25 ppm at 02:40
You are the only technically certified person on night shift at a cold-storage warehouse running an ammonia refrigeration plant. At 02:40 the fixed detection system raises an alarm: sensor A in the machine room reads 25 ppm, sensor B in the same room reads 3 ppm. Six people are working in the picking hall, which is separated from the machine room by a firedoor but shares the same ventilation intake. Your site procedure says a two-sensor confirmation triggers full evacuation; a single-sensor alarm requires investigation by a competent person within 30 minutes. You hold an electrical and controls certification, not a refrigeration or ammonia-response qualification, and the only ammonia-trained engineer is 55 minutes away. The duty manager, who is not on site, tells you by phone to take the portable meter into the machine room, confirm, and reset the alarm so picking can continue. He adds that the last two alarms this month were sensor faults.
1. What do you do in the next ten minutes? Explain the basis for each action.
Read the worked answer
Treat the alarm as real until it is proven otherwise, and treat the disagreement between sensors as unresolved information rather than as evidence of a fault. A single high reading with a low neighbour is consistent with a sensor fault, but it is equally consistent with a localised release near sensor A and a working ventilation path away from sensor B. You cannot tell which from where you are standing.
The two-sensor evacuation rule does not apply on its face, but neither does the single-sensor investigation rule - that rule presumes a competent person, and by your own account you are not one for ammonia. Competence is specific, not general.
So: alert the six people in the picking hall, move them to the assembly point upwind and outside the shared-intake zone, and account for them. Call the ammonia-trained engineer out. Notify the duty manager in writing of what you have done and why. Do not reset the alarm, do not silence it without recording it, and do not enter the machine room. Ten minutes of disruption is recoverable; a wrong entry is not.
2. The duty manager repeats the instruction to enter and adds that you will be held responsible for the lost production. How do you handle the pressure?
Read the worked answer
The production argument is not a reason to enter; it is a reason to escalate faster. Being held responsible for a stoppage is a management consequence. Entering an ammonia atmosphere without respiratory protection, gas detection you trust, or training to interpret what you find is a safety consequence, and it is not transferable to a manager who is not in the building.
Respond on the call with the one thing he needs to hear: the picking hall is clear and accounted for, the trained engineer is 55 minutes out, and there is no scenario in which an untrained entry shortens that. If he wants the alarm investigated sooner, the levers are the engineer's ETA and the site's emergency contractor, not you.
Immediately afterwards, put it in writing - time, instruction, your response, the reason, the evacuation. Copy whoever owns site safety. The written record is not aggression; it is the only thing that protects both of you if the sensor turns out to have been right.
3. The engineer arrives, finds no leak, and confirms sensor A has drifted. What should happen before the site returns to normal operation?
Read the worked answer
Resist the relief of a clean result. Two sensors disagreeing by a factor of eight on the same wall is an instrumentation finding with safety significance, not a nuisance alarm.
Before restart: record the as-found state of sensor A, including the drift value and the last calibration and bump-test dates, and check whether the drift is inside or outside its documented tolerance. Review the two earlier alarms this month - if they are the same sensor, the site has been treating a degrading detector as a false-alarm source and the 30-minute investigation rule has effectively been met by assumption.
Then: replace or recalibrate sensor A and verify against a reference gas; test the alarm logic end to end, including whether a single-sensor alarm should auto-evacuate given the layout; and review the ventilation path between machine room and picking hall, because the shared intake made a single-room event a whole-site event.
Finally, address the staffing gap that produced the situation - a night shift with nobody competent for the dominant site hazard is a management finding, and it will recur.