Ten miles south of downtown St. Paul, on the banks of the Mississippi River, sits an oil refinery that is by far the largest repository of hydrogen fluoride in Minnesota. In the nearly 80 years the plant has been operating, it has never experienced a catastrophic accident involving the highly toxic chemical.

On the remote chance that it did, however, more than 1½ million people living and working within a 19-mile radius of the refinery could be exposed to a deadly gas cloud, according to a "worst-case" scenario spelled out in records tucked away in the Chicago regional office of the Environmental Protection Agency.

To be sure, major accidents involving hydrogen fluoride are rare. But the April 26 explosion and fire at the Husky Energy oil refinery in Superior, Wis., was a reminder of the potential danger.

The Husky refinery uses hydrogen fluoride, too, and the risk of an accidental release of it led to the mandatory evacuation of thousands of people in Superior that day. At the considerably larger Andeavor refinery in St. Paul Park, the population put at risk would be 10 times greater, documents show.

The potential disaster scenario is included in records kept at the EPA's Chicago office under restrictions that make the information difficult for the public to obtain, a defensive measure intended to protect facilities from sabotage or terrorism. The reports, which federal regulators require of oil refineries, sketch out worst-case and medium-case scenarios as required by the Clean Air Act to help local emergency-response organizations plan.

Those records show that, as of a year ago, the St. Paul Park refinery stored some 190,000 pounds of hydrogen fluoride for use as a catalyst in the production of high-octane gasoline. If the largest tank cracked open and released its contents within 10 minutes, and if the wind conditions were right, the hydrogen fluoride gas might form a ground-hugging cloud capable of traveling up to 19 miles before dispersing, putting 1.7 million people at risk, according to the worst-case scenario.

If a transfer hose failed at the refinery, some 5,700 pounds of hydrogen fluoride could escape in 19 minutes, throwing out a cloud capable of traveling up to eight-tenths of a mile and putting 1,400 people at risk, the documents show.

Destin Singleton, an Andeavor spokeswoman, said last week that the worst-case scenarios in EPA documents are "not realistic."

"We have mitigation systems in place and we have response plans in place," she said.

Like many refineries that use hydrogen fluoride, the St. Paul Park plant has sensors to detect leaks and water systems to suppress them. The St. Paul Park refinery's "water curtains" and "deluge system," as Andeavor calls them, are meant to capture the hazardous chemical so it doesn't vaporize. Water can absorb the hydrogen fluoride and "knock it down," Singleton said.

Sounding alarms

Hydrogen fluoride is a fast-acting acid that can cause deep, severe burns or, with sufficient exposure, kill. Exposure can occur through inhalation and skin contact.

The chemical can permanently damage eyes, skin, nose, throat, respiratory system and bones, according to a 2013 report issued by the United Steelworkers union, which represents many refinery workers.

Hydrogen fluoride has been used in oil refining since the 1940s, though a safer alternative has long existed. It started getting public scrutiny after two accidental releases in 1987, including at a refinery in Texas City, Texas. The vapor cloud there led to the evacuation of 4,000 people, and more than 1,000 residents reported to area hospitals, some seeking treatment for skin burns.

Since then, there have been at least a half-dozen refinery accidents involving hydrogen fluoride releases, though there appear to be no fatalities among the public.

A recent close call involved a 2015 explosion at a Southern California refinery. The Chemical Safety Board, a U.S. regulatory body, concluded that explosion debris nearly hit tanks that contained hydrogen fluoride — a "near miss event."

Andeavor bought the St. Paul Park refinery last June, and is the plant's fourth owner since 2010. The company announced last week that the refinery will be sold again, this time as part of $23 billion deal with Marathon Petroleum.

The refinery reported one accident over the five years before May 3, 2017, the date of its most recent EPA risk management plan. The April 8, 2017 accident involved a release of isobutane, and was caused by human error, the report said.

Records from the Minnesota Occupational Safety and Health Administration say that a "trace amount" of hydrogen fluoride was released in the April 8 accident. The refinery was not cited for any safety violations. OSHA reports say five employees were sent to a hospital for observation, but they didn't need treatment.

The company also investigated an incident in the refinery's hydrogen fluoride alkylation unit in November 2016, EPA records show. No further information was available.

In 2003, an accident at the St. Paul Park refinery created a cloud of low-concentrate hydrogen fluoride. Fourteen workers were treated at a hospital, though none of their injuries was life-threatening.

Minnesota OSHA later cited the refinery for a serious safety violation, fining it $1,400.

Response plans

Local government officials near the Andeavor refinery have long discussed emergency plans. The St. Paul Park Police Department is among several local emergency organizations that has a response plan in place, said Chief Jessica Danberg.

The South Washington County School District, home to two schools located less than a mile from the refinery, would be immediately notified of any hazardous leaks by both the refinery's emergency management team and Washington County's emergency management department, said Damien Nelson, the district's emergency preparedness and safety coordinator.

The county would make the call on any evacuation. "We have the ability to take care of any evacuation in the areas of those two schools," Nelson said of Oltman Middle School and Newport Elementary School.

A spokeswoman for St. Paul Mayor Melvin Carter said last week that his office had received numerous calls in the wake of the Superior oil refinery explosion and fire. Carter issued a statement Thursday saying he has been deeply concerned about what happened there and plans to gather more information.

Myron Bailey, mayor of Cottage Grove, said the fire at Husky's Superior refinery made him think twice about the proximity of the Andeavor refinery, given that St. Paul Park is a direct neighbor. "After a situation like that, I always go back to our public safety director and say, 'Are we ready for this?' " he said. "The answer was 'Yes.' "

Alternatives are costly

After the explosion at Husky's refinery, the mayors of Superior and Duluth called on the company to stop using hydrogen fluoride. Other methods can do the same job.

The Flint Hills Resources oil refinery in Rosemount uses sulfuric acid as a catalyst to boost octane in gasoline. So do about half of the U.S. refineries that make higher-octane gasoline. The other half use hydrogen fluoride.

Sulfuric acid is hazardous, too, but it doesn't vaporize nearly as easily as hydrogen fluoride. No U.S. refinery has converted from hydrogen fluoride, according to a study by New Jersey-based Norton Engineering. But Chevron plans to do so by 2020 at its Salt Lake City refinery with a completely new technology.

"No one wants to be Number 1 out there, because there is a lot of risk," said Chris Steves, president of Norton Engineering.

The biggest risk is financial. Converting to sulfuric acid costs tens of millions to hundreds of millions of dollars, depending on a refinery's size, Steves said. Instead of converting, U.S. refineries have added water-based mitigation systems like the one in St. Paul Park to keep a hydrofluoric acid leak from morphing into a toxic cloud.

"If you spray enough water, you dilute it," said Ron Koopman, a retired scientist at Lawrence Livermore National Laboratory and a longtime researcher of toxic gas releases. "But it takes a lot of water, the water has to be applied perfectly to the cloud — and it has to be applied immediately."