Process Safety · Lesson 43 · 8 min read

A Dead Leg Can Degrade Faster Than the Flowing Line

A dead leg may have little or no normal flow, but it can remain connected to pressure and hazardous material. Because its temperature, composition and liquid level can differ from the flowing line, its damage mechanism may also be different. A sound main line therefore does not prove that an idle branch is fit for service.

Why a dead leg can behave differently

A dead leg is a portion of piping with little or no significant flow. Examples can include blinded branches, normally closed bypasses, spare equipment connections, level bridles, vents, drains, instrument connections and pressure-relief piping. The precise inventory must come from the installation's drawings and field configuration, not from a generic list.

Low flow changes the local environment. Liquids can settle, vapour can condense, solids can deposit and a thermal gradient or liquid interface can form. Where the service supports corrosion, attack may concentrate in a short band rather than spread evenly. The branch can therefore thin severely between routine measurement points while nearby pipe retains apparently normal thickness.

HSE warning: routine readings missed the local damage

HSE published a safety alert after an 8-inch vertical dead-leg relief line, about five metres long, failed catastrophically during normal refinery operation. The failure completely separated the line and released an estimated 75 tonnes of hot, extremely flammable hydrocarbon under pressure. The cloud did not ignite, so a larger catastrophe was narrowly avoided. [1]

Examination found highly localised internal thinning. The inspection regime had taken regular thickness measurements at four locations, but not at the damaged area. An adjacent relief line had a similar severe local condition that had also gone undetected. HSE highlighted thermal gradients, liquid interfaces and other local features as reasons a dead leg may need a targeted inspection strategy rather than convenient, repeated points.

CSB warning: an idle branch stayed connected to high-pressure propane

The U.S. Chemical Safety Board investigated the 2007 fire at the Valero McKee refinery. A control station had been out of service for about 15 years but remained connected to high-pressure liquid propane, creating a dead leg. Water accumulated at a low point, froze and cracked an elbow. When the ice thawed, propane escaped and ignited. Three employees and a contractor were injured, the refinery was evacuated and shut down, and extensive damage followed. [2]

The investigation found that the dead leg had not been recognised and that no formal management-of-change review had been completed when the control station was removed from service. This incident involved freezing in Texas; it does not prove that freezing is credible on every installation. Its wider lesson is that an idle, process-connected branch can develop conditions that the active process line does not reveal.

Hypothetical FPSO example: the spare branch is outside the inspection picture

Hypothetical example—not a documented incident: A team reviews a normally closed bypass around an FPSO produced-water control valve. The bypass remains process-connected, includes a low point and has not carried planned flow for several years. Inspection history covers the main line and the accessible ends of the bypass, but not the region where the corrosion review predicts a liquid interface could sit.

The team does not assume that closed valves or normal main-line readings make the branch safe. Operations, corrosion and inspection specialists confirm the field line-up, fluid phases, temperature profile, previous changes and credible damage mechanisms. They define authorised isolation and access, select examination locations and methods capable of finding local damage, and use the result to review similar branches. This example supplies no universal interval, thickness limit or permission to work on live equipment.

Critical controls

Identify the full population. Reconcile piping and instrumentation diagrams, line lists, operating modes and field walkdowns. Include temporary dead legs created when equipment, pumps, control loops or bypasses are taken out of service. Treat configuration changes as a management-of-change trigger where the site's process requires it.

Define the local mechanism. Determine what can enter, settle, condense or concentrate; how temperature changes along the branch; and where an interface, low point or deposit can develop. Use competent corrosion and process input rather than copying the main-line inspection plan.

Inspect where damage is credible. Choose locations, coverage and techniques that can find localised degradation. Repeating measurements at easy access points is not enough when the predicted damage zone lies elsewhere. Plan intrusive work for the possibility of severe thinning or an active leak and follow approved isolation, permit and inspection controls.

Eliminate or control the branch. Where practicable, remove redundant piping or apply an engineered positive isolation. Where it remains, assign ownership, inspection requirements, operating safeguards and a clear response to adverse findings.

Leadership actions

Leaders should ask for evidence that the dead-leg inventory matches the plant as operated today. Review overdue examinations, inaccessible branches and long-idled equipment. When one localised defect is found, require a documented search for similar geometry, service and history. Provide access, isolation windows and engineering support before integrity uncertainty becomes an emergency.

Three practical actions

• Find: select one dormant or normally closed branch and confirm that drawings, field configuration and operating status agree.
• Challenge: verify that inspection locations match the predicted liquid interface, thermal gradient, low point or deposit zone.
• Respond: feed every significant finding into the wider dead-leg inventory, similar-service review and repair or removal plan.

Official video: Fire from Ice

The official CSB video explains how an out-of-service dead leg remained connected to propane service, accumulated water and failed after freezing. View the official CSB video page and incident context.

Takeaway and team discussion

Key takeaway: no normal flow does not mean no pressure, no hazardous inventory or no degradation.

Discussion question: which dormant or normally closed branch on our installation has the weakest evidence that its actual condition and local damage mechanism are understood?

Continue in the Process Safety hub, and connect this lesson with mechanical integrity, small-bore branch vibration and localised corrosion at injection points.

Verified primary references

1. UK HSE: Catastrophic rupture of dead-leg pipe-work—official safety alert on a full-bore failure caused by highly localised corrosion missed by the inspection regime.
2. U.S. CSB final report: Valero McKee Refinery Propane Fire—official investigation of a freeze-related dead-leg failure and escalation.
3. U.S. CSB investigation page: Valero McKee Refinery Propane Fire—incident summary, final report and recommendations.
4. U.S. CSB official video: Fire from Ice—incident animation and safety lessons.

Published and sources checked 25 October 2026. Educational discussion only: apply the installation's approved integrity-management, management-of-change, isolation, permit-to-work, inspection and engineering procedures. No universal inspection interval, thickness limit or approval to disturb live equipment is supplied.

Discuss this article in the comments →

Register interest in future HSSE email updates