CASE STUDY

Heat exchanger rupture and ammonia 

release in Houston, Texas 

(One Killed, Six Injured)

2008-06-I-TX

January 2011

The Goodyear Tire and Rubber 

Company

Houston, TX

June 11, 2008

Key Issues:

• Emergency Response and Accountability 

• Maintenance Completion

• Pressure Vessel Over-pressure Protection

Introduction

This case study examines a 

heat exchanger rupture and 

ammonia release at The 

Goodyear Tire and Rubber 

Company plant in Houston, 

Texas. The rupture and release 

injured six employees. Hours 

after plant responders 

declared the emergency over; 

the body of an employee was 

discovered in the debris next 

to the heat exchanger. 

INSIDE . . .

Incident Description 

Background

Analysis

Lessons Learned
Goodyear Houston Case Study January 2011

2

1.0 Incident Description

This case study examines a heat exchanger 

rupture and ammonia release at The 

Goodyear Tire and Rubber Company 

(Goodyear) facility in Houston, Texas, that

killed one worker and injured six others. 

Goodyear uses pressurized anhydrous 

ammonia in the heat exchanger to cool the 

chemicals used to make synthetic rubber. 

Process chemicals pumped through tubes 

inside the heat exchanger are cooled by 

ammonia flowing around the tubes in a

cylindrical steel shell. 

On June 10, 2008, Goodyear operators 

closed an isolation valve between the heat 

exchanger shell (ammonia cooling side) and 

a relief valve to replace a burst rupture disk 

under the relief valve that provided overpressure protection. Maintenance workers 

replaced the rupture disk on that day; 

however, the closed isolation valve was not 

reopened. 

On the morning of June 11, an operator 

closed a block valve isolating the ammonia 

pressure control valve from the heat 

exchanger. The operator then connected a 

steam line to the process line to clean the

piping. The steam flowed through the heat 

exchanger tubes, heated the liquid ammonia 

in the exchanger shell, and increased the

pressure in the shell. The closed isolation 

and block valves prevented the increasing 

ammonia pressure from safely venting 

through either the ammonia pressure control 

valve or the rupture disk and relief valve. 

The pressure in the heat exchanger shell 

continued climbing until it violently 

ruptured at about 7:30 a.m.

The catastrophic rupture threw debris that 

struck and killed a Goodyear employee 

walking through the area. 

The rupture also released ammonia, 

exposing five nearby workers to the 

chemical. One additional worker was injured 

while exiting the area.

Immediately after the rupture and resulting 

ammonia release, Goodyear evacuated the

plant. Medical responders transported the six 

injured workers. The employee tracking 

system failed to properly account for all 

workers and as a result, Goodyear 

management believed all workers had safely 

evacuated the affected area. 

Management declared the incident over the 

morning of June 11, although debris blocked 

access to the area immediately surrounding 

the heat exchanger. Plant responders 

managed the cleanup while other areas of 

the facility resumed operations.

Several hours later, after plant operations 

had resumed, a supervisor assessing damage 

in the immediate incident area discovered 

the body of a Goodyear employee located 

under debris in a dimly lit area (Figure 1). 

Figure 1. Area of fatality
Goodyear Houston Case Study January 2011

3

2.0 Background

2.1 Goodyear 

Goodyear is an international tire and rubber 

manufacturing company founded in 1898 

and headquartered in Akron, Ohio. North 

American facilities produce tires and tire 

components. The Houston facility, originally 

constructed in 1942 and expanded in 1989, 

produces synthetic rubber in several process 

lines. 

2.1.1 Process Description

The facility includes separate production 

and finishing areas. In the production area, a 

series of reactor vessels process chemicals, 

including styrene and butadiene. Heat 

exchangers in the reactor process line use 

ammonia to control temperature. Piping 

carries product from the reactors to the 

product finishing area. 

2.1.2 Ammonia Heat Exchangers

Ammonia is a commonly used industrial 

coolant. Goodyear uses three ammonia heat 

exchangers in its production process lines.

The ammonia cooling system supplies the 

heat exchangers with pressurized liquid 

ammonia. As the ammonia absorbs heat 

from the process chemical flowing through 

tubes in the center of the heat exchanger, the 

ammonia boils in the heat exchanger shell 

(Figure 2). A pressure control valve in the 

vapor return line maintains ammonia 

pressure at 150 psig in the heat exchanger. 

Ammonia vapor returns to the ammonia 

cooling system where it is pressurized and 

cooled, liquefying the ammonia.

Figure 2. Ammonia heat exchanger
Goodyear Houston Case Study January 2011

4

The process chemicals exiting the heat 

exchanger flow to the process reactors. Each 

heat exchanger is equipped with a rupture 

disk in series with a pressure relief valve 

(both set at 300 psig) to protect the heat 

exchanger from excessive pressure. The 

relief system vented ammonia vapor through 

the roof to the atmosphere. 

2.2 Ammonia Properties 

Anhydrous ammonia is a colorless, toxic, 

and flammable vapor at room temperature. It 

has a pungent odor and is hazardous when 

inhaled, ingested, or if it contacts the skin or 

eyes. Ammonia vapor irritates the eyes and 

respiratory system and makes breathing 

difficult. 

Liquefied ammonia causes frostbite on 

contact. One cubic foot of liquid ammonia 

produces 850 cubic feet of vapor. Since 

ammonia vapor is lighter than air, it tends to 

rise. The vapor can also remain close to the 

ground when it absorbs water vapor from air 

in high humidity conditions. 

The Occupational Safety and Health 

Administration (OSHA) and National 

Institute for Occupational Safety and Health 

(NIOSH) limit worker exposure to ammonia 

to 25 and 50 parts per million (ppm), 

respectively, over an 8-hour time-weighted 

average. Ammonia is detectable by its odor 

at 5 ppm. 

 
Goodyear Houston Case Study January 2011

5

3.0 Analysis

3.1 Emergency Procedures

3.1.1 Onsite Emergency 

Response Training 

Goodyear maintained a trained 

emergency response team, which 

attended off-site industrial firefighter 

training, conducted response drills based 

on localized emergency scenarios, and 

practiced implementing an emergency 

operations center. Other employees 

received emergency preparedness 

training primarily as part of their annual 

computer-based health and safety 

training. 

Although Goodyear procedures required 

that a plant-wide evacuation and shelterin-place drill be conducted at least four 

times a year, workers told the Chemical 

Safety Board (CSB) that such drills had 

not been conducted in the four years

prior to the June 11th 2008 incident. 

Operating procedures discussed plantwide, alarm operations and emergency 

muster points for partial and plant-wide 

evacuations; however, some employees 

had not been fully trained on these 

procedures. 

3.1.2 Plant Alarm System 

Although Goodyear had installed a plantwide alarm system, some workers reported 

that the system was unreliable, as in this 

case, when workers were not immediately 

made aware of the nature of the incident. 

Emergency alarm pull-boxes located 

throughout the production unit areas sound a 

location-specific alarm. However, ammonia 

vapor released from the ruptured heat 

exchanger and water spray from the 

automatic water deluge system prevented 

responders from reaching the alarm pull-box 

in the affected process unit. Supervisors and 

response team members were forced to 

notify some employees by radio and wordof-mouth of the vessel rupture and ammonia 

release. 

3.1.3 Accounting for Workers in 

an Emergency 

Facility operating procedures also outlined 

Goodyear’s worker emergency

accountability scheme. Supervisors were to 

account for their employees using a master 

list generated from the computerized 

electronic badge-in/badge-out system. 

During the incident however, a malfunction 

in the badge tracking system delayed 

supervisors from immediately retrieving the 

list of personnel in their area. Handwritten 

employee and contractor lists were 

generated, listing the workers only as they 

congregated at the muster points or sheltered 

in place. Later, EOC personnel compared 

the handwritten lists against the computer 

record of personnel who remained badged in 

to the production areas. 

Additionally, although emergency response 

team members were familiar with the 

employee accountability procedures, not all 

supervisory and security employees, who 

were to conduct the accounting, had been 

trained on them. In fact, some of the 

employees responsible for accountability 

were unaware prior to the incident that their 

jobs could include this task in an emergency. 

Since the fatally injured employee was a 

member of the emergency response team, 

area supervisors did not consider her 

absence from the muster point unusual.
Goodyear Houston Case Study January 2011

6

The Emergency Operations Command

(EOC) declared all Goodyear employees 

accounted for at about 8:40 a.m. Accounting 

for the contract employees continued until 

about 11:00 a.m., at which time the EOC 

ended the plant-wide evacuation and 

disbanded. Only the immediate area 

involved in the rupture remained evacuated. 

At about 1:20 p.m., an operations supervisor 

assessing the damage to the incident area 

discovered the victim buried in rubble in a 

dimly lit area and contacted City of Houston 

medical responders.

3.2 Maintenance Procedures 

Training requirements for operators in the 

production area included standard operating 

procedures specifically applicable to the 

rupture disk maintenance performed on 

June 10:

• Use of the work order system 

including obtaining signature 

verification both before the work 

starts and after job was completed; 

and

• Use of lockout/tagout procedures for 

equipment that was undergoing 

maintenance. 

The CSB found evidence of breakdowns in 

both the work order and lockout/tagout 

programs that contributed to the incident. 

Although the work order procedure required 

a signature before work commenced and 

after the work had been completed, 

operators reported that maintenance 

personnel did not always obtain production 

operators’ signatures as required. 

Additionally, work order documentation was 

not kept at production control stations. 

Operators used the lockout/tagout 

procedures to manage the work on the heat 

exchanger rupture disk, but did not clearly 

document the progress and status of the 

maintenance. Information that the isolation 

valve on the safety relief vent remained in 

the closed position and locked out was 

limited to a handwritten note. 

Although maintenance workers had replaced 

the rupture disk by about 4:30 p.m. on 

June 10, the valve isolating the rupture disk 

was not reopened. No further activities 

involving the rupture disk or relief line 

occurred on the nightshift or the dayshift on 

June 11 and the valve remained closed. 

Figure 3 shows the timeline of these events.

Goodyear’s work order system for 

maintenance requires the process operator to 

sign off when the repairs are completed. 

However, whether this occurred during the 

June 10 dayshift is unclear, and Goodyear

was unable to produce a signed copy of the 

work order. 
Goodyear Houston Case Study January 2011

7

Figure 3. Event timeline

3.3 Pressure Vessel Overpressure Protection

3.3.1 Heat Exchanger Rupture

As Figure 2 shows, a rupture disk and a 

pressure relief valve in series protected 

the ammonia heat exchanger from overpressure. An isolation valve installed 

between the rupture disk and the heat 

exchanger isolated the rupture disk and 

relief valve for maintenance. However, 

when the valve was in the closed position, 

the heat exchanger was still protected 

from an over-pressure condition by the 

automatic pressure control valve. 

The next day, when operators began a 

separate task to steam clean the process 

piping they closed a block valve between 

the heat exchanger and the automatic 

pressure control valve. This isolated the 

ammonia side of the heat exchanger from 

all means of over-pressure protection. 

Steam flowing through the heat 

exchanger increased the ammonia 

temperature and the pressure in the 

isolated heat exchanger. Because the 

over-pressure protection remained

isolated, the internal pressure increased 

until the heat exchanger suddenly and 

catastrophically ruptured.

3.3.2 Pressure Vessel Standards

The American Society of Mechanical 

Engineers Boiler and Pressure Vessel 

Code, Section VIII (the ASME Code),

provides rules for pressure vessel design, 

use, and maintenance, including overpressure protection. Use of the ASME 

Code was required at Goodyear by OSHA’s 

29 CFR 1910.119 Process Safety 

Management Standard.1

The ASME Code requires that when a 

pressure vessel relief device is 

temporarily blocked and there is a 

possibility of vessel pressurization above 

the design limit, a worker capable of 

releasing the pressure must continuously 

monitor the vessel. Goodyear’s 

maintenance procedures did not address 

over-pressurization by the ammonia 

when the relief line was blocked, nor did 

it require maintenance and operations 

staff to post a worker at the vessel to 

open the isolation valve if the pressure 

increased above the operating limit.

 1 OSHA Process Safety Management regulation, 29 

CFR 1910.119, is a performance-based processsafety regulation requiring manufacturers to comply 

with recognized and generally accepted good 

engineering practices on processes containing greater 

than threshold quantities of toxic or flammable 

chemicals.
Goodyear Houston Case Study January 2011

8

4.0 Lessons Learned 

4.1 Worker Headcounts 

On the morning of the incident, Goodyear 

erroneously accounted for all its workers 

and declared an end to the emergency. 

Hours later, workers discovered the 

victim buried in the rubble near the 

ruptured vessel. Her absence had not 

been noted due to lack of training and 

drills on worker headcounts.

Companies should conduct worker 

headcount drills that implement their 

emergency response plans on a facilitywide basis. Company procedures must 

account for breakdowns in automated 

worker tracking systems to ensure that all 

workers inside a facility can be quickly 

accounted for in an emergency. Drills that 

simulate such malfunctions should be 

conducted to verify that all lines of 

responsibility and alternate verification 

techniques will account for workers in a 

real situation.

4.2 Maintenance Completion

Although maintenance workers had 

replaced the rupture disk by about 4:30 

p.m. on June 10, the primary overpressure protection for the heat 

exchanger remained isolated until the 

heat exchanger ruptured at about 7:30 

a.m. on June 11. 

Communicating plant conditions between 

maintenance and operations personnel is 

critical to the safe operation of a process 

plant. Good practice includes formal 

written turnover documents that inform 

maintenance personnel when a process is 

ready for maintenance and operations 

personnel when maintenance is completed 

and the process can be safely restored to 

operation. 

4.3 Isolating Pressure Vessels 

Goodyear employees completely isolated 

an ammonia heat exchanger, including the 

over-pressure protection, while steaming 

a process line through the heat exchanger. 

Workers left the pressure relief line 

isolated for many hours following 

completion of the maintenance.

In accordance with the ASME Boiler and 

Pressure Vessel Code, over-pressure 

protection shall be continuously provided 

on pressure vessels installed in process 

systems whenever there is a possibility that 

the vessel can be over-pressurized by any 

pressure source, including external 

mechanical pressurization, external 

heating, chemical reaction, and liquid-tovapor expansion. Workers should 

continuously monitor an isolated pressure 

relief system throughout the course of a 

repair and reopen blocked valves 

immediately after the work is completed.
Goodyear Houston Case Study January 2011

9

5.0 References

Occupational Safety and Health Administration (OSHA) Process Safety Management Standard. 

29 CFR 1910.119, 1992. 

American Society of Mechanical Engineers (ASME). Boiler and Pressure Vessel Code, Section 

VIII, Division I, 2004.

Center for Chemical Process Safety (CCPS). Plant Guidelines for Technical Management of 

Chemical Process Safety (revised ed.). American Institute of Chemical Engineers 

(AIChE), 2004.

CCPS. Guidelines for Engineering Design for Process Safety, AIChE, 1993, p. 539.
Goodyear Houston Case Study January 2011

10

The U.S. Chemical Safety and Hazard Investigation Board (CSB) is an independent Federal agency 

whose mission is to ensure the safety of workers, the public, and the environment by investigating and 

preventing chemical incidents. The CSB is a scientific investigative organization; it is not an enforcement 

or regulatory body. Established by the Clean Air Act Amendments of 1990, the CSB is responsible for 

determining the root and contributing causes of accidents, issuing safety recommendations, studying 

chemical safety issues, and evaluating the effectiveness of other government agencies involved in 

chemical safety. 

No part of the conclusions, findings, or recommendations of the CSB relating to any chemical accident 

may be admitted as evidence or used in any action or suit for damages. See 42 U.S.C. § 7412(r)(6)(G). 

The CSB makes public its actions and decisions through investigation reports, summary reports, safety 

bulletins, safety recommendations, case studies, incident digests, special technical publications, and 

statistical reviews. More information about the CSB is available at www.csb.gov.

CSB publications can be downloaded at 

www.csb.gov or obtained by contacting:

U.S. Chemical Safety and Hazard 

Investigation Board

Office of Congressional, Public, and Board Affairs

2175 K Street NW, Suite 400

Washington, DC 20037-1848

(202) 261-7600

CSB Investigation Reports are formal, 

detailed reports on significant chemical 

accidents and include key findings, root causes, 

and safety recommendations. CSB Hazard 

Investigations are broader studies of significant 

chemical hazards. CSB Safety Bulletins are 

short, general-interest publications that provide 

new or noteworthy information on 

preventing chemical accidents. CSB Case 

Studies are short reports on specific accidents 

and include a discussion of relevant prevention 

practices. All reports may contain safety 

recommendations when appropriate.