U.S. CHEMICAL SAFETY AND HAZARD INVESTIGATION BOARD

INVESTIGATION REPORT 

LPG FIRE AT VALERO – MCKEE REFINERY

(Four Injured, Total Refinery Evacuation, and Extended Shutdown) 

Photo: Associated Press 

VALERO ENERGY CORPORATION

SUNRAY, TEXAS

FEBRUARY 16, 2007 

KEY ISSUES: 

• FREEZE PROTECTION OF DEAD-LEGS

• EMERGENCY ISOLATION OF EQUIPMENT

• FIREPROOFING OF SUPPORT STEEL

• FIRE PROTECTION FOR HIGH PRESSURE LPG SERVICE

• CHLORINE RELEASE

REPORT NO. 2007-05-I-TX 

JULY 2008
Valero - Sunray July 2008 

Contents 

EXECUTIVE SUMMARY ..........................................................................................................................6

1.0 INTRODUCTION .........................................................................................................................10

1.1 Background.......................................................................................................................10

1.2 Investigative Process.........................................................................................................10

2.0 VALERO ENERGY CORPORATION.........................................................................................11

2.1 Company History..............................................................................................................11

2.2 McKee Refinery................................................................................................................11

2.3 Propane Deasphalting (PDA) Unit....................................................................................12

3.0 INCIDENT DESCRIPTION..........................................................................................................15

3.1 The Incident ......................................................................................................................15

3.2 Injuries..............................................................................................................................16

3.3 Emergency Response and Refinery Evacuation ...............................................................16

3.4 Aftermath..........................................................................................................................17

3.5 Near-Miss Events..............................................................................................................18

4.0 INCIDENT ANALYSIS................................................................................................................20

4.1 Incident Sequence .............................................................................................................21

4.2 Dead-Leg Freeze Protection .............................................................................................25

4.3 Fireproofing ......................................................................................................................29

4.4 Emergency Isolation and Shutdown .................................................................................33

5.0 NEAR-MISS ANALYSIS .............................................................................................................35

5.1 Chlorine Release ...............................................................................................................36

5.2 Butane Sphere Deluge Valves ..........................................................................................38

6.0 PROCESS HAZARD ANALYSIS (PHA) ....................................................................................41

2
Valero - Sunray July 2008 

3

7.0 REGULATORY ANALYSIS........................................................................................................43

7.1 OSHA Process Safety Management .................................................................................43

7.2 EPA Risk Management Program (RMP)..........................................................................43

7.3 Regulatory Enforcement History ......................................................................................44

8.0 ROOT AND CONTRIBUTING CAUSES....................................................................................45

8.1 Root Causes ......................................................................................................................45

8.2 Contributing Causes..........................................................................................................45

9.0 RECOMMENDATIONS...............................................................................................................46

10.0 REFERENCES ..............................................................................................................................49

APPENDIX A. FLOW DIAGRAM .....................................................................................................51

APPENDIX B INCIDENT TIMELINE..............................................................................................52

APPENDIX C PIPING ELBOW FAILURE ANALYSIS..................................................................54

APPENDIX D. INITIAL PROPANE RELEASE RATE.....................................................................57

APPENDIX E. RESPONSE OF STRUCTURAL STEEL TO FIRE HEATING................................59

APPENDIX F: EVENT TREE.............................................................................................................61
Valero - Sunray July 2008 

4

Figures 

Figure 1. PDA unit location in McKee Refinery ........................................................................................13

Figure 2. No. 1 Extractor simplified process flow diagram.......................................................................14

Figure 3. Approximately 90 seconds after ignition (from surveillance video)..........................................16

Figure 4. Aerial photograph of damage from the PDA fire .......................................................................19

Figure 5. Propane mix control station schematic (not to scale).................................................................21

Figure 6. Crack in the 10” diameter propane mix control station inlet elbow...........................................23

Figure 7. Downstream view of propane mix control station inlet block valve ..........................................24

Figure 8. Damaged 10” propane inlet on Extractor No. 1 .........................................................................25

Figure 9. Pipe bridge support fireproofing.................................................................................................30

Figure 10. Extractor towers (upper right) and collapsed pipe rack............................................................31

Figure 11. Distances between the E-W pipe rack supports and the extractors ..........................................32

Figure 12. Insurer-recommended locations for ROSOVs..........................................................................33

Figure 13. Ruptured one-ton chlorine container.........................................................................................38

Figure 14. Heat-damaged coating on sphere and location of sphere deluge valves...................................39
Valero - Sunray July 2008 

5

Acronyms and Abbreviations 

AIChE American Institute of Chemical Engineers 

API American Petroleum Institute 

BPD barrels per day (100 BPD = 2.92 gallons per minute) 

CCPS Center for Chemical Process Safety 

CFR Code of Federal Regulations 

CSB U.S. Chemical Safety and Hazard Investigation Board 

DAGO DeAsphalted Gas Oil 

DCS distributed control system 

EIV emergency isolation valve 

EHS extremely hazardous substance 

EOC Emergency Operations Center 

EPA U.S. Environmental Protection Agency 

EPCRA Emergency Planning and Community Right-to-Know Act 

ERPG Emergency Response Planning Guideline 

IChemE Institute of Chemical Engineers (UK) 

IDLH immediately dangerous to life or health 

LPG liquefied petroleum gas 

MOC Management of Change 

NPRA National Petrochemical and Refiners Association 

NWS National Weather Service 

OSHA Occupational Safety and Health Administration 

PDA Propane DeAsphalting Unit 

PEL permissible exposure limit 

PHA Process Hazard Analysis 

psi pounds per square inch (1 psig = 6.89 kPa) 

PSM Process Safety Management (OSHA) 

RMP Risk Management Program (EPA) 

ROSOV Remotely Operable Shut-Off Valve 

TCEQ Texas Commission on Environmental Quality 

UDS Ultramar Diamond Shamrock 
Valero - Sunray July 2008 

6

 

EXECUTIVE SUMMARY 

On February 16, 2007, a liquid propane release from cracked control station piping resulted in a massive 

fire in the propane deasphalting (PDA)1

 unit at Valero’s McKee Refinery near Sunray, Texas, injuring 

three employees and a contractor. The fire caused extensive equipment damage and resulted in the 

evacuation and total shutdown of the McKee Refinery. The refinery remained shut down for two months; 

the PDA unit was rebuilt and resumed operation nearly one year after the incident. Direct losses 

attributed to the fire were reported to exceed $50 million.2

The following are key findings of the Chemical Safety Board’s (CSB) investigation: 

1. The propane release was likely caused by the freeze-related failure of high-pressure piping at 

a control station that had not been in service for approximately 15 years. The control station 

was not isolated or freeze-protected but left connected to the process, forming a dead-leg.3

 

Water in the propane accumulated in the low point formed by the control station and froze 

during cold weather prior to the incident, cracking an inlet pipe elbow. Ice sealing the failed 

pipe from the process melted as the air temperature rose on the day of the incident, releasing 

4,500 pounds per minute of liquid propane, which ignited. 

2. The refinery did not conduct a management of change4

 review when the control station was 

removed from active service in the 1990s. Consequently, the freeze-related hazards of the 

1

 The McKee propane PDA unit uses liquid propane as a solvent to separate gas oil from asphalt. The gas oil is fed 

to other units in the refinery for further processing. The asphalt is sold as paving material. 

2

 RMP submittal, December 2007. 

3

 A dead-leg is a section of piping connected to the process that has no flow through it. 

4 Management of change is a systematic method for reviewing the safety implications 

of modifications to process technology, facilities, equipment, chemicals, organizations, policies, and standard 

operating practices and procedures. 
Valero - Sunray July 2008 

7

 

dead-leg formed by the control station were not identified or corrected when the change was 

made. 

3. The McKee Refinery’s freeze protection practices did not ensure that process units were 

systematically reviewed to identify and mitigate freezing hazards for dead-legs or 

infrequently used piping and equipment. 

4. American Petroleum Institute (API)5

-recommended safety practices for oil refineries do not 

provide detailed guidance on freeze protection programs, nor do they sufficiently stress freeze 

protection of dead-legs, or of infrequently used piping and equipment. 

5. The rapidly expanding fire prevented field operators from closing manual isolation valves or 

reaching local pump controls to isolate the high-pressure propane being vented to the 

atmosphere. Control room operators were unable to shut off the flow of propane because 

remotely operable shut-off valves (ROSOVs)6

 were not installed in the PDA. The lack of 

remote isolation significantly increased the duration and size of the fire, resulting in extensive 

damage to the PDA, the main pipe rack, and an adjacent process unit. 

6. API provides safety guidance for the use of ROSOVs in LPG storage installations, but does 

not address their use in refinery process units handling large quantities of flammable 

materials. Valero internal standards require the use of ROSOVs in such process units, but the 

McKee Refinery had not retrofitted them in the PDA unit. 

5

 The API, an industry trade group, publishes recommended practices and standards widely used in the refining 

industry. 

6

 ROSOVs, also called emergency isolation valves (EIVs), are equipped with actuators and are configured to be 

quickly and reliably operated from a safe location, such as a well-sited control room. 
Valero - Sunray July 2008 

8

 

7. Flame impingement on a non-fireproofed structural support caused a pipe rack to collapse, 

significantly increasing the size and duration of the fire, and led to the evacuation and 

extended shutdown of the refinery. 

8. API-recommended practices and Valero standards for fireproofing do not provide sufficiently 

protective guidance for fireproofing distance for pipe racks near process units containing 

high-pressure flammables. 

9. The exposure of three one-ton chlorine containers to radiant heating from the fire led to the 

release of approximately 2.5 tons of highly toxic chlorine,7

 which was used as a biocide in an 

adjacent cooling tower. Biocides that are inherently safer than chlorine are available. 

10. A butane storage sphere was exposed to radiant heating that blistered its paint. The manual 

firewater deluge valve for the butane sphere was located too close to the PDA unit and could 

not be opened during the fire. 

11. API-recommended practices do not require the evaluation of hazards posed by adjacent 

process units when specifying the design, operation, or location of firewater deluge valves. 

12. The McKee Refinery’s Process Hazard Analysis was ineffective in identifying and addressing 

the 

• risk of pipe failure due to freezing, 

• need for ROSOVs in the PDA unit to rapidly isolate LPG releases, and 

• hazards posed by fire exposure to neighboring equipment, including the chlorine ton 

containers and the butane storage sphere. 

7

 Chlorine has a permissible exposure limit (PEL) of 1.0 ppm, and is listed by the Environmental Protection Agency 

(EPA) as an extremely hazardous substance (EHS). 
Valero - Sunray July 2008 

9

This CSB report identifies root and contributing causes, and makes recommendations to Valero Energy 

Corporation, Valero–McKee Refinery, the API, the United Steelworkers Union, and Steelworkers Local 

13-487. 
Valero - Sunray July 2008 

10

PG) 

 

1.0 Introduction 

1.1 Background 

At 2:09 p.m. on Friday, February 16, 2007, liquid propane under high pressure was released in the 

Propane De-Asphalting (PDA)1

 unit of Valero’s McKee Refinery, 50 miles north of Amarillo in the 

Texas panhandle, near the town of Sunray. The resulting propane vapor cloud found an ignition source, 

and the subsequent fire injured workers, damaged unit piping and equipment, and collapsed a major pipe

rack. The fire grew rapidly and threatened surrounding units, including a Liquefied Petroleum Gas (L

storage area. Fire-fighting efforts were hampered by high and shifting winds and the rapid spread of the 

fire. A refinery-wide evacuation was ordered approximately 15 minutes after the fire ignited. 

Three of the four workers injured were seriously burned, including a contractor. The refinery was 

completely shut down for just under two months, and operated at reduced capacity for nearly a year. 

Because of the serious nature of this incident, the U.S. Chemical Safety and Hazard Investigation Board 

(CSB) launched an investigation to determine root and contributing causes and to make recommendations 

to help prevent similar incidents. 

1.2 Investigative Process 

The CSB investigators arrived at the McKee Refinery the morning of Sunday, February 18, 2007. The 

CSB interviewed Valero and contractor personnel, reviewed company documents and data from the PDA 

unit’s computerized control system, examined physical evidence, and tested valves and piping 

components. The CSB investigation team was aided by experts in metallurgical analysis and highpressure flow testing. The investigation focused on the refinery’s programs to identify and address 

1

 The McKee PDA unit uses liquid propane as a solvent to separate gas oil from asphalt. The gas oil is fed to other 
Valero - Sunray July 2008 

11

 

process hazards, and on the fire protection measures used in and around the PDA unit. Investigation 

activity was coordinated with the U.S. Occupational Safety and Health Administration (OSHA); the U.S. 

Environmental Protection Agency (EPA); and the Texas Commission on Environmental Quality (TCEQ). 

2.0 Valero Energy Corporation 

2.1 Company History 

Valero Energy Corporation was formed in 1980 as a natural gas-gathering company2 based in San 

Antonio, Texas. In the early 1980s, the company began expanding into the refining industry, and in 1997, 

separated its refining and marketing businesses into an independent company under the Valero name. 

Valero Energy expanded rapidly in the late 1990s and early 2000s, as it acquired 16 U.S. refining 

facilities, as well as plants in Quebec, Canada; and Aruba. Valero Energy became North America’s 

largest refiner in 2005, operating 18 refineries3

 with capacity of approximately 3.3 million barrels per day 

(bpd). In 2006 the company had assets of approximately $33 billion; annual revenues of $91.8 billion; 

and 21,800 employees.4

2.2 McKee Refinery 

The McKee Refinery in Sunray, Texas, was built in 1933 by Shamrock Oil and Gas Company.5 Major 

unit upgrades were made in the 1950s, 1990s, and, most recently, in 2004. The refinery became part of 

units in the refinery for further processing. The asphalt is sold for use in paving materials. 

2

 Gathering companies consolidate gas production from many natural gas wells into one or more large production 

pipelines for treating and distribution. 

3

 This number includes two separate plants (east and west) at one physical location. Since the February 2007 

incident, Valero has divested its Lima, Ohio, refinery, bringing Valero’s total to 17. 

4

 Dunn & Bradstreet, Directory of Corporate Affliations, s.v. “Valero Energy Corporation,” dated Dec. 11, 2007, 

accessed Dec. 13, 2007. 

5 Handbook of Texas Online, s.v. "Diamond Shamrock." 

http://www.tshaonline.org/handbook/online/articles/DD/hed6.html, accessed Jan. 2, 2008. 
Valero - Sunray July 2008 

12

 

Valero in late 2001 when Ultramar Diamond Shamrock (UDS), the previous owner, merged with Valero 

Energy. 

On July 29, 1956, the McKee Refinery experienced a tragic workplace accident when a light hydrocarbon 

storage vessel failed catastrophically during a fire, resulting in the deaths of 19 emergency responders. 

The refinery processes 170,000 barrels of crude oil per day, and distributes its products by pipeline to 

customers in Texas, New Mexico, Arizona, Colorado, and Oklahoma. 

2.3 Propane Deasphalting (PDA) Unit 

The PDA unit (Figure 1) recovered fuel feedstock and paving-grade asphalt from the heavy bottoms 

(pitch6

) produced in the refinery’s vacuum crude oil fractionator. In the McKee PDA process, two 

liquid/liquid extraction towers used liquid propane as a solvent to extract gas oil7

 from the pitch under 

approximately 500 pounds per square inch (psi)(3,447 kPa) pressure. The recovered gas oil was 

processed into gasoline in another refinery unit. The asphalt produced was sold for use in paving 

materials. Figure 2 is a simplified process flow diagram for the No. 1 Extractor, including the location 

from which the propane was initially released. 

6

 Pitch is the heavy, viscous material discharged from the bottom of the vacuum fractionator after the lighter 

fractions have been removed – the heaviest hydrocarbon mixture produced from crude oil in the refinery. 

7

 Gas oil is a hydrocarbon mixture with molecular weight and viscosity somewhat higher than diesel. 
Valero - Sunray July 2008 

13

Figure 1. PDA unit location in the McKee Refinery 

The relatively dense pitch entered an upper section of the extractor and flowed to the bottom of the tower. 

Less dense liquid “wash” propane entered a lower section and flowed to the top of the extractor. Internal 

structures in the tower promoted effective contact between the two streams. DeAsphalted Gas Oil 

(DAGO) extracted from the pitch flowed out of the top of the tower with much of the propane. This 

liquid flowed through a series of flash drums8

 to remove propane from the gas oil. The DAGO was sent 

elsewhere in the refinery for processing. 

A mixture of asphalt and propane flowed from the bottom of the extractor. This stream was also heated 

and flashed to remove entrained propane, and the asphalt sent to storage. 

 

8

 This is referred to as “flashing,” in which the pressure of a liquid mixture is suddenly reduced, causing light 

materials to vaporize, or “flash off,” separating them from heavier liquid components. 
Valero - Sunray July 2008 

14

Figure 2. No. 1 Extractor simplified process flow diagram 

Propane from the various flashing steps was condensed and sent to either the low- or high-pressure 

accumulators. Propane from both accumulators was pressurized by pumps, blended for temperature 

control, and recycled to the extractors. A small amount of makeup propane (about 0.5 percent of the 

circulating propane rate) entered the low-pressure accumulator to replace losses. Operators told the CSB 

investigators that the makeup propane contained a variable amount of entrained water, which was 

regularly drained from the low points on the accumulators.9

 Appendix A contains a more detailed 

process flow diagram of the PDA unit showing the major process flows and drainage points. 

 

9

 Many refinery streams normally contain small amounts of water. 
Valero - Sunray July 2008 

15

 

3.0 Incident Description 

3.1 The Incident 

On Friday, February 16, 2007, at approximately 2:09 p.m.,10 plant personnel and contractors working in 

the PDA unit heard a “pop,” and saw what appeared to be steam blowing from a control station near 

ground level at the No. 1 Extractor tower. Plant personnel quickly determined that the escaping cloud 

was propane and directed workers in the area to evacuate. 

The propane escaping from the high-pressure system formed a vapor cloud that traveled downwind 

toward the boiler house, where it likely ignited.11 The flames flashed back to the leak source. 

Surveillance video (Figure 3) shows the fire developing rapidly as flames impinged on piping around the 

No. 1 Extractor, releasing additional propane. 

A steel support column on the east/west (E-W) pipe rack was impacted by a high-pressure propane jet 

fire. The column, which was not protected by fireproofing insulation, buckled, collapsing the rack and 

causing multiple pipe failures. Liquid petroleum products discharged from the damaged pipes, 

contributing to the rapid spread of the fire and the damage caused to surrounding equipment, such as the 

No. 2 Cooling Tower and No. 4 Naphtha Column. 

10 The time of 2:09 p.m. is based on control system records examined after the incident. 

11 Nearby fired heaters were another possible source of ignition. 
Valero - Sunray July 2008 

16

Figure 3. Approximately 90 seconds after ignition (from surveillance video) 

3.2 Injuries 

Two Valero employees, who have since returned to work, and one contractor were seriously burned in the 

initial flash fire. The injured contractor continued to receive medical treatment for over a year after the 

incident. A member of the fire brigade received minor burn injuries while setting up fire-fighting 

equipment early in the response. Ten other Valero employees and contractors were treated for minor 

injuries and released. There were no fatalities and no reported off-site injuries. 

3.3 Emergency Response and Refinery Evacuation 

According to Valero’s incident response records, the fire alarm was activated at 2:10 p.m., about one 

minute after employees heard the “pop” of the initial release. The refinery’s emergency response team 

approached the fire, staging from the south. They attempted to activate stationary fire water monitors, but 
Valero - Sunray July 2008 

17

 

the high and shifting winds and the rapid growth of the fire hampered their efforts. 

Fifteen minutes after the fire erupted, managers at the Emergency Operations Center (EOC) ordered a 

total refinery evacuation. Refinery alarm records show that the evacuation alarm sounded at 2:26 p.m. 

The EOC tactical operations director later stated that the main concerns driving the evacuation decision 

were the number of pressurized pipes rupturing as the pipe rack collapsed and the proximity of the 

responders to the liquid propane filled extractor vessels, which were engulfed in flames and possibly at 

risk of failing catastrophically. This decision pulled responders and workers away from a rapidly 

deteriorating situation that could have endangered many lives. 

The refinery was shut down by isolating main feeds and the fuel gas supply. Emergency response teams 

later entered to isolate fuel sources, gradually shrinking the fire. Valero planned to stage a joint entry with 

responders from the nearby Conoco Phillips refinery12 to extinguish the fire the following day; however, 

chlorine and sulfuric acid leaks13 made this entry too hazardous. The fire was extinguished by Valero 

personnel on Sunday afternoon, February 18, 2008, approximately 54 hours after it ignited. 

3.4 Aftermath 

The refinery remained completely shut down for nearly two months. Media reports indicated spot 

shortages of reformulated gasoline in Denver, Colorado,14 in the weeks immediately following the fire. 

This incident occurred during a period when unplanned refinery outages kept approximately 480,000 bpd 

12 Refineries often establish mutual aid agreements to increase the resources available for responding to large 

emergencies. 

13 The chlorine and sulfuric acid were used to treat water circulating in a nearby cooling tower. 

14 Reformulated gasoline contains a specified content of oxygenated fuels to meet EPA requirements for automotive 

emissions in certain regions. Valero’s McKee Refinery is located approximately 400 miles from Denver, and 

typically supplies, via pipeline, much of the gasoline consumed in the Denver market. 
Valero - Sunray July 2008 

18

 

of capacity offline nationwide, of which 170,000 bpd was attributed to the McKee fire.15 Operations 

resumed at reduced throughput roughly two months after the fire. 

The PDA unit was heavily damaged (Figure 4). Much of the piping, control wiring, and heat exchange 

equipment in the area of the extractors was destroyed and major equipment items, including the extractor 

towers, required extensive evaluation to determine if they were safe for continued use. Valero restarted 

the rebuilt PDA unit in January 2008, nearly one year after the fire, restoring the refinery to full 

production capacity. 

3.5 Near-Miss Events 

The Center for Chemical Process Safety16, 17 (CCPS) defines a near-miss as “an extraordinary event that 

could reasonably have been expected to result in negative consequences, but actually did not” (1992). 

Two events during the February 16 fire could have resulted in serious, or even catastrophic, consequences 

if the wind direction had been different or if personnel had been nearby. 

3.5.1 Butane Sphere Heat Exposure 

At the time of the initial propane release, the wind was blowing from the west-northwest, pushing the fire 

in the general direction of the boiler house. Interviews, records, and security camera video footage 

indicate that the wind shifted several times during the fire, forcing the EOC to relocate. 

Radiant heat from the intense PDA fire blistered the paint on a 10,000 barrel (420,000 gallon) capacity 

butane storage sphere located 270 feet northwest of the No. 1 Extractor (Figure 4). Fortunately, the wind 

15http://tonto.eia.doe.gov/oog/info/twip/twiparch/080221/twipprint.html; accessed Feb 2008. 

16 The CCPS, an industry-sponsored affiliate of the American Institute of Chemical Engineers, publishes widely 

recognized process safety guidelines. 

17 CCPS defines process safety as a “discipline that focuses on the prevention of fires, explosions and accidental 

chemical releases at chemical process facilities.” Process Safety Management (PSM) applies management 

principles and analytical tools to prevent major accidents (CCPS, 1992). 
Valero - Sunray July 2008 

19

tended to move the flames away from the sphere; strong winds from the southeast might have greatly 

exacerbated the sphere’s thermal exposure. Even with favorable winds, heat from the fire kept responders 

from reaching the fire water deluge system valve for the sphere, preventing them from establishing a 

protective flow of water over its surface. During interviews, emergency responders indicated that they 

were concerned for the safety of the butane sphere, in light of a recent commemoration of the 1956 

incident in which the failure of a vessel in similar service caused 19 fatalities. 

Figure 4. Aerial photograph of damage from the PDA unit fire 
Valero - Sunray July 2008 

20

 

3.5.2 Chlorine Release 

Post-incident examination revealed that three one-ton chlorine containers in a cooling tower water 

treatment shed were subjected to radiant heating due to their proximity to the PDA unit (100 feet to No. 2 

Extractor) and pipe rack (20 feet). All three containers vented when their fusible plugs, installed to 

prevent container rupture, melted as designed. One container ruptured despite the operation of its fusible 

plugs, and another vented completely. The third developed a leak through a partially melted plug that 

was repaired by emergency responders using self-contained breathing equipment for protection against 

the toxic vapor. More than 2.5 tons of chlorine, an extremely toxic material, were released.18

Fortunately, emergency responders and other refinery personnel had pulled back from the area before the 

major chlorine release likely occurred.19 There is no evidence that personnel on- or off-site were exposed 

to hazardous levels of chlorine gas. However, if responders had been nearby when the cylinders released 

their contents, significant exposures could have occurred. 

4.0 Incident Analysis 

This section provides detailed analysis of the sequence of events and causal factors leading to the origin 

and spread of the February 16, 2007, fire and its impact on adjacent equipment. 

18 Chlorine has an OSHA PEL of 1.0 ppm; an NFPA toxicity rating of 4, the highest possible; and is listed by the 

EPA as an EHS. 

19 The CSB investigators could not precisely determine the time of release, but it was likely shortly after the collapse 

of the main E-W pipe rack, when a large pool fire burned just south of the chlorine container storage pad. 
Valero - Sunray July 2008 

21

4.1 Incident Sequence 

In this incident, water settling out of a propane stream likely leaked through a 10” NPS20 (250 DN) inlet 

block valve and accumulated in the low point formed by a control station (Figure 5). The control station 

was connected to the process, but had not been used for approximately 15 years. A period of cold 

weather likely froze the water, fracturing the pipe elbow upstream of the control valve. Warmer weather 

then melted the ice, resulting in a release of highly pressurized liquid propane through the fractured 

elbow. Appendix B contains a detailed time line of the incident. 

Figure 5. Propane mix control station schematic (not to scale) 

4.1.1 February Cold Weather 

National Weather Service records indicate that the Texas panhandle typically experiences periods of 

below-freezing weather during the winter, often in February. The 2007 cold snap began four days before 

the fire at the Valero-McKee Refinery, when temperatures dropped below 32°F and stayed below freezing 

for 87 hours. The average temperature in nearby Dumas, Texas, on February 14, 2007, was 26°F. A low 

temperature of 6°F was reached early in the morning of February 15. The temperature did not rise above 

 

20 NPS refers to U.S. Nominal Pipe Size. Dimensions of NPS pipe and fittings are specified in the American Society 

of Mechanical Engineers (ASME) standard B36.10. The metric equivalent is given in millimeters, nominal 

diameter (DN). 
Valero - Sunray July 2008 

22

 

freezing until the morning of February 16, approximately five hours before the incident (Weather 

Underground, 2007). 

4.1.2 Propane Mix Control Station Inlet Elbow Freezing and Failure 

The 6” NPS (150 DN) propane mix control valve originally mixed liquid propane into the pitch fed into 

the No. 1 Extractor. Due to a change in extractor control in the 1990s, use of the control valve was 

discontinued; however, this subsection of the No. 1 Extractor was left connected to the process under high 

pressure.21 The block valves around the control valve were closed, but the subsection was not removed or 

positively isolated from the process using slip blinds.22 The refinery conducted no formal process safety 

management of change (MOC) review of this idled control station.23 

The station’s configuration made it a dead-leg: a section of piping connected to the process with no flow 

through it. Water in the propane likely sank into the dead-leg, leaked by the inlet block valve, and 

accumulated in the control station piping.24 

The extended period of cold weather and the lack of freeze protection on the control station allowed the 

water to freeze and expand, cracking the elbow upstream of the control valve. The crack propagated 

along the inner radius of the elbow, the line of highest stress (Timoshenko , 1958), opening wider as it 

developed (Figure 6). Appendix C contains a more detailed discussion of the CSB’s analysis of crack 

formation and propagation. The damage to the inlet elbow and the post-incident leak rate determined for 

the inlet block valve are consistent with the estimated initial propane release rate during the incident. 

21 Senior operators in the PDA unit could not recall the exact time the control valve was last used. The change in 

extractor control occurred approximately 15 years before the incident. 

22 Slip blinds are solid pieces of metal inserted between flanges to positively isolate piping or equipment. 

23 MOC requires that changes to equipment, process, or design intent be reviewed for safety implications. It is a 

required element of OSHA’s Process Safety Management regulation, promulgated in 1992, and an element of API 

Recommended Practice 750, Management of Process Hazards, published in 1990. 

24 Water, which is insoluble (immiscible) in and denser than liquid propane, was known to be present in the propane. 

Water droplets entrained in propane can accumulate in the bottom of piping and vessels. 
Valero - Sunray July 2008 

23

Figure 6. Crack in the 10” diameter propane mix control station inlet elbow 

4.1.3 Thaw and Propane Release

On February 16, 2007, shortly after 9:00 a.m., ambient temperatures rose above freezing and the ice 

inside the elbow began to thaw. Post-incident examination of the control station inlet block valve (Figure 

7) revealed that a foreign object was jamming the valve,25 creating a leak path. When tested in a 

laboratory after the incident, this valve allowed over 1,025 gpm (233 m3

/hour) of water to leak through at 

process pressure. At approximately 2:09 p.m., melting ice opened the leak path, releasing liquid propane 

at 500 psig (3,447 kPa) pressure through the cracked elbow. A flammable vapor cloud rapidly formed. 

Based on recorded data from the PDA unit’s computerized control system, the CSB estimated an initial 

propane leak rate of 4,500 pounds (2,040 kg) per minute (Appendix D describes the propane mass balance 

calculations used to develop this figure). 
Valero - Sunray July 2008 

24

Figure 7. Downstream view of propane mix control station inlet block valve 

The wind blew the propane cloud toward the boiler house, where it likely ignited.26 The flames flashed 

back to the release point. The size and intensity of the resulting fire blocked access to manual shut-off 

valves and pump on-off switches that might otherwise have been used to control the propane discharge. 

Within minutes, the fire damaged piping and pipe rack supports, spreading the fire (Figures 4, 8, 9). 

 

25 In gate valves, a circular gate slides against metallic seat rings, providing a leak-tight seal when the valve is 

closed. The foreign object in the inlet gate valve prevented a tight fit between the gate and the seat rings. 

26 While the boiler house was the most likely source of ignition, nearby fired heaters could not be ruled out. 
Valero - Sunray July 2008 

25

Figure 8. Damaged 10” propane inlet on Extractor No. 1 

4.2 Dead-Leg Freeze Protection 

The initial release of propane was due to the McKee Refinery’s failure to recognize and address the 

freezing hazard posed by the propane mix valve control station dead-leg. 

4.2.1 Dead-Leg Not Recognized or Addressed 

The McKee Refinery had not identified the station as a dead-leg. A piping and instrumentation drawing 

(P&ID) update project for the PDA unit, completed in 2006, identified only dead-legs that were visually 

apparent, such as one formed when a control valve was physically removed and its flanged connections 

slip-blinded. However, the P&ID update did not detect the propane mix control station dead-leg, which 

was formed by closing block valves in the piping. 
Valero - Sunray July 2008 

26

 

A Process Hazard Analysis (PHA)27 performed on the PDA unit in 2006 did not examine freezing as a 

threat to piping integrity. Furthermore, the McKee Refinery’s freeze protection program did not 

periodically survey process units for potentially freeze-prone dead-legs. 

4.2.1.1 Inherently Safer Approach 

According to safety guidance by the CCPS in Inherently Safer Processes, A Life Cycle Approach (1996), 

the preferred way to control hazards is to eliminate them where possible. According to Lee’s Loss 

Prevention (2005), the best approach for managing dead-legs, such as the propane mix control station, is 

to remove them. If removing them is impractical, other approaches, in order of decreasing protective 

value, could include 1) positively isolating the dead-leg by installing slip blinds; 2) freeze-protecting 

them; or 3) procedures to regularly monitor and drain water from low points. 

4.2.2 McKee Refinery Freeze Protection Program 

Sunray, Texas, is in the north Texas panhandle, an area where below-freezing temperatures are common 

in February. Valero’s McKee Refinery protected piping and equipment from freezing by insulating and 

“tracing” with steam-filled tubing or electric heat tape.28 It was an unwritten practice to review and repair 

freeze protection components every fall. However, these activities focused on maintaining existing freeze 

protection measures, not on periodically reviewing units for dead-legs or other idle/infrequently used 

piping systems, or surveying process units for areas where water could collect. 

The refinery’s inspection program contained provisions for more frequent inspection of identified deadlegs, but these focused on identifying long-term corrosion issues, not acute freeze hazards. Freeze 

27 OSHA defines a PHA as a “thorough, orderly, systematic approach for identifying, evaluating, and controlling the 

hazards of processes involving highly hazardous chemicals.” PHAs must be updated and revalidated at least every 

five years under the Process Safety Management regulation 29 CFR 1910.119. 

28 Heat tracing involves providing a source of heat along the length of a pipe, usually by attaching or wrapping 

steam tubing or heating tape to or around the piping, and then insulating the protected piping. 
Valero - Sunray July 2008 

27

 

protection is both a mechanical integrity (inspection) and operational issue, and requires an integrated 

approach. 

4.2.3 Valero Corporation Freeze Protection Survey 

Following the McKee fire, Valero surveyed the freeze protection programs at its US refineries. Most of 

the refineries in freeze-prone areas had informal programs similar to McKee’s, while several had legacy 

freeze protection guidelines from previous owners. Valero did not have a corporate policy for freeze 

protection to set minimum standards for freeze protection programs at its facilities. 

4.2.4 Other Dead-Leg and Freeze-Related Incidents 

In a 2002 brochure, Understanding the Hazard: Freeze, FM Global29 cited “151 freeze incidents in 

industry with an average estimated gross loss of about $115,000 per incident from 1991 to 2000.” The 

following is a sampling of specific incidents identified by the CSB: 

• January 1962, Texas City, TX: An entire refinery was crippled and major process units shut 

down when the area experienced temperatures below freezing for 66 hours: “Dead-end water 

lines and steam lines froze, causing valves to break and some pipes to split”(API Publication 758, 

1983). 

• March 1979, Exxon, Linden, NJ: Seven injured when butane and propane released from a deadleg formed a large vapor cloud and exploded (Garrison, 1985). 

• February 1996, Total Petroleum, Denver, CO: Abandoned pump gland oil piping under process 

pressure froze and then burst above a vacuum bottom pump, causing a fire (Denver Post, June 28, 

1996). 

29 FM Global, a large process industry insurer, has developed widely used guidance documents. 
Valero - Sunray July 2008 

28

 

• February 2001, Bethlehem Steel, Burns Harbor, IL: Freezing in a dead-leg condensate line near a 

coke oven led to two fatalities and four injuries (CSB 2001-02-I-IN , 2002). 

• January 2008, Chevron, Pascagoula, MS: A freeze-related fire was reported at the refinery. This 

fire is an example of incidents where freezing temperatures occur occasionally, but not 

consistently during the winter (AP, January 3, 2008). 

The IChemE30 BP Process Safety Series publication, Hazards of Water, also lists numerous examples of 

process incidents related to water freezing. 

4.2.5 Available Industry Guidance 

FM Global’s Freeze brochure (2002) describes the risk and provides guidance for evaluating susceptible 

piping systems, with particular emphasis for facilities in regions where the risk of freezing weather is 

intermittent. The brochure provides general guidance for mitigating the hazard, but does not describe the 

specifics of freeze protection programs. However, FM Global has also published a Property Loss 

Prevention Data Sheet, Prevention of Freeze-Ups, (2007, latest edition) that does give guidance for 

establishing and maintaining freeze protection programs. 

Zurich, another major insurer, has published a cold weather checklist that tells users to “drain the vessels 

and piping of idle equipment”(Zurich, 2003). 

The CSB reviewed available publications by the API, an industry group that publishes voluntary 

standards, and found no detailed guidance for refineries on establishing effective freeze protection 

programs.31 32 

30 The Institute of Chemical Engineers (IChemE) is a UK engineering professional organization that publishes 

widely referenced process safety guidance. 

31 API publication Safety Digest of Lessons Learned, Section 9, Precautions Against Severe Weather Conditions, 

which provided general guidance for preparing a refinery for extreme cold weather, is no longer in print. 
Valero - Sunray July 2008 

29

 

4.3 Fireproofing 

A non-fireproofed structural support for a pipe bridge33 spanning a 90-foot wide open area north and east 

of the PDA unit (Figure 9) collapsed early in the incident, greatly increasing the magnitude of the fire. 

The support was located on a major E-W pipe rack north of the unit, outside the fireproofing distances 

recommended by API guidance and Valero internal standards. The collapse opened multiple lines 

carrying flammable and combustible materials from other areas of the refinery, contributing significantly 

to the damage experienced by adjacent units, and extending the time that the refinery was down for 

repairs. Fireproofed pipe rack support steel columns inside the PDA unit and at the No. 4 Naphtha 

Column all survived the fire without collapsing (Figure 10). 

Fireproofing is “fire resistant insulating material applied to steel to minimize the effects of fire exposure 

by flame impingement, to reduce the steel’s rate of temperature rise, and to delay structural failure”(API 

Publication 2510A, 1996). Without fireproofing, exposed structural steel members, such as pipe rack 

support columns, can rapidly lose their strength and fail, possibly within minutes (API 2218, 1999; CCPS, 

2003). Jet fires, such as the pressurized LPG release in this incident, can cause very rapid heating and 

failure of unprotected structural steel (Appendix E). 

32 API 570, Piping Inspection Code, mentions a variety of hazards associated with dead-legs, including freezing. 

API Recommended Practice 2001, Design and Construction of LPG Installations, discusses the importance of 

winterization and prevention programs in verifying that out-of-service piping and dead-legs are freeze-protected. 

However, neither document addresses freeze protection management systems, such as requirements for a formal 

written program or the need for periodic inspections to identify freeze hazards, which pertain to this incident. 

33 A pipe bridge is a reinforced section of a pipe rack that carries piping over a longer than normal span. 
Valero - Sunray July 2008 

30

Figure 9. Pipe bridge support fireproofing 

Fireproofing is a passive defense that can maintain the integrity of protected structures until a fire is 

controlled. According to Nolan (1996), “The primary value of fireproofing is obtained in the very early 

stages of a fire when efforts are primarily directed at shutting down [the] process, isolating fuel supplies 

to the fire...and conducting personnel evacuations.” 

Key guidance for fireproofing in refineries is API Publication 2218, Fireproofing Practices in Petroleum 

and Petrochemical Processing Plants. API Publications 2510, Design and Construction of LPG 

Installations, and 2510A, Fire-Protection Considerations for the Design and Operation of Liquefied 

Petroleum Gas (LPG) Storage Facilities, provide additional information on fireproofing in LPG34 storage 

facilities.35 These publications recommend fireproofing pipe rack support steel that is 20 to 40 feet from 

fuel sources for general refinery service, and up to 50 feet from LPG vessels. 

 

34 LPG includes the following light hydrocarbons and mixtures: propane, propylene, normal and iso-butane, and 

butylenes (API Standard 2510, 2001). These materials are all commonly handled as liquefied gases under 

pressure. 

35 LPG storage facilities are commonly found in refineries, including the McKee Refinery, which had four storage 

spheres northwest of the PDA unit. 
Valero - Sunray July 2008 

31

Valero Energy Corporation’s SP-00-04, Fire Proofing Specifications, calls for fireproofing pipe racks 

within 30 feet of equipment with the potential to cause a serious fire, but makes no special provisions for 

processes handling LPG. A loss-prevention report produced for the McKee Refinery listed fireproofing 

of pipe rack support steel, including the E-W pipe rack north of the PDA unit, as a top priority for the site 

fireproofing program, but the rack had not been fireproofed at the time of the incident. 

Figure 10. Extractor towers (upper right) and collapsed pipe rack 

A failed inlet flange to the No.1 Extractor, located 77 feet away from the buckled pipe bridge support, 

was the most likely source of the jet fire that collapsed the pipe bridge (Figure 11). The closest major 

process vessel (the No. 2 Extractor) was 51 feet away from the support. These distances exceed both 

API’s and Valero’s recommended fireproofing distances. 
Valero - Sunray July 2008 

32

Figure 11. Distances between the E-W pipe rack supports and the extractors 

API 2218 references the API 2210/2210A LPG fireproofing distance of 50 feet, developed for pool fires 

in LPG storage units. Neither standard addresses fireproofing for LPG processes or jet fire scenarios, 

even though process unit conditions, including pressure, can be more extreme than those found in storage 

facilities. In this incident, the high operating pressure of the extractors (500 psig, 3,447 kPa) likely 

produced a jet fire with a range and intensity beyond that anticipated in the API standards for LPG storage 

releases. 

In the Formosa–Point Comfort, Texas, propane/propylene fire in October 2005 that the CSB investigated, 

non-fireproofed steel columns supporting a critical structure also collapsed while adjacent fireproofed 

supports survived without damage (CSB 2006-01-I-TX, 2006). If the E-W pipe rack support columns in 
Valero - Sunray July 2008 

33

this incident had been fireproofed, the severity and duration of the fire would likely have been greatly 

reduced.36

4.4 Emergency Isolation and Shutdown 

Although the PDA unit contained large inventories of high-pressure propane, it was not equipped with 

remotely operable shut-off valves (ROSOVs)37 to rapidly stop propane releases. ROSOVs should be used 

in facilities, such as the PDA unit, where fast and effective isolation is needed to reduce the impact of 

major hazardous releases (HSE, 1999). 

Graphic based on FM Global Property Loss Prevention Data Sheet 7-14, 2004 

Figure 12. Insurer-recommended locations for ROSOVs 

 

36 Jet fire scenarios may require the use of fireproofing rated for longer fire exposure and greater resistance to 

erosion than might be required for protection in pool fire scenarios. 

37 ROSOVs, also referred to as EIVs, are equipped with actuators and configured to be quickly and reliably operated 

from a safe location, such as a well-sited control room. 
Valero - Sunray July 2008 

34

 

Figure 12 shows insurer-recommended ROSOV locations for a typical process unit. ROSOVs should be 

installed on large inventories of highly flammable materials,38 especially when downstream pumps are 

present that could produce pressurized releases. Such pumps should be interlocked to shut down when 

ROSOVs are closed. 

4.4.1 American Petroleum Institute (API) Guidance 

API’s Recommended Practice 2001, Fire Protection in Refineries and API 2030, Application of Fixed 

Water Spray Systems for Fire Protection in the Petroleum Industry, discuss the use of isolation valves in 

emergencies, including considering access to valves during fires. However, while these recommended 

practices briefly reference remotely operable isolation valves, they focus on fire- and heat-actuated valves 

and their limitations. The 2007 release of API 521, Pressure-relieving and Depressuring Systems, 

addresses the limitations of pressure relief systems in protecting against jet fires, and states that “unlike a 

pool fire, a jet fire can, in essence, be ‘turned off” through isolation and depressurization of the jet fire 

source...”39 However, none of these guidance documents provide specific guidance on the design, 

location, and use of ROSOVs for the rapid isolation of LPG processes during emergencies. 

4.4.2 Valero Corporate Emergency Isolation Valve (EIV) Standard 

Valero’s Emergency Isolation Valve Standard (SP-40-01) requires evaluation and installation of ROSOVs 

during new construction projects, and application of the standard during PHA revalidations in existing 

38 Guidance varies on appropriate threshold quantities for installing ROSOVs. Valero’s corporate procedure gives 

highest priority to installing ROSOVs on vessels containing more than 10,000 pounds of LPG-like materials 

(NFPA Class 4 flammables), such as propane. One insurer recommends ROSOV use on flammable inventories 

greater than 4 m3

 (4,225 gallons) in volume. The UK’s Health and Safety Executive (HSE) recommends installing 

the capability to physically isolate “large” inventories of hazardous substances. 

39 API 521 (5th ed.) also highlights the need for an integrated approach to mitigating jet fire hazards, including 

fireproofing and other measures in addition to emergency isolation capability. However, it does not provide 

detailed guidance. 
Valero - Sunray July 2008 

35

 

process units, such as the PDA.40 The standard specifies giving the highest priority to installing EIVs on 

vessels containing 10,000 pounds or more of National Fire Protection Association41 (NFPA) Class 4 

materials, such as propane.42 The CSB confirmed that both the high- and low-pressure accumulators (as 

well as the extractors) could contain well over 10,000 pounds of propane under normal operating 

conditions,43 yet neither was equipped with ROSOVs nor was SP-40-01 applied as required during the 

2006 PDA unit PHA revalidation. A UDS PHA in 1996 had identified the need for ROSOVs in the PDA 

unit; however, they were never installed, and the action item was incorrectly closed out as having been 

completed. 

4.4.3 Formosa–Point Comfort, Texas, Incident 

In a similar incident in 2005 involving an uncontrolled release of LPG (CSB-2006-I-TX), operators were 

also unable to reach locally operated valves to isolate the fuel source of the fire. The resulting fire 

extensively damaged Formosa Plastics Corporation’s Point Comfort, Texas, Olefins 2 unit. In both the 

Formosa and Valero incidents, the use of ROSOVs would have enabled operators to quickly control the 

initial releases, prevent the rapid spread of the fires, and mitigate the serious damage that occurred. 

5.0 Near-Miss Analysis 

Near-misses are extraordinary events that could reasonably have been expected to result in negative 

consequences, but actually did not. Examples of near-misses include releases of flammable vapors that 

40 OSHA’s PSM regulation requires PHAs to be periodically “updated and revalidated.” CCPS (2001) states that 

PHAs are revalidated to “produce an updated PHA that adequately identifies, evaluates, and proposes controls for 

the hazards of the process, as they are currently understood.” 

41 The NFPA develops widely recognized consensus fire protection codes and standards. 

42 The NFPA classifies the degree of hazard of a material on a scale of 0-4, with 4 the most hazardous or “severe.” 

Class 4 flammable materials are defined as either gases or materials that will flash to a gas at ambient temperature, 

such as LPG. The 10,000 pound criterion in the Valero standard applies to either the mass of a single Class 4 

material or to the Class 4 components of a mixture. 

43 Based on control system data and field measurements of the vessel diameters. 
Valero - Sunray July 2008 

36

 

dissipate without igniting, activation of safety protective and shutdown systems, and process conditions 

that exceed predefined control limits (CCPS, 1992). 

In this incident, two near-misses resulted from the exposure of nearby equipment to radiant heating by the 

fire. While no injuries or serious damage resulted, under slightly different circumstances the 

consequences could have been much more serious, even catastrophic. 

5.1 Chlorine Release 

5.1.1 Damage to Chlorine Containers 

Three one-ton containers of highly toxic44 liquid chlorine, used in cooling tower water treatment, were 

located in a shed approximately 100 feet from the PDA unit (Figure 4). The fire exposed the containers to 

radiant heating, rupturing one (Figure 13) despite the melting of its fusible plugs, and causing the other 

two to vent chlorine through their melted plugs.45 Valero reported to the Texas Commission for 

Environmental Quality (TCEQ) that 5,332 pounds of chlorine were released (see Section 7.2). 

Fortunately, responders had pulled back from the area prior to the release and no injuries were attributed 

to chlorine exposure. 

44 The NFPA rates chlorine’s health risk as a “4,” the most hazardous rating. 

45 Fusible plugs are safety devices that use metal alloys that melt at comparatively low temperatures, in this case 

roughly 155o

F (68oC) to vent containers exposed to excessive heating. The one-ton container that ruptured was 

likely exposed to an extremely high radiant heat flux, causing the container wall to weaken due to overtemperature and fail before its contents could be vented through the fusible plugs. 
Valero - Sunray July 2008 

37

 

The cooling tower water treatment shed served the No. 2 Cooling Tower, directly to the north; however, 

the shed did not need to be located next to the PDA unit and pipe rack. Furthermore, the PHA for this 

system had not examined the hazards of locating the chlorine containers close to the PDA unit. 

Following the incident the refinery rebuilt the treatment system, using bleach as the biocide, on the north 

side of the cooling tower. 

Chlorine was used at the McKee Refinery to prevent microbial growth in cooling water; however, its 

toxicity made it an inherently hazardous material to work with.46 The release of the contents of a single 

one-ton container of chlorine can create toxic effects up to three miles away, presenting a serious risk to 

workers and the public.47

5.1.2 Inherently Safer Alternatives 

In applying inherent safety principles,48 the preferred approach to control hazards is to eliminate them. 

However, if elimination is not feasible, replacing hazardous materials with less dangerous ones 

(substitution) should be examined (CCPS, 1996). This basic principle was described by noted process 

safety expert Trevor Kletz, who stated that “what you don’t have can’t leak” (1998). 

46 The EPA’s toxic endpoint for chlorine release modeling (the Emergency Planning Response Guideline-2 

concentration) is 3 ppm. The National Institute for Occupational Safety and Health (NIOSH)-recommended 

exposure limit is 0.5 ppm. 

47 Based on the CSB runs of the EPA’s “RMP Comp” software, v. 1.07, 2,000 pound release, RMP worst case, rural 

area (appropriate for the McKee Refinery’s location). 

48 “A chemical manufacturing process is inherently safer if it reduces or eliminates the hazards associated with 

materials and operations used in the process, and this reduction or elimination is permanent and inseparable” (CCPS, 

1996).
Valero - Sunray July 2008 

38

Figure 13. Ruptured one-ton chlorine container 

Safer materials for controlling biological growth in cooling towers are available, and Valero has identified 

replacing chlorine in cooling water treatment at all its refineries as a safety goal in its 2008-2012 Strategic 

Plan. The plan noted that 10 of its 18 refineries (as of May 2007) used ton container quantities of gaseous 

chlorine as a cooling water biocide. The McKee Refinery substituted sodium hypochlorite (bleach) for 

chlorine in its No. 2 Cooling Tower during PDA unit reconstruction. Bleach essentially stores chlorine in 

a form that presents a much lower inhalation hazard, an example of the inherently safer principal of 

attenuation (Kletz, 1998).49, 50

5.2 Butane Sphere Deluge Valves 

5.2.1 Heat Damage to Butane Sphere 

Four 10,000 barrel (420,000 gallon, 1590 m3) spherical tanks storing LPG were located northwest of the 

PDA unit (see Figure 4, page 19). At the time of the incident, the tank closest to the PDA unit contained 

 

49 Kletz states, “The worst that can happen with hypochlorite is far less than the worst effects of chlorine, and on 

balance the change seems justified.” 
Valero - Sunray July 2008 

39

approximately 3,600 barrels (151,000 gallons, 572 m3

) of liquid butane under pressure, and was exposed 

to radiant heat from the fire. Figure 14 shows heat damage to the white protective coating on the tank’s 

exterior. 

Figure 14. Heat-damaged coating on sphere and location of sphere deluge valves 

Analysis of the overall effects of the fire revealed significant vessel damage as far as several hundred feet 

away from the PDA unit, generally downwind from the initial release, and including the insulated No. 4 

Naphtha Column. Although the wind shifted several times during the fire, it never blew strongly from the 

southeast, which would have directed the flames toward the uninsulated butane sphere. Exposure to direct 

flame impingement or to significant heating over a prolonged period might have resulted in a vessel 

failure with potentially catastrophic consequences. 

 

50 Using bleach requires chlorine handling at the bleach production facility. 
Valero - Sunray July 2008 

40

 

Emergency responders were unable to reach the fire water deluge valves intended to protect the butane 

sphere (Tank 195) from excessive heating due to fire exposure. These manual valves were located under 

a pipe rack north of the PDA unit (Figure 14), and were too close to the fire to be safely approached. 

While the butane sphere was equipped with pressure relief devices, these primarily protect against the 

effects of pool fires on the liquid filled (wetted) portion of the sphere. In a pool fire, the liquid butane 

boils, cooling the wall of the sphere and generating vapor that would vent through the relief system.51 

The vapor-filled section of the sphere facing the PDA fire had no liquid to provide cooling, and could be 

protected against excessive heating only by applying water to the external surface via the deluge system. 

Without deluge protection, the sphere was vulnerable to possible failure through loss of metal strength 

due to over-temperature. While favorable winds limited the sphere’s thermal exposure during this 

incident, the inability of operators to reach the deluge valves to establish water flow over the sphere was 

nonetheless a serious failure of the butane sphere’s fire protection system. 

API standards do not require refineries to evaluate hazards from nearby units when locating fire water 

deluge valves, and Valero’s PHA for the LPG spheres did not examine the possibility that a fire could 

block access to the valves.52

5.2.2 Effective Deluge Valve Operation 

API Standard 2510, Design and Construction of LPG Installations, provides guidance on the design of 

LPG storage systems, and includes details on deluge system requirements for fire protection. API 2510 

specifies the use of manual deluge valves, such as the ones used for the LPG spheres, and specifically 

51 API 521, Pressure-relieving and Depressuring Systems, describes the design and application of pressure relief 

systems for pool fire scenarios. 
Valero - Sunray July 2008 

41

 

allows the use of automatic or remotely operated valves53 only if the tanks are unattended or partially 

attended, which was not the case at the McKee Refinery. 

Had the butane sphere deluge valve been remotely operable from a safe location at the time of the 

incident, emergency responders could have activated the water deluge system, greatly reducing the 

likelihood of a catastrophic vessel failure in the event of an unfavorable shift in wind direction. 

6.0 Process Hazard Analysis (PHA) 

PHA is a formal method for identifying process hazards. The PDA unit PHA revalidation performed in 

2006 did not address hazards that were causal to the February 16, 2007, incident. Furthermore, the PHAs 

performed on the water treatment system and the LPG storage spheres did not rigorously examine siting 

issues causal to the two near-miss incidents discussed in section 5.0. 

The CSB identified several areas where the McKee Refinery’s 2006 PDA unit PHA was ineffective in 

identifying hazards that contributed to the February 16, 2007, incident: 

• As documented in section 4.2.1, the process safety information developed for the PDA unit 

PHAs did not identify the propane mix control station as a dead-leg, which could be subject 

to freezing. Identifying and addressing this dead-leg could have prevented the propane 

release. 

• The node size selected for the “HAZOP” PHA method 54 used was too large, which can lead 

to inadequate review of node components. In this case, the large node size likely led to the 

propane mix control station not being reviewed. 

52 However, OSHA’s PSM compliance directive (CPL2-2.45A, Appendix B) addresses automating deluge valves to 

improve protection when process units are closely spaced. 

53 Automatic deluge valves are opened by a control system based on sensor input, such as high temperature or the 

presence of flammable concentrations of LPG. Remotely operated valves can be opened by facility personnel 

from a safe location. 
Valero - Sunray July 2008 

42

 

• According to CSB interviews, the 2006 PHA did not effectively engage the operators in the 

review process; rather, the contract facilitator performed most of the analysis. Involving the 

operating staff directly in the PHA process is a key to performing an effective PHA. 

• As documented in section 4.4.2, the 2006 PHA did not apply Valero Emergency Isolation 

Valve standard SP-40-01 to identify locations requiring ROSOVs. Installing these valves on 

the propane accumulator vessels would likely have greatly reduced the severity of the 

incident. 

• The PHA did not revisit recommendations from earlier PHAs to confirm that they had been 

properly implemented. As a result, the 1996 recommendation that ROSOVs be installed in 

the PDA unit was not reviewed. 

Furthermore, as discussed in sections 5.1 and 5.2, the PHAs for the water treatment system and the 

LPG storage spheres did not address the potential for fire exposure from the adjacent PDA unit. The 

OSHA PSM regulation specifically requires consideration of siting issues when performing PHAs. 

Exposure of chlorine containers and LPG storage tanks to heating from fires is a well-recognized 

hazard. 

PHAs are an important component of a PSM system. Guidance on performing effective PHAs is 

available; examples include Guidelines for Hazard Evaluation Procedures, (2nd ed.), and 

Revalidating Process Hazard Analyses, both from CCPS, and HAZOP Guide to Best Practice from 

the European Process Safety Center, among others. 

54 For the HAZOP (hazard and operability study) PHA methodology used in this PHA, a “node” is a section of 

equipment with definite boundaries (e.g., a line between two vessels) within which process parameters are 

investigated for deviations (CCPS, 1992). 
Valero - Sunray July 2008 

43

7.0 Regulatory Analysis 

The OSHA PSM (29 CFR 1910.119) and the EPA Risk Management Program (RMP - 40 CFR Part 68) 

regulations both aim to reduce the risk of catastrophic releases of hazardous chemicals. The PSM 

standard addresses employer requirements to implement effective PSM programs to protect workers. 

RMP incorporates the elements of PSM and adds requirements for evaluating off-site consequences, 

emergency response, and community outreach. These regulations apply to processes containing 

hazardous materials above specified threshold quantities. The PDA and LPG storage areas were covered 

under both regulations, as they contained more than the specified threshold quantity (10,000 pounds) of 

flammable propane or butane. The cooling water treatment system was also covered under both, as it 

contained an above threshold quantity (1,500 pounds for PSM; 2,500 pounds for RMP) of chlorine gas. 

7.1 OSHA Process Safety Management 

The PSM regulation is performance-based and requires companies with covered processes to implement 

programs addressing 12 key elements, many of which are mutually supporting. As discussed in section 

4.0, the CSB investigation found causal deficiencies in several elements of the McKee Refinery’s PSM 

program, including: 

• Process safety information – the propane mix control station was not identified as no longer in 

use or as a dead-leg freeze hazard. 

• PHA – the PDA unit piping was not reviewed for freeze rupture, Valero’s ROSOV procedure was 

not applied, and chlorine container siting issues were not considered. 

7.2 EPA Risk Management Program (RMP) 

The RMP regulation requires that covered facilities implement an RMP that includes hazard assessment, 

prevention program, and coordinated emergency response elements. Facilities such as Valero’s McKee 
Valero - Sunray July 2008 

44

 

Refinery must prepare an RMP, submit it to the EPA, and periodically update it. 

The McKee RMP included an estimate of the worst-case scenario for a toxic chemical release; a release 

of one ton of pressurized chlorine gas (a single one-ton container) from the water treatment facility with a 

toxic endpoint distance of three miles. Slightly over 2.5 tons of chlorine were estimated to have been 

released from the three co-located containers impacted by the fire.55 

7.3 Regulatory Enforcement History 

Federal OSHA administers and enforces worker safety and health standards in Texas. OSHA had 

inspected the McKee Refinery twice under Valero’s ownership; however, neither inspection was PSMoriented.56 Based on its investigation of this accident, OSHA issued three serious citations57 to Valero for 

violating the PSM standard with proposed penalties of $21,000; one citation was related to the PHA, and 

two to the “Mechanical Integrity” elements of the PSM regulation. An informal settlement agreement58

between Valero and OSHA resulted in one of the “serious” citations being reclassified as “other,” and a 

penalty reduction to $15,000, along with a stipulation that the refinery would, “as a voluntary hazard 

recognition measure[,]...adopt measures to manage `dead-legs’ within piping systems.” 

The McKee Refinery had not been audited by the EPA prior to the February 2007 incident. While the 

EPA responded to the fire, it did not investigate the refinery’s RMP compliance after the incident. 

55 EPA guidance requires companies to consider releases from co-located vessels. General Guidance for Risk 

Management Programs (40 CFR Part 68), Office of Solid Waste and Emergency Response, EPA-550-B-00-008, 

May 2000, page I-8. 

56 www.osha.gov/pls/imis. 

57 OSHA, Citation and Notification of Penalty, Diamond Shamrock Refining Company, L.P., dba Valero - McKee 

Refinery, Inspection Number 310690086, August 13, 2007. 

58 OSHA, Informal Settlement Agreement, Diamond Shamrock Refining Company, L.P., dba Valero - McKee 

Refinery, OSHA Inspection No. 310690086, September 4, 2007. 
Valero - Sunray July 2008 

45

 

8.0 Root and Contributing Causes 

The CSB’s investigation determined the following root and contributing causes59: 

8.1 Root Causes 

1. The McKee Refinery had no formal written program in place to identify, review, and freezeprotect dead-legs or infrequently used piping and equipment, such as the propane mix control 

station. 

2. The McKee Refinery did not apply Valero’s mandatory Emergency Isolation Valve procedure 

when evaluating risks in the PDA unit to ensure that the large quantities of flammable materials 

in the unit could be rapidly isolated in an emergency. 

3. API guidance and Valero’s corporate Fire Proofing Specifications standard do not specify 

sufficiently protective distances for fireproofing pipe rack support steel for processes handling 

high-pressure flammables, such as the LPG in the PDA unit. 

8.2 Contributing Causes 

1. API-recommended practices on locating and operating LPG firewater deluge valves do not 

address potential hazards from nearby processes. 

2. Valero–McKee Refinery’s hazard assessment process did not recognize the risk of using chlorine 

in close proximity to equipment handling flammable hydrocarbons. 

59 Appendix F contains an event tree used to help develop root and contributing causes. 
Valero - Sunray July 2008 

46

9.0 Recommendations 

American Petroleum Institute (API) 

2007-05-I-TX-R1 Issue API-recommended practices for freeze protection in oil refinery process 

units that include, as a minimum: 

• the establishment of a written program; 

• periodic inspections to identify freeze hazards in dead-legs or infrequently 

used piping and equipment where water could collect; 

• specific approaches to eliminate or protect against such freeze hazards; and 

• identification of infrequently used piping or equipment subject to freezing as 

a trigger for Management Of Change (MOC) reviews. 

2007-05-I-TX-R2 Revise API 2218, Fireproofing Practices in Petroleum and Petrochemical 

Processing Plants, so that conformance with the standard addresses jet fire 

scenarios, and requires more protective fireproofing radii and other measures 

(e.g., emergency isolation valves, depressuring systems) for pipe rack support 

steel near process units containing highly pressurized flammables. 

2007-05-I-TX-R3 Revise API Recommended Practice 2001, Fire Protection in Refineries, and API 

2030, Application of Fixed Water Spray Systems for Fire Protection in the 

Petroleum Industry, so that conformance with these recommended practices 

includes the design, installation, and use of ROSOVs and interlocked equipment 

controls to enable the safe and rapid emergency isolation of process equipment 

containing highly pressurized flammables. 

2007-05-I-TX-R4 Revise API Standard 2510, Design and Construction of LPG Installations,, and 

API Publication 2510A, Fire-Protection Considerations for the Design and 

Operation of Liquefied Petroleum Gas (LPG) Storage Facilities, to address 

effective deluge system activation during emergencies originating in nearby 

process units. 
Valero - Sunray July 2008 

47

Valero Energy Corporation 

2007-05-I-TX-R5 Identify all processes in this and other refineries where Valero’s mandatory 

Emergency Isolation Valve standard is applicable, and ensure that Remotely 

Operable Shut-off Valves (ROSOVs) are installed to control large accidental 

releases of flammable materials. 

2007-05-I-TX-R6 Establish corporate requirements for written freeze protection programs at Valero 

refineries subject to freezing temperatures, including identification, mitigation, 

MOC, and audit requirements. 

2007-05-I-TX-R7 Revise Valero standards, including Fire Proofing Specifications, to require 

evaluation of jet fire scenarios and, as a minimum, ensure more protective 

fireproofing for pipe rack support steel near process units containing highly 

pressurized flammables. 

2007-05-I-TX-R8 Audit PHA performance at its refineries to ensure adherence to company 

standards and good practice guidelines. 

2007-05-I-TX-R9 Implement Valero’s strategic plan to replace chlorine used as a biocide in cooling 

water treatment with inherently safer materials, such as sodium hypochlorite, at 

all refineries. 

Valero–McKee Refinery, United Steelworkers Union, and Local 13-487 

2007-05-I-TX-R10 Work together to benchmark effective PHA methods and practices and 

implement improvements to the McKee Refinery PHA program, including: 

• involving the workforce in PHA preparation, performance, and follow-up; 

• training participants; 

• conducting PHA quality control checks; and 

• following up on recommendations for timely implementation and appropriate 

close-out. 
Valero - Sunray July 2008 

48

By the 

U.S. Chemical Safety and Hazard Investigation Board 

 John S. Bresland 

 Chair 

 Gary L. Visscher 

 Member 

 William B. Wark 

 Member 

 William E. Wright 

 Member 

Date of Board Approval 
Valero - Sunray July 2008 

49

10.0 References 

American Petroleum Institute (API). Safety Digest of Lessons Learned. Section 9, Precautions Against 

Severe Weather Conditions,Publication 758, Section 6; Washington DC, 1983.

API. Pressure-relieving and Depressuring Systems, ANSI/API Standard 521, with Addendum, 

Washington, DC, 2008. 

API. Fire Protection in Refineries, Publication 2001; Washington DC, 1998.

API. Application of Fixed Water Spray Systems for Fire Protection in the Petroleum Industry, Publication 

2030; Washington DC, 1998.

API. Design and Construction of LPG Installations, Publication 2510; Washington DC, 2001.

API. Fire-Protection Considerations for the Design and Operation of Liquefied Petroleum Gas (LPG) 

Storage Facilities, Publication 2510A; Washington, DC, 1996.

API.Fireproofing Practices in Petroleum and Petrochemical Processing Plants, Publication 2218;

Washington, DC, 1999. 

Center for Chemical Process Safety (CCPS). Guidelines for Hazard Evaluation Procedure, 2nd ed;

American Institute of Chemical Engineers (AIChE), New York, 1992. 

CCPS. Guidelines for Investigating Chemical Accidents, 1st ed; AIChE, New York, 1992. 

CCPS. Inherently Safer Processes, A Life Cycle Approach, AIChE, New York, 1996.

Crawley, F., Preston, M., & Tyler, B., HAZOP: Guide to best practice; Institution of Chemical Engineers, 

Warwickshire, UK, 2000. 

The Chemical Safety and Hazard Investigation Board (CSB). Steel Manufacturing Incident; Washington, 

DC, 2002. 

CSB. Fire at Formosa Plastics Corporation: Evaluating Process Hazards; Washington, DC, 2006. 

Energy Information Administration. Lost and Found Refinery Capacity.

http://tonto.eia.doe.gov/oog/info/twip/twiparch/080221/twipprint.html (accessed Feb 2008). 

Environmental Protection Agency (EPA), General Guidance for Risk Management Programs; Office of 

Solid Waste and Emergency Response, EPA-550-B-00-008, Washington, DC, 2000. 

EPA. General Guidance for Risk Management Program (40 CFR Part 68), RMP Series; EPA-550-B-00-

008, May 2000; p. I-8. 

Frank, W. & Whittle, D. Revalidating Process Hazard Analyses; AIChE, New York, 2001. 

FM Global. Evaluating the Hazard: Freeze; FM Global, Norwood, MA, 2002. 

FM Global.Property Loss Prevention Data Sheet 9-18, 17-18: Prevention of Freeze-Ups; FM Global, 

Norwood, MA, 2007. 

Garrison, W., editor. One Hundred Largest Losses: A Thirty-Year Review of Property Damage Losses in 

the Hydrocarbon-Chemical Industries; Marsh, Inc., New York, 1985. 

Handbook of Texas Online; Diamond Shamrock. 
Valero - Sunray July 2008 

50

http://www.tshaonline.org/handbook/online/articles/DD/hed6.html, (accessed Jan 2, 2008). 

Health and Safety Executive (UK). Emergency isolation of process plant in the chemical industry, 

Chemicals Sheet No. 2; HSE Books, Sudbury, England, 1999. 

Kletz, Trevor A., 1998. Process plants: A handbook for inherently safer design; Taylor & Francis, 

Philadelphia, PA. 

Directory of Corporate Affiliations, s.v. Valero Energy Corporation. Lexis Nexis (accessed Dec 2007). 

Mannan, S., ed. Lee’s Loss Prevention in the Process Industries, 3rd ed.; Elsevier ButterworthHeinemann, Burlington, MA, 2005.

Marsh & McLennan, One Hundred Largest Losses, May 1985, incident # 63. 

The Natural Gas Council. How Natural Gas Gets to Consumers. 

http://www.yankeegas.com/yankeegascommon/pdfs/gastoconsumers.pdf (accessed January 24, 

2008). 

Nolan, D., Handbook of Fire and Explosion Protection Engineering Principles for Oil, Gas, Chemical, 

and Related Facilities; Noyes Publications, Westwood, NJ, 1996. 

Occupational Safety and Health Administration (OSHA). CPL 2-2.45A (REVISED) – Process Safety 

Management of Highly Hazardous Chemicals -- Compliance Guidelines and Enforcement Procedure, 

Appendix B. Washington, DC, 1992. 

OSHA. Citation and Notification of Penalty, Diamond Shamrock Refining Company, L.P., dba Valero - 

McKee Refinery, Inspection Number 310690086, August 13, 2007. 

OSHA, 2007. Informal Settlement Agreement, Diamond Shamrock Refining Company, L.P., dba Valero - 

McKee Refinery, OSHA Inspection No. 310690086, September 4, 2007. 

OSHA. Inspection Data. www.osha.gov/pls/imis (accessed February 2008). 

Riecher, A. Fateful 1956 Blast Still Remembered. Industrial Fire World, November-December 2006, p 

5. 

Timoshenko, S. Strength of Materials, Part II; Van Nostrand Reinhold, New York, 1958;. p. 123. 

Valero Energy Corporation. Valero Through the Years. 

www.valero.com/aboutus/history.htm (accessed on November 13, 2007). 

Zurich Risk Engineering. Zurich Risk Topics: Cold Weather Preparation, November 2003, 2-7-005. 

http://www.zurichna.com/zsc/reel.nsf/b777a8062cedf191c12571fe00467717/e5da540a6edd74998

6256adc006e5a84/$FILE/cold_weather_preparation_rt_2-7.005_20031113.pdf. (accessed March 

2008). 
Valero - Sunray 

51

Appendix A. Flow Diagram 
Valero - Sunray June 2008 

Appendix B. Incident Timeline 

Date Time Event 

Circa 1992 Extractor control changed. Propane mixture control 

station idled 

March 1, 1996 

Initial PHA of the PDA included recommendations to 

install ROSOVs to shut off flow in event of pipe leak or 

rupture 

Action item inaccurately closed out as "complete" 

July 13, 2001 PDA PHA revalidation did not verify actual status of 

recommendation to install ROSOVs 

January 1, 2002 Valero takes ownership of McKee Refinery 

February 23-27, 2004 

PSM/RMP compliance audit identified that P&IDs had 

not been updated and that PHA recommendations 

were not being resolved in a timely manner 

February 21-24, 2006 PDA HAZOP study did not identify the need for 

ROSOVs due to deficiencies in study methodology 

February 12-15, 2007 National Weather Service winter weather advisory in 

effect 

February 12, 2007 Sub-freezing temperatures began. Ambient 

temperatures drop below 32°F for 87 hrs 

February 15, 2007 Minimum temperature recorded of 6°F in Dumas Texas 

February 16, 2007 9:05 AM Temperature rises above 32°F 

 1:30 PM Team personnel sign in at PDA unit Control Room 

 1:35 PM Board Operator issues work permit to Team personnel 

 2:09-2:10 PM 

Process flow indicators swing sharply, consistent with 

an initial propane release of 4,500 pounds per minute 

First signs of a release occurring on security camera 

 2:10--2:11 PM 

Ignition of propane vapor cloud: one contractor and two 

Valero workers burned. A fire brigade member is later 

burned during response activities 

 2:11 PM Fire alarm received at Dumas Fire Department 

 2:12 -2:15 PM Multiple fireballs/ruptures 

 2:15 PM First wisps of smoke visible from burning No. 2 Cooling 

Tower 

 2:16 PM Wind shifts from northwest to north affecting 

emergency response. 

 2:19-2:22 PM 

First water stream seen from due south 

Security camera captures multiple large 

fireballs/ruptures in or near the pipe rack 

Flames intensify 

52
Valero - Sunray June 2008 

53

 2:23 PM • Dumas Fire Department arrives on scene 

• Wind shifts slightly, coming from northwest 

 ~2:24-2:26 PM Multiple fireballs/ruptures captured on camera 

 2:26 PM Total evacuation of refinery 

 3:00 PM Life Flight helicopter arrives 

 3:30 PM Emergency Operations Center (EOC) relocated outside 

refinery fence 

 3:40 PM EOC relocated to west of Tank 300 M3 

 3:50 PM Evacuated employees directed to the Dumas 

Community Center 

 4:00 PM EOC relocated SW of Tank 300 M3 

 4:06 PM EOC relocated east of the refinery due to wind shift. 

 4:15 PM EPA notified 

 4:25 PM EOC relocated to ammonia plant (north of refinery) 

February 17, 2007 ~1:00 PM Fire declared out 
Valero - Sunray June 2008 

Appendix C. Piping Elbow Failure Analysis 

The fracture in the inlet elbow of the No. 1 Extractor propane mix control station initiated in the exterior 

surface (cap) welding pass of the girth weld that joined the 10” NPS inlet flange to the 10” elbow, on the 

intrados (the inner radius) of the elbow (Figure C- 1). No flaw was observed at the initiating site, and the 

elbow and flange materials were within specification for tensile properties and chemical composition.1

Figure C- 1. Fractured inlet elbow 

 

1

 ASTM A105 for the flange material and ASTM A234 for the elbow. 

54
Valero - Sunray June 2008 

The fracture propagated parallel to the pipe axis in both directions, with the surface exhibiting brittle 

fracture propagation features (Figure C-2). 

Charpy V-notch (CVN) toughness tests were performed on the elbow and flange materials. Based on a 50 

percent shear-area appearance, ductile to brittle transition temperatures were determined to be 95o

F and 

70o

F (35oC and 21oC), respectively. Given that this piping was exposed to temperatures as low as 6oF (-

14o

C), brittle propagation behavior could be expected in these components. 

Figure C- 2. Origin and brittle propagation markers 

The deposited weld metal and heat-affected zone of the girth weld were CVN-tested. However, 

insufficient material was available to determine the complete ductile-brittle transition. Testing at -20o

F (-

29o

C) gave from 20 to 85 percent shear area appearance, consistent with a brittle-ductile transition 

temperature near -20o

F (-29oC). However, based on the observed grain structure, the cap weld likely had 

lower toughness (higher transition temperature) than the underlying weld metal, which had likely been 

annealed by heat from subsequent welding passes. Because the thickness of the cap was on the order of 

55
Valero - Sunray June 2008 

56

 

the depth of the CVN specimen notch, it was not possible to measure these differences with standard or 

subsized CVN specimens. 

Correction of the weld metal and heat-affected zone samples for the difference in thickness of the 

specimens and the actual pipe wall, based on the method of Rosenfeld,2

 shifts their transition 

temperatures 25o

F (14oC) warmer, again implying reduced toughness at low temperatures. 

The probable reduced toughness of the cap weld, combined with a relatively high transition temperature, 

likely promoted brittle failure at a point along the line of highest stress along the intrados of the elbow. 

Brittle initiation could possibly have been caused by dynamic loading of the elbow (e.g., an external 

impact), or by high internal pressures combined with low ambient temperatures. There was no evidence 

of impact, nor are there records of activities in the area during the likely period of failure that might have 

applied such a dynamic load. However, ambient temperatures were as low as 6o

F (-14oC) prior to the 

release, and water in the piping could easily have generated very high internal pressures as it froze and 

expanded.3

 The CSB concluded that the failure likely resulted from water trapped in the propane mix 

control station dead-leg freezing due to low ambient temperatures. 

2

 Rosenfeld, M.J., Procedure Improves Line Pipe Charpy Test Interpretation, Oil & Gas Journal, April 14, 1997. 

3

 Atypically, water expands (its density decreases) as it freezes. 
Valero - Sunray June 2008 

Appendix D. Initial Propane Release Rate 

Background 

Witness statements were consistent with the initial release originating from either of two control stations. 

Physical examination and flow-testing of components, as described in the body of this report, 

demonstrated conclusively that the release was from the cracked inlet elbow on the No. 1 Extractor 

propane mix flow control station. Recovered control system data supported the mix control station as the 

location of the leak, and allowed the CSB investigators to estimate the propane release rate during the first 

minute of the incident. The fire damaged the instrumentation in the area of the release almost 

immediately after the fire ignited. 

Propane Release Estimate 

Data from PDA unit propane flow meters indicated a significant increase in flow upstream, and a 

significant decrease in flow downstream, of the No. 1 Extractor propane mix flow control station at the 

time of the incident.1

 This is consistent with the leak occurring at the cracked inlet elbow of the mix 

control station. 

Figure 1 plots the sum of the upstream and downstream flow meter readings, in bpd.2

 The offset prior to 

the incident is due to an unmeasured process flow between the low- and high-pressure propane supplies 

upstream of the leak point. Assuming that this offset was fixed during the incident is conservative – the 

actual release rate was likely modestly higher than estimated here. 

 

1

 Data recovered from the PDA unit’s AspenTech IP21 datalogger, recorded at 30-second intervals. 

2

 Refining barrels hold 42 U.S. gallons; 100 bpd equal 2.917 gpm. 

57
Valero - Sunray June 2008 

58

Propane release rate = [increase in upstream flow] + [decrease in downstream flow] 

[21,900] + [19,500] = 41,400 bpd. 

Based on a liquid propane density of 27.7 lb per cubic foot at process conditions, the CSB estimated an 

initial release rate of 4,500 lb/min. 

60,000

65,000

70,000

75,000

80,000

85,000

90,000

95,000

100,000

105,000

110,000

14:08:32 14:09:02 14:09:32 14:10:02 14:10:32 14:11:02

Time

Propane Flow, BPD

Sum Upstream

Sum Downstream

Figure D- 1. Changes in propane flows upstream and downstream of the cracked elbow 
Valero - Sunray June 2008 

Appendix E. Response of Structural Steel to Fire Heating 

CCPS’ Guidelines for Fire Protection in Chemical, Petrochemical, and Hydrocarbon Processing 

Facilities discusses the importance of fireproofing during the early stages of a fire, when “if nonfireproofed equipment and pipe supports fail due to fire related heat exposure, they could collapse and 

cause gasket failures, line breaks, and equipment failures, resulting in expansion of the fire.” This type of 

knock-on damage was a significant factor in the damage caused by the PDA unit fire. As Figure E-1

illustrates, exposure to a jet fire, as can occur in pressurized LPG fires, can lead to rapid heating and the 

failure of exposed steel within a few minutes.1

Figure E-1. Time temperature curves for fire tests (CCPS, 2003) 

 

1

 The curves shown are based on standardized tests and are illustrative only. 

59
Valero - Sunray June 2008 

60

CCPS describes key factors to consider when specifying the required duration of fireproofing protection, 

including the 

• time required to isolate fuel supplies; 

• availability and capacity of fire-fighting water; 

• time required to establish cooling from fixed fire monitors (as were installed at the 

McKee Refinery), including personnel response time; and the 

• time required for drainage to remove hydrocarbon spills. 

In this incident, the severity of the fire caused rapid knock-on damage before fuel supplies could be 

isolated or effective water sprays established. The use of ROSOVs, combined with fireproofed pipe rack 

supports, would likely have significantly reduced the damage caused by this fire. 
Valero - Sunray 

Appendix F. Event Tree 

61
Valero - Sunray 

62
Valero - Sunray 

63
Valero - Sunray 

64
Valero - Sunray 

65