U.S. C HEMICAL S AFETY AND H AZARD I NVESTIGATION B OARD 

# INVESTIGATION REPORT
LPG F IRE AT 

# V ALERO 

# – M C 

# K EE 

# R EFINERY (Four Injured, Total Re finery Evacuation, and Extended Shutdown)

Photo: Associated Press 

## V ALERO 

## E NERGY 

## C ORPORATION 

### S UNRAY 

### , T EXAS 

### F EBRUARY 

### 16, 2007 

### K EY 

### I SSUES 

### :

• F REEZE P ROTECTION OF D EAD - LEGS

• E MERGENCY I SOLATION OF E QUIPMENT

• F IREPROOFING OF S UPPORT S TEEL

• F IRE P ROTECTION FOR HIGH PRESSURE LPG S ERVICE

• C HLORINE R ELEASE

REPORT NO. 2007-05-I-TX J ULY 2008Valero - Sunray July 2008


## Contents

EXECUTIVE SUMMARY ..........................................................................................................................6
1.0 INTRODUCTION .........................................................................................................................10
1.1 Background.......................................................................................................................10
1.2 Investigative Process .........................................................................................................10
2.0 VALERO ENERGY CORPORATION .........................................................................................11
2.1 Company History ..............................................................................................................11
2.2 McKee Refinery ................................................................................................................11
2.3 Propane Deasphalting (PDA) Unit ....................................................................................12
3.0 INCIDENT DESCRIPTION ..........................................................................................................15
3.1 The Incident ......................................................................................................................15
3.2 Injuries ..............................................................................................................................1 6
3.3 Emergency Response and Refinery Evacuation ...............................................................16
3.4 Aftermath ..........................................................................................................................17
3.5 Near-Miss Events ..............................................................................................................18
4.0 INCIDENT ANALYSIS ................................................................................................................20
4.1 Incident Sequence .............................................................................................................21
4.2 Dead-Leg Freeze Protection .............................................................................................25
4.3 Fireproofing ......................................................................................................................29
4.4 Emergency Isolation and Shutdown .................................................................................33
5.0 NEAR-MISS ANALYSIS .............................................................................................................35
5.1 Chlorine Release ...............................................................................................................36
5.2 Butane Sphere Deluge Valves ..........................................................................................38
6.0 PROCESS HAZARD ANALYSIS (PHA) ....................................................................................41

2Valero - Sunray July 2008

3 7.0 REGULATORY ANALYSIS ........................................................................................................43
7.1 OSHA Process Safety Management .................................................................................43
7.2 EPA Risk Management Program (RMP) ..........................................................................43
7.3 Regulatory Enforcement History ......................................................................................44
8.0 ROOT AND CONTRIBUTING CAUSES ....................................................................................45
8.1 Root Causes ......................................................................................................................45
8.2 Contributing Causes ..........................................................................................................45
9.0 RECOMMENDATIONS ...............................................................................................................46
10.0 REFERENCES ..............................................................................................................................4 9
APPENDIX A. FLOW DIAGRAM .....................................................................................................51
APPENDIX B INCIDENT TIMELINE ..............................................................................................52
APPENDIX C PIPING ELBOW FAILURE ANALYSIS ..................................................................54
APPENDIX D. INITIAL PROPANE RELEASE RATE .....................................................................57
APPENDIX E. RESPONSE OF STRUCTURAL STEEL TO FIRE HEATING ................................59
APPENDIX F: EVENT TREE .............................................................................................................61Valero - Sunray July 2008

4 

## Figures Figure 1. PDA unit location in McKee Refinery ........................................................................................13 Figure 2. No. 1 Extractor simplified process flow diagram .......................................................................14 Figure 3. Approximately 90 seconds after ignition (from surveillance video) ..........................................16 Figure 4. Aerial photograph of damage from the PDA fire .......................................................................19 Figure 5. Propane mix control station schematic (not to scale) .................................................................21 Figure 6. Crack in the 10” diameter propane mix control station inlet elbow ...........................................23 Figure 7. Downstream view of propane mix control station inlet block valve ..........................................24 Figure 8. Damaged 10” propane inlet on Extractor No. 1 .........................................................................25 Figure 9. Pipe bridge support fireproofing .................................................................................................30 Figure 10. Extractor towers (upper right) and collapsed pipe rack ............................................................31 Figure 11. Distances between the E-W pipe rack supports and the extractors ..........................................32 Figure 12. Insurer-recommended locations for ROSOVs ..........................................................................33 Figure 13. Ruptured one-ton chlorine container .........................................................................................38 Figure 14. Heat-damaged coating on sphere and location of sphere deluge valves ...................................39Valero - Sunray July 2008

5 

## Acronyms and Abbreviations AIChE American Institute of Chemical Engineers API American Petroleum Institute BPD barrels per day (100 BPD = 2.92 gallons per minute) CCPS Center for Chemical Process Safety CFR Code of Federal Regulations CSB U.S. Chemical Safety and Hazard Investigation Board DAGO DeAsphalted Gas Oil DCS distributed control system EIV emergency isolation valve EHS extremely hazardous substance EOC Emergency Operations Center EPA U.S. Environmental Protection Agency EPCRA Emergency Planning and Community Right-to-Know Act ERPG Emergency Response Planning Guideline IChemE Institute of Chemical Engineers (UK) IDLH immediately dangerous to life or health LPG liquefied petroleum gas MOC Management of Change NPRA National Petrochemical and Refiners Association NWS National Weather Service OSHA Occupational Safety and Health Administration PDA Propane DeAsphalting Unit PEL permissible exposure limit PHA Process Hazard Analysis psi pounds per square inch (1 psig = 6.89 kPa) PSM Process Safety Management (OSHA) RMP Risk Management Program (EPA) ROSOV Remotely Operable Shut-Off Valve TCEQ Texas Commission on Environmental Quality UDS Ultramar Diamond ShamrockValero - Sunray July 2008

6 

## EXECUTIVE SUMMARY

On February 16, 2007, a liquid propane release from cracked control station piping resulted in a massive fire in the propane deasphalting (PDA) 1 unit at Valero’s McKee Refinery near Sunray, Texas, injuring three employees and a contractor. The fire caused extensive equipment damage and resulted in the evacuation and total shutdown of the McKee Refinery. The refinery remained shut down for two months; the PDA unit was rebuilt and resumed operation nearly one year after the incident. Direct losses attributed to the fire were reported to exceed $50 million. 2
The following are key findings of the Chem ical Safety Board’s (CSB) investigation:

1. The propane release was likely caused by the freeze- related failure of high-pressure piping at a control station that had not been in service fo r approximately 15 years. The control station was not isolated or freeze-protected but left c onnected to the process, forming a dead-leg. 3 Water in the propane accumulated in the low poi nt formed by the control station and froze during cold weather prior to the incident, cracking an inlet pipe elbow. Ice sealing the failed pipe from the process melted as the air temperat ure rose on the day of the incident, releasing 4,500 pounds per minute of liquid propane, which ignited.

2. The refinery did not conduct a management of change 4 review when the control station was removed from active service in the 1990s. C onsequently, the freeze-related hazards of the

1 The McKee propane PDA unit uses liquid propane as a solven t to separate gas oil from asphalt. The gas oil is fed

to other units in the refinery for further processing. The asphalt is sold as paving material. 2 RMP submittal, December 2007. 3 A dead-leg is a section of piping connected to the process that has no flow through it. 4 Management of change is a systematic method for reviewing the safety implications of modifications to process technology, facilities, equipment, chemicals, organizations, policies, and standard operating practices and procedures.Valero - Sunray July 2008

7 dead-leg formed by the control station were not identified or corrected when the change was made.

3. The McKee Refinery’s freeze protection practices did not ensure that process units were systematically reviewed to identify and mitigate freezing hazards for dead-legs or infrequently used piping and equipment.

4. American Petroleum Institute (API) 5 -recommended safety practices for oil refineries do not provide detailed guidance on freeze protection pr ograms, nor do they sufficiently stress freeze protection of dead-legs, or of infreque ntly used piping and equipment.

5. The rapidly expanding fire prevented field opera tors from closing manual isolation valves or reaching local pump controls to isolate the high-pressure propane being vented to the atmosphere. Control room opera tors were unable to shut off the flow of propane because remotely operable shut-off valves (ROSOVs) 6 were not installed in the PDA. The lack of remote isolation significantly increased the duration and size of the fire, resulting in extensive damage to the PDA, the main pipe rack, and an adjacent process unit.

6. API provides safety guidance for the use of RO SOVs in LPG storage installations, but does not address their use in refinery process un its handling large quantities of flammable materials. Valero internal standards require th e use of ROSOVs in such process units, but the McKee Refinery had not retrofitted them in the PDA unit.

5 The API, an industry trade group, publishes recommended practices and standards widely used in the refining

industry. 6 ROSOVs, also called emergency isolation valves (EIVs), are equipped with actuators and are configured to be

quickly and reliably operated from a safe location, such as a well-sited control room.Valero - Sunray July 2008

8 7. Flame impingement on a non-fireproofed structural support caused a pipe rack to collapse, significantly increasing the size and duration of the fire, and led to the evacuation and extended shutdown of the refinery.

8. API-recommended practices and Valero standards for fireproofing do not provide sufficiently protective guidance for fireproofing distance fo r pipe racks near process units containing high-pressure flammables.

9. The exposure of three one-ton chlorine containers to radiant heating from the fire led to the release of approximately 2.5 tons of highly toxic chlorine, 7 which was used as a biocide in an adjacent cooling tower. Biocides that are inhe rently safer than chlorine are available.

10. A butane storage sphere was exposed to radiant heating that blistered its paint. The manual firewater deluge valve for the butane sphere was located too close to the PDA unit and could not be opened during the fire.

11. API-recommended practices do not require the evaluation of hazards posed by adjacent process units when specifying the design, operation, or location of firewater deluge valves.

12. The McKee Refinery’s Process Hazard Analysis was ineffective in identifying and addressing the

• risk of pipe failure due to freezing,

• need for ROSOVs in the PDA unit to rapidly isolate LPG releases, and

• hazards posed by fire exposure to neighbor ing equipment, including the chlorine ton containers and the butane storage sphere.

7 Chlorine has a permissible exposure limit (PEL) of 1.0 ppm, and is listed by the Environmental Protection Agency

(EPA) as an extremely hazardous substance (EHS).Valero - Sunray July 2008

9 This CSB report identifies root and contributing cau ses, and makes recommendations to Valero Energy Corporation, Valero–McKee Refinery, the API, the United Steelworkers Union, and Steelworkers Local
13-487.Valero - Sunray July 2008

10 PG) 

## 1.0 Introduction

1.1 Background At 2:09 p.m. on Friday, February 16, 2007, liqui d propane under high pressure was released in the Propane De-Asphalting (PDA) 1 unit of Valero’s McKee Refinery, 50 miles north of Amarillo in the Texas panhandle, near the town of Sunray. The resulting propane vapor cloud found an ignition source, and the subsequent fire injured workers, damaged un it piping and equipment, and collapsed a major pipe rack. The fire grew rapidly and threatened surroun ding units, including a Liquefied Petroleum Gas (L storage area. Fire-fighting efforts were hampered by high and shifting winds and the rapid spread of the fire. A refinery-wide evacuation was ordered appr oximately 15 minutes after the fire ignited.
Three of the four workers injured were seriously burned, including a contractor. The refinery was completely shut down for just under two months, a nd operated at reduced capacity for nearly a year.
Because of the serious nature of this incident, the U.S. Chemical Safety and Hazard Investigation Board (CSB) launched an investigation to determine root and contributing causes and to make recommendations to help prevent similar incidents.



### 1.2 Investigative Process The CSB investigators arrived at the McKee Refinery the morning of Sunday, February 18, 2007. The CSB interviewed Valero and contr actor personnel, reviewed company documents and data from the PDA unit’s computerized control system, examined ph ysical evidence, and tested valves and piping components. The CSB investigation team was aide d by experts in metallurgical analysis and highpressure flow testing. The investigation focused on the refinery’s programs to identify and address

1 The McKee PDA unit uses liquid propane as a solvent to separate gas oil from asphalt. The gas oil is fed to otherValero - Sunray July 2008

11 process hazards, and on the fire protection measures used in and around the PDA unit. Investigation activity was coordinated with the U.S. Occupational Safety and Health Administration (OSHA); the U.S. Environmental Protection Agency (EPA); and the Texas Commission on Environmental Quality (TCEQ).


## 2.0 Valero Energy Corporation

2.1 Company History
Valero Energy Corporation was formed in 1980 as a natural gas-gathering company 2 based in San Antonio, Texas. In the early 1980s, the company bega n expanding into the refining industry, and in 1997, separated its refining and marketing businesses into an independent company under the Valero name.
Valero Energy expanded rapidly in the late 1990s and early 2000s, as it acquired 16 U.S. refining facilities, as well as plants in Quebec, Canada; and Aruba. Valero Energy became North America’s largest refiner in 2005, operating 18 refineries 3 with capacity of approximately 3.3 million barrels per day (bpd). In 2006 the company had assets of approxima tely $33 billion; annual revenues of $91.8 billion; and 21,800 employees. 4



### 2.2 McKee Refinery The McKee Refinery in Sunray, Texas, was built in 1933 by Shamrock Oil and Gas Company. 5 Major unit upgrades were made in the 1950s, 1990s, and, most recently, in 2004. The refinery became part of

units in the refinery for further processing. Th e asphalt is sold for use in paving materials. 2 Gathering companies consolidate gas production from many natural gas wells into one or more large production

pipelines for treating and distribution. 3 This number includes two separate plants (east and we st) at one physical location. Since the February 2007

incident, Valero has divested its Lima, Ohio, refinery, bringing Valero’s total to 17. 4 Dunn & Bradstreet, Directory of Corporate Affliations, s.v. “Valero Energy Corporation,” dated Dec. 11, 2007,

accessed Dec. 13, 2007. 5 Handbook of Texas Online , s.v. "Diamond Shamrock."

http://www.tshaonline.org/handbook/online/articles/DD/hed6.html , accessed Jan. 2, 2008.Valero - Sunray July 2008

12 Valero in late 2001 when Ultramar Diamond Shamrock (UDS), the previous owner, merged with Valero Energy.
On July 29, 1956, the McKee Refinery experienced a tragic workplace accident when a light hydrocarbon storage vessel failed catastrophically during a fire, resu lting in the deaths of 19 emergency responders.
The refinery processes 170,000 barrels of crude oil per day, and distributes its products by pipeline to customers in Texas, New Mexico, Arizona, Colorado, and Oklahoma.



### 2.3 Propane Deasphalting (PDA) Unit The PDA unit ( Figure 1 ) recovered fuel feedstock and pavi ng-grade asphalt from the heavy bottoms (pitch 6 ) produced in the refinery’s vacuum crude o il fractionator. In the McKee PDA process, two liquid/liquid extraction towers used liquid propane as a solvent to extract gas oil 7 from the pitch under approximately 500 pounds per squa re inch (psi)(3,447 kPa) pressu re. The recovered gas oil was processed into gasoline in another refinery unit. The asphalt produ ced was sold for use in paving materials. Figure 2 is a simplified process flow di agram for the No. 1 Extractor, including the location from which the propane was initially released.

6 Pitch is the heavy, viscous material discharged from the bottom of the vacuum fractionator after the lighter

fractions have been removed – the heaviest hydrocarbon mixture produced from crude oil in the refinery. 7 Gas oil is a hydrocarbon mixture with molecular weight and viscosity somewhat higher than diesel.Valero - Sunray July 2008

13 Figure 1. PDA unit location in the McKee Refinery The relatively dense pitch entered an upper section of th e extractor and flowed to the bottom of the tower. Less dense liquid “wash” propane entered a lower section a nd flowed to the top of the extractor. Internal structures in the tower promoted effective contact between the two streams. DeAsphalted Gas Oil (DAGO) extracted from the pitch flowed out of the t op of the tower with much of the propane. This liquid flowed through a series of flash drums 8 to remove propane from the gas oil. The DAGO was sent elsewhere in the refinery for processing.
A mixture of asphalt and propane flowed from the bottom of the extractor. This stream was also heated and flashed to remove entrained propane, and the asphalt sent to storage.

8 This is referred to as “flashing,” in which the pressure of a liquid mixture is suddenly reduced, causing light

materials to vaporize, or “flash off,” separating them from heavier liquid components.Valero - Sunray July 2008

14 Figure 2. No. 1 Extractor si mplified process flow diagram Propane from the various flashing steps was condensed and sent to either the low- or high-pressure accumulators. Propane from both accumulators w as pressurized by pumps, blended for temperature control, and recycled to the extractors. A small amount of makeup propane (about 0.5 percent of the circulating propane rate) en tered the low-pressure accumulator to re place losses. Operators told the CSB investigators that the makeup propane contained a variable amount of entrained water, which was regularly drained from the low points on the accumulators. 9 Appendix A contains a more detailed process flow diagram of the PDA unit showing the major process flows and drainage p oints.

9 Many refinery streams normally contain small amounts of water.Valero - Sunray July 2008

15 

## 3.0 Incident Description

3.1 The Incident On Friday, February 16, 2007, at approximately 2:09 p.m., 10 plant personnel and contractors working in the PDA unit heard a “pop,” and saw what appeared to be steam blowing from a control station near ground level at the No. 1 Extractor tower. Plant personnel quickly determined that the escaping cloud was propane and directed workers in the area to evacuate.
The propane escaping from the high-pressure system formed a vapor cloud that traveled downwind toward the boiler house, where it likely ignited. 11 The flames flashed back to the leak source. Surveillance video ( Figure 3 ) shows the fire developing rapidly as flames impinged on piping around the No. 1 Extractor, releasing additional propane.
A steel support column on the east/west (E-W) pipe r ack was impacted by a high-pressure propane jet fire. The column, which was not protected by firepr oofing insulation, buckled, collapsing the rack and causing multiple pipe failures. Liquid petroleum products discharged from the damaged pipes, contributing to the rapid spread of the fire and the damage caused to surrounding equipment, such as the No. 2 Cooling Tower and No. 4 Naphtha Column.

10 The time of 2:09 p.m. is based on control system records examined after the incident. 11 Nearby fired heaters were anot her possible source of ignition.Valero - Sunray July 2008

16 Figure 3. Approximately 90 seconds af ter ignition (from surveillance video) 

### 3.2 Injuries Two Valero employees, who have since returned to wo rk, and one contractor were seriously burned in the initial flash fire. The injured contractor continued to receive medical treatment for over a year after the incident. A member of the fire brigade received minor burn injuries while setting up fire-fighting equipment early in the response. Ten other Valero employees and contractors were treated for minor injuries and released. There were no fatalities and no reported off-site injuries.



### 3.3 Emergency Response and Refinery Evacuation According to Valero’s incident response records, th e fire alarm was activated at 2:10 p.m., about one minute after employees heard the “pop” of the initial release. The refinery’s emergency response team approached the fire, staging from the south. They atte mpted to activate stationary fire water monitors, butValero - Sunray July 2008

17 the high and shifting winds and the rapid growth of the fire hampered their efforts.
Fifteen minutes after the fire erupted, managers at the Emergency Operations Center (EOC) ordered a total refinery evacuation. Refinery alarm records show that the evacuation alarm sounded at 2:26 p.m. The EOC tactical operations director later stated th at the main concerns driving the evacuation decision were the number of pressurized pipes rupturing as th e pipe rack collapsed and the proximity of the responders to the liquid propane filled extractor vessels, which were engulfed in flames and possibly at risk of failing catastrophically. This decision pu lled responders and workers away from a rapidly deteriorating situation that c ould have endangered many lives.
The refinery was shut down by isolating main feeds and the fuel gas supply. Emergency response teams later entered to isolate fuel sources, gradually shrinking the fire. Valero planned to stage a joint entry with responders from the nearby Conoco Phillips refinery 12 to extinguish the fire the following day; however, chlorine and sulfuric acid leaks 13 made this entry too hazardous. Th e fire was extinguished by Valero personnel on Sunday afternoon, February 18, 2008, approximately 54 hours after it ignited.



### 3.4 Aftermath The refinery remained completely shut down for nearly two months. Media reports indicated spot shortages of reformulated g asoline in Denver, Colorado, 14 in the weeks immediately following the fire. This incident occurred during a period when unplanne d refinery outages kept approximately 480,000 bpd

12 Refineries often establish mutual aid agreements to in crease the resources available for responding to large

emergencies. 13 The chlorine and sulfuric acid were used to treat water circulating in a nearby cooling tower. 14 Reformulated gasoline contains a specified content of oxygenated fuels to meet EPA requirements for automotive

emissions in certain regions. Valero’s McKee Refinery is located approximately 400 miles from Denver, and typically supplies, via pipeline, much of the gasoline consumed in the Denver market.Valero - Sunray July 2008

18 of capacity offline nationwide, of which 170, 000 bpd was attributed to the McKee fire. 15 Operations resumed at reduced throughput roughly two months after the fire.
The PDA unit was heavily damaged ( Figure 4 ). Much of the piping, control wiring, and heat exchange equipment in the area of the extractors was destroye d and major equipment items, including the extractor towers, required extensive evaluation to determine if th ey were safe for continued use. Valero restarted the rebuilt PDA unit in January 2008, nearly one year after the fire, restoring the refinery to full production capacity.



### 3.5 Near-Miss Events The Center for Chemical Process Safety 16 , 17 (CCPS) defines a near-miss as “an extraordinary event that could reasonably have been expected to result in negative consequences, but actually did not” (1992). Two events during the February 16 fire could have re sulted in serious, or even catastrophic, consequences if the wind direction had been differe nt or if personnel had been nearby.



### 3.5.1 Butane Sphere He at Exposure At the time of the initial propane release, the wind was blowing from the west-northwest, pushing the fire in the general direction of the boiler house. Inte rviews, records, and security camera video footage indicate that the wind shifted several times dur ing the fire, forcing the EOC to relocate.

Radiant heat from the intense PDA fire blistered the paint on a 10,000 barrel (420,000 gallon) capacity butane storage sphere located 270 feet northwest of the No. 1 Extractor ( Figure 4 ). Fortunately, the wind

15 http://tonto.eia.doe.gov/oog/info/twip /twiparch/080221/twipprint.html; accessed Feb 2008. 16 The CCPS, an industry-sponsored affiliate of the Ameri can Institute of Chemical Engineers, publishes widely

recognized process safety guidelines. 17 CCPS defines process safety as a “discipline that focuse s on the prevention of fires, explosions and accidental

chemical releases at chemical process facilities.” Pr ocess Safety Management (PSM) applies management principles and analytical tools to prevent major accidents (CCPS, 1992).Valero - Sunray July 2008

19 tended to move the flames away from the sphere; st rong winds from the southeast might have greatly exacerbated the sphere’s thermal exposure. Even with favorable winds, heat from the fire kept responders from reaching the fire water deluge system valve for the sphere, preventing them from establishing a protective flow of water over its surface. During inte rviews, emergency responders indicated that they were concerned for the safety of the butane sphe re, in light of a recent commemoration of the 1956 incident in which the failure of a vessel in similar service caused 19 fatalities.

Figure 4. Aerial photograph of damage from the PDA unit fireValero - Sunray July 2008

20 

### 3.5.2 Chlorine Release
Post-incident examination revealed that three one-t on chlorine containers in a cooling tower water treatment shed were subjected to radiant heating due to their proximity to the PDA unit (100 feet to No. 2 Extractor) and pipe rack (20 feet). All three contai ners vented when their fusible plugs, installed to prevent container rupture, melted as designed. One container ruptured despite the operation of its fusible plugs, and another vented completely. The third de veloped a leak through a partially melted plug that was repaired by emergency responders using self-c ontained breathing equipment for protection against the toxic vapor. More than 2.5 tons of chlo rine, an extremely toxic material, were released. 18
Fortunately, emergency responders a nd other refinery personnel had pulle d back from the area before the major chlorine release likely occurred. 19 There is no evidence that personnel on- or off-site were exposed to hazardous levels of chlorine gas. However, if responders had been nearby when the cylinders released their contents, significant exposures could have occurred.


## 4.0 Incident Analysis

This section provides detailed analysis of the sequence of events and causal factors leading to the origin and spread of the February 16, 2007, fire and its impact on adjacent equipment.

18 Chlorine has an OSHA PEL of 1.0 ppm; an NFPA toxicity rating of 4, the highest possible; and is listed by the

EPA as an EHS. 19 The CSB investigators could not precisely determine the tim e of release, but it was likely shortly after the collapse

of the main E-W pipe rack, when a large pool fire burned just south of the chlorine container storage pad.Valero - Sunray July 2008

21 

## 4.1 Incident Sequence
In this incident, water settling out of a pr opane stream likely leaked through a 10” NPS 20 (250 DN) inlet block valve and accumulated in the low point formed by a control station ( Figure 5 ). The control station was connected to the process, but had not been used for approximately 15 years. A period of cold weather likely froze the water, fracturing the pipe elbow upstream of the control valve. Warmer weather then melted the ice, resulting in a release of hi ghly pressurized liquid propane through the fractured elbow. Appendix B contains a detailed time line of the incident.

Figure 5. Propane mix control station schematic (not to scale) 

### 4.1.1 February Cold Weather
National Weather Service records indicate that th e Texas panhandle typically experiences periods of below-freezing weather during the winter, often in Febr uary. The 2007 cold snap began four days before the fire at the Valero-McKee Refinery, when te mperatures dropped below 32°F and stayed below freezing for 87 hours. The average temperature in nearby Dum as, Texas, on February 14, 2007, was 26°F. A low temperature of 6°F was reached early in the morning of February 15. The temperature did not rise above

20 NPS refers to U.S. Nominal Pipe Size. Dimensions of NPS pipe and fittings are specified in the American Society

of Mechanical Engineers (ASME) standard B36.10. The metric equivalent is given in millimeters, nominal diameter (DN).Valero - Sunray July 2008

22 freezing until the morning of February 16, approx imately five hours before the incident (Weather Underground, 2007).



### 4.1.2 Propane Mix Control Station Inle t Elbow Freezing and Failure The 6” NPS (150 DN) propane mix control valve originally mixed liquid propane into the pitch fed into the No. 1 Extractor. Due to a change in extractor control in the 1990s, use of the control valve was discontinued; however, this subsection of the No. 1 Ex tractor was left connected to the process under high
pressure. 21 The block valves around the control valve were closed, but the subsection was not removed or positively isolated from the process using slip blinds. 22 The refinery conducted no formal process safety management of change (MOC) review of this idled control station. 23
The station’s configuration made it a dead-leg: a secti on of piping connected to the process with no flow through it. Water in the propane likely sank into th e dead-leg, leaked by the inlet block valve, and accumulated in the control station piping. 24
The extended period of cold weather and the lack of freeze protection on the control station allowed the water to freeze and expand, cracking the elbow upstream of the control valve. The crack propagated along the inner radius of the elbow, the line of highest stress (Timoshenko , 1958), opening wider as it developed ( Figure 6 ). Appendix C contains a more detailed discussion of the CSB’s analysis of crack formation and propagation. The damage to the inlet el bow and the post-incident leak rate determined for the inlet block valve are consistent with the estimated initial propane release rate during the incident.

21 Senior operators in the PDA unit could not recall the exact time the control valve was last used. The change in

extractor control occurred approximately 15 years before the incident. 22 Slip blinds are solid pieces of me tal inserted between flanges to pos itively isolate piping or equipment. 23 MOC requires that changes to equipment, process, or design intent be reviewed for safety implications. It is a

required element of OSHA’s Process Safety Management regulation, promulgated in 1992, and an element of API Recommended Practice 750, Management of Process Hazards , published in 1990. 24 Water, which is insoluble (immiscible) in and denser than liquid propane, was known to be present in the propane.

Water droplets entrained in propane can accumulate in the bottom of piping and vessels.Valero - Sunray July 2008

23 Figure 6. Crack in the 10” diameter propane mix control station inlet elbow


### 4.1.3 Thaw and Propane Release On February 16, 2007, shortly after 9:00 a.m., ambient temperatures rose above freezing and the ice inside the elbow began to thaw. Post-incident exam ination of the control station inlet block valve ( Figure
7 ) revealed that a foreign object was jamming the valve, 25 creating a leak path. When tested in a laboratory after the incident, this valve allowed over 1,025 gpm (233 m 3 /hour) of water to leak through at process pressure. At approximately 2:09 p.m., meltin g ice opened the leak path, releasing liquid propane at 500 psig (3,447 kPa) pressure through the cracked elbow. A flammable vapor cloud rapidly formed. Based on recorded data from the PDA unit’s computer ized control system, the CSB estimated an initial propane leak rate of 4,500 pounds (2,040 kg) per minute (Appendix D describes the propane mass balance calculations used to develop this figure).Valero - Sunray July 2008

24 Figure 7. Downstream view of propane mix control station inlet block valve

The wind blew the propane cloud toward the boiler house, where it likely ignited. 26 The flames flashed back to the release point. The size and intensity of the resulting fire blocked access to manual shut-off valves and pump on-off switches that might otherwise ha ve been used to control the propane discharge. Within minutes, the fire damaged piping and pipe r ack supports, spreading the fire (Figures 4, 8, 9).

25 In gate valves, a circular gate slides against metallic seat rings, providing a leak-tig ht seal when the valve is

closed. The foreign object in the inlet gate valve prevented a tight fit between the gate and the seat rings. 26 While the boiler house was the most likely source of ignition, nearby fired heaters could not be ruled out.Valero - Sunray July 2008

25 Figure 8. Damaged 10” propane inlet on Extractor No. 1 

### 4.2 Dead-Leg Freeze Protection The initial release of propane was due to the McKee Refinery’s failure to recognize and address the freezing hazard posed by the propane mi x valve control station dead-leg.



### 4.2.1 Dead-Leg Not Recogniz ed or Addressed The McKee Refinery had not identified the station as a dead-leg. A piping and instrumentation drawing (P&ID) update project for the PDA unit, completed in 2006, identified only dead-legs that were visually apparent, such as one formed when a control valve was physically removed and its flanged connections slip-blinded. However, the P&ID update did not detect the propane mix control station dead-leg, which was formed by closing block valves in the piping.Valero - Sunray July 2008

26 A Process Hazard Analysis (PHA) 27 performed on the PDA unit in 2006 did not examine freezing as a threat to piping integrity. Furthermore, the McKee Refinery’s freeze protection program did not periodically survey process units fo r potentially freeze-prone dead-legs.



### 4.2.1.1 Inherently Safer Approach According to safety guidance by the CCPS in Inherently Safer Processes, A Life Cycle Approach (1996 ), the preferred way to control hazards is to el iminate them where possible. According to Lee’s Loss
Prevention (2005), the best approach for managing dead-legs, such as the propane mix control station, is to remove them. If removing them is impractical, other approaches, in order of decreasing protective value, could include 1) positively isolating the dead-leg by installing slip blinds; 2) freeze-protecting them; or 3) procedures to regularly monitor and drain water from low points.



### 4.2.2 McKee Refinery Freeze Protection Program Sunray, Texas, is in the north Texas panhandle, an area where below-freezing temperatures are common in February. Valero’s McKee Refinery protected piping and equipment from freezing by insulating and “tracing” with steam-filled tubing or electric heat tape. 28 It was an unwritten practice to review and repair freeze protection components every fall. However, these activities focused on maintaining existing freeze protection measures, not on periodically reviewing uni ts for dead-legs or other idle/infrequently used piping systems, or surveying process un its for areas where water could collect.
The refinery’s inspection program contained provisions for more frequent inspection of identified deadlegs, but these focused on identifying long-term corrosion issues, not acute freeze hazards. Freeze

27 OSHA defines a PHA as a “thorough, orderly, systematic approach for identifying, evaluating, and controlling the

hazards of processes involving highly hazardous chemicals.” PHAs must be updated and revalidated at least every five years under the Process Safety Management regulation 29 CFR 1910.119. 28 Heat tracing involves providing a source of heat along the length of a pipe, usually by attaching or wrapping

steam tubing or heating tape to or around the piping, and then insulating the protected piping.Valero - Sunray July 2008

27 protection is both a mechanical integrity (inspection) and operational issue, and requires an integrated approach.



### 4.2.3 Valero Corporation Freeze Protection Survey Following the McKee fire, Valero surveyed the freeze pr otection programs at its US refineries. Most of the refineries in freeze-prone areas had informal programs similar to McKee’s, while several had legacy freeze protection guidelines from previous owners. Valero did not have a corporate policy for freeze protection to set minimum standards for freeze protection programs at its facilities.



### 4.2.4 Other Dead-Leg and Freeze-Related Incidents In a 2002 brochure, Understanding the Hazard: Freeze , FM Global 29 cited “151 freeze incidents in industry with an average estimated gross loss of about $115,000 per incident from 1991 to 2000.” The following is a sampling of specific incidents identified by the CSB:

• January 1962, Texas City, TX: An entire refine ry was crippled and major process units shut down when the area experienced temperatures below freezing for 66 hours: “Dead-end water lines and steam lines froze, causing valves to break and some pipes to split”(API Publication 758, 1983).

• March 1979, Exxon, Linden, NJ: Seven injured wh en butane and propane released from a deadleg formed a large vapor cloud and exploded (Garrison, 1985).

• February 1996, Total Petroleum, Denver, CO : Abandoned pump gland oil piping under process pressure froze and then burst above a vacuum bottom pump, causing a fire ( Denver Post , June 28, 1996).

29 FM Global, a large process industry insurer, has developed widely used guidance documents.Valero - Sunray July 2008

28 • February 2001, Bethlehem Steel, Burns Harbor, IL : Freezing in a dead-leg condensate line near a coke oven led to two fatalities and four injuries (CSB 2001-02-I-IN , 2002).

• January 2008, Chevron, Pascagoula, MS: A freeze-rela ted fire was reported at the refinery. This fire is an example of incidents where freezing temperatures occur occasionally, but not consistently during the winter (AP, January 3, 2008).

The IChemE 30 BP Process Safety Series publication, Hazards of Water , also lists numerous examples of process incidents related to water freezing.



### 4.2.5 Available Industry Guidance
FM Global’s Freeze brochure (2002) describes the risk and provides guidance for evaluating susceptible piping systems, with particular emphasis for facilitie s in regions where the risk of freezing weather is intermittent. The brochure provides general guidance for mitigating the hazard, but does not describe the specifics of freeze protection programs. However, FM Global has also published a Property Loss Prevention Data Sheet, Prevention of Freeze-Ups , (2007, latest edition) that does give guidance for establishing and maintaining freeze protection programs.
Zurich, another major insurer, has published a cold weat her checklist that tells u sers to “drain the vessels and piping of idle equipment”(Zurich, 2003).
The CSB reviewed available publications by the API, an industry group that publishes voluntary standards, and found no detaile d guidance for refineries on establishing effective freeze protection
programs. 31 32

30 The Institute of Chemical Engineers (IChemE) is a UK engineering professional organization that publishes widely referenced process safety guidance. 31 API publication Safety Digest of Lessons Learned, Section 9, Precautions Against Severe Weather Conditions ,

which provided general guidance for preparing a refinery for extreme cold weather, is no longer in print.Valero - Sunray July 2008

29 

## 4.3 Fireproofing
A non-fireproofed structural support for a pipe bridge 33 spanning a 90-foot wide open area north and east of the PDA unit (Figure 9) collapsed early in the in cident, greatly increasing the magnitude of the fire. The support was located on a major E-W pipe rack nor th of the unit, outside the fireproofing distances recommended by API guidance and Valero internal standards. The collapse opened multiple lines carrying flammable and combustible materials from other areas of the refinery, contributing significantly to the damage experienced by adjacent units, and extending the time that the refinery was down for repairs. Fireproofed pipe rack support steel columns inside the PDA unit and at the No. 4 Naphtha Column all survived the fire without collapsing ( Figure 10 ).
Fireproofing is “fire resistant insulating material app lied to steel to minimize the effects of fire exposure by flame impingement, to reduce the steel’s rate of temperature rise, and to delay structural failure”(API Publication 2510A, 1996). Without fireproofing, exposed structural steel members, such as pipe rack support columns, can rapidly lose their strength and fail, possibly within minutes (API 2218, 1999; CCPS, 2003). Jet fires, such as the pressurized LPG release in this incident, can cause very rapid heating and failure of unprotected structural steel (Appendix E).

32 API 570, Piping Inspection Code , mentions a variety of hazards associat ed with dead-legs, including freezing.

API Recommended Practice 2001, Design and Construction of LPG Installations , discusses the importance of winterization and prevention programs in verifying that out-of-service pipi ng and dead-legs ar e freeze-protected. However, neither document addresses freeze protection management systems, such as requirements for a formal written program or the need for period ic inspections to identif y freeze hazards, which pertain to this incident. 33 A pipe bridge is a reinforced section of a pipe rack that carries piping over a longer than normal span.Valero - Sunray July 2008

30 Figure 9. Pipe bridge support fireproofing Fireproofing is a passive defense th at can maintain the integrity of protected structures until a fire is controlled. According to Nolan (1996), “The primary value of fireproofing is obtained in the very early stages of a fire when efforts are primarily directed at shutting down [the] process, isolating fuel supplies to the fire...and conducting personnel evacuations.”
Key guidance for fireproofing in refineries is API Publication 2218, Fireproofing Practices in Petroleum and Petrochemical Processing Plants. API Publications 2510, Design and Construction of LPG Installations , and 2510A, Fire-Protection Considerations for the Design and Operation of Liquefied Petroleum Gas (LPG) Storage Facilities , provide additional information on fireproofing in LPG 34 storage facilities. 35 These publications recommend fireproofing pipe rack support steel that is 20 to 40 feet from fuel sources for general refinery service, and up to 50 feet from LPG vessels.

34 LPG includes the following light hydrocarbons and mixtures: propane, propylene, normal and iso-butane, and

butylenes (API Standard 2510, 2001). These materials are all commonly handled as liquefied gases under pressure. 35 LPG storage facilities are commonly found in refineries, including the McKee Refinery, which had four storage

spheres northwest of the PDA unit.Valero - Sunray July 2008

31 Valero Energy Corporation’s SP-00-04, Fire Proofing Specifications , calls for fireproofing pipe racks within 30 feet of equipment with the potential to cau se a serious fire, but makes no special provisions for processes handling LPG. A loss-prevention report produ ced for the McKee Refinery listed fireproofing of pipe rack support steel, including the E-W pipe rack north of the PDA unit, as a top priority for the site fireproofing program, but the rack had not been fireproofed at the time of the incident.

Figure 10. Extractor towers (upper right) and collapsed pipe rack A failed inlet flange to the No.1 Extractor, located 77 feet away from the buckled pipe bridge support, was the most likely source of the jet fi re that collapsed the pipe bridge ( Figure 11 ). The closest major process vessel (the No. 2 Extractor) was 51 feet away from the support. These distances exceed both API’s and Valero’s recommended fireproofing distances.Valero - Sunray July 2008

32 Figure 11. Distances between the E-W pipe rack supports and the extractors API 2218 references the API 2210/2210A LPG fireproof ing distance of 50 feet, developed for pool fires in LPG storage units. Neither standard addresses fireproofing for LPG processes or jet fire scenarios, even though process unit conditions, including pressure, can be more extreme than those found in storage facilities. In this incident, the high operating pressu re of the extractors (500 psig, 3,447 kPa) likely produced a jet fire with a range and intensity beyond th at anticipated in the API standards for LPG storage releases.
In the Formosa–Point Comfort, Texas, propane/propylene fire in October 2005 that the CSB investigated, non-fireproofed steel columns supporting a critical stru cture also collapsed while adjacent fireproofed supports survived without damage (CSB 2006-01-I-TX, 2006). If the E-W pipe rack support columns inValero - Sunray July 2008

33 this incident had been fireproofed, the severity and du ration of the fire would likely have been greatly reduced. 36



## 4.4 Emergency Isolation and Shutdown
Although the PDA unit contained large inventories of high-pressure propane, it was not equipped with remotely operable shut-off valves (ROSOVs) 37 to rapidly stop propane releases. ROSOVs should be used in facilities, such as the PDA unit, where fast and effective isolation is needed to reduce the impact of major hazardous releases (HSE, 1999).

Graphic based on FM Global Property Loss Prevention Data Sheet 7-14, 2004 Figure 12. Insurer-recommended locations for ROSOVs

36 Jet fire scenarios may require the use of fireproofing ra ted for longer fire exposure and greater resistance to

erosion than might be required for protection in pool fire scenarios. 37 ROSOVs, also referred to as EIVs, are equipped with actuators and configured to be quickly and reliably operated

from a safe location, such as a well-sited control room.Valero - Sunray July 2008

34 Figure 12 shows insurer-recommended ROSOV locations for a typical process unit. ROSOVs should be installed on large inventories of highly flammable materials, 38 especially when downstream pumps are present that could produce pressurized releases. Such pumps should be interlocked to shut down when ROSOVs are closed.



### 4.4.1 American Petroleum Inst itute (API) Guidance
API’s Recommended Practice 2001, Fire Protection in Refineries and API 2030, Application of Fixed Water Spray Systems for Fire Protection in the Petroleum Industry , discuss the use of isolation valves in emergencies, including considering access to valv es during fires. However, while these recommended practices briefly reference remotely operable isolation valves, they focus on fire- and heat-actuated valves and their limitations. The 2007 release of API 521, Pressure-relieving and Depressuring Systems , addresses the limitations of pressure relief systems in protecting against jet fires, and states that “unlike a pool fire, a jet fire can, in essence, be ‘turned off” through isolation and depressu rization of the jet fire
source...” 39 However, none of these guidance documents provide specific guidance on the design, location, and use of ROSOVs for the rapid is olation of LPG processes during emergencies.



### 4.4.2 Valero Corporate Emergency Is olation Valve (EIV) Standard
Valero’s Emergency Isolation Valve Standard (SP-40-01) requires evaluation and installation of ROSOVs during new construction projects, and application of the standard during PHA revalidations in existing

38 Guidance varies on appropriate threshold quantities for installing ROSOVs. Valero’s corporate procedure gives

highest priority to installing ROSOVs on vessels containing more than 10,000 pounds of LPG-like materials (NFPA Class 4 flammables), such as propane. One insurer recommends ROSOV use on flammable inventories greater than 4 m 3 (4,225 gallons) in volume. The UK’s Health and Safety Executive (HSE) recommends installing the capability to physically isolate “large” inventories of hazardous substances. 39 API 521 (5 th ed.) also highlights the need for an integrated approach to mitigating jet fire hazards, including

fireproofing and other measures in addition to emergency isolation capability. However, it does not provide detailed guidance.Valero - Sunray July 2008

35 process units, such as the PDA. 40 The standard specifies giving the highest priority to installing EIVs on vessels containing 10,000 pounds or more of National Fire Protection Association 41 (NFPA) Class 4 materials, such as propane. 42 The CSB confirmed that both the high- and low-pressure accumulators (as well as the extractors) could contain well over 10 ,000 pounds of propane under normal operating conditions, 43 yet neither was equipped with ROSOVs no r was SP-40-01 applied as required during the 2006 PDA unit PHA revalidation. A UDS PHA in 1996 ha d identified the need for ROSOVs in the PDA unit; however, they were never installed, and the action item was incorrectly closed out as having been completed.



### 4.4.3 Formosa–Point Comfort, Texas, Incident In a similar incident in 2005 involving an uncon trolled release of LPG (CSB-2006-I-TX), operators were also unable to reach locally operated valves to isol ate the fuel source of the fire. The resulting fire extensively damaged Formosa Plastics Corporation’s Po int Comfort, Texas, Olefins 2 unit. In both the Formosa and Valero incidents, the use of ROSOVs w ould have enabled operators to quickly control the initial releases, prevent the rapid spread of the fires, and mitigate the serious damage that occurred.


## 5.0 Near-Miss Analysis

Near-misses are extraordinary events that could r easonably have been expected to result in negative consequences, but actually did not. Examples of n ear-misses include releases of flammable vapors that

40 OSHA’s PSM regulation requires PHAs to be periodically “updated and revalidated.” CCPS (2001) states that

PHAs are revalidated to “produce an updated PHA that adequately identifies, evaluates, and proposes controls for the hazards of the process, as they are currently understood.” 41 The NFPA develops widely recognized consensus fire protection codes and standards. 42 The NFPA classifies the degree of hazard of a material on a scale of 0-4, w ith 4 the most hazardous or “severe.”

Class 4 flammable materials are defined as either gases or materials that will flash to a gas at ambient temperature, such as LPG. The 10,000 pound criterion in the Valero standard applies to either the mass of a single Class 4 material or to the Class 4 components of a mixture. 43 Based on control system data and fiel d measurements of the vessel diameters.Valero - Sunray July 2008

36 dissipate without igniting, activation of safety prot ective and shutdown systems, and process conditions that exceed predefined control limits (CCPS, 1992).
In this incident, two near-misses resulted from the expos ure of nearby equipment to radiant heating by the fire. While no injuries or serious damage resu lted, under slightly different circumstances the consequences could have been much more serious, even catastrophic.



### 5.1 Chlorine Release

5.1.1 Damage to Chlorine Containers Three one-ton containers of highly toxic 44 liquid chlorine, used in cooling tower water treatment, were located in a shed approximately 100 feet from the PDA unit ( Figure 4 ). The fire exposed the containers to radiant heating, rupturing one ( Figure 13 ) despite the melting of its fusible plugs, and causing the other two to vent chlorine through their melted plugs. 45 Valero reported to the Texas Commission for Environmental Quality (TCEQ) that 5,332 pounds of chlorine were released (see Section 7.2 ). Fortunately, responders had pulled back from the area pr ior to the release and no injuries were attributed to chlorine exposure.

44 The NFPA rates chlorine’s health risk as a “4,” the most hazardous rating. 45 Fusible plugs are safety devices that use metal alloys that melt at comparatively lo w temperatures, in this case

roughly 155 o F (68 o C) to vent containers exposed to excessive hea ting. The one-ton container that ruptured was likely exposed to an extrem ely high radiant heat flux, causing the container wall to weaken due to overtemperature and fail before its contents could be vented through the fusible plugs.Valero - Sunray July 2008

37 The cooling tower water treatment shed served the No. 2 Cooling Tower, directly to the north; however, the shed did not need to be located next to the P DA unit and pipe rack. Furthermore, the PHA for this system had not examined the hazards of locating th e chlorine containers close to the PDA unit. Following the incident the refinery rebuilt the treatment system, using bleach as the biocide, on the north side of the cooling tower.
Chlorine was used at the McKee Refinery to preven t microbial growth in cooling water; however, its toxicity made it an inherently hazardous material to work with. 46 The release of the contents of a single one-ton container of chlorine can create toxic effects up to three miles away, presenting a serious risk to workers and the public. 47



### 5.1.2 Inherently Safer Alternatives In applying inherent safety principles, 48 the preferred approach to control hazards is to eliminate them. However, if elimination is not feasible, repl acing hazardous materials with less dangerous ones (substitution) should be examined ( CCPS, 1996). This basic principle was described by noted process safety expert Trevor Kletz, who stated that “what you don’t have can’t leak” (1998).

46 The EPA’s toxic endpoint for chlorine release modeling (the Emergency Planning Response Guideline-2

concentration) is 3 ppm. The National Institute fo r Occupational Safety and Health (NIOSH)-recommended exposure limit is 0.5 ppm. 47 Based on the CSB runs of the EPA’s “RMP Comp” softwa re, v. 1.07, 2,000 pound release, RMP worst case, rural area (appropriate for the McKee Refinery’s location). 48 “A chemical manufacturing process is in herently safer if it reduces or elim inates the hazards associated with materials and operations used in the pr ocess, and this reduction or eliminati on is permanent and inseparable” (CCPS, 1996).Valero - Sunray July 2008

38 Figure 13. Ruptured one-ton chlorine container Safer materials for controlling biological growth in co oling towers are available, and Valero has identified replacing chlorine in cooling water treatment at all its refineries as a safety goal in its 2008-2012 Strategic Plan. The plan noted that 10 of its 18 refineries ( as of May 2007) used ton container quantities of gaseous chlorine as a cooling water biocide. The McKee Refinery substituted sodium hypochlorite (bleach) for chlorine in its No. 2 Cooling Tower during PDA unit r econstruction. Bleach essentially stores chlorine in a form that presents a much lower inhalation hazard, an example of the inherently safer principal of attenuation (Kletz, 1998). 49 , 50



### 5.2 Butane Sphere Deluge Valves

5.2.1 Heat Damage to Butane Sphere Four 10,000 barrel (420,000 gallon, 1590 m 3 ) spherical tanks storing LPG were located northwest of the PDA unit (see Figure 4 , page 19 ). At the time of the incident, the tank closest to the PDA unit contained

49 Kletz states, “The worst that can happ en with hypochlorite is far less than the worst effects of chlorine, and on

balance the change seems justified.”Valero - Sunray July 2008

39 approximately 3,600 barrels (151,000 gallons, 572 m 3 ) of liquid butane under pressure, and was exposed to radiant heat from the fire. Figure 14 shows heat damage to the white protective coating on the tank’s exterior.

Figure 14. Heat-damaged coating on s phere and location of sphere deluge valves Analysis of the overall effects of the fire revealed significant vessel damage as far as several hundred feet away from the PDA unit, generally downwind from th e initial release, and including the insulated No. 4 Naphtha Column. Although the wind shifted several times during the fire, it never blew strongly from the southeast, which would have directed the flames toward the uninsulated butane sphere. Exposure to direct flame impingement or to significant heating over a prolonged period might have resulted in a vessel failure with potentially catastrophic consequences.

50 Using bleach requires chlorine hand ling at the bleach production facility.Valero - Sunray July 2008

40 Emergency responders were unable to reach the fire water deluge valves intended to protect the butane sphere (Tank 195) from excessive hea ting due to fire exposure. The se manual valves were located under a pipe rack north of the PDA unit ( Figure 14 ), and were too close to the fire to be safely approached.
While the butane sphere was equipped with pressure relief devices, these primarily protect against the effects of pool fires on the liquid filled (wetted) portion of the sphere. In a pool fire, the liquid butane boils, cooling the wall of the sphe re and generating vapor that woul d vent through the relief system. 51 The vapor-filled section of the sphere facing the PDA fi re had no liquid to provide cooling, and could be protected against excessive heating only by applying wate r to the external surface via the deluge system. Without deluge protection, the sphere was vulnerabl e to possible failure through loss of metal strength due to over-temperature. While favorable winds limited the sphere’s thermal exposure during this incident, the inability of operators to reach the del uge valves to establish water flow over the sphere was nonetheless a serious failure of the butan e sphere’s fire protection system.
API standards do not require refineries to evaluate hazards from nearby units when locating fire water deluge valves, and Valero’s PHA for the LPG sphere s did not examine the possibility that a fire could block access to the valves. 52



### 5.2.2 Effective Deluge Valve Operation API Standard 2510, Design and Construction of LPG Installations , provides guidance on the design of LPG storage systems, and includes details on deluge system requirements for fire protection. API 2510 specifies the use of manual deluge valves, such as th e ones used for the LPG spheres, and specifically

51 API 521, Pressure-relieving and Depressuring Systems , describes the design and application of pressure relief

systems for pool fire scenarios.Valero - Sunray July 2008

41 allows the use of automatic or remotely operated valves 53 only if the tanks are unattended or partially attended, which was not the case at the McKee Refinery.
Had the butane sphere deluge valve been remotely operable from a safe location at the time of the incident, emergency responders could have activat ed the water deluge system, greatly reducing the likelihood of a catastrophic vessel failure in the ev ent of an unfavorable shift in wind direction.


## 6.0 Process Hazard Analysis (PHA)

PHA is a formal method for identifying process haza rds. The PDA unit PHA revalidation performed in 2006 did not address hazards that were causal to the Fe bruary 16, 2007, incident. Furthermore, the PHAs performed on the water treatment system and the LPG storage spheres did not rigorously examine siting issues causal to the two near-miss incidents discussed in section 5.0

.
The CSB identified several areas where the McKee Re finery’s 2006 PDA unit PHA was ineffective in identifying hazards that contributed to the February 16, 2007, incident:

• As documented in section 4.2.1 , the process safety information developed for the PDA unit PHAs did not identify the propane mix control station as a dead-leg, which could be subject to freezing. Identifying and addressing this dead-leg could have prevented the propane release.

• The node size selected for the “HAZOP” PHA method 54 used was too large, which can lead to inadequate review of node components. In this case, the large node size likely led to the propane mix control station not being reviewed.

52 However, OSHA’s PSM compliance directive (CPL2-2.45A, Appendix B) addresses automating deluge valves to

improve protection when process units are closely spaced. 53 Automatic deluge valves are opened by a control system based on sensor input, such as high temperature or the

presence of flammable concentrations of LPG. Remote ly operated valves can be opened by facility personnel from a safe location.Valero - Sunray July 2008

42 • According to CSB interviews, the 2006 PHA did not effectively engage the operators in the review process; rather, the contract facilitator performed most of the analysis. Involving the operating staff directly in the PHA process is a key to performing an effective PHA.

• As documented in section 4.4.2 , the 2006 PHA did not apply Valero Emergency Isolation Valve standard SP-40-01 to id entify locations requiring ROSOVs. Installing these valves on the propane accumulator vessels would likely have greatly reduced the severity of the incident.

• The PHA did not revisit recommendations from ear lier PHAs to confirm that they had been properly implemented. As a result, the 1996 recommendation that ROSOVs be installed in the PDA unit was not reviewed.

Furthermore, as discussed in sections 5.1 and 5.2, the PHAs for the water treatment system and the LPG storage spheres did not address the potential fo r fire exposure from the adjacent PDA unit. The OSHA PSM regulation specifically requires consid eration of siting issues when performing PHAs. Exposure of chlorine containers and LPG storage tanks to heating from fires is a well-recognized hazard.
PHAs are an important component of a PSM syst em. Guidance on performing effective PHAs is available; examples include Guidelines for Hazard Evaluation Procedures , (2 nd ed.), and Revalidating Process Hazard Analyses , both from CCPS, and HAZOP Guide to Best Practice from the European Process Safety Center, among others.

54 For the HAZOP (hazard and operability study) PHA methodology used in this PHA, a “node” is a section of

equipment with definite boundaries (e.g., a line betw een two vessels) within which process parameters are investigated for deviations (CCPS, 1992).Valero - Sunray July 2008

43 

## 7.0 Regulatory Analysis

The OSHA PSM (29 CFR 1910.119) and the EPA Risk Management Program (RMP - 40 CFR Part 68) regulations both aim to reduce the risk of catast rophic releases of hazardous chemicals. The PSM standard addresses employer requirements to implement effective PSM programs to protect workers. RMP incorporates the elements of PSM and adds re quirements for evaluating off-site consequences, emergency response, and community outreach. Th ese regulations apply to processes containing hazardous materials above specified threshold quantiti es. The PDA and LPG storage areas were covered under both regulations, as they contained more than the specified threshold quantity (10,000 pounds) of flammable propane or butane. The cooling water treatment system was also covered under both, as it contained an above threshold quantity (1,500 pounds for PSM; 2,500 pounds for RMP) of chlorine gas.



## 7.1 OSHA Process Safety Management
The PSM regulation is performance- based and requires companies with covered processes to implement programs addressing 12 key elements, many of which ar e mutually supporting. As discussed in section
4.0 , the CSB investigation found causal deficiencies in several elements of the McKee Refinery’s PSM program, including:

• Process safety information – the propane mix cont rol station was not identified as no longer in use or as a dead-leg freeze hazard.

• PHA – the PDA unit piping was not reviewed fo r freeze rupture, Valero’s ROSOV procedure was not applied, and chlorine containe r siting issues were not considered.



## 7.2 EPA Risk Management Program (RMP)
The RMP regulation requires that covered facilities implement an RMP that includes hazard assessment, prevention program, and coordinated emergency res ponse elements. Facilities such as Valero’s McKeeValero - Sunray July 2008

44 Refinery must prepare an RMP, submit it to the EPA, and periodically update it.

The McKee RMP included an estimate of the worst-case s cenario for a toxic chemical release; a release of one ton of pressurized chlorine gas (a single one-ton container) from the water treatment facility with a toxic endpoint distance of three miles. Slightly over 2.5 tons of chlorine were estimated to have been released from the three co-located containers impacted by the fire. 55



## 7.3 Regulatory Enforcement History

Federal OSHA administers and enforces worker saf ety and health standards in Texas. OSHA had inspected the McKee Refinery twice under Valero’s ownership; however, neither inspection was PSMoriented. 56 Based on its investigation of this accident, OSHA issued three serious citations 57 to Valero for violating the PSM standard with proposed penalties of $21,000; one citation was related to the PHA, and two to the “Mechanical Integrity” elements of the PSM regulation. An informal settlement agreement 58
between Valero and OSHA resulted in one of the “seri ous” citations being reclassified as “other,” and a penalty reduction to $15,0 00, along with a stipulation that the refinery would, “as a voluntary hazard recognition measure[,]...adopt measures to manage `dead-legs’ within piping systems.”
The McKee Refinery had not been audited by the EP A prior to the February 2007 incident. While the EPA responded to the fire, it did not investigate the refinery’s RMP compliance after the incident.

55 EPA guidance requires companies to cons ider releases from co-located vessels. General Guidance for Risk

Management Programs (40 CFR Part 68), Office of Solid Waste and Emergency Response, EPA-550-B-00-008, May 2000, page I-8. 56 www.osha.gov/pls/imis. 57 OSHA, Citation and Notification of Penalty , Diamond Shamrock Refining Company, L.P., dba Valero - McKee

Refinery, Inspection Number 310690086, August 13, 2007. 58 OSHA, Informal Settlement Agreement , Diamond Shamrock Refining Comp any, L.P., dba Valero - McKee

Refinery, OSHA Inspection No. 310690086, September 4, 2007.Valero - Sunray July 2008

45 

## 8.0 Root and Contributing Causes
The CSB’s investigation determined the following root and contributing causes 59 :



### 8.1 Root Causes
1. The McKee Refinery had no formal written pr ogram in place to identify, review, and freezeprotect dead-legs or infrequently used piping and equipment, such as the propane mix control station.
2. The McKee Refinery did not apply Valero’s mandatory Emergency Isolation Valve procedure when evaluating risks in the PDA unit to ensure that the large quantities of flammable materials in the unit could be rapidly isolated in an emergency.
3. API guidance and Valero’s corporate Fire Proofing Specifications standard do not specify sufficiently protective distances for fireproofing pipe rack support steel for processes handling high-pressure flammables, such as the LPG in the PDA unit.



### 8.2 Contributing Causes
1. API-recommended practices on locating and opera ting LPG firewater deluge valves do not address potential hazards from nearby processes.
2. Valero–McKee Refinery’s hazard assessment process did not recognize the risk of using chlorine in close proximity to equipment handling flammable hydrocarbons.

59 Appendix F contains an event tree used to help develop root and contributing causes.Valero - Sunray July 2008

46 

## 9.0 Recommendations
American Petroleum Institute (API)

2007-05-I-TX-R1 Issue API-recommended practices for freeze protection in oil refinery process units that include, as a minimum:

• the establishment of a written program;

• periodic inspections to identify freeze h azards in dead-legs or infrequently used piping and equipment where water could collect;

• specific approaches to eliminate or protect against such freeze hazards; and

• identification of infrequently used pipi ng or equipment subject to freezing as a trigger for Management Of Change (MOC) reviews.

2007-05-I-TX-R2 Revise API 2218, Fireproofing Practices in Petroleum and Petrochemical Processing Plants , so that conformance with the standard addresses jet fire scenarios, and requires more protective fireproofing radii and other measures (e.g., emergency isolation valves, depr essuring systems) for pipe rack support steel near process units containing highly pressurized flammables.

2007-05-I-TX-R3 Revise API Recommended Practice 2001, Fire Protection in Refineries , and API 2030, Application of Fixed Water Spray Systems for Fire Protection in the Petroleum Industry , so that conformance with these recommended practices includes the design, installation, and use of ROSOVs and interlocked equipment controls to enable the safe and rapid emergency isolation of process equipment containing highly pressurized flammables.

2007-05-I-TX-R4 Revise API Standard 2510, Design and Construction of LPG Installations ,, and API Publication 2510A, Fire-Protection Consideratio ns for the Design and Operation of Liquefied Petroleum Gas (LPG) Storage Facilities , to address effective deluge system activation duri ng emergencies originating in nearby process units.Valero - Sunray July 2008

47 

## Valero Energy Corporation
2007-05-I-TX-R5 Identify all processes in this and ot her refineries where Valero’s mandatory Emergency Isolation Valve standard is applicable, and ensure that Remotely Operable Shut-off Valves (ROSOVs) are in stalled to control large accidental releases of flammable materials.

2007-05-I-TX-R6 Establish corporate requirements for written freeze protection programs at Valero refineries subject to freezing temperatures , including identification, mitigation, MOC, and audit requirements.

2007-05-I-TX-R7 Revise Valero standards, including Fire Proofing Specifications, to require evaluation of jet fire scenarios and, as a minimum, ensure more protective fireproofing for pipe rack support steel near process units containing highly pressurized flammables.

2007-05-I-TX-R8 Audit PHA performance at its refine ries to ensure adherence to company standards and good practice guidelines.

2007-05-I-TX-R9 Implement Valero’s strategic plan to replace chlorine used as a biocide in cooling water treatment with inherently safer materials, such as sodium hypochlorite, at all refineries. 

## Valero–McKee Refinery, United Steel workers Union, and Local 13-487
2007-05-I-TX-R10 Work together to benchmark e ffective PHA methods and practices and implement improvements to the McKee Refinery PHA program, including:

• involving the workforce in PHA preparation, performance, and follow-up;

• training participants;

• conducting PHA quality control checks; and

• following up on recommendations for time ly implementation and appropriate close-out.Valero - Sunray July 2008

48 By the
U.S. Chemical Safety and Hazard Investigation Board

John S. Bresland Chair

Gary L. Visscher Member

William B. Wark Member

William E. Wright Member

Date of Board ApprovalValero - Sunray July 2008

49 

## 10.0 References
American Petroleum Institute (API). Safety Digest of Lessons Learned. Section 9, Precautions Against Severe Weather Conditions, Publication 758, Section 6; Washington DC, 1983. API. Pressure-relieving and Depressuring Systems , ANSI/API Standard 521, with Addendum, Washington, DC, 2008. API. Fire Protection in Refineries, Publication 2001; Washington DC, 1998. API. Application of Fixed Water Spray Systems fo r Fire Protection in the Petroleum Industry , Publication 2030 ; Washington DC, 1998. API. Design and Construction of LPG Installations , Publication 2510 ; Washington DC, 2001. API. Fire-Protection Considerations for the Desi gn and Operation of Liquefied Petroleum Gas (LPG) Storage Facilities, Publication 2510A ; Washington, DC, 1996. API. Fireproofing Practices in Petroleum and Petrochemical Processing Plants, Publication 2218 ; Washington, DC, 1999. Center for Chemical Process Safety (CCPS). Guidelines for Hazard Evaluation Procedure, 2 nd ed ; American Institute of Chemical Engineers (AIChE), New York, 1992. CCPS. Guidelines for Investigating Chemical Accidents, 1 st ed; AIChE, New York, 1992. CCPS. Inherently Safer Processes, A Life Cycle Approach, AIChE, New York, 1996. Crawley, F., Preston, M., & Tyler, B., HAZOP: Guide to best practice; Institution of Chemical Engineers, Warwickshire, UK, 2000. The Chemical Safety and Hazard Investigation Board (CSB). Steel Manufacturing Incident; Washington, DC, 2002. CSB. Fire at Formosa Plastics Corporation: Evaluating Process Hazards; Washington, DC, 2006. Energy Information Administration. Lost and Found Refinery Capacity. http://tonto.eia.doe.gov/oog/info/twip/twiparch/ 080221/twipprint.html (accessed Feb 2008). Environmental Protection Agency (EPA), General Guidance for Risk Management Programs; Office of Solid Waste and Emergency Response, EPA-550-B-00-008, Washington, DC, 2000. EPA. General Guidance for Risk Management Program (40 CFR Part 68 ), RMP Series; EPA-550-B-00- 008, May 2000; p. I-8. Frank, W. & Whittle, D. Revalidating Process Hazard Analyses; AIChE, New York, 2001. FM Global. Evaluating the Hazard: Freeze; FM Global, Norwood, MA, 2002. FM Global. Property Loss Prevention Data Sheet 9-18, 17-18: Prevention of Freeze-Ups; FM Global, Norwood, MA, 2007. Garrison, W., editor. One Hundred Largest Losses: A Thirty-Yea r Review of Property Damage Losses in the Hydrocarbon-Chemical Industries; Marsh, Inc., New York, 1985. Handbook of Texas Online; Diamond Shamrock.Valero - Sunray July 2008

50 http://www.tshaonline.org/handbook/ online/articles/DD/hed6.html , (accessed Jan 2, 2008). Health and Safety Executive (UK). Emergency isolation of process plant in the chemical industry, Chemicals Sheet No. 2; HSE Books, Sudbury, England, 1999. Kletz, Trevor A. , 1998. Process plants: A handbook for inherently safer design; Taylor & Francis, Philadelphia, PA. Directory of Corporate Affiliations , s.v. Valero Energy Corporation. Lexis Nexis (accessed Dec 2007). Mannan, S., ed. Lee’s Loss Prevention in the Process Industries , 3 rd ed.; Elsevier ButterworthHeinemann, Burlington, MA, 2005. Marsh & McLennan, O ne Hundred Largest Losses , May 1985, incident # 63. The Natural Gas Council. How Natural Gas Gets to Consumers. http://www.yankeegas.com/yankeegascommon/pdfs/gastoconsumers.pdf (accessed January 24, 2008). Nolan, D., Handbook of Fire and Explosion Protection Engineering Principles for Oil, Gas, Chemical, and Related Facilities; Noyes Publications, Westwood, NJ, 1996. Occupational Safety and Health Administration (OSHA). CPL 2-2.45A (REVISED) – Process Safety Management of Highly Hazardous Chemicals -- Co mpliance Guidelines and Enforcement Procedure, Appendix B

. Washington, DC, 1992. OSHA. Citation and Notification of Penalty , Diamond Shamrock Refining Company, L.P., dba Valero - McKee Refinery, Inspection Number 310690086, August 13, 2007. OSHA, 2007. Informal Settlement Agreement , Diamond Shamrock Refining Company, L.P., dba Valero - McKee Refinery, OSHA Inspection No. 310690086, September 4, 2007. OSHA. Inspection Data. www.osha.gov/pls/imis (accessed February 2008). Riecher, A. Fateful 1956 Blast Still Remembered. Industrial Fire World , November-December 2006, p

5. Timoshenko, S. Strength of Materials, Part II ; Van Nostrand Reinhold, New York, 1958;. p. 123. Valero Energy Corporation. Valero Through the Years. www.valero.com/aboutus/history.htm (accessed on November 13, 2007). Zurich Risk Engineering. Zurich Risk Topics: Cold Weather Preparation, November 2003, 2-7-005. http://www.zurichna.com/zsc/reel.nsf/b777a 8062cedf191c12571fe0046 7717/e5da540a6edd74998 6256adc006e5a84/$FILE/cold_weather _preparation_rt_2-7.005_20031113.pdf . (accessed March 2008).Valero - SunrayJune 200851Appendix A. Flow DiagramValero - Sunray June 2008 

## Appendix B. Incident Timeline

Date Time Event Circa 1992 Extractor control changed. Propane mixture control station idled
March 1, 1996 Initial PHA of the PDA included recommendations to install ROSOVs to shut off fl ow in event of pipe leak or rupture Action item inaccurately closed out as "complete" July 13, 2001 PDA PHA revalidation did not verify actual status of recommendation to install ROSOVs January 1, 2002 Valero takes ownership of McKee Refinery

February 23-27, 2004 PSM/RMP compliance audit identified that P&IDs had not been updated and that PHA recommendations were not being resolved in a timely manner February 21-24, 2006 PDA HAZOP study did not identify the need for ROSOVs due to deficiencies in study methodology February 12-15, 2007 National Weather Service winter weather advisory in effect February 12, 2007 Sub-freezing temperat ures began. Ambient temperatures drop below 32°F for 87 hrs February 15, 2007 Minimum temperature recorded of 6°F in Dumas Texas February 16, 2007 9:05 AM Temperature rises above 32°F 1:30 PM Team personnel sign in at PDA unit Control Room 1:35 PM Board Operator issues work permit to Team personnel

2:09-2:10 PM Process flow indicators swing sharply, consistent with an initial propane release of 4,500 pounds per minute First signs of a release occurring on security camera

2:10--2:11 PM Ignition of propane vapor cloud: one contractor and two Valero workers burned. A fire brigade member is later burned during response activities 2:11 PM Fire alarm received at Dumas Fire Department 2:12 -2:15 PM Multiple fireballs/ruptures 2:15 PM First wisps of smoke visible from burning No. 2 Cooling Tower 2:16 PM Wind shifts from northwest to north affecting emergency response.

2:19-2:22 PM First water stream seen from due south Security camera capt ures multiple large fireballs/ruptures in or near the pipe rack Flames intensify

52Valero - Sunray June 2008

53 2:23 PM • Dumas Fire Department arrives on scene • Wind shifts slightly, coming from northwest ~2:24-2:26 PM Multiple fire balls/ruptures captured on camera 2:26 PM Total evacuation of refinery 3:00 PM Life Flight helicopter arrives 3:30 PM Emergency Operations Center (EOC) relocated outside refinery fence 3:40 PM EOC relocated to west of Tank 300 M3 3:50 PM Evacuated employees directed to the Dumas Community Center 4:00 PM EOC relocated SW of Tank 300 M3 4:06 PM EOC relocated east of the refinery due to wind shift. 4:15 PM EPA notified 4:25 PM EOC relocated to ammonia plant (north of refinery) February 17, 2007 ~1:00 PM Fire declared outValero - Sunray June 2008 

## Appendix C. Piping Elbow Failure Analysis

The fracture in the inlet elbow of the No. 1 Extractor propane mix control station initiated in the exterior surface (cap) welding pass of the girth weld that joined the 10” NPS inle t flange to the 10” elbow, on the intrados (the inner radius) of the elbow ( Figure C- 1 ). No flaw was observed at the initiating site, and the elbow and flange materials were within specifica tion for tensile properties and chemical composition. 1

Figure C- 1. Fractured inlet elbow

1 ASTM A105 for the flange materi al and ASTM A234 for the elbow.

54Valero - Sunray June 2008
The fracture propagated parallel to the pipe axis in both directions, with the surface exhibiting brittle fracture propagation features (Figure C-2).
Charpy V-notch (CVN) toughness tests were performed on the elbow and flange materials. Based on a 50 percent shear-area appearance, ductile to brittle tr ansition temperatures were determined to be 95 o F and
70 o F (35 o C and 21 o C), respectively. Given that this pipi ng was exposed to temperatures as low as 6 o F (-
14 o C), brittle propagation behavior could be expected in these components.

Figure C- 2. Origin and brittle propagation markers The deposited weld metal and heat-affected zone of the girth weld were CVN-tested. However, insufficient material was available to determine the complete ductile-brittle transition. Testing at -20 o F (- 29 o C) gave from 20 to 85 percent shear area appearan ce, consistent with a brittle-ductile transition temperature near -20 o F (-29 o C). However, based on the observed grai n structure, the cap weld likely had lower toughness (higher transition temperature) than the underlying weld metal, which had likely been annealed by heat from subsequent welding passes. Because the thickness of the cap was on the order of

55Valero - Sunray June 2008

56 the depth of the CVN specimen notch, it was not possi ble to measure these differences with standard or subsized CVN specimens.

Correction of the weld metal and heat-affected z one samples for the difference in thickness of the specimens and the actual pipe wall, based on the method of Rosenfeld, 2 shifts their transition temperatures 25 o F (14 o C) warmer, again implying reduced toughness at low temperatures.
The probable reduced toughness of the cap weld, combin ed with a relatively high transition temperature, likely promoted brittle failure at a point along the line of highest stress along the intrados of the elbow. Brittle initiation could possibly have been caused by dynamic loading of the elbow (e.g., an external impact), or by high internal pressures combined with low ambient temperatures. There was no evidence of impact, nor are there records of activities in the ar ea during the likely period of failure that might have applied such a dynamic load. However, ambient temperatures were as low as 6 o F (-14 o C) prior to the release, and water in the piping could easily have generated very high internal pressures as it froze and expanded. 3 The CSB concluded that the failure likely resulted from water trapped in the propane mix control station dead-leg freezing due to low ambient temperatures.

2 Rosenfeld, M.J., Procedure Improves Line Pipe Charpy Test Interpretation, Oil & Gas Journal , April 14, 1997. 3 Atypically, water expands (its density decreases) as it freezes.Valero - Sunray June 2008 

## Appendix D. Initial Propane Release Rate Background

Witness statements were consistent with the initial rel ease originating from either of two control stations. Physical examination and flow-testing of component s, as described in the body of this report, demonstrated conclusively that the release was from the cracked inlet elbow on the No. 1 Extractor propane mix flow control station. Recovered contro l system data supported the mix control station as the location of the leak, and allowed the CSB investigators to estimate the propane release rate during the first minute of the incident. The fire damaged the in strumentation in the area of the release almost immediately after the fire ignited.


## Propane Release Estimate

Data from PDA unit propane flow meters indicated a significant increase in flow upstream, and a significant decrease in flow downstream, of the No. 1 Extractor propane mix flow control station at the time of the incident. 1 This is consistent with the leak occu rring at the cracked inlet elbow of the mix control station.
Figure 1 plots the sum of the upstream an d downstream flow meter readings, in bpd. 2 The offset prior to the incident is due to an unmeasured process flow between the low- and high-pressure propane supplies upstream of the leak point. Assuming that this offset was fixed during the incident is conservative – the actual release rate was likely modestly higher than estimated here.

1 Data recovered from the PDA unit’s AspenTech IP21 datalogger, recorded at 30-second intervals. 2 Refining barrels hold 42 U.S. gallons; 100 bpd equal 2.917 gpm.

57Valero - Sunray June 2008

58 Propane release rate = [increase in upstream flow] + [decrease in downstream flow] [21,900] + [19,500] = 41,400 bpd. Based on a liquid propane density of 27.7 lb per cu bic foot at process conditions, the CSB estimated an initial release rate of 4,500 lb/min.



### 60,000 65,000 70,000 75,000 80,000 85,000 90,000 95,000 100,000 105,000 110,000

14:08:32 14:09:02 14:09:32 14:10:02 14:10:32 14:11:02 

### TimePropane Flow, BPD



### Sum Upstream Sum Downstream

Figure D- 1. Changes in propane flows upstream and downstream of the cracked elbowValero - Sunray June 2008 

## Appendix E. Response of Structural Steel to Fire Heating

CCPS’ Guidelines for Fire Protection in Chemical , Petrochemical, and Hydrocarbon Processing Facilities discusses the importance of fireproofing during the early stages of a fire, when “if nonfireproofed equipment and pipe supp orts fail due to fire related heat exposure, they could collapse and cause gasket failures, line breaks, and equipment failures, resulting in expansion of the fire.” This type of knock-on damage was a significant factor in th e damage caused by the PDA unit fire. As Figure E-1 illustrates, exposure to a jet fire, as can occur in pressu rized LPG fires, can lead to rapid heating and the failure of exposed steel within a few minutes. 1

Figure E-1. Time temperature curves for fire tests (CCPS, 2003)

1 The curves shown are based on standardized tests and are illustrative only.

59Valero - Sunray June 2008

60 CCPS describes key factors to consider when specifyi ng the required duration of fireproofing protection, including the

• time required to isolate fuel supplies;

• availability and capacity of fire-fighting water;

• time required to establish cooling from fixed fi re monitors (as were installed at the McKee Refinery), including personnel response time; and the

• time required for drainage to remove hydrocarbon spills. In this incident, the severity of the fire caused rapid knock-on damage before fuel supplies could be isolated or effective water sprays established. The use of ROSOVs, combined with fireproofed pipe rack supports, would likely have significantly re duced the damage caused by this fire.Valero - SunrayJune 2008Appendix F. Event Tree61Valero - SunrayJune 200862Valero - SunrayJune 200863Valero - SunrayJune 200864Valero - SunrayJune 200865