Ammonia refrigeration risk re-assessment
At a milk-processing plant outside Darkhan, a 900 kW ammonia refrigeration system serves three cold stores. The risk assessment, last updated in 2021, rates 'ammonia leak' as medium because 'operators are trained'. On 3 February a 6 kg ammonia release occurred when a maintenance fitter opened a valve without isolating the line; two workers developed eye irritation and cough; the local exhaust in the plant room had been disconnected for 5 weeks and the fixed leak detector had been bypassed after a false alarm. The plant room has one exit; the emergency plan says 'call the fire brigade'. Contract cleaners work in the plant room without gas training. Production pressure is high before Tsagaan Sar. The OSH officer must re-assess and define controls.
1. Critique the existing risk assessment and re-rank the risk using likelihood, severity and exposure. Explain the role of the hierarchy of controls.
Read the worked answer
The existing rating is not credible. It treats 'operators are trained' as a control that makes a leak medium risk, but training is an administrative control and does not prevent a fitter from opening a valve without isolation. Severity is potentially fatal: ammonia is corrosive and toxic to the eyes and respiratory tract, and a large release in a plant room with one exit can trap workers. Likelihood is also higher than assumed because the local exhaust was disconnected for five weeks, the detector was bypassed, contractors work in the room without gas training, and maintenance is happening under production pressure before Tsagaan Sar.
Exposure is not limited to the fitter. Cleaners, maintenance staff and anyone entering the plant room are exposed, and a release could affect adjacent production areas. The risk should be re-ranked as high or critical until engineering controls are restored. The assessment should record the assumptions, the people exposed, the possible release scenarios, and the emergency response capability.
The hierarchy of controls should drive the decision. Elimination or substitution, such as reducing ammonia charge or using a less hazardous refrigerant, is the most reliable. Engineering controls come next: ventilation, fixed detection with alarm and automatic shutdown, isolation valves, and pressure relief. Administrative controls such as permits, procedures, training and drills support these but cannot replace them. PPE is the last line and is not a control for the plant room as a whole.
2. Specify engineering and procedural controls, with verification and residual risk.
Read the worked answer
Engineering controls: repair and commission the local exhaust; provide mechanical ventilation with emergency extraction; install or restore ammonia detectors at likely leak points and at low level, with alarm and automatic shutdown; identify and label isolation points; fit lockout/tagout; provide emergency eyewash and shower; and ensure the plant room has a second escape route or a protected refuge if the single exit cannot be changed. The maintenance fitter should have a permit-to-work that requires isolation, depressurisation, gas testing and a second person.
Procedural controls: a contractor induction for cleaners and maintenance workers; a plant-room entry log; a written isolation procedure; leak-testing after maintenance; an emergency plan that names who calls the fire brigade, who isolates the plant, and where workers assemble; and drills with the local fire service. The plan should be in Mongolian and understood by all shifts. Training should be verified by observation, not only signatures.
Verification: detector calibration records, ventilation test results, permit audits, drill reports, and a post-maintenance leak test. Residual risk after these controls may be low but not zero, because ammonia remains on site and maintenance errors are still possible. The assessment should state that residual risk and the additional controls, such as restricting the ammonia charge or remote isolation, needed to reduce it further.
3. The plant manager wants to restart in six hours after fixing the valve. What should the OSH officer recommend?
Read the worked answer
The OSH officer should recommend against restart in six hours unless every critical safeguard is restored and verified. Fixing the valve addresses only the immediate leak path. The detector was bypassed, the exhaust was disconnected for five weeks, and the permit system failed. Restarting without correcting those would recreate the same conditions.
Before restart, the valve repair should be leak-tested; the detector should be calibrated and no longer bypassed; the ventilation should be tested; the permit-to-work and isolation procedure should be in place; the maintenance fitter and supervisors should be briefed; and the emergency plan should be tested at least by a walk-through. The investigation should establish why the detector was bypassed and why the exhaust was left disconnected for five weeks. Contract cleaners should not enter the plant room until they are inducted and the area is controlled.
A staged restart is reasonable: restart one cold store at a time, with the OSH officer present, and monitor for leaks. Production pressure before Tsagaan Sar is not a justification for bypassing safeguards. If the manager insists, the OSH officer should document the advice, escalate to senior management, and consider notifying the labor inspector. The decision should be recorded as a management-of-change decision with named accountability.