The line he opened was live
Olin Freeport, PBF Martinez, and isolation that wasn't where the work was
He had the permit, the package and the respirator. The line he opened still had chlorine at 100 psi behind it.
On 20 May 2025, a worker at Olin's Freeport plant opened a rupture disc holder on a live chlorine system and released about 8,000 pounds of chlorine at 100 psi. Weeks earlier, contract workers at PBF Martinez opened a flange on a live hydrocarbon line and started a fire that cost an estimated $924 million. The CSB ties both — and the 2024 PEMEX fatalities — to one mechanism: the wrong line was opened. At Olin the isolation had actually been done, but on a nearly identical line, not the one the worker broke into. He had the work package, the permit and the respirator. What was missing was the single barrier that catches this every time: a pre-job walkthrough where the people doing the work physically verify, at the point of break-in, that THIS device is isolated and prepared. Isolation is not a paperwork status. It is a physical proof you obtain at the flange, on the actual line, before the first bolt.
The Olin job was routine on paper. The plan was to replace a rupture disc — RD-217N — a safety device protecting a heat exchanger in the chlorine liquefaction unit. Two contract maintenance workers were given the work package and a permit. At about 8:10 a.m. one of them began disassembling the rupture disc holder with a battery-powered impact wrench, wearing an air-supplied respirator with a 30-minute bottle. At 8:15, liquid chlorine at 100 psi began releasing from the partially disassembled holder. Around 8,000 pounds escaped; one worker was seriously injured, and the surrounding community was ordered to shelter in place.
The worker did nothing reckless. He was sent to that device, authorised to open it, and equipped to do the job. The failure was upstream of his hands: the line he opened was live, and the isolation that should have made it dead had been performed on a different, nearly identical line. Olin's operations team had isolated, cleared and tagged the wrong system — and never tagged the one he was about to break into.
The most dangerous configuration in any plant is two systems that look the same. Isolation done on the twin gives everyone — operators, planners, the crew — the feeling of a job made safe, while the actual line stays live. The tag reads "isolated." It just is not on the thing you are about to open. A correct isolation in the wrong place is more dangerous than no isolation at all, because it manufactures confidence.
Isolation is a physical proof, not a paperwork status
Energy isolation is the barrier between a worker and the stored energy in a line — pressure, toxicity, flammability. It has a documentary form (permits, tags, isolation registers) and a physical reality (the right valves shut and locked, the line drained and depressurised, on the right system). The documentary form is evidence of intent. Only the physical reality is the control. And when the two diverge — the paperwork says isolated, the line is live — the paperwork does worse than nothing: it actively conceals the hazard behind a record of safety.
At Olin the control-of-work paperwork existed. What the CSB found missing was the pre-job site walkthrough that would have let operators and the maintenance crew verify the rupture disc had actually been prepared for replacement — that is, physically confirm, together, on the real device, before any tool touched it. That walkthrough is the moment the documentary claim is tested against physical reality. Skip it, and you are trusting a claim at the exact instant you break containment — the one instant where being wrong is irreversible.
A tag is a claim that someone, somewhere, isolated something. A point-of-break-in verification is proof that THIS line, THIS device, is dead. Never break containment on a claim.
Why the wrong line gets opened
Three ingredients recur. First, near-identical adjacent systems — Olin's isolated twin, sitting beside the live line. Second, workers unfamiliar with the specific equipment: at PBF Martinez the CSB's fix was to have a knowledgeable person present to ensure the crew disassembled the correct flange and knew the hazards. Third, tagging that does not make the correct item unmistakable — the CSB explicitly recommended PBF improve its tagging so it is obvious which equipment to open. Put those three together and a competent, authorised worker opens the wrong thing while fully believing it is the right one.
The impact wrench appears here too. At Olin the worker used a battery impact wrench to disassemble the holder — fast, efficient, and irreversible the moment the seal lets go. Speed at the point of break-in removes the slow, doubting beat in which someone might notice the line is still live, or that the tag is on the neighbour. The tool is not the cause. But powered break-in shortens the last window in which the error could have surfaced before chlorine did.
The point of no return is the first broken seal
Every other barrier — design, permit, tag, PPE — exists to be correct before the seal breaks. Once it breaks on a live line, you are no longer in prevention; you are in consequence management, where the only things left are PPE, evacuation and luck. At Olin the worker had a 30-minute escape bottle; at PBF, the hydrocarbons found an ignition source. The break-in is the hinge between a controllable job and an uncontrolled release — and everything you do to verify isolation has to be complete on the safe side of that hinge, because there is no second attempt after it.
The practitioner tool: a break-in verification gate
Before any tool breaks containment on any line, this gate is passed by the people doing the work, at the equipment — not in the planning office.
- Identify the exact item, physically — Match the work package's equipment ID to the tag on the actual device in front of you — not to the line you assume it is. If there is a near-identical neighbour, walk both and confirm out loud which is which before anything else.
- Verify the isolation is on THIS item — Trace the isolation points and confirm the tags and locks are on the valves that isolate the device you will open — not on a parallel system. A tag anywhere else protects nothing here.
- Prove zero energy at the point of work — Confirm depressurised, drained and de-energised by a positive test — gauge, bleed, drain, try-to-start — on the actual line. Never by the assumption that it "should be" isolated. On a 100-psi line, a real test fails loudly and safely before a tool ever does.
- Hold the pre-job walkthrough, together — Operators and the work crew physically walk the job before the first tool, verifying preparation on the real equipment. If anyone unfamiliar with the equipment is doing the work, a knowledgeable person is present at the break-in — the exact barrier missing at both Olin and PBF.
- Treat the first seal as a stop point — The first flange crack, gasket or disc loosening is a deliberate, watched step — slow, with the line treated as live until proven otherwise. If anything is unexpected (residual pressure, weeping, wrong orientation), stop and re-verify before continuing.
Applied to Olin, steps 1, 2 and 4 each catch the event independently: the tag was on the twin and not on the device in front of the worker; no joint walkthrough verified the real item; and a positive zero-energy test would never have passed on a 100-psi live line. A gate that has to succeed only once was available three times over.
Point to retain
The wrong line is almost never opened by a careless worker. It is opened by a competent one who trusted a claim — a tag, a plan, an assumption — at the one moment that demands physical proof. The defence is not more paperwork; it is a disciplined physical verification at the point of break-in, by the people whose hands are on the tool, every time, on the actual equipment. Isolation you have not personally proven on this line is isolation you do not have.
"A tag tells you what someone intended. Only a test tells you what the line will do when you open it."
Glossary
- Energy isolation
- — Placing equipment in a zero-energy state — depressurised, drained, de-energised, isolated — before work begins, so stored energy cannot reach the worker.
- Lockout/tagout (LOTO)
- — Applying physical locks and tags to isolation points so equipment cannot be re-energised while work is in progress.
- Positive isolation
- — Isolation proven by physical means (blind, double-block-and-bleed, spool removal) and verified, not merely a closed valve assumed to hold.
- Rupture disc
- — A one-time pressure-relief device that bursts at a set pressure to protect equipment; the device being replaced at Olin.
- Control of work
- — The system of permits, isolations and approvals governing how hazardous work is planned, authorised and executed.
- Stored energy
- — Energy held in a system — pressure, chemical, thermal, electrical — capable of doing harm when released; 100 psi of liquid chlorine at Olin.
- Line break / break-in
- — The act of physically opening a pipe, vessel or device that may contain hazardous material; the irreversible point in the job.
- Pre-job walkthrough
- — A joint physical inspection by operators and the work crew, at the equipment, verifying preparation before any tool is used.
Resources
- US Chemical Safety Board (2026). Incident Reports, Volume 4 — Olin Freeport (20 May 2025) and PBF Energy Martinez (1 Feb 2025). https://www.csb.gov/assets/1/6/incident_reports_volume_4_2026-02-18.pdf
- US Chemical Safety Board — Investigations and Incident Reports. https://www.csb.gov/investigations/
- Reason, J. (1997). Managing the Risks of Organizational Accidents. Ashgate.
Frequently asked questions
This article is published by HSESKILLS Ltd for educational and informational purposes only. Composite scenarios illustrate common patterns and do not reference any specific organisation unless explicitly named.