Why recurring accidents cannot be explained as individual error

Steelworks CO poisoning is not an accident caused by missing a smell: CO is colorless and odorless, may remain in process gas, and accidents arise when gas networks, valves, pressure changes, maintenance, and poorly ventilated work locations fail together.

A 2021 Korea Occupational Safety and Health Agency case involved two contractor workers who reported dizziness after blast-furnace cooling-water piping work. The investigation identified delayed crack repair, work without respiratory protection at high CO concentration, no stop-work action, inadequate risk assessment, and failure to manage the location as a confined space.

Prevention must therefore go beyond telling people to be careful with CO. It requires examining, by process, where CO is generated and travels and how protective layers fail when conditions depart from normal operation.

CO is a gas present within the process, not an abnormal by-product

In a blast furnace, carbon sources such as coke and pulverized coal provide heat and participate in reduction that removes oxygen from iron ore. worldsteel explains that, in the traditional blast-furnace/basic-oxygen route, coke is iron ore’s main reducing agent and fuel. During reduction, CO is an important process constituent that reacts with iron oxides, and remaining blast-furnace gas may, after dust collection and cleaning, be reused as fuel for hot-blast stoves, boilers, or other heating processes. Thus, the CO hazard is not confined to one point inside the furnace; it extends to multiple plant areas through gas-recovery and supply networks.

CO is not confined to blast furnaces. Coke-oven gas from coke making, basic-oxygen-furnace gas produced when the carbon content of hot metal is lowered in a converter, and off-gas produced in an electric arc furnace when carbon and oxygen are introduced for decarburization or slag formation also require management. A NIOSH report on a blast furnace at one steelworks described how blast-furnace gas at that time could contain a high proportion of CO, and documented both direct-reading instruments in work areas exceeding their upper measurement limit and increased blood carboxyhemoglobin in workers after a shift. The specific figures from this older investigation cannot be generalized to every steelworks today, but the point that process gas itself is both a substantial potential energy source and an inventory of toxic material remains important.

The starting point is not that leaks are rare, but that process equipment may always contain high-concentration gas that people cannot readily detect by their senses if it leaks. Rather than assuming the source is absent, safety management should be designed to contain CO that is normally present securely and to isolate it before it reaches people when something goes wrong.

Invisible exposure obscures symptoms and judgments about place

The NIOSH Pocket Guide describes CO as a colorless, odorless gas. It has no sensory warning signal—such as eye irritation or a distinctive odor—that immediately signals danger. Headache, dizziness, nausea, and fatigue that can occur early in an exposure are also easily mistaken for heat, dehydration, lack of sleep, or strenuous work. If a worker notices something is wrong but assumes rest will make it better, leaving the exposure area and warning coworkers may be delayed.

CO has a relative gas density similar to that of air. Sampling locations therefore cannot be determined by a one-sentence rule such as “it is light, so it always rises” or “it is heavy, so it accumulates only in pits.” Concentration patterns continually change with the rise of hot process gas, flow after cooling, the shape of equipment and buildings, wind, exhaust and supply fans, open doors, and local heat sources. At locations where air is not readily exchanged—such as upper-furnace platforms, pipe galleries, stairwells, cable pits, around dust-collection and gas-cleaning equipment, ducts, and shafts—hazardous air can form at a worker’s breathing zone.

A normal value obtained at one point before entry does not assure conditions throughout the job. OSHA’s confined-space atmospheric-testing procedures distinguish testing to evaluate hazards in a space from testing to verify actual entry conditions, and direct sampling along the direction of travel and the surrounding area where stratification is possible. An instrument must draw a sample for the response time specified by its manufacturer. At a steelworks, valve operations, fan starts and stops, changes in furnace pressure, removal of deposits, and opening piping can change the atmosphere, so continuous monitoring is close to a governing principle for work in which conditions change.

Pressure and flow changes create unexpected leak paths

After being generated in the furnace, steelworks process gas passes through hoods, uptakes, dust-collection and cleaning equipment, blowers, gas holders, and fuel piping. This system operates through pressure differentials and flow. A small gap that drew air inward in normal conditions can become a leak source that sends gas outward when operating conditions change and the system becomes positively pressurized. Conversely, rapid depressurization or increased exhaust can draw gas from another area into the work location. Gas follows pressure gradients more than the boundaries on equipment drawings.

Many events can create such change. Charging and tapping, adjustments to oxygen or pulverized-coal injection, burner operation, damper switching, dust-collection-fan trips, load changes at gas users, changes in gas-holder level, purging and bleeding, emergency shutdowns, and restarts all alter system balance. OSHA material on CO explosion hazards in electric arc furnaces also emphasizes the relationship among oxygen-injection rate, positive furnace pressure, and off-gas analysis and control. Its focus is explosion prevention, but its point that CO generation and pressure conditions are not fixed values and can change rapidly with operating actions can also inform toxic-exposure management.

A work permit should therefore record not only the “current concentration” but also the process state at the time of measurement. It should confirm which fans and dampers are operating, whether gas users are scheduled to change, whether furnace pressure and the gas holder are stable, and whether adjacent work will operate valves. If process conditions change after the permit is issued, the previous readings and permit conditions must be reassessed.

Maintenance deliberately opens a contained system

During normal operation, flanges, valves, water seals, expansion joints, furnace shells, and ducts contain CO. Maintenance is work that dismantles these boundaries or approaches them closely. Faults with major production consequences—such as cooling-water leaks, cracks, or stuck valves—can create pressure for temporary repairs and rapid restoration. If the work scope expands little by little while equipment is not fully shut down, the initial risk assessment and actual exposure conditions can diverge.

In the Korea Occupational Safety and Health Agency accident case, routine scheduled repair of a furnace-shell crack had been delayed, and required protective measures and stop-work action were not carried out even though high CO was measured at the cooling-pipe replacement location. The risk assessment identified toxic-gas leakage, but the control stopped at wearing a gas detector. A meter warns of danger; it is not an engineering control that stops a leak or keeps workers in breathable air.

Before maintenance, energy and gas sources should be physically isolated. Where possible, the team should consider robust isolation appropriate to site criteria, such as a blind or a verified double-block-and-bleed arrangement, rather than relying only on a shutoff valve. After emptying and purging piping, residual CO and oxygen conditions must be confirmed, and isolation points, discharge points, and purge direction compared with drawings and the field. Lockout and tagout, shift handover, and communication between the central control room and the responsible person in the field must prevent another department from reopening a valve or starting a fan during the work.

When contractors perform the work, the host employer must provide information on process changes and adjacent systems and confirm that workers understand the actual alarm and evacuation criteria. It must be more specific than a general notice that “gas may be released”: it should state at which alarm to stop immediately, which direction to leave, and who will isolate the process.

Confined spaces are not limited to the inside of tanks

A dangerous misconception in steelworks CO incidents is to treat only tanks or vessels that people fully enter as confined spaces. Outer platforms of the blast-furnace structure, narrow areas between walls and equipment, semi-open buildings, underground pits, cable tunnels, the lower portions of dust collectors, and inspection routes around gas piping can also retain hazardous gas when access is restricted and natural ventilation is inadequate. The fact that people do not normally remain there is not evidence of safety; it can instead cause a hazardous space to be overlooked.

The Korea Occupational Safety and Health Agency investigation also found that the inside of the blast-furnace structure was managed as a confined space, while the accident location was omitted from the list despite its potential to retain CO. Fixing a space list by building name makes it difficult to reflect ventilation blind spots newly created by equipment modifications, temporary shields, sound barriers, tarpaulins, scaffold sheeting, or temporary maintenance structures. Spaces should be reclassified not only during regular inspections but also before and after major overhauls and equipment changes.

Entry management must combine pre-entry testing, continuous monitoring during work, forced ventilation, an attendant, communication, stop-work authority, and a rescue plan. Ventilation air must come from an uncontaminated location, and discharged gas must not return to another work area or an air intake. Because an improvised rescue in which an unprotected coworker enters after an alarm can cause a chain of poisonings, non-entry rescue means and a trained rescue team must be prepared before work begins.

The misconception that more alarms always mean greater safety

Fixed detectors and portable instruments are key protective layers in CO management, but the existence of an alarm is different from an alarm functioning effectively. If a sensor’s measurement range is lower than the actual leak concentration, its display can remain at the upper limit and fail to distinguish the scale of danger. Calibration drift, a blocked inlet, low battery power, an incorrect sampling location, delay from a long hose, and an end-of-life sensor can also slow response. OSHA advises using portable direct-reading instruments in accordance with manufacturer instructions, performing a functional (bump) test or verifying calibration before use, fully calibrating equipment that is outside the allowable range, and removing failed equipment from service.

Another problem is alarm fatigue. If the same alarm sounds during repeated small leaks, sensor contamination, unsuitable setpoints, or process transitions and then returns without action, workers can easily begin to treat it as background noise. The UK HSE’s alarm-management principles explain that every alarm should be useful and relevant, have a defined response, and allow time to respond before the situation worsens. It is more important to make clear what action each alarm requires than simply to add more alarms.

Alarm history should be managed as safety-performance information. Track recurrent or standing alarms, alarms suppressed for long periods without authorization, alarms that received no response, and locations that recur from shift to shift. A high-concentration alarm must not mean “approach to confirm conditions”; it should mean evacuate first and stabilize the process remotely. Alarm priority, the cause at first occurrence, automatic shutdown and ventilation links, evacuation broadcasts, and portable-device alarms in the field should be integrated so they do not conflict, and regular drills should verify actual response times and communication.

A control strategy that places protective layers before people

worldsteel describes process safety as the combination of engineering, operational, and management capabilities used to prevent toxic releases, fires, explosions, and similar events caused by loss of containment of hazardous materials and energy. CO-poisoning prevention needs the same perspective. Personal monitors and protective equipment are the final protective layers; equipment integrity and automatic protection must come before them.

  • Set inspection intervals for furnace shells, ducts, piping, water seals, valves, and joints according to risk, and connect trends in cracking, thickness, corrosion, and leakage to the maintenance plan.

  • Place fixed CO detectors to reflect expected leak sources, actual airflow, and worker travel paths, and monitor power and communication failures as well.

  • Review furnace pressure, fans, dampers, gas holders, and off-gas analysis together to identify abnormal signs and, where necessary, link alarms to ventilation, fuel shutoff, and process-shutdown interlocks.

  • Before maintenance, verify isolation, depressurization, discharge, purging, and concentration confirmation in sequence; if process conditions change, suspend the permit and reissue it.

  • Ensure portable instruments have a range and response time that cover expected concentrations, and maintain records of pre-use functional testing, periodic calibration, sensors, batteries, and filters.

  • Train workers and contractors not only to recognize symptoms but also on stop-work actions for each alarm, wind-aware evacuation routes, assembly, reporting, and criteria barring re-entry.

  • For work where isolation and ventilation cannot assure a safe atmosphere, apply supplied-air respirators or self-contained breathing apparatus (SCBA), standby, and rescue arrangements based on the risk assessment. Qualified experts must select the actual equipment according to concentration, work conditions, Korean law, and respirator-selection criteria.

Managers should look beyond the number of accidents to leading indicators. When overdue leak repairs, repeated CO alarms, calibration failures, process-condition changes during a permit, omitted confined-space listings, incomplete contractor training, and communication delays identified in emergency drills accumulate, protective layers have already weakened before an accident occurs.

Questions to ask during a site inspection

  1. Do we know the current piping and pressure boundaries from the points where blast-furnace, basic-oxygen-converter, coke-oven, and electric-arc-furnace gases are generated through to their final use?

  2. Has the risk assessment included worst-case scenarios not only for normal operation but also for startup, shutdown, trips, purging, gas switching, and major overhauls?

  3. Even when an accident location is not on the list, do we reassess it as a confined space on the basis of restricted access and inadequate ventilation?

  4. Do the instruments’ range and response time, and the locations of fixed sensors, match the leaks actually expected and the airflow?

  5. For every recurring alarm, do we close out the cause and action, or do we ignore or suppress it without authorization or a deadline?

  6. If fans, dampers, valves, or furnace pressure change after a work permit is issued, who stops the work and reassesses the permit?

  7. Do contractor workers understand that, during a high-concentration alarm, they must evacuate immediately rather than approach to confirm conditions?

  8. When rescue is needed, can we prevent unprotected coworkers from entering and activate a professional rescue system?

Conclusion: the point of breaking recurrence is the interface between process and work

Steelworks CO poisoning recurs because CO may be continuously present in the process, pressure and flow in gas networks change, maintenance opens containment boundaries, and limited spaces outside tanks can also be contaminated. When a hazard that cannot be sensed is left to meters and alarms recur, human response capacity also weakens. These conditions are not independent of one another.

Preventing recurrence does not begin by telling workers to be more careful. Equipment integrity, process state, space classification, isolation and ventilation, instrument performance, the meaning of alarms, work permits, and information-sharing with contractors must be connected as one system. The strongest control is not to let people inhale CO and then hear an alarm; it is to detect leaks in advance, stop the gas, and keep people from entering the hazardous area.

Sources

Cover photo

Original photo from Pexels