Steam pipe maintenance: why closing a valve does not prove safe isolation

A small gasket opens a process boundary

At Kettleby Foods in Melton Mowbray, a company employee and a contractor were replacing a leaking gasket on an isolation valve in steam pipework in a boiler room. A gantry did not reach the work position, so both stepped off it and worked on top of the boiler. When the gasket was removed, hot water from the pipework splashed both workers and scalded them. The UK Health and Safety Executive reported the case on 16 September 2026. Samworth Brothers Ltd was fined £594,000.

The HSE found failures in task risk assessment, a documented safe system, suitable isolation and lock-off procedures, protection for work at height, supervision and monitoring. Its release does not establish that a valve was closed, the operating pressure or temperature, the exact source of water, drain positions or the system diagram. The headline asks a general engineering question; it does not reconstruct the accident.

Can closing a valve alone make a line safe? Not necessarily. A safe line opening requires a defined isolation boundary, all sources controlled, residual inventory removed or contained, and the condition proved before intrusive work. One zero reading on a pressure gauge cannot establish the temperature and pressure of every trapped pocket.

Shutdown, isolation, lock-off and verification are different

Stopping production does not necessarily empty a hot, pressurised pipe. Isolation separates the work section from every possible feed. Lock-off controls inadvertent operation of the isolation devices. Depressurising, draining, venting and cooling address what remains within the boundary. Verification tests whether the required state has actually been achieved and will persist while the work proceeds.

A valve may pass internally, be the wrong tagged valve, receive pressure from a reverse route or trap inventory between boundaries. Condensate can retain dangerous heat without visible steam. A gauge may be faulty or remote from the pocket that will be opened. Each observation must be related to the actual section and its credible sources, rather than used as a universal 'zero energy' certificate.

Where hazardous energy remains

Look beyond the steam supply: bypasses, interconnections, return lines, adjacent equipment, condensate in low points, thermal expansion of trapped fluid and operating changes can reintroduce pressure or heat. Leakage through an isolation device can allow pressure to reaccumulate. Elevation and a liquid column may also matter. A quiet pipe is not necessarily depressurised; one cool surface does not establish the temperature everywhere.

The US OSHA overview lists thermal and other hazardous energies and illustrates a steam valve being turned on while a downstream joint is under repair. This is a useful comparison, not evidence of what happened in Melton Mowbray and not a statement of UK or Brazilian law. Identify the type and magnitude of energy for the actual system.

Draw the isolation boundary before line breaking

Line breaking is an intentional breach of process containment to remove a flange, gasket, valve or spool. Locate the exact opening point on current drawings and in the field. Trace upstream and downstream feeds, bypasses, drains, vents and connections that another crew might operate. A walkdown reconciles tags and physical positions with the isolation certificate and permit-to-work.

HSE's HSG253 covers isolation planning, documentation, selection of isolation standard, draining and venting, and proof before intrusive work. Written principally for oil and gas, chemicals and pipelines, it offers broadly applicable process-isolation principles. The chosen boundary and method depend on the fluid, pressure, temperature, likelihood and consequence of release, reliability of devices and ability to prove the result. HSG253 is not Brazilian legislation.

Single isolation, double block and bleed, positive isolation

Single isolation relies on one barrier where the engineering assessment permits it and addresses leakage and inadvertent operation. Double block and bleed uses two block points with an intermediate bleed or test point, subject to the actual design. Positive isolation may physically separate the source using a spectacle blind, spade, blind flange or removed spool where appropriate. The label alone does not prove correct installation or performance.

No one arrangement is mandatory for every steam intervention. A bleed or drain must lead to a safe place and communicate with the relevant trapped volume. A drawing showing a nozzle is not proof that it can establish the condition at the gasket. Competent personnel must select, document, execute and test the arrangement appropriate to the specific work.

Prove the state and manage the first opening

Before removing a gasket, verify that specified isolation points are effective, stored energy has been relieved or controlled and dangerous reaccumulation will be detected or prevented. Representative pressure readings, suitable drain or vent checks and functional tests may be part of the method, depending on design. Know the instrument's limitations and what each test point actually communicates with. OSHA 29 CFR 1910.147 addresses relief and possible reaccumulation of stored energy and verification of isolation in the US context.

The first controlled opening remains a hazard: plan stable access, personnel positions outside the likely release path, an exclusion area, tools and emergency response. If unexpected fluid, heat or pressure appears, stop and reassess. This article is a framework for competent assessment, not an executable line-breaking procedure.

Permit-to-work is a shared map

A permit-to-work and isolation certificate connect operations, maintenance and area control. They identify the equipment, tags, isolation boundary, lock-offs, tests, residual hazards, authorisation and reinstatement conditions. Workers should confirm the physical devices and understand who can change them. Signatures without a field check are weak evidence.

Supervision must test whether the planned work is physically feasible. If the planned gantry cannot reach a gasket, access and method require reassessment before people improvise a position. Shift handover must transfer the state of isolation, open points, tests and permit limits. During reinstatement, account for gaskets, flanges, temporary blinds, drains, vents and valves before a controlled return to service.

Access creates a second risk

In the reported case, the gantry failed to provide access and the workers moved onto the boiler. Exposure to hot water and a fall hazard existed together. A safe system must provide suitable access and fall controls without forcing a maintenance crew into an unplanned position to reach the component.

Brazil's NR-35 is only relevant to a comparable Brazilian activity if its specific work-at-height scope is met. It did not govern this UK incident. Risk assessment must bring process energy and physical access into one practical work method.

Brazilian context: the actual reach of NR-13

Brazilian NR-13 cannot be applied wholesale to every steam pipe. Item 13.2.1(e) describes its piping scope in terms of class A or B fluids connected to covered boilers or vessels, while its fluid classification lists water vapour as class C. Crucially, item 13.2.2(q) expressly excludes piping operating with steam, subject to item 13.6.2.6. That specific provision requires water-steam piping and accessories to be kept in good operational condition according to the establishment's maintenance plan.

The exclusion does not mean ignoring dangerous pressurised systems: item 13.2.3 addresses inspection and maintenance of excluded systems posing risk, with responsible technical oversight and reference to manufacturers, codes and applicable standards. Do not impose the entire 13.6 inspection programme on every steam line. Where piping actually falls within NR-13 scope, the inspection plan considers fluid, working pressure and temperature, anticipated damage mechanisms and failure consequences. Brazilian NR-01/GRO addresses occupational risk management for the activity. None of these Brazilian provisions governed the UK enforcement action.

Brazilian NR-13 and integrity guide — in Portuguese →

Questions before authorising line opening

These are review prompts for a competent site team, not an isolation certificate or operating sequence.

A different hazardous-energy case: conveyors — in Portuguese →

• Is the exact work section and opening point identified by equipment and tag in the field?
• Are fluid, actual pressure, temperature and operating state known?
• Have all feeds, returns, bypasses and trapped pockets been traced?
• Has the isolation boundary and standard been selected for the risk?
• Are devices locked and access controlled under the site's procedure?
• Have necessary draining, venting, purging and cooling been carried out to safe destinations?
• Could condensate, leakage or operating changes reintroduce energy?
• Does the proof method represent the section to be opened and the instrument limitations?
• Are access, body position, exclusion zone, tools and response planned?
• Are permit, certificate, supervisors and shift handover unambiguous?
• Will a scope change stop work and trigger reassessment?
• Are reinstatement and controlled return to service planned?

Make the isolation physically credible

The size of the gasket does not measure the risk: removing it opens a process boundary. Drawings, physical access, documentation, execution, proof and supervision have to agree. The HSE reported several failures but did not publish enough data to assign the scalding to a particular valve position or single leakage mechanism.

Andrade Safe supports mechanical engineering, integrity, maintenance and NR-13-related technical assessments in Brazil within the agreed scope. Start with the actual system, opening point and credible energy sources; then choose proportionate controls.

Mechanical integrity and NR-13 services in Brazil — in Portuguese →