Goodyear Heat Exchanger Ammonia Rupture | SafeGuard PSM Case Study

📋 Incident Summary

On June 11, 2008, an ammonia heat exchanger at the Goodyear Tire & Rubber Company facility in Houston, Texas ruptured catastrophically, releasing a toxic ammonia cloud that killed one worker and injured six others. The rupture was the direct result of a maintenance error that left the heat exchanger without overpressure protection.

During a maintenance shutdown, an isolation valve between the heat exchanger and its pressure relief valve had been closed to permit safe maintenance work. When the heat exchanger was returned to service, the isolation valve was not reopened — leaving the exchanger operating with no relief protection. As process conditions caused ammonia pressure to rise beyond the design limit, the heat exchanger catastrophically ruptured.

The CSB found that Goodyear had no written restart procedure or post-maintenance checklist requiring verification that all isolation valves were in their correct positions before returning equipment to service. The incident is a textbook example of a mechanical integrity and management of change program failure — where a single omitted step removed all pressure relief protection from a vessel under hazardous service.

🔎 Key Findings

Finding 1

Relief Valve Isolation Valve Left Closed After Maintenance

The isolation valve between the ammonia heat exchanger and its pressure relief valve was not reopened after maintenance was completed. The heat exchanger was returned to full service with zero overpressure protection.

Finding 2

No Post-Maintenance Valve Position Verification Procedure

Goodyear had no written procedure or checklist requiring workers to verify all isolation valves — including those blocking relief devices — were in the correct position before equipment restart.

Finding 3

Inadequate Management of Change Program

The MOC process did not capture the safety significance of relief valve isolation valve positions during maintenance or require specific verification of their restoration before restart.

Finding 4

Mechanical Integrity Program Deficiency

The MI program did not include provisions to verify that relief valve isolation valves were confirmed open during normal operating status checks.

Finding 5

OSHA PSM Requirement Violated

OSHA 29 CFR 1910.119 requires pressure relief devices to be operational during equipment operation. Operating a vessel with its relief valve blocked is a direct PSM compliance violation.

Finding 6

Lockout/Tagout Restoration Gap

The LOTO procedures for the maintenance work did not include a systematic verification that all process valve positions were restored to the correct operating state before re-energization.

🔍 Root Causes

Isolation Valve Not Restored After Maintenance

The proximate cause was the failure to reopen the relief valve isolation valve after maintenance — a single omission that eliminated all overpressure protection from an ammonia heat exchanger.

Absent Post-Maintenance Restart Checklist

No post-maintenance restart checklist required verification of safety-critical valve positions. This absence allowed the dangerous configuration to go undetected until failure.

MOC Program Failure

The MOC system did not manage the temporary configuration change created by closing the relief valve isolation valve, nor did it require verification of restoration before restart.

Mechanical Integrity Program Gap

The MI program did not include routine verification that relief valve isolation valves were confirmed open during normal operating status.

☑ CSB Recommendations

→ Goodyear

Implement written restart procedures for all maintenance activities that explicitly require verification of safety-critical valve positions — including all relief valve isolation valves — before equipment is returned to service.

→ Goodyear

Add a mechanical integrity program provision requiring periodic inspection and documentation confirming relief valve isolation valve positions in all operating units.

→ Goodyear

Revise the MOC process to capture safety implications of temporary valve position changes during maintenance and require documented restoration verification.

→ OSHA

Issue a safety communication highlighting the hazards of operating process equipment with relief valve isolation valves in the closed position.

→ API / AIChE

Update guidance on relief system mechanical integrity to specifically address isolation valve management procedures during maintenance activities.

💡 Lessons Learned

⚠ A pressure relief valve that is isolated from the vessel it protects provides no protection. Relief valve isolation valves are safety-critical devices whose position must be verified before and during all operations.

⚠ Post-maintenance restart checklists save lives. A written requirement to verify all valve positions before re-energizing a system is a simple, low-cost safeguard against potentially fatal errors.

⚠ Management of change is not only for permanent equipment modifications. Temporary configuration changes during maintenance — including closing a relief valve isolation valve — require the same MOC rigor as permanent changes.

⚠ Mechanical integrity programs must include safety-critical valve positions, not just equipment condition. A well-maintained heat exchanger with a blocked relief valve is not a safe piece of equipment.

⚠ LOTO procedures returning equipment to service must verify all process valves — not just energy isolation points — are in their correct operating positions before re-energization.

PSM Elements: MI · MOC · SOP · HOW

🔨 Safety Meeting Toolbox Talk

Topic: Relief Valve Isolation, Post-Maintenance Verification & MOC

💬Does our facility have relief devices with upstream or downstream isolation valves? Are their positions verified as part of every startup or post-maintenance restart procedure?

💬Do our post-maintenance restart procedures include a specific line-item check to verify all safety-critical valve positions before returning equipment to service?

💬Does our MOC process specifically cover temporary valve position changes made during maintenance activities and require documentation of restoration?

💬Does our mechanical integrity program include provisions for confirming relief valve isolation valves are confirmed open during routine operating status checks?

💬Are there any conditions under which a relief device could be bypassed or isolated without a specific work authorization, time limit, and automatic re-check requirement?

💬Do all workers who operate or isolate relief valve isolation valves fully understand the consequence of leaving them closed when equipment is returned to service?

✎ Team Action Items

✓Walk your unit and identify all pressure relief devices — verify whether any have upstream or downstream isolation valves that could inadvertently be left closed

✓Pull the startup and post-maintenance restart procedure for your unit and confirm explicit line-item verification of relief valve isolation valve positions is included

✓Review the most recent MOC records for maintenance activities on your unit — verify that valve restoration requirements were specifically captured and signed off

✓Ask your maintenance team: what is the specific procedure to verify a relief valve isolation valve has been re-opened after maintenance is completed and documented?

🔗 PSM Failures Behind This Incident

This incident traced to breakdowns across 4 PSM elements (MI · MOC · SOP · HOW). Each represents a documented gap that process safety documentation and consulting can close before a similar event occurs at your facility.

Mechanical Integrity (MI)

Equipment must be designed, inspected, and maintained to operate safely in its intended service. Mechanical integrity failures — degraded equipment, missed inspections, deferred repairs — contributed to loss of containment here.

Supporting documents in our library →

Management of Change (MOC)

Changes to equipment, chemistry, operating limits, or procedures that bypass formal review create new hazard pathways your PHA never evaluated. MOC failures open the door to incidents like this one.

Supporting documents in our library →

Operating Procedures (SOPs)

Operators cannot reliably hold safe operating limits without clear, current, enforced procedures. Deviation from acceptable operating conditions — a root cause here — is a direct consequence of SOP failure.

Supporting documents in our library →

Hot Work Permits

Unauthorized or poorly controlled ignition sources near flammable atmospheres are entirely preventable. A rigorous hot work permit system with pre-job atmospheric testing closes this pathway.

Supporting documents in our library →

SafeGuard PSM

Process Safety Management Consulting & Document Library

📂

PSM Document Library

32 ready-to-deploy PSM documents covering all 14 OSHA elements — procedures, checklists, and audit templates built for facilities operating under 29 CFR 1910.119.

Browse the Library →

📊

Free PSM Health Score

Find out where your PSM program stands across all 14 OSHA elements. Our free health score surfaces your biggest gaps in under 10 minutes — no account required.

Check Your Score →

📞

Consulting Services

PHA facilitation, PSM program builds, compliance audits, and OSHA inspection support. Transparent flat-fee pricing — no retainer required to get started.

View Pricing →

📋 Explore the full incident library: All 132 CSB Case Studies →