DIAMOND SHAMROCK REFINING CO., L.P., Diamond Shamrock Refining and Marketing Co., Diamond Shamrock, Inc., Sigmor Corp., and Ultramar Diamond Shamrock Corp., Petitioners, v. Donna HALL, Respondent, 168 S.W.3d 164

Justice HECHT delivered the opinion of the Court. Charles Hall died of burns he suffered in a refinery explosion. His wife sued his employer, Diamond Shamrock Refining Co., L.P., a self-insured subscriber under the Texas Workers’ Compensation Act, its parent, Ultramar Diamond Shamrock Corp. (collectively “Diamond Shamrock”), and others for gross negligence to recover exemplary damages as permitted by

article XVI,

section 26 of the Texas Constitution and

section 408.001 of the Texas Labor Code. The trial court rendered judgment for the plaintiff for a portion of the damages assessed by the jury, and she and Diamond Shamrock both appealed. A divided court of appeals reversed and remanded the case for a new trial. The plaintiff and Diamond Shamrock have both petitioned this Court for review.

The dis-positive issue for us is whether any clear and convincing evidence supports the jury’s finding that Diamond Shamrock was grossly negligent — more specifically, that Diamond Shamrock was actually, subjectively aware of the risk to Hall and was nevertheless consciously indifferent to his welfare. Applying the standard of eviden-tiary review adopted in Southwestern Bell Telephone Co. v. Garza, we conclude that there is no such evidence. Accordingly, we reverse and render judgment for Diamond Shamrock.

I The explosion that resulted in Charles Hall’s death occurred when a reciprocating gas compressor at Diamond Shamrock’s crude oil refinery in Dumas ruptured. The compressor, located in the Feed Prep Unit (FPU), compressed vapors (like hexane) produced in other parts of the plant so that their hydrocarbon constituents (like propane and butane) could be extracted and used rather than burned at the torch.

The compressor could not compress liquids (liquids, of course, cannot usually be compressed), and the injection of even a small amount of liquid into the compressor cylinder could cause it to fracture, releasing highly combustible hydrocarbons that could ignite and explode. That had happened twice at the refinery some thirty years earlier, before the FPU was built, when exceptionally cold weather caused liquid hydrocarbons to condense out of the vapor stream in the compressor suction line on the way to the FPU.

To prevent such problems from recurring, the FPU was designed to include a large suction drum to collect liquid hydrocarbons from the line entering the FPU and drain them to an underground accumulator drum. The suction drum had a sight glass to allow the compressor crew to see if liquids were present, a high-level alarm to warn if the drum was filling with liquids, and an automatic shutoff switch for the compressor. Circumstances leading to the explosion at issue here began when the Hydrocracker Unit (HCU) was restarted following a routine maintenance shutdown.

Although the HCU crew was attempting to follow the same restart procedures that had been used many times before, the HCU began to overheat, causing excessive vaporization of liquid hydrocarbons in the HCU. This vapor was sent to the FPU, but on its way it cooled, causing the liquids to condense and flow through the vapor line into the suction drum. As the suction drum began to fill, the high-level alarm sounded, prompting the FPU operator to ascertain that the liquids were coming from the HCU.

When the operator saw in the sight glass that liquids were filling the suction drum faster than it would drain, he insisted that the HCU operator stop the flow. The HCU operator requested permission from a plant foreman to divert the flow from the HCU to the torch or to storage, but permission was refused. Recognizing the danger of sending liquids to the FPU compressor, the HCU operator disobeyed the instructions he had been given and diverted the flow to storage. Meanwhile, the automatic shutoff switch on the suction drum failed to operate, and the FPU crew shut down the compressor manually.

Liquids draining from the suction drum into the accumulator drum were pumped from there to the compressor’s discharge line. This took several hours, and while it was in progress, there was a shift change. A new crew, including Charles Hall and two other men, finished the process. After some 456 barrels had been pumped out, the crew checked the sight glass on the suction drum and opened bleeder valves on the compressor suction line to be sure no more liquids were present. None were, and the crew then began the process of restarting the compressor.

To understand what happened next, one must understand the system of lines and valves around the compressor, as illustrated in this schematic diagram: The numbers indicate where valves were positioned on the lines. Just past the suction drum (not shown), Valve 1, the suction valve, regulated the input to the compressor, and Valve 4, the discharge valve, regulated the output. Valve 2 regulated the flow through a recirculating line that connected the discharge end of the compressor to its intake. All three were block valves that had to be manually operated by the crew.

When the compressor was shut down, they were all closed. Valve 8 was a bleeder valve that if opened would release the contents of the discharge line into the open air just outside the compressor building. It may have been installed so that the system could be hydrostatically tested when it was first constructed, and it had not been used since. Valve 5 was a check valve with a flapper that operated automatically. Vapor flow from the compressor would push the flapper up; when the flow stopped, the flapper would fall by force of gravity to block any backflow in the discharge line toward the compressor.

Cheek valves are not generally designed to be leak-proof, and at some earlier time (the record is not clear exactly when) an FPU operator thought this check valve leaked and had “written it up” — that is, asked that it be repaired. It never was. Crew members were not instructed to inspect Valve 5 before restarting the compressor, and Hall and his co-workers did not do so. Unbeknownst to them, the valve flapper inside the line had become detached, rendering the valve inoperable. Liquids pumped from the accumulator drum entered the discharge line beyond Valve 5, as shown at the upper right of the schematic.

When the compressor was running and Valves 1, 4, and 5 were open, vapor flow from the compressor flushed any liquids pumped from the accumulator drum down the discharge line. But when the compressor was stopped and Valve 4 was closed, there was a back-pressure on the discharge line. The line also sloped toward the compressor. Diamond Shamrock knew that without Valve 5, back-pressure and gravity would force liquids pumped into the discharge line while the compressor was stopped to run down toward Valve 4, and when it was opened, they would be sucked into the compressor.

That is in fact what happened the day of the explosion. Because Valve 5 was broken, it did not block the liquids being pumped into the discharge line from flowing back toward Valve 4. The compressor had been shut down and restarted many times since the FPU was constructed fifteen years earlier, and the restart procedures were clearly prescribed. Following those procedures to the letter, Hall opened Valve 2 and started the compressor engine.

With Valves 1 and 4 both closed, vapor simply recirculated without putting any load on the compressor until its engine had warmed up. (An open torch line, not shown in the schematic, also reduced pressure on the system during startup.) The crew was then required first to open Valve 4, next to open Valve 1, and finally to close Valve 2, at which point the compressor would be back on line. Restart procedures did not call for the crew to check for liquids on the discharge side of the compressor, and they did not do so.

Had they been instructed to open Valve 3, liquids would have escaped, revealing their presence in the discharge line. But Valve 3, as already noted, had not been used to test for the presence of liquids and apparently had not been installed for that purpose. Because it was never used, over the years it had become covered up with dirt. Some FPU crew members knew where it was, but Hall and his co-workers did not.

As Valve 4 was opened, gravity and back-pressure on the discharge line pushed the accumulated liquids that had moved down the line from the broken check valve into the recirculating line where they were pulled up into the suction of the compressor. Seconds later, the compressor began to make loud, knocking noises, which one crew member described as sounding like cannon fire. Hall’s coworker quickly tried to close Valve 4, but the knocking continued. Almost immediately, a cover plate on the compressor cylinder cracked from the pressure, and vapor and liquids began spewing out, catching fire.

The crew realized that to prevent an explosion, they would have to stop the compressor, which they could do only by shutting off the fuel to its engine. Before they could reach the cutoff, the compressor exploded. All three men were severely burned, and eight days later Hall died of his injuries. After the explosion, Diamond Shamrock modified the bleeder valves in the discharge line, adding a collection line and an extension handle, so that they could be used to detect and collect liquids in the discharge line when the compressor was shut down, before it was restarted.

Diamond Shamrock also instructed FPU crews to monitor the pressure on the compressor cylinder when the compressor was shut down to determine whether the discharge valve, Valve 4, or the check valve, Valve 5, was leaking. Hall’s widow, Donna Hall (to whom we refer as “the plaintiff’, to distinguish her from her husband), sued Diamond Shamrock and three related entities for wrongful death. Because the Texas Workers’ Compensation Act allowed her to recover only exemplary damages for gross negligence, the trial court excluded all evidence of actual damages.

Without objection, the court instructed the jury— • that gross negligence means

an act or omission— (

i) which, when viewed objectively from the standpoint of Diamond Shamrock Refining Company, L.P. at the time of its occurrence, involved an extreme degree of risk, considering the probability and magnitude of the potential harm to others; and (ii) of which Diamond Shamrock Refining Company, L.P. had actual, subjective awareness of the risk involved, but nevertheless proceeded with conscious indifference to the rights, safety, or welfare of others. • that it could find gross negligence only by clear and convincing evidence, defined as “proof that produces a firm belief or conviction as to the truth of the allegation sought to be established.” The jury found that Diamond Shamrock Refining Co., L.P. was grossly negligent and assessed exemplary damages of $42.5 million.

Following the announcement of the verdict, defendants’ counsel moved in open court “to have the court limit the recovery of punitive damages in this case ... to the amount of $200,000” in accordance with

section 41.008 of the Texas Civil Practice and Remedies Code. The court agreed and rendered judgment against Diamond Shamrock for that amount plus prejudgment interest. Both the plaintiff and Diamond Shamrock appealed. A divided court of appeals held: that evidence of gross negligence was legally and factually sufficient; that

section 41.008 applied; that

section 41.008 was not unconstitutional as applied; and that Diamond Shamrock did not waive its right to the statutory cap; but that the trial court erred by precluding the plaintiff from proving actual damages for purposes of calculating the statutory cap. Accordingly, the court reversed and remanded the case for a new trial. The court of appeals did not reach other arguments raised by the parties. Justice Green, dissenting, would have held that there was no evidence of the subjective component of gross negligence, paragraph (ii) of the definition quoted above. We granted both parties’ petitions for review.

II The parties have raised several arguments we need not address because, as already noted, we have concluded that there is no clear and convincing evidence of gross negligence. The plaintiff argues that Diamond Shamrock waived its evidentiary challenge by moving in open court for judgment on the verdict. Although she acknowledges that Diamond Shamrock later argued that there was no evidence to support a judgment, she complains that Diamond Shamrock was trying to “have it both ways”, citing our opinion in Litton Industrial Products, Inc. v.

Gammage, There, Litton moved that judgment be rendered against it for actual damages rather than treble damages, but argued in an accompanying brief that it reserved the right to challenge any judgment. We “disapprove[d] a practice by which a party, by motion, induces the trial court on the one hand to render a judgment, but reserves in a brief the right for the movant to attack the judgment if the court grants the motion.” Unlike Litton, Diamond Shamrock did not move for judgment of a specific amount; it urged only that judgment not exceed what it argued was the statutory cap.

This was not inconsistent with its arguments that no evidence supported a judgment of any amount. Diamond Shamrock did not waive its evidentiary challenge. In Southwestern Bell Telephone Co. v.

Garza, we held that— in reviewing the legal sufficiency of evidence to support a finding that must be proved by clear and convincing evidence, an appellate court must “look at all the evidence in the light most favorable to the finding to determine whether a reasonable trier of fact could have formed a firm belief or conviction that its finding was true.” The parties in this case agree that gross negligence was required to be proved by clear and convincing evidence as defined in the jury charge. Accordingly, we apply this elevated standard of review in assessing the evidence.

As in Garza, we follow the procedure set out in In re J.F.C.: In a legal sufficiency review, a court should look at all the evidence in the light most favorable to the finding to determine whether a reasonable trier of fact could have formed a firm belief or conviction that its finding was true.

To give appropriate deference to the fact-finder’s conclusions and the role of a court conducting a legal sufficiency review, looking at the evidence in the light most favorable to the judgment means that a reviewing court must assume that the factfinder resolved disputed facts in favor of its finding if a reasonable fact-finder could do so. A corollary to this requirement is that a court should disregard all evidence that a reasonable fact-finder could have disbelieved or found to have been incredible. This does not mean that a court must disregard all evidence that does not support the finding.

Disregarding undisputed facts that do not support the finding could skew the analysis of whether there is clear and convincing evidence. If, after conducting its legal sufficiency review of the record evidence, a court determines that no reasonable factfinder could form a firm belief or conviction that the matter that must be proven is true, then that court must conclude that the evidence is legally insufficient.

We focus on the subjective component of gross negligence as stated in the jury charge: that an actor has “subjective awareness of the risk involved, but nevertheless proceed[s] with conscious indifference to the rights, safety, or welfare of others.” The risk here was that liquids could accumulate in the discharge line while the compressor was shut down and be drawn into the compressor when it was restarted, causing an explosion like the one that resulted in Hall’s death.

As clear and convincing proof of Diamond Shamrock’s actual, subjective awareness of, and conscious indifference to, this risk, the plaintiff points to the following evidence, which we address in three categories: • Past experience and the HCU: Diamond Shamrock knew that sending liquids through the vapor line to the FPU compressor could cause an explosion, as it had on two prior occasions.

Yet on the day of this explosion a plant foreman refused to divert liquids from the HCU to storage or the torch and prevent them from flooding the FPU. • The check valve: Diamond Shamrock knew that liquids pumped from the accumulator drum emptied into the compressor’s discharge line, that the check valve would leak or fail, that pressure from the discharge line appeared to an FPU operator sometime earlier to be leaking past the check valve, that a request from that operator to fix the valve had gone unheeded, and that if liquids accumulated in the discharge line near the discharge valve an explosion could result.

Diamond Shamrock’s expert testified that to know of a problem with the check valve was to know of a potential danger. Yet not until after the explosion was the FPU redesigned to allow the integrity of the check valve to be monitored by measuring the line pressure at the discharge valve. • The absence of bleeder valves: Diamond Shamrock knew that the bleeder valves in the discharge line (Valve 3) could have been used to determine whether liquids were present, yet it did not tell Hall or his crew about the existence of the valves or instruct them in their use.

Bleeder valves were used elsewhere in the refinery for that purpose, and after the explosion the bleeder valves in the discharge line were modified so that they could be used to check for liquids. As for the first category: What Diamond Shamrock knew from the prior explosions was that it had to guard against liquids in the suction line, upstream from the suction valve (Valve 1). The suction drum, with its sight glass and high-level warning alarm, was intended to serve this purpose, and on the day of the explosion, it did.

Even if the flow from the HCU should have been stopped sooner, that delay is no evidence that Diamond Shamrock was consciously indifferent to the danger of an explosion. The FPU was designed so that the compressor would be shut down before any liquids from the HCU or anywhere else reached the suction valve, and that is exactly what happened. Regarding the check valve: Diamond Shamrock was aware of the possibility that liquids could backflow in the discharge line, and it installed the check valve to prevent back pressure in the line. This system worked without incident for fifteen years.

Even though an FPU operator thought the check valve was leaking, nothing in the evidence suggests that Diamond Shamrock actually knew that it presented any danger of explosion. Certainly, no one that day imagined that liquids had traveled back through the discharge line toward the compressor. The FPU crews were careful to see that all liquids were removed from the suction line to the compressor, a process that took several hours. Diamond Shamrock’s failure to take further precautions may have been evidence of negligence.

But “[ejvidence of simple negligence alone is not sufficient to establish gross negligence.” There is no evidence, certainly no clear and convincing evidence, that Diamond Shamrock was consciously indifferent to the risk of explosion. Regarding the use of bleeder valves: The bleeder valve in the discharge line (Valve 3) vented the flammable contents of the line into the open air. The valve had been used only to test the system hydro-statically when it first came on line and had not been used since.

After the explosion, Diamond Shamrock modified the bleeder valves so that they could be used to check for liquids in the line, adding an extension to allow operation from a platform outside the building and a collection line to gather any contents. Its failure to make these modifications before the explosion may have been negligent, but again, this is not enough to prove gross negligence. Diamond Shamrock was not indifferent to the risk that liquids would accumulate in the discharge line. It installed a check valve which appeared to have protected against the risk for fifteen years.

Diamond Shamrock’s failure to implement redundant safety systems is not, on this record, any evidence of conscious indifference to the risk of explosion. The plaintiff complains that Diamond Shamrock’s arguments are tantamount to claiming that it was entitled to “one free explosion”, but that characterization is not supported by the evidence. For one thing, any explosion threatened the entire refinery and all of its employees, and this one certainly took a tremendous toll. It was by no means “free”.

More importantly, the record establishes, and no one disputes, that refinery operations are by their very nature dangerous. Diamond Shamrock’s efforts to protect against those dangers were imperfect; they may have been negligent. But there is no evidence that Diamond Shamrock was unconcerned. The plaintiff argues that this case is like Mobil Oil Corp. v. Ellender and Seminole Pipeline Co. v. Broad Leaf Partners, Inc,, cases in which the. defendant was grossly negligent, but each is distinguishable.

In Mobil Oil, there was evidence that the employer went to great lengths to protect its own employees from improperly handling benzene but intentionally did nothing to protect contract workers from the same danger, even though employees and contract workers worked side by side. There is no evidence in the present case that Diamond Shamrock intentionally did nothing to protect Hall from the risk of explosion. In Seminole Pipeline, the defendant’s own employees testified that they knew its salt dome storage safety system was inadequate but continued to expand storage capacity despite the risk of explosion.

In the present case, there is no evidence that Diamond Shamrock knew the FPU compressor was unsafe as designed and operated. We think the case is closer to Louisianar-Pacific Corp. v. Andrade, in which the defendant’s employees knew that electricity to an overhead crane near where Andrade was working had to be “locked out” (disconnected) and thought that had been done Although the employees were mistaken, there was no evidence of conscious indifference to the risk of harm.

To the contrary: “all of the testimony indicated that the [defendant’s] employees involved in the chain of the lock-out process actually, subjectively believed that they personally had either locked-out the crane, or that their personal subjective recollection of various events led them to believe that the crane had been locked-out by someone prior to Andrade beginning work on the day in question.” And “[w]hat is further lacking from the evidence, even inferentially, is proof that any [of defendant’s] personnel were consciously indifferent to the risk of electrocution if the crane was energized.” “[W]hat separates ordinary negligence from gross negligence is the defendant’s state of mind; in other words, the plaintiff must show that the defendant knew about the peril, but his acts or omissions demonstrate that he did not care.” Viewing the record in the light most favorable to the plaintiff, there is no clear and convincing evidence that Diamond Shamrock knew of the risk of the compressor explosion that resulted in Hall’s death and yet did not care.

Accordingly, the judgment of the court of appeals is reversed and judgment is rendered that Hall take nothing. Justice GREEN did not participate in the decision. . TEX. CONST, art. XVI, § 26 (“Every person, corporation, or company, that may commit a homicide, through wilful act, or omission, or gross neglect, shall be responsible, in exemplary damages, to the surviving husband, widow, heirs of his or her body, or such of them as there may be, without regard to any criminal proceeding that may or may not be had in relation to the homicide.”). . TEX. LAB. CODE § 408.001(b)(“This

section [making workers’ compensation benefits the exclusive remedy against an employer for the death or work-related injury of an employee] does not prohibit the recovery of exemplary damages by the surviving spouse or heirs of the body of a deceased employee whose death was caused by an intentional act or omission of the employer or by the employer's gross negligence.”). . 82 S.W.3d 5 (Tex.App. — San Antonio 2001). . 164 S.W.3d 607 (Tex.2004). . See TEX. CIV. PRAC. & REM. CODE § 41.001(11). . See id. § 41.003(a). . See id. § 41.001(2). . Id. § 41.008(b) (“Exemplary damages awarded against a defendant may not exceed an amount equal to the greater of: (1)(

A) two times the amount of economic damages; plus (

B) an amount equal to any noneconomic damages found by the jury, not to exceed $750,000; or (2) $200,000.”). . 82 S.W.3dat 12-18. . Id. at 18-21. . Id. at 21-22. . Id. at 22-23. . Id. at 23-24. . Id. at 25. . Id. (Green, J., dissenting). . 46 Tex. Sup.Ct. J. 584 (Apr. 17, 2003). . 668 S.W.2d 319 (Tex. 1984). . Id. at 321-322. . Id. at 322. . Southwestern Bell Telephone Co. v. Garza, 164 S.W.3d 607, 632 (Tex.2004) (quoting In re J.F.C., 96 S.W.3d 256, 266 (Tex.2002)). . In re J.F.C., 96 S.W.3d at 266. . Louisiana-Pacific Corp. v.

Andrade, 19 S.W.3d 245, 247 (Tex.1999). . 968 S.W.2d 917 (Tex.1998). . 979 S.W.2d 730 (Tex.App.—Houston [14th Dist.] 1998, no pet.). . 979 S.W.2d at 743-748. . 19 S.W.3d 245, 247-248(Tex.1999). . Id. at 248 (quoting Louisiana-Pacific Corp. v. Andrade, 964 S.W.2d 944, 953 (Tex.App.— Beaumont 1998) (Walker, C.J., dissenting)) (citations omitted). . Id. at 246-247 (citing Williams v. Steves Indus., Inc., 699 S.W.2d 570, 573 (Tex.1985), and Burk Royalty Co. v. Walls, 616 S.W.2d 911, 922 (Tex.1981)).