They Blamed the Man at the Panel

▶️ Prefer to watch? Every story’s a short video → https://www.youtube.com/@GetSafetyIntel · 📣 Got a near-miss? Share it anonymously (QR + link at the bottom).

Twenty-eight years ago today, a pump tripped on a quiet Friday morning at a gas plant in the marshes of eastern Victoria, and by lunchtime two men were dead and an entire Australian state was about to go two weeks without gas. When the company went looking for someone to blame, it pointed at the operator at the panel. A former High Court judge spent 53 days looking at the same evidence and pointed somewhere else entirely. This is the story that taught a generation of us what “human error” actually means — and why the person closest to the work is almost never the cause.

At 12:26 p.m. on Friday, September 25, 1998, a heat exchanger the size of a delivery truck tore open at Esso’s Gas Plant 1 in Longford, in the Gippsland region of Victoria, Australia. The plant was the onshore receiving point for the natural gas that fed most of the state — run by Esso Australia, a subsidiary of Exxon, in a joint venture with BHP. Two workers, plant supervisor Peter Wilson and maintenance supervisor John Lowery, were killed in the fire that followed. Eight others were injured.

Here is what actually happened, because the mechanism is the lesson. That morning, a pump that circulated warm “lean oil” through the plant tripped and stopped. Lean oil was the plant’s heat blanket — a light hydrocarbon that kept the process vessels warm as freezing-cold gas and liquid moved through them. With the warm oil no longer flowing but the cold process fluid still coming, parts of the plant plunged to around minus 48°C (minus 54°F). Ice formed on the outside of the steel. And carbon steel, when it gets that cold, stops behaving like the tough metal you think it is — it goes brittle, like glass in a freezer.

The crew wrestled with the upset for hours. Nobody on shift fully understood what the cold was doing to the metal, because nobody had ever been trained for this exact failure, and there was no procedure for it. Eventually they got the lean-oil pump running again and pushed 230°C (446°F) oil back into a vessel that had been sitting near minus-48. Hot metal wants to expand; the brittle, frozen shell couldn’t take the thermal shock. At 12:26 it fractured and let go. About 10 tonnes of hydrocarbon flashed into a vapor cloud, drifted until it found a set of fired heaters 170 meters away, and ignited — the flame front burned back to the rupture and settled into a roaring jet fire. Wilson and Lowery were near it when it lit.

Then it cascaded. The jet fire burned under a critical pipe rack the operators nicknamed “King’s Cross,” and over the next half hour it cooked open three more inventories of flammable material. The plant burned for two days — the interconnections between the gas plants were so tangled that it took nearly two and a half days just to isolate the fuel feeding the fire. Gas production stopped cold. Within days the state’s gas network was shut down. 1.4 million households and 89,000 businesses lost gas. Victorians went 20 days — until October 14 — with no heating, no hot water, and no gas cooking, in the back end of a cold spring. The economic hit was estimated at around A$1.3 billion.

And here’s the part that made Longford a permanent fixture in every process-safety course since. When the Longford Royal Commission convened, Esso’s defense was to blame the men on the floor — it even produced the training records of one panel operator, James Ward, to argue he should have known how to handle the upset. The Commissioner, former High Court judge Daryl Dawson, rejected that outright. The Commission found the real causes sat with the company: no hazard study (HAZOP) had ever been done on that part of the plant, which almost certainly would have caught the brittle-fracture scenario; operating procedures and training for major upsets were inadequate; the plant’s engineers had been relocated to Melbourne, stripping the site of the expertise that might have recognized the danger; the alarm system threw so many alerts that operators had been conditioned to work through them; and a nearly identical warning event a month earlier, on August 28, never made it up the chain. Esso was later found guilty of 11 breaches of the Victorian Occupational Health and Safety Act and fined a then-record A$2 million.

Error is normal — and it was never the operator’s error to begin with. The men at the panel did exactly what people do: they tried to recover a plant they didn’t have the tools, training, or procedures to understand, under an alarm system that had cried wolf so many times it had gone quiet in their heads. Blaming James Ward wouldn’t have prevented the next one. It would only have guaranteed it, by hiding the real causes behind a name.

Context drove every “decision.” They pumped hot oil into cold steel because nobody had built them a world in which that was obviously catastrophic — no HAZOP that named the hazard, no procedure that said “warm it slowly,” no engineer on site to say “stop.” Pull the engineers to Melbourne, drown the panel in alarms, skip the hazard study, and you haven’t got operators making bad choices — you’ve got a plant that was going to bite whoever happened to be standing there.

The person closest to the work saw it first — a month early. The August 28 near-identical event was the plant telling its people exactly what was coming. The failure wasn’t that no one noticed; it’s that the organization had no path for what the floor noticed to reach the people who could act. How leaders respond to the weak signal is the whole game. Longford is what happens when the signal arrives and nobody’s built to catch it.

Longford happened in Australia, so the law it reshaped is Australian — it drove Victoria’s Major Hazard Facilities regime and the “safety case” approach now used across the country. But every failure the Royal Commission named maps cleanly onto the U.S. standard that governs plants like this one: OSHA’s Process Safety Management of Highly Hazardous Chemicals — 29 CFR 1910.119. Be honest about the timeline: PSM was written in 1992, six years before Longford, so Longford didn’t create it. Longford is the case that shows you what every element of it is for. (Verify current text at https://www.osha.gov/process-safety-management and https://www.ecfr.gov before you build anything on it.)

1910.119(e) — Process Hazard Analysis. This is the requirement to sit down, before something bites you, and systematically ask “what could go wrong here and what stops it.” Longford never ran a HAZOP on the lean-oil system. Dawson’s finding was blunt: a proper hazard study would almost certainly have flagged the risk of rupturing a vessel with sudden temperature change. Translate it to the floor: the scenario that kills you is usually one nobody ever formally sat down and imagined out loud.

1910.119(f) — Operating procedures, including procedures for abnormal conditions and startup after an upset. Longford’s people had no firm procedure for loss of lean-oil circulation — the exact upset they were living through. The rule exists because the dangerous moments in any plant are the non-normal ones: the trip, the restart, the “we’ve never seen it do this before.”

1910.119(g) — Training. Operators and supervisors have to actually be equipped to run the process, especially when it goes sideways. The company’s instinct was to say the operator should have known. The standard says: that’s the employer’s job to ensure, and prove, before the bad day.

1910.119(l) — Management of Change. Moving the plant engineers to Melbourne was a change — an organizational one — and nobody assessed what it would do to safety. That’s textbook MOC failure. When you reorganize, thin out, or “temporarily” work around something, the rule says stop and ask what safety net you just moved.

The one-line version, written in the blood of two supervisors: you cannot inspect, procedure, or “be careful” your way around a hazard you never engineered out and never trained anyone to face.

Most of what we cover is E, H, and S at once. Longford is unusual in where the weight fell — and I’ll be straight about that rather than manufacture a symmetry that isn’t in the record.

Environmental (E): the immediate release was roughly 10 tonnes of hydrocarbon, followed by a fire that burned natural gas, condensate and LPG for two days — real air emissions, including unburned methane, which is a potent greenhouse gas. What I won’t invent is an offsite spill into a river or soil: the record doesn’t center one, and the honest environmental story here is different and bigger in its own way. Cutting the gas supply to an entire state for 20 days is an energy-and-economic shock with a real footprint — every household that switched to electric heaters, every business idled, every alternative fuel trucked in.

Health (H): eight workers were seriously hurt in the fire. But the health toll spread far past the fence line. For 20 days, 1.4 million households had no heating, no hot water, and no way to cook with gas, in a cold Victorian spring. That falls hardest on exactly the people least able to absorb it — the elderly, the sick, the poor, families with infants. A process-safety failure at one plant became a public-welfare event across a whole state.

Safety (S): the spine of it — brittle steel, hot oil into cold metal, no HAZOP, no upset procedure, no on-site engineers, an alarm system nobody could hear anymore. The fix was never a sharper man at the panel. It was engineering and management systems that would have made the panel operator’s job survivable. It is almost never just the S — even when, as here, the S is where the two bodies were.

The same failure just showed up again — 27 years later, in Pennsylvania. On September 16, 2026, the U.S. Chemical Safety Board released its final report on the June 4, 2025 explosion and fire at Shell Polymers Monaca, the ethane cracker outside Pittsburgh. Read it next to Longford and your skin crawls. A process control engineer who had never performed the task before and had limited process knowledge inadvertently opened two isolation valves at once, letting flammable cracked gas backflow into a furnace firebox where it hit lit pilots and blew — about six minutes later — rupturing the firebox wall. Roughly $95 million in damage, an estimated 5,100 pounds of ethylene and combustion products released, 15 people evacuated. The CSB’s core findings: Shell leaned on 11 administrative controls — all depending on people following procedures perfectly — when the furnace maker had already supplied an engineered control that would have blocked the backflow, and Shell hadn’t configured it. The control screen showed three nearly identical valves whose tags differed only by the last digit. So what for safety leaders: this is Longford’s lesson with a 2026 date stamp — a catastrophic scenario your own hazard analysis already identified, held together by nothing but people-not-making-a-mistake, when an engineered safeguard was sitting right there. Go find yours before the CSB finds it for you. (Source: U.S. CSB, Sept. 16, 2026 — https://www.csb.gov/us-chemical-safety-board-releases-final-investigation-report-on-2025-explosion-and-fire-at-shell-polymers-monaca-facility-in-pennsylvania/)

”Willful” is still landing weekly — the enforcement climate hasn’t gone soft. In the last stretch of September 2026 alone, OSHA cited a New Jersey car wash for willfully exposing workers to hazards with more than $446K proposed, and a Florida pipeline installation contractor for willfully exposing workers after a March fatality (both dated Sept. 23, 2026). “Willful” is the word OSHA uses when it concludes the employer knew about the hazard and didn’t fix it — which is the through-line from Longford to Shell to this week: the danger was known and left standing. So what for safety leaders: don’t confuse a quieter news cycle with a lighter regulator, and more to the point, don’t let a hazard you already know about become the one an inspector has to name for you. (Source: OSHA news releases — https://www.osha.gov/news/newsreleases/all)

Shared blamelessly, because that’s the only way anyone learns from it.

A night-shift crew is bringing a unit back up after an early-evening trip. They’re behind, the phone’s ringing for product, and the control system keeps refusing to let them line up a valve — a permissive interlock trips them back every time they try. The temptation is right there and everybody feels it: bypass the interlock, get the lineup, get the unit running, sort out the “nuisance trip” in the morning. The lead operator’s hand is basically on it. A newer operator, half apologetic, asks the question anyway: why is that interlock even there? Nobody on shift is totally sure. So instead of forcing it, they stop and call the process engineer at home. Turns out the interlock was doing precisely its job — it was blocking a lineup that, in the abnormal state the unit was in, would have pushed hot material into a section that wasn’t ready for it. They warmed the system through properly, cleared the permissive the right way, and brought it up an hour later than they wanted. Nobody got hurt. Nothing ruptured. It became a five-minute story at the next tailgate instead of a report somebody else writes about you.

The HOP read: that crew wasn’t heroic and the interlock wasn’t magic — the pull to defeat a “nuisance” safeguard under production pressure is exactly what a bad night does to good, experienced people, and “we’ll fix the sensor tomorrow” is how most of these start. The save wasn’t a braver operator. It was two things working together: an engineered safeguard that actually stood in the way (the same thing Shell didn’t configure and Longford never had), and a culture where a green operator could ask “why is this here?” out loud and get a stop instead of an eye-roll. That gap — a safeguard you don’t defeat and a question you’re allowed to ask — is the whole distance between a near-miss and a funeral.

Got a fail or a near-miss? Hit reply, or scan the QR below — we’ll feature it anonymously — no names, no company, no blame. Just the lesson, so the next crew doesn’t learn it the hard way.

Share your near-miss here → https://scantoconfess.com — 100% anonymous, no names, no company, no blame.

Before your next shift, pull one scenario — just one — out of your PHA, your JHA, or the back of your own mind: a way your process could seriously hurt someone that today is prevented only because people follow a procedure correctly every single time. Now ask the two Longford-and-Shell questions about it. One: is there an engineered safeguard that could take that catastrophe off the table — an interlock, a relief path, a physical block, a design change — and if one exists, is it actually installed and turned on, or is it sitting in a manual somewhere unconfigured? Two: the person you’d hand that critical task to on a bad night — are they genuinely trained and experienced for it, and can you point to the record with a name and a date, or are you quietly counting on “they’ll figure it out”? Longford counted on the man at the panel figuring it out. He couldn’t, because nobody had built a plant where he could. Don’t run a smaller version of that.

🎬 Rather watch than read? Every Safety Intel story is a short video on YouTube → https://www.youtube.com/@GetSafetyIntel — subscribe so you never miss one. 📸 Share YOUR near-miss (100% anonymous): https://scantoconfess.com — or just scan the QR above. 📤 Forward this to a crew member who needs it today.

Please stay Safe & Hydrated!!!

Longford Royal Commission — The Esso Longford Gas Plant Accident: Report of the Longford Royal Commission (Dawson & Brooks, 1999): https://web.archive.org/web/20221111015445/https://www.parliament.vic.gov.au/papers/govpub/VPARL1998-99No61.pdf

1998 Esso Longford fire — date (Sept. 25, 1998, 12:26 pm), mechanism, 2 killed / 8 injured, 20-day gas outage, 1.4M households, findings, A$2M fine: https://en.wikipedia.org/wiki/1998_Esso_Longford_fire

Coroner’s inquest into the deaths of Peter Wilson and John Lowery (Coroners Court of Victoria, Case No. 2907/98): https://web.archive.org/web/20070622023036/http://www.coronerscourt.vic.gov.au/CA256902000FE154/Lookup/Coronial_Findings_of_Importance/LONGFORD.pdf

Longford 20-years-on remembrance (ABC News, Sept. 25, 2018): https://www.abc.net.au/news/2018-09-25/20-years-since-deadly-longford-gas-plant-explosion/10299988

OSHA Process Safety Management — 29 CFR 1910.119: https://www.osha.gov/process-safety-management

U.S. CSB final report on the 2025 Shell Polymers Monaca explosion (released Sept. 16, 2026): https://www.csb.gov/us-chemical-safety-board-releases-final-investigation-report-on-2025-explosion-and-fire-at-shell-polymers-monaca-facility-in-pennsylvania/

OSHA news releases (willful citations, Sept. 23, 2026): https://www.osha.gov/news/newsreleases/all