and “Imperial Chemical Industries Heavy Organics Division, Safety Newsletter
Issue 14.” 1969. IChemE provides the entire series of ICI Newsletters on its website.
47. Ibid.
48. Chemical Engineering Progress is a publication of the American Institute of Chemical Engineers (AICHE).
49. Trevor Kletz, “Emergency Isolation Valves for Chemical Plants.” Chemical Engineering Progress, Volume 71, No. 9. September 1975; p 137.
50. Ibid.

CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment 21

cloud or a fire or use a ladder. The most ideal situation, Pimenta and Martins also listed the following as
according to Mannan, is remote operation from the minimum criteria for emergency isolation valves:
control room.51
• Closes within five seconds after actuation;
According to a guidance document by Marsh, the • Closes on failure of the electrical supply, air supply,
ability to isolate large inventories of hazardous or release of fusible element;
materials promptly and safely is a key design • Closes in the direction of the liquid flow so system
consideration and risk-control measure for process pressure may hold the valve in the closed position;
equipment. According to Marsh, the most effective
• Closes against a pressure of at least 150 percent of
method for isolation is through the use of ROEIVs.52
the design rating;
Marsh defines ROEIVs as safety-critical equipment
whose primary purpose is to provide effective • Is installed to prevent alterations (bypass, blockage)
and timely isolation of plant equipment containing that will make the valve ineffective;
hazardous substances in the event that the primary • Can only be reset manually; and
containment system fails, including leaks from piping • Must withstand a fire for at least 15 minutes.56
and associating fittings.53
These perspectives clarify not only when remote
In a paper presented at the 2020 Virtual Spring isolation equipment is necessary, but also what type
Meeting and 16th Global Congress on Process Safety, of isolation valve is appropriate for each process or
54th Annual Loss Prevention Symposium, the authors situation.
H. Pimenta of FM Global and M. Martins of the
University of San Paulo, argued, as Kletz had in 1975,
that emergency isolation valves are impracticable
for every piece of equipment. Defining the locations
Marsh defines ROEIVs as safety-critical
for remote isolation valves in a facility is extremely
equipment whose primary purpose is to provide
important and can be done using elements of process
effective and timely isolation of plant equipment
safety such as Management of Change (MOC) and
containing hazardous substances in the event
PHA.54 According to Pimenta and Martins, emergency
that the primary containment system fails,
isolation valves are highly recommended for the
including leaks from piping and associating
following conditions:
fittings.
• The system (equipment and piping) is particularly
likely to leak ignitable liquids (i.e. very hot or cold
pumps);
• The size of the vessel exceeds 660 gallons; or
• The expected leak rate is greater than 66 gallons
per minute.55

51. Sam Mannan, Lees’ Loss Prevention to the Process Industries, Volumes 1-3 – Hazard Identification, Assessment and Control (4th Edition) – 12.7.13 Valve Interlocks. 2012; p 529.
Retrieved from https://app.knowvel.com/hotlink/pdf/id.kt00BF#8K2/lees-loss-prevention/valve-interlocks.
52. Marsh JLT Specialty. “Remotely Operated Emergency Isolation Valves (­ROEIVs): Risk engineering position paper.” https://www.marsh.com/us/industries/energy-and-power/insights/
risk-engineering-paper-remotely-operated-emergency-isolation-valves.html (accessed January 24, 2023). September 2020; p 4.
53. Ibid.
54. Center for Chemical Process Safety (CCPS)/AIChE. 2020 Virtual Spring Meeting and 16th Global Congress on Process Safety Proceedings, 54th ­Annual Loss Prevention Symposium
(LPS), August 17-21, 2020. How Emergency Isolation Valves Can Effectively Mitigate the Consequences of Early Pool Fires. Retrieved from https://app.knovel.com/hotlink/pdf/id:kt-
012MIJN1/virtual-spring-meeting/how-emergency-isolation.
55. Ibid.
56. Ibid.

22 CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment

Conclusion
As several major incidents investigated by the CSB
have demonstrated,57 many chemical facilities are not
protected with remote isolation equipment that can The CSB further believes that companies have
help mitigate loss-of-containment incidents. These a responsibility to promptly adopt the use of the
incidents, if allowed to progress, can result in fatalities, CCPS flow chart or an equivalent methodology
injuries, damage to equipment, the destruction during all future hazard reviews to evaluate
of facilities, and serious harm to surrounding whether and where remote isolation should be
infrastructures, communities, and the environment. applied for all major process equipment – and
As shown by the HSE, on a global scale, major then implement those findings.
incidents have led to the development of robust
guidance for facilities to assess whether remote
isolation is needed, along with detailed steps for
implementation. Additionally, as shown by the NTSB’s
consequences from a major loss-of-containment event
San Bruno investigation, this issue is applicable to
can be significantly reduced by safe, rapid, and remote
many industry segments and has resulted in calls for
isolation of process equipment58 following a release.
regulatory change.
The CSB further believes that companies have a
As such, the CSB concludes that additional action is
responsibility to promptly adopt the use of the CCPS
needed. The API should improve existing voluntary
flow chart or an equivalent methodology during
standards by establishing criteria for various facility
all future hazard reviews to evaluate whether and
types including petroleum refineries as well as
where remote isolation should be applied for all
chemical petrochemical facilities with major process
major process equipment – and then implement
equipment and atmospheric storage tanks, that
those findings. By systematically evaluating process
details conditions that necessitate the installation of
equipment and applying remote isolation equipment to
remote isolation devices that may be automatically
mitigate major loss-of-containment events, companies
activated or remotely activated from a safe location
can save lives, protect jobs, protect the environment,
during an emergency. Additionally, while strong
and safeguard critical infrastructure vital to the
industry standards are needed, regulatory gaps must
economy.
also be addressed. EPA and OSHA must implement
regulatory requirements for the critical review of
major process equipment to determine whether the

57. The following is a list of accidental release incidents reported to or investigated by the CSB (including the incidents discussed above in this Safety Study) that would likely have been
less severe had remote isolation been effectively employed as a mitigative safeguard:
• DPC Enterprises Festus Chlorine Release - August 14, 2002
• Honeywell Chemical Incidents - July 20, 2003
• DPC Enterprises Glendale Chlorine Release - November 17, 2003
• Formosa Plastics Propylene Explosion - October 6, 2005
• Valero McKee Refinery Propane Fire - February 16, 2007
• CITGO Refinery Hydrofluoric Acid Release and Fire - July 19, 2009
• DuPont Belle Toxic Chemical Releases - January 23, 2010
• Millard Refrigerated Services Ammonia Release - August 23, 2010
• Intercontinental Terminals Company (ITC) Tank Fire - March 17, 2019
• KMCO LLC Fatal Fire and Explosion - April 2, 2019
• Philadelphia Energy Solutions (PES) Refinery Fire and Explosions - June 21, 2019
• TPC Port Neches Explosions and Fire - November 27, 2019
• Foundation Food Group Fatal Chemical Release - January 28, 2021
• Chemtool Rockton Facility Mineral Oil Release and Fire [incident report] – June 14, 2021
58. As demonstrated in the CSB’s Philadelphia Energy Solutions investigation, any application of remote isolation of major process equipment should be robust and resilient. Redundan-
cy should also be a consideration.

CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment 23

Recommendations
To prevent future chemical incidents or mitigate their To U.S. Environmental Protection
consequences, and in the interest of driving chemical Agency (EPA)
safety excellence to protect communities, workers,
2024-01-H-R2
and the environment, the CSB makes the following
Update the Risk Management Program (RMP) rule
safety recommendations:
by expanding the requirements of 40 CFR Part 68
to include an evaluation of the need for remote
American Petroleum Institute isolation devices for major process equipment that
2024-01-H-R1 can be remotely activated from a safe location
Develop a new publication or revise an existing or automatically activated during a release. The
publication or publications that should be applicable evaluation should be included in hazard assessments,
to various facility types such as refineries, chemical hazard reviews, and process hazard analyses.
and petrochemical facilities, terminals, etc. with major
process equipment and atmospheric storage tanks, Occupational Safety and Health
that details conditions that necessitate the installation Administration
of remote isolation devices [use “shall” instead of
2024-01-H-R3
“should” language] that may be automatically activated
or remotely activated from a safe location, particularly Update the Process Safety Management (PSM)
during an emergency. When establishing these standard by expanding the Process Hazard Analysis
conditions refer to the guidance published by CCPS (PHA) requirements under 29 CFR 1910.119(e)(3)
entitled Guidelines for Fire Protection in Chemical, to include an evaluation of the need for remote
Petrochemical, and Hydrocarbon Processing Facilities, isolation devices for major process equipment that
Sections 8.1.10 and 8.1.11. At a minimum, the conditions can be remotely activated from a safe location or
should address major process equipment and automatically activated during a release.
atmospheric storage tanks, material volumes/weight as
well as flammability, corrosivity, and toxicity.

A CSB Safety Study is an advocacy product that details operations in 1998. The CSB’s core mission activities
significant chemical safety topics from previous CSB include conducting incident investigations; formulating
work/products that, unlike a safety alert or safety bulletin, preventive or mitigative recommendations based
results in issuing recommendations. on investigation findings and advocating for their
implementation; issuing reports containing the findings,
The U.S. Chemical Safety and Hazard Investigation Board
conclusions, arising and recommendations from incident
(CSB) is an independent federal agency charged with
investigations; and conducting studies on chemical
investigating and determining the cause or probable
hazards.
cause of industrial chemical incidents resulting from the
accidental release of a regulated or extremely hazardous No part of the conclusions, findings, of CSB or
substance into the ambient air. The mission of the CSB recommendations relating to any chemical incident may
is to drive chemical safety change through independent be admitted as evidence or used in any action or suit
investigations to protect people and the environment. The for damages arising out of any matter mentioned in an
Agency was created by the Clean Air Act Amendments investigation report (see 42 U.S.C. § 7412(r)(6XG)).
of 1990, and the CSB was first funded and commenced

U.S. Chemical Safety and Hazard Investigation Board

1750 Pennsylvania Ave, NW, Suite 910, Washington, DC 20006
For more information please visit www.csb.gov or call 2O2-261-76OO

24 CSB Safety Study: No. 2024-01-H: Remote Isolation of Process Equipment