TPC Port Neches made dead-leg management and process-data retention an industrial accountability test

Summary

• In the early hours of November 27, 2019, a pipe connected to an offline pump in TPC Group's South Unit ruptured. About 6,000 gallons of primarily liquid butadiene escaped, vaporized and ignited. Explosions and fires injured workers and a contractor, damaged surrounding property, led to a four-mile evacuation and destroyed the butadiene unit; residual fires continued for weeks.
• The Chemical Safety Board found that rapidly growing “popcorn” polymer had accumulated in a temporary dead leg created when a pump was left out of service. TPC knew this polymerization mechanism, had dead-leg and pump-rotation practices, and had encountered polymer, yet fragmented paper records, ineffective inspection, uncertain oxygen-analyzer performance and incomplete configuration control did not produce timely intervention.
• Accountability later travelled through distinct channels. OSHA issued contested citations; the CSB made safety recommendations; tort claims intersected with a Chapter 11 reorganization; and TPC pleaded guilty to a Clean Air Act offense while resolving separate civil allegations through a consent decree. Those outcomes must not be collapsed into one finding or used outside their legal boundaries.
• Durable repair means more than closing an investigation. It requires a living inventory of permanent and temporary dead legs, auditable electronic records, reliable instrumentation, passivation and inhibition controls, disciplined abnormal-condition escalation, independent emergency isolation, community information and continuing verification that closed recommendations still work as equipment and operations change.

The rupture turned an idle branch into the centre of the process

TPC's Port Neches Operations facility separated crude C4 feed into products including high-purity 1,3-butadiene. In the South Unit, two pumps served the final fractionator system. One could operate while the other remained available as a spare. When a pump was isolated from circulation, the pipe between process equipment and its isolation valve could cease to receive normal flow. That stagnant volume was a temporary dead leg even though the underlying piping had not been newly installed.

At about 12:56 a.m. on November 27, the pipe in the dead leg associated with the out-of-service A pump ruptured. The released butadiene formed a flammable vapor cloud and ignited within minutes. A later blast propelled heavy equipment, damaged structures and compromised additional process systems. The unit could not be quickly emptied through a single remote valve because inventories and interconnected equipment continued feeding fires. The official CSB investigation page records the final report, recommendations and their subsequent status; it is the controlling public index for the Board's safety work.

The event is sometimes summarized as a generic refinery explosion. That loses the most useful control information. Port Neches was a petrochemical plant, and the initiating hazard involved high-purity butadiene in a particular stagnant branch. A dead leg is not inherently defective hardware. It is an operating condition in which flow is absent or limited public evidence, and it may appear when equipment status changes. Its risk therefore cannot be managed only from an as-built drawing. Operators must connect the drawing to actual valve, pump and service status.

The CSB estimated approximately $450 million in on-site damage and $153 million off site. Those are investigation estimates, not court awards or a complete ledger of insured and uninsured loss. The Board reported injuries to employees and a contractor; later enforcement records describe additional injury consequences using their own definitions. Precision requires attribution rather than forcing every source into one count.

The sequence also rebuts a comforting assumption: standby equipment is safe because it is not operating. In reactive service, isolation may remove circulation, inhibitor replenishment and useful measurement while retaining hazardous material. The availability strategy for a spare pump can therefore create a chemical-reaction hazard unless the isolated branch is drained, flushed, inerted, passivated, monitored or frequently returned to controlled circulation.

Popcorn polymer was a known mechanism with accelerating consequences

Butadiene can polymerize by more than one mechanism. The form central to Port Neches is commonly called popcorn polymer because its hard, porous mass resembles popcorn. Once initiated, the polymer can grow by feeding on monomer, expand within confined equipment and propagate without a conventional external ignition source. Growth can accelerate and generate mechanical force. A small observed deposit is therefore not necessarily a stable nuisance whose future size is proportional to elapsed time.

The CSB's adopted investigation report 2020-02-I-TX reconstructed the chemistry, equipment configuration, operating history, rupture and organizational controls. The Board concluded that polymer accumulated in the temporary dead leg, expanded and produced enough pressure to rupture the pipe. It treated inadequate identification and control of dead legs as a central safety issue. That is a safety-investigation conclusion, not a criminal judgment or a civil allocation of fault.

Commercial butadiene is commonly protected with an inhibitor that addresses one polymerization pathway, while oxygen concentration and passivation matter to other reactions. The presence of inhibitor in the main stream does not prove that every stagnant pocket retains effective protection. Nor does a normal bulk-process sample establish conditions in an isolated pipe. Control must be based on the chemistry at the vulnerable location and on the time since flow, flushing or protective treatment last reached it.

Popcorn polymer had been observed at Port Neches before the incident. That evidence matters because it changes the management question from whether the mechanism was imaginable to whether recurring indications were classified, trended and escalated. A deposit removed during maintenance is not only debris. It is evidence of an active damage mechanism. Its location, quantity, appearance, growth interval and associated equipment state should enter a searchable record that can identify repetition across units and shifts.

The American Chemistry Council's butadiene stewardship guidance supplied industry context, but general guidance did not eliminate the need for site-specific engineering. The CSB later asked the Council to improve guidance on temporary dead legs and on what should count as an excessive or dangerous polymer excursion. That recommendation recognises a basic governance problem: if a site lacks decision thresholds, observations can be documented yet never trigger shutdown, redesign or urgent cleaning.

A pump outage changed the hazard map

The A pump had been taken out of service months before the rupture. The process continued using the other pump. In production terms, the unit could still operate; in configuration terms, the hazard map had changed. The pipe segment to the idle pump became stagnant and remained filled with high-purity material. A robust management-of-change or equipment-outage review should ask whether such a state creates new dead legs, disables monitoring, alters inhibitor distribution or makes an emergency valve inaccessible.

Dead-leg identification often begins with piping and instrumentation diagrams. Those diagrams are necessary but limited public evidence. A diagram depicts possible paths and installed equipment; it does not continuously say which pump is unavailable, which valve is shut, what temporary spool is installed or how a line is actually used. The required control is a reconciliation of engineering records with field verification and current operating state.

TPC had a dead-leg inspection procedure and a spare-pump rotation practice. The existence of those documents shows institutional knowledge, but a written control is not equivalent to verified execution. The accident exposed questions about whether the affected branch was correctly identified, whether pump rotation occurred as intended, what inspections saw, how polymer findings were escalated and whether supervisors could reconstruct performance after records were damaged.

The CSB's final-report release identifies four recurring safety themes: dead-leg identification and control, recognition of excessive polymer, process-data retention and emergency preparedness. These themes connect engineering and information governance. A plant can possess chemical expertise yet fail if the current configuration is not visible. It can inspect equipment yet fail if observations are not retained. It can know a condition is abnormal yet fail if no threshold mandates action.

A mature temporary-dead-leg register should be dynamic. Each entry needs the equipment boundary, chemical service, creation date and reason, responsible owner, protective method, maximum allowed duration, inspection and flushing interval, relevant instruments, last completed action and authorized disposition. Digital status should not replace field tags or permits; the two should reconcile. Overdue actions should escalate beyond the shift that created them.

Design elimination is preferable where practicable. A spare can be arranged for continuous minimum flow, isolated closer to the flowing header, drained after use or protected by a validated circulation and passivation method. Where elimination is not possible, the basis for the selected control should be documented against credible growth rate, instrument uncertainty and worst-case outage duration—not merely inherited practice.

Inspection evidence existed but did not become a decisive barrier

The pipe did not fail because nobody had ever considered polymer. Port Neches personnel conducted inspections and used forms. The harder accountability issue is why observations and tasks did not combine into a reliable prediction that the stagnant branch was approaching failure. An inspection regime succeeds only if it covers the actual hazard location, uses a technique capable of detecting the relevant condition, records interpretable results and triggers action before the safety margin disappears.

Conventional thickness measurement is useful for corrosion but does not necessarily quantify internal popcorn polymer. External examination may find deformation late, after expansive force has already developed. Opening a line can expose workers and disturb evidence. The inspection plan therefore needs chemical and operational indicators alongside mechanical measurements: duration out of service, prior deposits, flow history, oxygen and inhibitor performance, flushing completion, temperature anomalies and any restriction during rotation.

OSHA's inspection record 1448049.015 shows that the federal workplace-safety inspection remained listed as open and records the referral, scope and cited items. Its status is important. A citation is an enforcement allegation when issued, and a contested citation is not a final adjudicated fact. Reporting should preserve that difference even when the alleged conditions overlap with later evidence in another forum.

The agency announced proposed penalties of $514,692 and three willful citations concerning emergency shutdown procedures, inspection and testing, and correction of equipment deficiencies. The Department of Labor release accurately describes what OSHA cited and what procedural choices the employer had. It should not be rewritten as a final conviction or as the CSB's probable-cause determination.

One published OSHA violation detail alleges that equipment operated outside acceptable limits in the presence of polymer and identifies the citation as contested. The useful governance lesson is not to borrow the citation's label as rhetoric. It is to ensure that the mechanical-integrity programme defines acceptable limits, associates them with observable evidence, prevents continued service without authorized safeguards and retains the disposition.

Inspection quality can be audited. A reviewer should be able to select a high-purity butadiene branch and reconstruct every interval of stagnation, every required task, its performer and timestamp, the result, any deviation, the supervisor's decision and eventual closeout. If the evidence exists only in loose sheets, local notebooks or the recollection of experienced staff, management cannot reliably trend weak signals or demonstrate control after a catastrophic event.

Paper records became a safety-system dependency

Operators used handwritten logs and check sheets for dead-leg inspection, spare-pump rotation and critical process instrumentation. Paper is not automatically unsafe. It can work during network outages and support immediate field notation. The failure mode arises when unique evidence remains only on paper in an industrial area vulnerable to fire, blast, water and evacuation, or when its structure prevents timely aggregation and analysis.

After the explosions, the plant's damage impeded recovery of some records. Investigators could not reconstruct all relevant performance with the confidence that electronic retention and routine review could have supported. That gap affected more than post-event explanation. Before the event, fragmented records made it harder to see whether a pump remained unrotated, an oxygen analyzer repeatedly failed, inspections reported polymer in related locations or tasks were signed without meaningful results.

The CSB recommendation required TPC to incorporate specified paper-based process-performance information into its existing electronic records-management system. The Board's later status summary for recommendation R3 records closure as acceptable action after implementation. Closure means the Board judged the submitted action responsive to the recommendation's objective. It is not a permanent certification of every record, every user entry or future system configuration.

Digitization should preserve meaning, not merely images of forms. Fields should identify equipment uniquely, constrain dates and units, record both expected and actual values, capture reasons for missed tasks, and prevent silent overwriting. Original entries and corrections need audit history. Access control must allow operators to record promptly while preventing unauthorized deletion. Retention should survive the loss of a control room or local server.

Useful automation looks for conditions that humans might miss across shifts. It can flag an offline pump approaching its maximum stagnant interval, an inspection showing repeated polymer, an analyzer unavailable beyond its permitted window or a mismatch between maintenance and operating databases. But automation is not accountability by itself. Alarm ownership, response time, override authority and review of chronic overdue alerts must be explicit.

Data quality also has a physical side. An electronic record saying a pump rotated does not prove flow reached the dead leg. Verification may require valve position, motor current, discharge pressure, flow indication or a competent field observation. The evidence model should distinguish task completion from proof that the intended chemical protection occurred.

Oxygen, inhibitor and passivation controls need independent proof

The process used an oxygen analyzer because oxygen concentration was relevant to polymerization control. Instrument reliability matters most when management uses a reading to infer that chemistry is protected. An analyzer that is unavailable, poorly maintained, outside calibration or sampled from a location unrepresentative of a dead leg cannot support that inference.

Critical-instrument logs should document calibration, fault periods, bypasses, maintenance, substitute measurements and the operational consequence of losing the signal. A permissible outage needs a defined compensating measure and maximum duration. If operators repeatedly continue without the analyzer because production appears stable, the instrument becomes decorative rather than protective.

Inhibitor control has similar proof requirements. Receipt specifications, injection rate, sample result and bulk concentration are relevant, but each addresses a bounded question. They do not establish distribution within stagnant piping. Engineering must explain whether circulation refreshes the isolated branch, whether inhibitor depletes, whether oxygen ingress changes reaction pathways and how long the protective state remains valid.

Passivation aims to reduce sites that can initiate or sustain popcorn polymer. The Board recommended passivating storage vessels, fixed equipment and associated high-purity butadiene piping at the Port Neches terminal consistent with good practice. Its R2 status decision records the evidence on which the recommendation was closed. Passivation is a lifecycle task: cleaning, treatment coverage, verification, re-treatment triggers and preservation during repairs all matter.

No single layer should carry the whole safety case. A credible design combines dead-leg elimination, circulation or flushing, inhibitor management, passivation, condition inspection, reliable instrumentation and time-based limits. These layers should fail differently. If a paper checklist is missed, a physical design should still slow accumulation. If an analyzer fails, a conservative operating limit should prevent indefinite continuation. If polymer is observed, an escalation rule should override schedule pressure.

The most important metric is not the percentage of forms completed. It is whether hazardous configurations were identified and removed within their allowed time, whether abnormal polymer findings led to controlled disposition, and whether the plant can show no unassessed high-purity branch remains. Completion statistics without denominator integrity can disguise missing equipment from the register.

Emergency isolation was constrained by process design

Once the pipe ruptured, responders faced a large flammable release, escalating fire and blast damage. The initial event damaged equipment and made access hazardous. Continuing process inventory fed fire. A control system designed around routine shutdown may not remain available after the initiating explosion has broken piping, removed power or made manual valves unreachable.

Emergency planning should therefore start from damaged-state assumptions. Remote isolation valves need locations that divide inventory into defensible segments and actuators that remain operable under credible fire and blast conditions. Operators need unambiguous indications of valve position and pressure. Depressurization routes must discharge to a safe system. The plan should identify what material remains trapped after each isolation action.

OSHA alleged deficiencies in emergency shutdown procedure development and implementation. The later Clean Air Act resolution also required review and revision of emergency shutdown procedures. These proceedings do not make every asserted deficiency identical, but together they show why emergency controls need both documented logic and field validation. A tabletop description that assumes intact utilities cannot be the only proof.

The fires continued for more than a month in smaller pockets while isolation and response work proceeded. Long duration changes the accountability horizon. Unified Command must manage air monitoring, runoff, ignition control, debris stability, worker entry, public information and safe termination, not only the first alarm. Each transfer of command needs a current common operating picture and clear responsibility for unresolved hazards.

EPA and the Texas Commission on Environmental Quality joined local authorities and TPC in Unified Command. The archived EPA response resource announcement documents multi-agency public information and monitoring work. A response story map is evidence of reported activities, not proof that every exposure was absent or that every resident's loss was remedied.

Emergency exercises should test inconvenient conditions: the normal control room unavailable, conflicting instrument readings, blocked road access, a second explosion, a shelter-in-place order changing to evacuation, overloaded public channels and schools needing inspection before reopening. Lessons should flow back to equipment design, not remain confined to emergency manuals.

Community warning carried decisions beyond the fence line

The blast damaged homes and businesses and was felt far from the plant. Local officials first used shelter and evacuation controls as conditions evolved, ultimately issuing a mandatory evacuation within four miles that affected Port Neches, Groves, Nederland and part of Port Arthur. Schools closed, road and waterway activity changed, and residents faced uncertainty about air quality and when return was safe.

Warning is a decision system, not only a siren. Authorities need a credible source term, wind and monitoring data, geographic reach, message approval, redundant delivery and feedback that vulnerable populations received the instruction. Messages must state who is covered, what to do, what not to do, where assistance is available and when the next update will arrive.

Facility operators hold process information that public agencies need, while public officials hold evacuation authority and community channels. Pre-incident agreements should define how those roles connect under time pressure. Data shared with responders should distinguish measured values, modeled projections and uncertain estimates. Public statements should change openly as evidence improves rather than concealing revisions.

Off-site damage estimates reveal scale but not distribution. A homeowner with windows destroyed, a tenant displaced, a school requiring cleaning and a business losing access experience different losses and remedies. Claims systems need accessible intake, preservation of photographs and repair records, language support, status visibility and appeal. Community monitoring should preserve raw and quality-assured data so later questions can be examined.

The 2024 civil settlement required fenceline and community air monitoring, timely public reporting of specified incidents, community meetings and information about risk, evacuation routes and sheltering. EPA's settlement information sheet describes these obligations and an estimated approximately $80 million cost for injunctive relief. Because the page also explains that the decree was proposed and subject to court approval when announced, timing and procedural posture must be stated rather than assumed.

Community assurance after a catastrophe cannot rest on a declaration that lessons were learned. It needs recurring publication of monitor availability, incident notifications, overdue corrective actions where disclosure is lawful, exercise findings and the operational status of the facility. At Port Neches, the destroyed production unit did not return to butadiene manufacturing; terminal or storage activity has a different hazard profile and should be described accurately.

Safety findings, enforcement allegations and a guilty plea are different records

The CSB is an independent investigative body, not an enforcement agency. Its findings explain accident mechanisms and support recommendations. Federal law restricts use of CSB conclusions in damages litigation. The Board does not impose criminal guilt, civil liability or compensation. Its technical account can align with evidence later used elsewhere without becoming that later tribunal's judgment.

OSHA's citations addressed workplace standards and were contested. EPA and DOJ pursued Clean Air Act matters under a different statutory framework. In May 2024, TPC entered a guilty plea to one count concerning knowing failure to implement written operating procedures, including required monthly flushing. The court later accepted the plea and adjudged the company guilty. DOJ's case page and selected court record index preserves the sequence and, importantly, distinguishes a victim-notification investigation notice from the later charge and adjudication.

The Department announced $18 million in criminal fines, a one-year probation term and a public apology, alongside $12.1 million in civil penalties payable through bankruptcy and extensive injunctive relief. Its archived plea and settlement release combines several procedural events. The guilty plea supports the criminal count and its factual basis; it does not automatically adjudicate every civil allegation or every disputed tort claim.

The civil complaint contained numerous alleged violations at Port Neches and Houston. Allegations remain allegations unless admitted or resolved with the legal effect specified by the decree. A consent decree can impose binding remedies while stating that liability is not admitted for civil claims. Good accountability writing identifies the document, the actor and the procedural verb: alleged, cited, pleaded guilty, adjudged guilty, agreed, ordered or closed.

The final remedy should also be judged by verifiable outputs. Process-safety-information updates must correspond to actual equipment. Hazard analyses need timely resolution of recommendations, not repeated extensions. Training needs competence checks. Emergency procedures need drills under degraded conditions. Metrics need independent review and consequences for chronic exceptions.

Bankruptcy changed the claims pathway without deciding technical cause

TPC and affiliates entered Chapter 11 in 2022. Bankruptcy consolidated creditor claims and enabled a restructuring, but it was not an accident investigation. The confirmed plan and global settlement affected how tort plaintiffs could pursue and recover claims, including claims involving equity sponsors. Legal questions about estate ownership, releases and direct versus derivative theories are distinct from the chemical mechanism that ruptured the pipe.

The Bankruptcy Court's memorandum opinion on plan enforcement describes a $30 million pool for general unsecured creditors, including tort plaintiffs, and analyzes which asserted claims belonged to the estate or could proceed directly. The amount is a plan settlement feature, not an official estimate of total Port Neches harm and not proof that any particular claimant was fully compensated.

On appeal, the District Court's 2025 opinion addressed the plan's effect on veil-piercing and negligent-undertaking theories. It did not retry the explosion cause. The distinction matters because corporate restructuring can narrow defendants, forums and recoveries even while public safety obligations continue through regulators and a reorganized entity.

Claims governance should preserve the line between eligibility and causation. A claim may be allowed for plan purposes without a merits judgment; a settlement may resolve uncertainty without admission; a release may bar litigation without disproving loss. Reports should not label all filed amounts as paid damages or all objected claims as false.

For affected communities, fragmentation creates a practical burden. Property, bodily injury, business interruption, insurance subrogation, environmental enforcement and bankruptcy claims can travel through different systems. A durable accountability design provides a clear map of forums, deadlines, evidentiary requirements and contacts. It also retains records long enough for latent claims and regulatory verification after reorganization.

Corporate continuity should include safety-data continuity. When ownership, financing or operating purpose changes, electronic maintenance histories, process-safety studies, inspection results, community commitments and recommendation evidence must transfer with defined custodianship. A reorganized balance sheet cannot be allowed to orphan the technical memory needed to prevent recurrence.

Recommendation closure is a milestone, not the end of verification

The CSB issued three recommendations to TPC and two to the American Chemistry Council. They covered a dead-leg programme, passivation, electronic capture of paper performance information, industry guidance on identifying temporary dead legs, and a methodology for dangerous polymer excursions. By the investigation page's current status, all five are closed, some as acceptable action and some as acceptable alternative action.

For TPC's dead-leg programme, the Board required periodic review using both diagrams and field evaluations, recognition of operating changes that create temporary or permanent dead legs, design elimination where practical, mitigation through monitoring, flushing, inhibitor or maintenance timing, and at least annual management audit. The R1 closure summary records the submitted programme and Board decision.

Closure answers whether the recipient's response met the recommendation's objective at review. It does not guarantee implementation at every future facility, invalidate later contrary evidence or eliminate the hazard. The plant's change to storage use narrows some process conditions, but high-purity butadiene terminal service can still create stagnant equipment. Verification must follow the remaining operation.

Alternative action also requires care in wording. When the Council revised guidance in a way the Board accepted as an alternative, that means the response addressed the safety objective by a different route. It does not mean the original recommended text was unnecessary or that every member company adopted the guidance.

An assurance programme should sample the equipment universe, not only review policy. Inspectors can select current and recently retired dead legs, walk down their physical configuration, inspect records, test alarms, interview operators, reconcile work orders and verify that abnormal findings changed operation. Trend measures should include the age of open temporary dead legs, overdue protective tasks, repeat polymer findings, analyzer unavailability and time from evidence to disposition.

Independent challenge is essential because a programme can slowly become ceremonial. Audit teams should include chemical-reaction and mechanical-integrity competence and be able to stop work or escalate outside the production line. Findings should remain visible until physical correction is verified. Repeat findings should trigger a broader management-system review rather than another local reminder.

A practical control model joins configuration, chemistry and evidence

Before assembling the control model, it is useful to separate compliance evidence from safety capacity. The federal TPC consent decree specifies detailed obligations, schedules, reporting, stipulated-penalty mechanisms and independent professional roles. Those provisions create enforceable deliverables if and when effective under the court's order. They do not make a document submission proof that the corresponding field condition is safe. Compliance review must test both whether the required artifact was delivered and whether the artifact accurately governs the plant.

This distinction is especially important for process hazard analysis. A study can be completed on time while its recommendations remain overdue, narrowly scoped or disconnected from work orders. Each action should retain the hazard scenario that generated it, the interim safeguard, the accountable executive, the technical acceptance criteria and evidence of field completion. Deferrals need escalating approval and a new risk review; repeated deferral cannot become an unofficial permanent operating mode.

Operating procedures require the same dual proof. A current revision in a document system establishes controlled text, not habitual performance. Auditors should observe representative tasks, compare operator understanding, inspect line-up and sample history, and examine deviations. Monthly flushing, for example, must define the correct boundary, sequence, destination, minimum effective volume or duration and objective evidence of flow. A signature alone cannot show that protective material reached an isolated branch.

Training is strongest when it tests decisions under ambiguity. Personnel should be able to recognize how taking a spare pump out of service creates a temporary dead leg, explain why normal inhibitor data may not represent stagnant material, identify the response to a failed analyzer and know who can order a conservative shutdown. Scenario-based assessment reveals whether people can apply the rule outside the exact wording of a checklist.

Management review should combine these views at equipment level. For each high-consequence scenario, leaders need to see the preventive barriers, current impairments, overdue actions, recent demands and independent test results. A red metric should carry a named decision and deadline. Aggregate green dashboards must not hide one long-lived configuration with credible catastrophic consequence.

Finally, assurance needs retention beyond the immediate remedy term. Systems, contractors and leadership will change. The organization should preserve baseline inventories, rationale for design choices, audit sampling and trend histories so a future reviewer can detect erosion. Consent-decree termination or recommendation closure should trigger a transition plan for ordinary governance, not removal of the additional visibility that made repair possible.

The first layer is configuration control. Maintain a single equipment identity across diagrams, field tags, maintenance and operating systems. Detect when pump, valve or bypass status creates stagnation. Require an owner, expiry and protective plan before an outage can extend beyond a defined period. Verify in the field that the database matches reality.

The second is chemistry control. Define the credible polymerization pathways for each concentration, temperature, material and contamination state. Validate inhibitor, oxygen and passivation assumptions at the vulnerable volume. Establish conservative action thresholds for polymer observation and protective-system loss. Treat an unknown state as degraded, not normal.

The third is mechanical integrity. Select inspection methods that can detect the expected failure precursor, understand where they cannot see and combine them with operating indicators. Define acceptable limits and mandatory disposition. Do not keep equipment in service merely because a thickness reading addresses a different damage mechanism.

The fourth is information integrity. Capture structured, time-stamped records; preserve originals and corrections; back them up away from the hazard area; and make them searchable across shifts and equipment. Link a task to objective proof of its effect. Use automated exception reporting but assign accountable human owners.

The fifth is emergency resilience. Limit inventories, provide survivable remote isolation, rehearse damaged-state shutdown, integrate facility and public command, and preserve environmental monitoring. Warning decisions need pre-agreed triggers and accessible delivery. Response evidence should remain available for community review and after-action learning.

The sixth is remedy and oversight. Keep safety findings, citations, criminal outcomes, civil decrees and bankruptcy distributions in their correct legal lanes. Publish what each remedy requires, how compliance is measured and who can enforce it. Protect claimant access without presenting settlements as causal judgments.

These layers turn Port Neches from a list of mistakes into an auditable system. The decisive question is not whether an organization has a dead-leg procedure. It is whether every hazardous stagnant volume is known now, whether its chemistry remains within a proven safe envelope, whether missed actions become visible before failure, and whether someone with authority must resolve the exception.

What durable accountability looks like

For operators, proof begins with the complete denominator: all high-purity butadiene equipment, all configurations capable of stagnation and every interval in which those configurations existed. It continues with evidence that protections reached the vulnerable volume and remained effective. It ends with disposition records showing that abnormal evidence led to drainage, cleaning, repair, redesign or a technically justified return to service.

For boards and lenders, process risk should not be reduced to injury frequency. They need leading indicators tied to catastrophic hazards: long-lived temporary dead legs, overdue safety-critical work, unresolved hazard-analysis actions, repeat polymer findings, impaired analyzers and emergency valves not proven under demand. Capital decisions should show how safety margins were protected.

For regulators, coordination can reduce blind spots while respecting authority. CSB findings can identify systemic lessons; OSHA can address workplace compliance; EPA can enforce accident-prevention duties; local authorities can govern warning and land-use consequences; courts can adjudicate charges and claims. Shared equipment identity and preservation protocols improve evidence without merging legal standards.

For communities, confidence depends on understandable operational facts, not assurances. Monitoring availability, reportable events, exercise schedules, evacuation information and consent-decree milestones should be accessible. Uncertainty should be explicit. Absence of a detected exceedance is not proof that no exposure occurred when monitors were absent or below a method's capability.

For industry groups, guidance should translate rare-event learning into usable criteria. Temporary configurations must be included, dangerous polymer accumulation needs conservative escalation, and alternative protective methods need validation. Operators should not have to rediscover through catastrophe that an idle spare created a live reactive hazard.

Port Neches ultimately made recordkeeping part of mechanical integrity. The missing barrier was not simply a stronger pipe or another checklist. It was a trustworthy chain from changing equipment state to chemical risk, from observation to retained evidence, from evidence to authorized action, and from corrective action to independent verification. When that chain is visible and tested, the quiet branch beside an offline pump can no longer disappear from the safety case.