IN THE SUPREME COURT OF TEXAS








IN THE SUPREME COURT OF 
TEXAS
 
════════════
No. 
02-0566
════════════
 
Diamond 
Shamrock Refining Co., L.P., Diamond Shamrock
Refining 
and Marketing Co., Diamond 
Shamrock, Inc.,
Sigmor 
Corp., and Ultramar Diamond Shamrock 
Corp.,
Petitioners,
 
v.
 
Donna 
Hall, 
Respondent
 
════════════════════════════════════════════════════
On Petition for Review from 
the
Court of Appeals for the 
Fourth District of Texas
════════════════════════════════════════════════════
 
 
Argued October 1, 2003
 
 
Justice Hecht delivered the opinion of 
the Court.
 
Justice Green and JUSTICE JOHNSON did 
not participate in the decision.
 
Charles 
Hall died of burns he suffered in a refinery explosion.  His wife sued his employer, Diamond 
Shamrock Refining Co., L.P., a self-insured subscriber under the Texas Workers’ 
Compensation Act, its parent, Ultramar Diamond Shamrock Corp. (collectively 
“Diamond Shamrock”), and others for gross negligence to recover exemplary 
damages as permitted by article XVI, section 26 of the Texas Constitution[1] 
and section 408.001 of the Texas Labor Code.[2]  The trial court rendered judgment for 
the plaintiff for a portion of the damages assessed by the jury, and she and 
Diamond Shamrock both appealed.  A 
divided court of appeals reversed and remanded the case for a new trial.[3]  The plaintiff and Diamond Shamrock have 
both petitioned this Court for review.  
The dispositive issue for us is whether any 
clear and convincing evidence supports the jury’s finding that Diamond Shamrock 
was grossly negligent — more specifically, that Diamond Shamrock was actually, 
subjectively aware of the risk to Hall and was nevertheless consciously 
indifferent to his welfare.  
Applying the standard of evidentiary review adopted in Southwestern 
Bell Telephone Co. v. Garza,[4] 
we conclude that there is no such evidence.  Accordingly, we reverse and render 
judgment for Diamond Shamrock.
I
The 
explosion that resulted in Charles Hall’s death occurred when a reciprocating 
gas compressor at Diamond Shamrock’s crude oil refinery in Dumas ruptured.  The compressor, located in the Feed Prep 
Unit (FPU), compressed vapors (like hexane) 
produced in other parts of the plant so that their hydrocarbon constituents 
(like propane and butane) could be extracted and used rather than burned at the 
torch.  The compressor could not 
compress liquids (liquids, of course, cannot usually be compressed), and the 
injection of even a small amount of liquid into the compressor cylinder could 
cause it to fracture, releasing highly combustible hydrocarbons that could 
ignite and explode.  That had 
happened twice at the refinery some thirty years earlier, before the 
FPU was built, when exceptionally cold 
weather caused liquid hydrocarbons to condense out of the vapor stream in the 
compressor suction line on the way to the 
FPU.  
To prevent such problems from recurring, the 
FPU was designed to include a large suction 
drum to collect liquid hydrocarbons from the line entering the 
FPU and drain them to an underground 
accumulator drum.  The suction drum 
had a sight glass to allow the compressor crew to see if liquids were present, a 
high-level alarm to warn if the drum was filling with liquids, and an automatic 
shutoff switch for the compressor.
Circumstances 
leading to the explosion at issue here began when the Hydrocracker Unit (HCU) was restarted following a routine 
maintenance shutdown.  Although the 
HCU crew was attempting to follow the same restart procedures that had been used 
many times before, the HCU began to overheat, causing excessive vaporization of 
liquid hydrocarbons in the HCU.  
This vapor was sent to the FPU, but on 
its way it cooled, causing the liquids to condense and flow through the vapor 
line into the suction drum.  As the 
suction drum began to fill, the high-level alarm sounded, prompting the 
FPU operator to ascertain that the liquids 
were coming from the HCU.  When the 
operator saw in the sight glass that liquids were filling the suction drum 
faster than it would drain, he insisted that the HCU operator stop the 
flow.  The HCU operator requested 
permission from a plant foreman to divert the flow from the HCU to the torch or 
to storage, but permission was refused.  
Recognizing the danger of sending liquids to the 
FPU compressor, the HCU operator disobeyed 
the instructions he had been given and diverted the flow to storage.  Meanwhile, the automatic shutoff switch 
on the suction drum failed to operate, and the 
FPU crew shut down the compressor 
manually.
Liquids 
draining from the suction drum into the accumulator drum were pumped from there 
to the compressor’s discharge line.   
This took several hours, and while it was in progress, there was a shift 
change.  A new crew, including 
Charles Hall and two other men, finished the process.  After some 456 barrels had been pumped 
out, the crew checked the sight glass on the suction drum and opened bleeder 
valves on the compressor suction line to be sure no more liquids were 
present.  None were, and the crew 
then began the process of restarting the compressor.
To 
understand what happened next, one must understand the system of lines and 
valves around the compressor, as illustrated in this schematic diagram:


The 
numbers indicate where valves were positioned on the lines. Just past the 
suction drum (not shown), Valve 1, the suction valve, regulated the input to the 
compressor, and Valve 4, the discharge valve, regulated the output. Valve 2 
regulated the flow through a recirculating line that 
connected the discharge end of the compressor to its intake. All three were 
block valves that had to be manually operated by the crew. When the compressor 
was shut down, they were all closed. Valve 3 was a bleeder valve that if opened 
would release the contents of the discharge line into the open air just outside 
the compressor building. It may have been installed so that the system could be 
hydrostatically tested when it was first constructed, and it had not been used 
since. Valve 5 was a check valve with a flapper that operated automatically. 
Vapor flow from the compressor would push the flapper up; when the flow stopped, 
the flapper would fall by force of gravity to block any backflow in the 
discharge line toward the compressor. Check valves are not generally designed to 
be leak-proof, and at some earlier time (the record is not clear exactly when) 
an FPU operator thought this check valve 
leaked and had “written it up” C 
that is, asked that it be repaired. It never was. Crew members were not 
instructed to inspect Valve 5 before restarting the compressor, and Hall and his 
co-workers did not do so. Unbeknownst to them, the valve flapper inside the line 
had become detached, rendering the valve inoperable.
Liquids 
pumped from the accumulator drum entered the discharge line beyond Valve 5, as 
shown at the upper right of the schematic. When the compressor was running and 
Valves 1, 4, and 5 were open, vapor flow from the compressor flushed any liquids 
pumped from the accumulator drum down the discharge line. But when the 
compressor was stopped and Valve 4 was closed, there was a back-pressure on the 
discharge line. The line also sloped toward the compressor. Diamond Shamrock 
knew that without Valve 5, back-pressure and gravity would force liquids pumped 
into the discharge line while the compressor was stopped to run down toward 
Valve 4, and when it was opened, they would be sucked into the compressor. That 
is in fact what happened the day of the explosion. Because Valve 5 was broken, 
it did not block the liquids being pumped into the discharge line from flowing 
back toward Valve 4.
The 
compressor had been shut down and restarted many times since the 
FPU was constructed fifteen years earlier, 
and the restart procedures were clearly prescribed. Following those procedures 
to the letter, Hall opened Valve 2 and started the compressor engine. With 
Valves 1 and 4 both closed, vapor simply recirculated 
without putting any load on the compressor until its engine had warmed up. (An 
open torch line, not shown in the schematic, also reduced pressure on the system 
during startup.) The crew was then required first to open Valve 4, next to open 
Valve 1, and finally to close Valve 2, at which point the compressor would be 
back on line. Restart procedures did not call for the crew to check for liquids 
on the discharge side of the compressor, and they did not do so. Had they been 
instructed to open Valve 3, liquids would have escaped, revealing their presence 
in the discharge line. But Valve 3, as already noted, had not been used to test 
for the presence of liquids and apparently had not been installed for that 
purpose. Because it was never used, over the years it had become covered up with 
dirt. Some FPU crew members knew where it 
was, but Hall and his co-workers did not.
As 
Valve 4 was opened, gravity and back-pressure on the discharge line pushed the 
accumulated liquids that had moved down the line from the broken check valve 
into the recirculating line where they were pulled up 
into the suction of the compressor. Seconds later, the compressor began to make 
loud, knocking noises, which one crew member described as sounding like cannon 
fire. Hall’s co-worker quickly tried to close Valve 4, but the knocking 
continued. Almost immediately, a cover plate on the compressor cylinder cracked 
from the pressure, and vapor and liquids began spewing out, catching fire. The 
crew realized that to prevent an explosion, they would have to stop the 
compressor, which they could do only by shutting off the fuel to its engine. 
Before they could reach the cutoff, the compressor exploded. All three men were 
severely burned, and eight days later Hall died of his injuries.
After 
the explosion, Diamond Shamrock modified the bleeder valves in the discharge 
line, adding a collection line and an extension handle, so that they could be 
used to detect and collect liquids in the discharge line when the compressor was 
shut down, before it was restarted. Diamond Shamrock also instructed 
FPU crews to monitor the pressure on the 
compressor cylinder when the compressor was shut down to determine whether the 
discharge valve, Valve 4, or the check valve, Valve 5, was leaking.
Hall’s 
widow, Donna Hall (to whom we refer as “the plaintiff”, to distinguish her from 
her husband), sued Diamond Shamrock and three related entities for wrongful 
death. Because the Texas Workers’ Compensation Act allowed her to recover only 
exemplary damages for gross negligence, the trial court excluded all evidence of 
actual damages. Without objection, the court instructed the jury C
 
$          
that gross negligence means an act or omission C
 
(i)        
which, when viewed objectively from the standpoint of Diamond Shamrock 
Refining Company, L.P. at the time of its occurrence, involved an extreme degree 
of risk, considering the probability and magnitude of the potential harm to 
others; and
 
(ii)       of which 
Diamond Shamrock Refining Company, L.P. had actual, subjective awareness of the 
risk involved, but nevertheless proceeded with conscious indifference to the 
rights, safety, or welfare of others.[5]
 
$          
that it could find gross negligence only by clear and convincing 
evidence,[6] 
defined as “proof that produces a firm belief or conviction as to the truth of 
the allegation sought to be established.”[7]
 
The 
jury found that Diamond Shamrock Refining Co., L.P. was grossly negligent and 
assessed exemplary damages of $42.5 million. Following the announcement of the 
verdict, defendants’ counsel moved in open court “to have the court limit the 
recovery of punitive damages in this case . . . to the amount of 
$200,000” in accordance with section 41.008 of the Texas Civil Practice and 
Remedies Code.[8] 
The court agreed and rendered judgment against Diamond Shamrock for that amount 
plus prejudgment interest.
Both 
the plaintiff and Diamond Shamrock appealed. A divided court of appeals held: 
that evidence of gross negligence was legally and factually sufficient;[9] 
that section 41.008 applied;[10] 
that section 41.008 was not unconstitutional as applied;[11] 
and that Diamond Shamrock did not waive its right to the statutory cap;[12] 
but that the trial court erred by precluding the plaintiff from proving actual 
damages for purposes of calculating the statutory cap.[13] 
Accordingly, the court reversed and remanded the case for a new trial.[14] 
The court of appeals did not reach other arguments raised by the parties. 
Justice Green, dissenting, would have held that there was no evidence of the 
subjective component of gross negligence, paragraph (ii) of the definition 
quoted above.[15]
We 
granted both parties’ petitions for review.[16]
II
The 
parties have raised several arguments we need not address because, as already 
noted, we have concluded that there is no clear and convincing evidence of gross 
negligence.
The 
plaintiff argues that Diamond Shamrock waived its evidentiary challenge by 
moving in open court for judgment on the verdict. Although she acknowledges that 
Diamond Shamrock later argued that there was no evidence to support a judgment, 
she complains that Diamond Shamrock was trying to “have it both ways”, citing 
our opinion in Litton Industrial Products, Inc. v. Gammage.[17] 
There, Litton moved that judgment be rendered against it for actual damages 
rather than treble damages, but argued in an accompanying brief that it reserved 
the right to challenge any judgment.[18] 
We “disapprove[d] a practice by which a party, by motion, induces the trial 
court on the one hand to render a judgment, but reserves in a brief the right 
for the movant to attack the judgment if the court 
grants the motion.”[19] 
Unlike Litton, Diamond Shamrock did not move for judgment of a specific amount; 
it urged only that judgment not exceed what it argued was the statutory cap. 
This was not inconsistent with its arguments that no evidence supported a 
judgment of any amount. Diamond Shamrock did not waive its evidentiary 
challenge.
In 
Southwestern Bell Telephone Co. v. Garza, we held that C
 
in reviewing the legal sufficiency of evidence to support a 
finding that must be proved by clear and convincing evidence, an appellate court 
must “look at all the evidence in the light most favorable to the finding to 
determine whether a reasonable trier of fact could 
have formed a firm belief or conviction that its finding was true.”[20]
 
The 
parties in this case agree that gross negligence was required to be proved by 
clear and convincing evidence as defined in the jury charge. Accordingly, we 
apply this elevated standard of review in assessing the evidence. As in 
Garza, we follow the procedure set out in In re J.F.C.:
 
In a legal sufficiency review, a court should look at all the 
evidence in the light most favorable to the finding to determine whether a 
reasonable trier of fact could have formed a firm 
belief or conviction that its finding was true. To give appropriate deference to 
the factfinder’s conclusions and the role of a court 
conducting a legal sufficiency review, looking at the evidence in the light most 
favorable to the judgment means that a reviewing court must assume that the 
factfinder resolved disputed facts in favor of its 
finding if a reasonable factfinder could do so. A 
corollary to this requirement is that a court should disregard all evidence that 
a reasonable factfinder could have disbelieved or 
found to have been incredible. This does not mean that a court must disregard 
all evidence that does not support the finding. Disregarding undisputed facts 
that do not support the finding could skew the analysis of whether there is 
clear and convincing evidence.
 
If, after conducting its legal sufficiency review of the 
record evidence, a court determines that no reasonable factfinder could form a firm belief or conviction that the 
matter that must be proven is true, then that court must conclude that the 
evidence is legally insufficient.[21]
 
            
We focus on the subjective component of gross negligence as stated in the 
jury charge: that an actor has “subjective awareness of the risk involved, but 
nevertheless proceed[s] with conscious indifference to the rights, safety, or 
welfare of others.” The risk here was that liquids could accumulate in the 
discharge line while the compressor was shut down and be drawn into the 
compressor when it was restarted, causing an explosion like the one that 
resulted in Hall’s death. As clear and convincing proof of Diamond Shamrock’s 
actual, subjective awareness of, and conscious indifference to, this risk, the 
plaintiff points to the following evidence, which we address in three 
categories:
 
$          
Past experience and the HCU: Diamond Shamrock knew that sending 
liquids through the vapor line to the FPU 
compressor could cause an explosion, as it had on two prior occasions. Yet on 
the day of this explosion a plant foreman refused to divert liquids from the HCU 
to storage or the torch and prevent them from flooding the 
FPU.
 
$          
The check valve: Diamond Shamrock knew that liquids pumped from 
the accumulator drum emptied into the compressor’s discharge line, that the 
check valve would leak or fail, that pressure from the discharge line appeared 
to an FPU operator 
sometime earlier to be leaking past the check valve, that a request from that 
operator to fix the valve had gone unheeded, and that if liquids accumulated in 
the discharge line near the discharge valve an explosion could result. Diamond 
Shamrock’s expert testified that to know of a problem with the check valve was 
to know of a potential danger. Yet not until after the explosion was the 
FPU 
redesigned to allow the integrity of the check valve to be monitored by 
measuring the line pressure at the discharge valve.
 
$          
The absence of bleeder valves: Diamond Shamrock knew that the 
bleeder valves in the discharge line (Valve 3) could have been used to determine 
whether liquids were present, yet it did not tell Hall or his crew about the 
existence of the valves or instruct them in their use. Bleeder valves were used 
elsewhere in the refinery for that purpose, and after the explosion the bleeder 
valves in the discharge line were modified so that they could be used to check 
for liquids.
 
As 
for the first category: What Diamond Shamrock knew from the prior explosions was 
that it had to guard against liquids in the suction line, upstream from 
the suction valve (Valve 1). The suction drum, with its sight glass and 
high-level warning alarm, was intended to serve this purpose, and on the day of 
the explosion, it did. Even if the flow from the HCU should have been stopped 
sooner, that delay is no evidence that Diamond Shamrock was consciously 
indifferent to the danger of an explosion. The 
FPU was designed so that the compressor would 
be shut down before any liquids from the HCU or anywhere else reached the 
suction valve, and that is exactly what happened.
Regarding 
the check valve: Diamond Shamrock was aware of the possibility that 
liquids could backflow in the discharge line, and it installed the check valve 
to prevent back pressure in the line. This system worked without incident for 
fifteen years. Even though an FPU operator 
thought the check valve was leaking, nothing in the evidence suggests that 
Diamond Shamrock actually knew that it presented any danger of explosion. 
Certainly, no one that day imagined that liquids had traveled back through the 
discharge line toward the compressor. The FPU 
crews were careful to see that all liquids were removed from the suction line to 
the compressor, a process that took several hours. Diamond Shamrock’s failure to 
take further precautions may have been evidence of negligence. But “[e]vidence of simple negligence alone is not sufficient to 
establish gross negligence.”[22] 
There is no evidence, certainly no clear and convincing evidence, that Diamond 
Shamrock was consciously indifferent to the risk of explosion.
Regarding 
the use of bleeder valves: The bleeder valve in the discharge line (Valve 3) 
vented the flammable contents of the line into the open air. The valve had been 
used only to test the system hydrostatically when it first came on line and had 
not been used since. After the explosion, Diamond Shamrock modified the bleeder 
valves so that they could be used to check for liquids in the line, adding an 
extension to allow operation from a platform outside the building and a 
collection line to gather any contents. Its failure to make these modifications 
before the explosion may have been negligent, but again, this is not enough to 
prove gross negligence. Diamond Shamrock was not indifferent to the risk that 
liquids would accumulate in the discharge line. It installed a check valve which 
appeared to have protected against the risk for fifteen years. Diamond 
Shamrock’s failure to implement redundant safety systems is not, on this record, 
any evidence of conscious indifference to the risk of explosion.
The 
plaintiff complains that Diamond Shamrock’s arguments are tantamount to claiming 
that it was entitled to “one free explosion”, but that characterization is not 
supported by the evidence. For one thing, any explosion threatened the entire 
refinery and all of its employees, and this one certainly took a tremendous 
toll. It was by no means “free”. More importantly, the record establishes, and 
no one disputes, that refinery operations are by their very nature dangerous. 
Diamond Shamrock’s efforts to protect against those dangers were imperfect; they 
may have been negligent. But there is no evidence that Diamond Shamrock was 
unconcerned.
The 
plaintiff argues that this case is like Mobil Oil Corp. v. Ellender[23] 
and Seminole Pipeline Co. v. Broad Leaf Partners, Inc.,[24] 
cases in which the defendant was grossly negligent, but each is distinguishable. 
In Mobil Oil, there was evidence that the employer went to great lengths 
to protect its own employees from improperly handling benzene but intentionally 
did nothing to protect contract workers from the same danger, even though 
employees and contract workers worked side by side. There is no evidence in the 
present case that Diamond Shamrock intentionally did nothing to protect Hall 
from the risk of explosion. In Seminole Pipeline, the defendant’s own 
employees testified that they knew its salt dome storage safety system was 
inadequate but continued to expand storage capacity despite the risk of 
explosion.[25] 
In the present case, there is no evidence that Diamond Shamrock knew the 
FPU compressor was unsafe as designed and 
operated. We think the case is closer to Louisiana-Pacific Corp. v. 
Andrade, in which the defendant’s employees knew that electricity to an 
overhead crane near where Andrade was working had to be “locked out” 
(disconnected) and thought that had been done.[26] 
Although the employees were mistaken, there was no evidence of conscious 
indifference to the risk of harm. To the contrary:
 
“all of the testimony indicated that the [defendant’s] 
employees involved in the chain of the lock‑out process actually, 
subjectively believed that they personally had either locked‑out the crane, 
or that their personal subjective recollection of various events led them to 
believe that the crane had been locked‑out by someone prior to Andrade beginning 
work on the day in question.” And “[w]hat is further lacking from the evidence, 
even inferentially, is proof that any [of defendant’s] personnel were 
consciously indifferent to the risk of electrocution if the crane was 
energized.”[27]
 
“[W]hat 
separates ordinary negligence from gross negligence is the defendant’s state of 
mind; in other words, the plaintiff must show that the defendant knew about the 
peril, but his acts or omissions demonstrate that he did not care.”[28] 
Viewing the record in the light most favorable to the plaintiff, there is no 
clear and convincing evidence that Diamond Shamrock knew of the risk of the 
compressor explosion that resulted in Hall’s death and yet did not care.
*     
*     
*
Accordingly, 
the judgment of the court of appeals is reversed and judgment is rendered that 
Hall take nothing.
 
_________________________
Nathan L. Hecht
Justice
 
Opinion 
delivered: July 8, 
2005
 
 



[1] Tex. Const. art. XVI, § 26 (“Every person, corporation, or 
company, that may commit a homicide, through wilful 
act, or omission, or gross neglect, shall be responsible, in exemplary damages, 
to the surviving husband, widow, heirs of his or her body, or such of them as 
there may be, without regard to any criminal proceeding that may or may not be 
had in relation to the homicide.”).

[2] Tex. 
Lab. Code § 408.001(b) (“This section [making workers’ 
compensation benefits the exclusive remedy against an employer for the death or 
work-related injury of an employee] does not prohibit the recovery of exemplary 
damages by the surviving spouse or heirs of the body of a deceased employee 
whose death was caused by an intentional act or omission of the employer or by 
the employer's gross negligence.”).

[3] 82 S.W.3d 5 (Tex. App.CSan Antonio 2001).

[4] ___ S.W.3d ___ (Tex. 2004).

[5] See Tex. 
Civ. 
Prac. & Rem. Code § 41.001(11).

[6] See id. 
§ 41.003(a).

[7] See id. 
§ 41.001(2).

[8] Id. § 41.008(b) (“Exemplary damages awarded 
against a defendant may not exceed an amount equal to the greater of: (1)(A) two 
times the amount of economic damages; plus (B) an amount equal to any noneconomic damages found by the jury, not to exceed 
$750,000; or (2) $200,000.”).

[9] 82 S.W.3d at 12-18.

[10] Id. at 18-21.

[11] Id. at 21-22.

[12] Id. at 22-23.

[13] Id. at 23-24.

[14] Id. at 25.

[15] Id. (Green, J., 
dissenting).

[16] 46 Tex. Sup. Ct. J. 584 (Apr. 17, 
2003).

[17] 668 S.W.2d 319 (Tex. 1984).

[18] Id. at 321-322.

[19] Id. at 322.

[20] Southwestern Bell Telephone Co. v. Garza, ___ 
S.W.3d ___, ___ (Tex. 2004) (quoting In re J.F.C., 96 S.W.3d 256, 266 
(Tex. 2002)).

[21] In re J.F.C., 96 S.W.3d at 
266.

[22] Louisiana-Pacific Corp. v. Andrade, 19 S.W.3d 
245, 247 (Tex. 1999).

[23] 968 S.W.2d 917 (Tex. 1998).

[24] 979 S.W.2d 730 (Tex. App.CHouston [14th Dist.] 1998, no 
pet.).

[25] 979 S.W.2d at 943-948.

[26] 19 S.W.3d 245, 247-248 (Tex. 
1999).

[27] Id. at 248 (quoting Louisiana-Pacific Corp. 
v. Andrade, 964 S.W.2d 944, 953 (Tex. App.CBeaumont 1998) (Walker, C.J., dissenting))(citations 
omitted).

[28] Id. at 246-247 (citing Williams v. Steves Indus., Inc., 699 S.W.2d 570, 573 (Tex. 1985), 
and Burk Royalty Co. v. Walls, 616 S.W.2d 911, 922 (Tex. 
1981)).