How Longford Turned a Process Upset Into a Leadership Test

A process upset does not need to become a disaster. It becomes one when the organization has no reliable way to recognize the hazard, recover the process, escalate uncertainty, and isolate the energy before the situation outruns the response.

The Esso Longford gas-plant accident in Victoria, Australia, is a useful case because the visible event looked technical while the investigation exposed a leadership system that had lost important connections between engineering, operations, training, alarms, and organizational change. On September 25, 1998, the event killed two employees and injured eight, according to the Institution of Chemical Engineers incident summary.

The initial scenario was a process upset that changed the equipment state

The plant was taken offline after a major upset. During the following restart, the rich-oil deethaniser reboiler became intensely cold, and warm lean oil was later reintroduced. The resulting thermal condition contributed to a catastrophic failure of the reboiler channel end.

The Institution of Chemical Engineers summary records that more than 10 tonnes of hydrocarbon vapour were released, the vapour cloud travelled approximately 170 metres to fired heaters, and the resulting fire continued for more than two days. Those figures matter because they show how quickly a local process condition can become a site-wide emergency when isolation and recovery barriers are weak.

The technical failure exposed a missing hazard in the operating model

The low-temperature hazard was not adequately identified before the event. That gap matters more than the final fracture because a risk assessment can only control hazards that the organization has recognized and represented accurately.

James Reason's work on latent failures helps explain the leadership implication. The operator may be acting inside a system whose procedures, training, alarms, and engineering support have already narrowed the available safe choices. A review that stops at the final action misses the conditions that made the action appear reasonable.

Hazard identification failed before the procedure failed

When a hazard is absent from the operating team's mental model, a procedure can be technically complete and still provide little protection. The Longford analysis identified incomplete operating procedures because the relevant abnormal condition had not been adequately recognized.

Leaders should therefore ask a harder question than whether procedures are current. They should ask which process states have been tested, which low-probability conditions could produce high consequences, and whether operators have practiced the recovery decisions that follow from those conditions.

Management of change included people, not only equipment

The incident analysis identified the relocation of senior engineering staff to Melbourne as an organizational change that did not receive an adequate management-of-change review. No pipe had to move for the safety system to change. The expertise available during an upset, the speed of technical escalation, and the quality of local supervision had already been altered.

This is a common blind spot. Many management-of-change processes focus on modifications, chemicals, software, or production rates while treating staffing and decision access as administrative matters. A safety leader should review changes in competence, authority, contractor reliance, and engineering presence with the same seriousness applied to physical changes.

Alarm volume did not create alarm quality

The Longford incident analysis identified inadequate alarm management, including too many alarms and poor prioritisation. An alarm system can therefore be active while the operator is functionally unsupported, because the signal that matters is buried in a stream that does not distinguish urgency.

The leadership test is practical. During an abnormal-condition exercise, can the operator identify the first alarm that changes the decision? Can the supervisor explain which alarm requires shutdown, isolation, evacuation, or technical escalation? If the answer depends on personal memory rather than a tested design, the alarm system is not carrying the control burden assigned to it.

Training could not replace missing abnormal-operation competence

The incident summary identified inadequate training for abnormal operations and upsets. That finding does not mean more classroom hours would have solved the case. Training is effective only when it gives people the knowledge, practice, authority, and equipment needed to perform the required recovery action.

A useful training review follows the event backward. What condition should the operator have recognized? What response was possible? What information was available? Who could authorize a stop? Which physical barrier could have limited the release? The answers reveal whether the gap belongs to competence, design, staffing, or leadership governance.

The measured result was a new expectation for major-hazard governance

The Longford Royal Commission created a public record that connected the fire to more than equipment. The incident contributed to stronger major-hazard regulation in Victoria, including the Occupational Health and Safety Major Hazard Facilities Regulations 2000 and a safety-case expectation for covered facilities, as summarized by the Institution of Chemical Engineers.

The useful before-and-after comparison is not the number of recommendations issued. It is whether the organization changed how it recognizes major hazards, manages competence, controls abnormal conditions, prioritizes alarms, and verifies that safeguards remain available.

What plant leaders should apply before the next upset

Choose one process upset that could change temperature, pressure, flow, inventory, or isolation status faster than the normal operating routine can respond. Map the first ten minutes of the expected recovery. Identify the critical hazard, the first decision, the person who owns it, the signal that should trigger it, and the barrier that limits the consequence.

Then remove one assumed support. Make the engineering contact unavailable, introduce an unfamiliar alarm sequence, or delay a handover. The goal is not theatrical stress. It is to discover whether the safe response depends on a person, a document, or a communication path that the organization has never tested under degraded conditions.

What supervisors should verify at the point of work

Supervisors can turn the Longford case into a short field conversation. Ask what has changed since the last stable run, which abnormal condition would make the current procedure invalid, and who can authorize isolation when the evidence is incomplete.

When workers raise an unusual temperature, sound, alarm pattern, or process response, the supervisor should record the decision and escalate according to a known threshold. A concern that disappears into a log has been documented, not controlled.

Andreza Araujo's safety-leadership perspective places this gap between declared commitment and operating evidence at the center of transformation work. Leaders build credibility when they protect the time, competence, and authority required to act on weak signals before the process becomes unrecoverable.

Conclusion: treat organizational distance as a process hazard

Longford remains relevant because the event did not depend on one dramatic act of disregard. It emerged from a process condition that the operating system did not recognize well enough, supported by gaps in procedures, abnormal-operation training, alarm prioritisation, engineering presence, management of change, and process-safety governance.

That pattern gives safety leaders a concrete test. When the process leaves its normal state, can the people closest to it identify the hazard, reach competent support, make the stop decision, and isolate the energy before the consequence expands? If not, the leadership system is already part of the exposure.

Headline Podcast examines the decisions behind safer work. Explore Headline Podcast for more practical analysis of safety leadership and incident investigation.