BLOWDOWN DRUM FAILURE — ASPHALT UNIT — DELAYED COKER
Valero Energy Corporation Asphalt Blowdown Drum Explosion
Valero Energy Corporation
📍 Port Arthur, TX
Incident: September 16, 2007  •  CSB Report: 2012
0
Fatalities
Asphalt / Heavy Hydrocarbon (Blowdown Drum Overpressurization — Delayed Coker Blowdown System)
Chemical Involved
5
CSB Recommendations
📋 Incident Summary

On September 16, 2007, a blowdown drum at the Valero Energy Corporation refinery in Port Arthur, Texas, exploded and ejected molten asphalt material. Fourteen workers were injured, three seriously. The blowdown drum was part of the delayed coker unit's asphalt blowdown system — a vessel designed to safely receive and depressurize process materials during unit upsets and shutdowns.

The CSB investigation determined that the blowdown drum failed due to overpressurization and structural failure when it was subjected to conditions beyond its design capacity. The sequence of events that led to the failure involved process conditions during an upset that directed more material to the drum than its design accounted for.

The incident highlighted the critical importance of properly sizing blowdown drums for all credible upset scenarios and ensuring that the actual operating conditions that can direct flow to the drum are fully characterized and reflected in vessel design.

🔎 Key Findings
Finding 01
Blowdown Drum Overpressurized and Failed — Molten Asphalt Ejected
The blowdown drum failed due to overpressurization when subjected to conditions beyond its design capacity. The failure ejected molten asphalt material that injured 14 workers.
Finding 02
Drum Not Designed for Maximum Credible Upset Flow
The blowdown drum had not been designed to accommodate the maximum credible flow and pressure from all potential upset scenarios in the delayed coker unit that could direct material to the drum.
Finding 03
14 Workers Injured — Three Seriously
The ejection of hot molten asphalt from the failed drum injured 14 workers. Three workers sustained serious burn injuries from the hot material.
Finding 04
Blowdown System Design Not Verified Against All Credible Scenarios
The blowdown system design had not been verified against the full range of credible upset scenarios that could direct process material to the drum. This design verification gap left the drum undersized for actual operating conditions.
Finding 05
Delayed Coker Blowdown Systems Require Specific Design Attention
Delayed coker units generate upset conditions with high flow rates and pressures. Blowdown system design for coker units must account for the full range of coker-specific upset scenarios.
🔍 Root Causes
1
Blowdown Drum Undersized for Actual Upset Scenario Flow and Pressure
The blowdown drum was not designed to handle the flow rate and pressure from the upset scenario that directed material to the drum. The undersizing resulted in overpressurization and catastrophic failure.
2
Design Basis for Blowdown Drum Not Verified to Cover All Credible Upsets
The design basis for the blowdown drum was not verified against all credible upset scenarios in the delayed coker unit. This verification gap allowed an undersized vessel to remain in service.
☑ CSB Recommendations
→ Valero Energy / Refinery Operators
Verify that all blowdown drums and relief collection systems are designed to handle the maximum credible flow from all connected sources under all credible upset scenarios; update designs where deficiencies are identified.
→ API / Refining Industry
Provide specific guidance on blowdown system design verification for delayed coker units; address the range of coker-specific upset scenarios that must be considered in blowdown drum sizing.
→ OSHA
Evaluate blowdown drum and relief collection system design verification as a PSM enforcement focus at refineries; ensure facilities can demonstrate that blowdown systems are sized for maximum credible upset conditions.
💡 Lessons Learned
Blowdown drums and relief collection systems are safety-critical equipment — they are the systems designed to safely handle process material during exactly the upset conditions when other protective systems are being stressed. A blowdown drum that is undersized for the actual upset conditions it will receive is not a safety system — it is a pressure vessel waiting to fail at the worst possible moment.
Design verification for safety-critical equipment like blowdown drums must be conducted against the full range of credible upset scenarios, not just the design scenario specified at the time of original construction. Process changes, unit modifications, and changes in operating rates over the life of the unit can all change the conditions that reach the blowdown drum. Periodic revalidation of blowdown drum sizing is a necessary MI and PHA activity.
Molten asphalt and hot process materials ejected from a failing vessel create a serious burn injury hazard for all personnel in the vicinity. Siting of work areas relative to blowdown drums and relief devices must account for the potential for ejected material in a failure scenario. Personnel siting and occupancy management near safety-critical pressure containment equipment are process safety decisions.
MI: Mechanical IntegrityPHA: Process Hazard AnalysisSOP: Operating ProceduresPSSR: Pre-Startup Safety Review
🔨 Safety Meeting Toolbox Talk
►Have you verified that all blowdown drums and relief collection systems at your facility are sized for the maximum credible flow from all connected sources under all credible upset scenarios? When was this verification last conducted?
►Does your PHA for coker, cracker, and high-pressure process units include specific analysis of the scenarios that can direct maximum flow to blowdown drums? Have safeguard gaps been identified and addressed?
►When was the last design basis review conducted for your blowdown system? Have any process changes or operating rate changes since original design affected the maximum credible flow to your blowdown drums?
Immediate Action Items
✓Conduct a design basis review for all blowdown drums and relief collection systems; verify sizing against the maximum credible flow from all connected sources for all credible upset scenarios.
✓Add blowdown drum adequacy as a specific PHA node for all process units with connected blowdown systems; document design basis and evaluate scenario coverage.
✓Review worker siting and occupancy near blowdown drums and relief devices; confirm that work areas are positioned to minimize exposure to potential ejected material in a failure scenario.
✓Establish a periodic revalidation schedule for blowdown drum sizing that is triggered by any process change, unit modification, or operating rate change that could affect maximum credible flow.
🔗 PSM Failures Behind This Incident

This incident traced to breakdowns across 4 PSM elements (MI · PHA · SOP · PSSR). Each represents a documented gap that process safety documentation and consulting can close before a similar event occurs at your facility.

Mechanical Integrity (MI)
Equipment must be designed, inspected, and maintained to operate safely in its intended service. Mechanical integrity failures — degraded equipment, missed inspections, deferred repairs — contributed to loss of containment here.
Supporting documents in our library →
Process Hazard Analysis (PHA)
A structured PHA or HAZOP study exists to identify exactly these scenarios before they occur. When PHA is absent, superficial, or overdue for revalidation, hazards operate unseen until they kill someone.
Supporting documents in our library →
Operating Procedures (SOPs)
Operators cannot reliably hold safe operating limits without clear, current, enforced procedures. Deviation from acceptable operating conditions — a root cause here — is a direct consequence of SOP failure.
Supporting documents in our library →
Pre-Startup Safety Review (PSSR)
PSSR is the final checkpoint before hazardous chemicals are introduced into a new or modified system. When PSSR fails or is bypassed, unresolved hazards go live with the process.
Supporting documents in our library →
Process Safety Management Consulting & Document Library
📂
PSM Document Library
32 ready-to-deploy PSM documents covering all 14 OSHA elements — procedures, checklists, and audit templates built for facilities operating under 29 CFR 1910.119.
Browse the Library →
📊
Free PSM Health Score
Find out where your PSM program stands across all 14 OSHA elements. Our free health score surfaces your biggest gaps in under 10 minutes — no account required.
Check Your Score →
📞
Consulting Services
PHA facilitation, PSM program builds, compliance audits, and OSHA inspection support. Transparent flat-fee pricing — no retainer required to get started.
View Pricing →
📋 Explore the full incident library: All 132 CSB Case Studies →