Ammonia Refrigeration: ALARP Decision with a Marginal QRA
Northern Cold Storage runs a 4,800 kg anhydrous ammonia refrigeration system serving a 22,000 m² cold warehouse. Its corporate QRA, built on generic leak frequencies of 0.08 per vessel-year, IIAR dispersion modeling, and a 210 m distance to the nearest residence, predicts a maximum individual risk of 3.4×10⁻⁵ per year at that residence. Corporate criteria set 1×10⁻⁵ per year as the maximum tolerable public risk and require an ALARP demonstration between 1×10⁻⁵ and 1×10⁻⁴. Option A costs $1.9 million for ammonia detection, automatic emergency ventilation, and a machine-room firewall, and predicts 6×10⁻⁶ per year. Option B costs $240,000 for written procedures, operator training, and monthly leak surveys, and predicts 2.6×10⁻⁵ per year. The plant has had two small ammonia leaks in three years, both from corroded liquid-line couplings; the QRA treats leak frequency as independent of equipment age and condition. Maintenance staffing was cut 30% last year, and the same two technicians would perform the leak surveys. Sixty people live within the modeled plume footprint.
1. Is the current risk tolerable? Which option or options should the operator implement, and how does the gross-disproportion test apply?
Read the worked answer
Current status. A maximum individual risk of 3.4×10⁻⁵/yr exceeds the 1×10⁻⁵/yr maximum tolerable criterion, so the risk is not tolerable as-is. It falls in the ALARP band (1×10⁻⁵ to 1×10⁻⁴), so risk must be reduced unless the cost is grossly disproportionate to the benefit.
Option B is inexpensive and should be implemented: it addresses mechanical integrity and operating practice, which the leak history shows are weak. It is not sufficient alone because residual risk (2.6×10⁻⁵) remains in the ALARP band.
Gross-disproportion check. Using 60 residents and a 30-year remaining life: Option B averts 60×0.8×10⁻⁵ = 4.8×10⁻⁴ expected fatalities/yr, about 0.014 over 30 years; cost per expected fatality averted ≈ $240k/0.014 ≈ $17M. Option A averts 60×2.8×10⁻⁵ = 1.68×10⁻³/yr, about 0.050 over 30 years; ≈ $1.9M/0.050 ≈ $38M. Against a $10M value of a statistical life, Option A is about 3.8× - high but often within the 2–10× gross-disproportion range, and it moves individual risk below 1×10⁻⁵. Both options are defensible; A is likely required unless a site-specific ALARP justification shows gross disproportion. Because the QRA probably understates risk (corrosion, staffing), the case for A strengthens. Document the decision, sensitivity cases, and residual risk.
2. Critique the QRA basis and explain how its weaknesses affect the decision.
Read the worked answer
The QRA is being used outside its valid basis. Generic leak frequencies (0.08 per vessel-year) do not reflect equipment age, corrosion history, coupling condition, or the 30% maintenance staffing cut. The two observed coupling leaks are evidence of a mechanical-integrity and inspection problem, not random events, and they undermine the independence assumption between leak prevention and emergency response.
The model also assumes mitigations perform as designed. Option A's predicted 6×10⁻⁶/yr depends on detection reliability and operator response, but the same reduced staff must maintain the detectors and respond. If the QRA credits emergency ventilation without a availability factor, it is optimistic. Option B's leak surveys use the same two technicians already stretched by staffing cuts, so its predicted 2.6×10⁻⁵ is also optimistic unless resources are added.
Other gaps: the plume footprint and 60 residents are treated as fixed, while weather and occupancy vary; small releases that dominate frequency may not be modeled; and no uncertainty analysis is presented. The decision should use sensitivity cases (leak frequency ×2, mitigation availability 0.8) and a site-specific frequency update based on inspection and leak data. If the risk estimate is uncertain by a factor of two or more, the ALARP decision should favor the more robust engineered option rather than relying on procedural controls.
3. What additional information would most change your decision, and how would you document the final judgment?
Read the worked answer
The most decision-relevant information is: (1) actual corrosion and inspection data for the liquid-line couplings and piping, including wall thickness and remaining life; (2) the reliability and availability of the proposed detection and ventilation, including maintenance staffing; (3) emergency response times and whether residents are especially vulnerable; (4) site-specific leak frequency and consequence modeling, with uncertainty bounds; and (5) corporate cost-effectiveness policy, including the value of statistical life and any gross-disproportion factor.
A credible change would be evidence that coupling failures are eliminated by an inspection and replacement program, which could justify deferring Option A while implementing Option B plus accelerated mechanical-integrity work. Conversely, evidence of widespread corrosion or unreliable detection would make Option A urgent.
Documentation should include: the risk criterion and ALARP band; the cost-benefit calculations with assumptions; sensitivity results; the rejected options and reasons; interim risk controls; and a management-of-change record. Because this is a risk-acceptance decision, the operator should record who accepted the residual risk, at what level, and on what basis, and should schedule a review when inspection data or staffing changes.