|Contents
|Background
|Qualifications and information reviewed
|Method
|Previous incidents
|Risk-ranking matrix
|Subsystems List
|Possible Causes
|Possible Consequences
|Existing Safeguards
|Recommended Actions

PSM-CAP App

Process-hazard analysis (PHA) for
process Ammonia Refrigeration in facility Plant A1 owned by My Company, Inc.

PHA Team leader:
Test, User71, Maintenance Manager, My Company, Inc., info@factplusfancy.com

Date the team leader gave a spoken report summarizing the PHA recommended actions:
December 10, 2021

Next due date. The next PHA update and revalidation should be completed in time for its team leader to give a spoken or written report by:
December 10, 2026

Activity notice posted, to facilitate additional employee participation, digital filename:
[No uploaded files found for this field.]

Team attendance records and any other supporting materials:
[No uploaded files found for this field.]

Facility name and location:
[Nothing has been recorded in the field.]

Prepared for:
[Nothing has been recorded in the field.]

Prepared by:
[Nothing has been recorded in the field.]

Date this written report was issued:
December 10, 2021

Background on the process, applicable PHA rules, and past PHA or revisions history

[IF CUSTOMIZING THIS SAMPLE PHA, COMPLETE ALL NEEDED ANALYSIS, VERIFY EVERYTHING IN IT, AND MODIFY IT AS NEEDED.]

The [OWNER/OPERATOR NAME], [FACILITY NAME], located at [FACILITY STREET ADDRESS OR LOCATION] (the facility) had records indicating that its:
* closed-loop mechanical ammonia-refrigeration system (the ammonia-refrigeration system)
* contained approximately [_________] pounds of anhydrous ammonia, as of [DATE].

As a result, the following require a process-hazard analysis (PHA) update and revalidation every five years:
* Process Safety Management (PSM) regulations at Title 29, Code of Federal Regulations, Section 1910.119 (29 CFR 1910.119), implemented by U.S. Department of Labor, Occupational Safety and Health Administration (OSHA), and
* Program 3 Prevention Program regulations at 40 CFR 68, Subpart D, implemented by the U.S. Environmental Protection Agency (EPA).
The PSM rules are designed to protect employees by safely managing processes that use highly hazardous chemicals, such as anhydrous ammonia. The EPA's Chemical Accident Prevention (CAP, also called Risk Management Plan, RMP) rules (40 CFR 68), are designed to protect the surrounding community from similar hazards.

This report includes recommended actions developed by the PHA team. Many of these are not specifically required by codes or regulations. They may be optional, depending on judgment about whether the current situation is reasonably safe, and so meets the general duty and PSM good-practice rules. The PHA team did not evaluate health, safety, environmental, engineering, construction, financial, security or other considerations required for implementing recommended actions, resolution options, or other suggestions made in this report. Safe and effective resolution of recommended actions -- including careful evaluation of resolution options or other suggestions made in this report and also including means, methods, and sequences -- remains the responsibility of the Owner/Operator of the facility or contractors that may take on specific projects.

Resolution of PHA Recommended Actions:
Any imminently dangerous situations should be immediately controlled. The risk ranking, based on likelihood and severity, helps assess this. Otherwise, the PSM final rule preamble indicates, "It is OSHA's intention that the actions to be taken as a result of the process hazard analysis recommendations be completed as soon as possible. In most cases, OSHA believes that employers will be able to complete these actions within a one to two year time frame, but notes that in unusual circumstances longer completion periods may be necessary." (57 Federal Register 6379, February 24, 1991)

Facility PHA History
[IF APPLICABLE, PUT HISTORY HERE, INCLUDE TEAM LEADERS, TEAM MEMBERS, AND COMPLETION DATES.]

Team qualifications and information reviewed

[PSM CONTRACTOR-ORGANIZATION OR EMPLOYEE NAME] assisted [OWNER/OPERATOR NAME] with completing this [YEAR] PHA update and revalidation [OR INITIAL PHA], with additional assistance from [REFRIGERATION CONTRACTOR-ORGANIZATION NAME].

The PHA update and revalidation team included:
[NAMES, TITLES, AND COMPANIES OF TEAM MEMBERS]
[ENSURE THESE MEET APPLICABLE COMPETENCY REQUIREMENTS OR EMPLOYEE-PARTICIPATION REQUIREMENTS, SUCH AS
* 29 CFR 1910.119(e)(4)) The process hazard analysis shall be performed by a team with expertise in engineering and process operations, and the team shall include at least
- one employee [OR CONTRACTOR INDIVIDUAL] who has experience and knowledge specific to the process being evaluated. Also,
- one member of the team must be knowledgeable in the specific process hazard analysis methodology being used.
* 29 CFR 1910.119(c)(2) Employers shall consult with employees and their representatives on the conduct and development of process hazards analyses...]

[DESCRIBE QUALIFICATIONS OF THE PHA TEAM LEADER IN DETAIL AND ALSO OF THE OTHER PHA TEAM MEMBERS, AS NEEDED TO DEMONSTRATE THAT COMPETENCY AND EMPLOYEE-PARTICIPATION ARE ADEQUATELY ADDRESSED.]

The PHA team members gained experience and knowledge specific to the facility's ammonia-refrigeration system as follows.

[DESCRIBE:
* DOCUMENTS REVIEWED,
* PEOPLE COMMUNICATED WITH, SUCH AS BY PHONE CALLS OR EMAILS, AND
* THINGS OBSERVED.]

Method

The [YEAR] PHA update and revalidation team (the team) used the [LIST METHOD, WHICH SHOULD MEET APPLICABLE REQUIREMENTS, SUCH AS AT 29 CFR 1910.119(e)(2), FOR EXAMPLE] what-if/checklist method, similar to the methods used for the initial PHA and previous PHA updates and revalidations at the facility. This is a hazard identification and risk analysis (HIRA) method intended to:
* identify and evaluate hazards and existing safeguards (engineering controls, administrative controls, and other safeguards), including hazards revealed by, related to, or amplified by
- prior incidents (at the facility or elsewhere, if known and applicable),
- facility siting (distances from hazards to people, property, or other important things, like rivers...),
- human factors,
- interrelationships between safeguards (independence of protection layers), and
- failure consequences of safeguards,
* provide a semi-quantitative risk assessment for each hazard (including the failure of safeguards), which moderately exceeds the required "qualitative evaluation of a range of the possible safety and health effects of failure of controls",
* make recommendations (called recommended actions in this report), and so
* satisfy the PHA requirements of the PSM and CAP rules cited above.

The team communicated synchronously from [DATE] to [DATE] and asynchronously, via email, from [DATE] to [DATE].

Synchronous communications. All times in [TIME ZONE].
[LIST IN-PERSON MEETINGS, VIDEO CONFERENCES WITH SCREEN SHARES, PHONE CALLS, AND OTHER SYNCHRONOUS COMMUNICATIONS.]

Asynchronous communications.
See emails records, from [DATE] to [DATE], which [PSM CONTRACTOR-ORGANIZATION NAME (OR, IF THE PHA-TEAM LEADER WAS AN EMPLOYEE OF THE OWNER/OPERATOR) OWNER/OPERATOR NAME] intends to keep on file for at least ten years.

Before and during the above communication period, the team leader verified that the process-safety information, augmented by the PHA team's ability to observe the as-built ammonia-refrigeration system, was adequate to complete the PHA.

[DESCRIBE ANYTHING COVERED IN THE PHA MEETINGS THAT IS NOT ADEQUATELY DESCRIBED IN THE PHA REPORT'S SCENARIOS.]

As part of completing the PHA update and revalidation, the PHA team assessed or developed the following for common as well as site-specific scenarios (what-if questions):
* possible causes,
* possible consequences,
* existing safeguards, at/for/in the facility and its ammonia-refrigeration system,
* severity with existing safeguards in place, and
* likelihood of the above severity with existing safeguards in place,
* recommended actions, if needed.

The PHA team also considered, as needed to assess the PHA scenarios, known and applicable:
* changes since the last PHA update and revalidation,
* previous incidents at the facility or elsewhere,
* other failures or scenarios, including any needed to ensure that the scenarios adequately covered
- engineering-controls or administrative-controls failures,
- hazards created or amplified by human factors or facility siting, and
- any significant interrelationships among the above.

The PHA team reviewed aerial images, local maps, site and floor plans, the ammonia-refrigeration system flow diagram, piping & instrumentation diagram (P&ID), component-manufacturer documentation, and other process-safety information as needed to evaluate the scenarios.

External hazards, protection, and security -- the PHA team
(1) reviewed external hazards that may influence designing, building, maintaining, and securing the facility, such as avalanche/debris flow/landslide/mudslide, cold, earthquake, flood, hail, heat, humidity, ice, lightning, rain, salinity/sea spray, sand or dust storm, snow, terrorism/theft/vandalism, tsunami, volcanic activity, wildfire, and wind (including from hurricanes and tornadoes), by reviewing
(1.1) multi-hazard maps (such as, in the USA, the National Risk Index for Natural Hazards and the ASCE 7 Hazard Tool),
(1.2) flood maps (in the USA, published by FEMA),
(1.3) seismic maps (such as, in the USA, USGS Seismic Hazard Maps), and
(1.4) the facility and local history of external hazards, based on discussions with facility managers, employees, or others, and if applicable
(2) reviewed the conclusions and recommendations of any reports assessing the protection of the ammonia-refrigeration system from these hazards, including any damage assessments from prior events, that the responsible individual(s), per the Owner/Operator management system, were aware of and provided to the PHA team,
(2.1) reviewed how the prior PHAs, for the ammonia-refrigeration system, covered these hazards,
(3) checked if as-built documentation indicated consideration of external hazards, as needed, such as by listing applicable building codes and editions, structural design criteria, or similar, on a sample that [PREFERABLY] included as-built documentation for
(3.1) buildings or structures that support or protect the ammonia-refrigeration system,
(3.2) piping supports or hangers, including any needed seismic bracing,
(3.3) for earthquake/seismic hazards, larger and heavier things, especially if their supports may allow too much oscillation (such as longer supports), and also flexible things near rigid things, for example,
(3.3.1) condenser support structures,
(3.3.2) large pressure vessels that contained liquid, such as receivers and recirculators, and their supports,
(3.3.3) anything heavier than piping, such as liquid-containing pressure vessels, that was hung from supports above it,
(3.3.4) horizontal cantilevers, such as vessels or heavy piping supported from walls,
(3.3.5) pipe penetrations through room or building envelopes, such as floors, roofs, and walls, which need to be well sealed while allowing for differential movement during earthquakes,
(3.3.6) piping that crossed a building's seismic joints, and
(3.4) the foundations of all of the above, where applicable, and
(4) [FOR ALREADY BUILT SYSTEMS] during the facility tour, checked a sample of the ammonia-refrigeration system, its supports, and its security for consistency with intended protections from external hazards.

Some of the above effort by the PHA team may have been done by sub-groups or individuals within the team, and summarized to the team.

The word "known" in this method description means known to the PHA team and its leader, after their efforts to find needed information, reasonably consistent with typical efforts by PHA teams assessing ammonia-refrigeration systems.

Risk rankings were assigned to each scenario, based on their severity and likelihood, using the risk-ranking matrix below (or linked below).

A risk ranking was also assigned to each recommended action based on the highest risk ranking of a scenario with which the recommended action was associated.

Identification of applicable previous incidents

Many of the scenarios evaluated by the PHA team, including scenarios that could lead to an anhydrous-ammonia release, were based on known failure mechanisms or previous incidents, at the facility or elsewhere. In cases where a specific previous incident was discussed by the PHA team, this may be summarized in the applicable scenario or elsewhere in this report. Each scenario includes an optional scenario type field, which may be used to identify scenarios that were based on previous incidents, at any time or place, not just at the facility.

The PHA leader reviewed the following facility ammonia-refrigeration incident-investigation reports, and modified the PHA scenarios as needed to ensure that they covered the findings and recommendations of these reports. The PHA team discussed these reports when relevant scenarios were evaluated, focusing on any unresolved recommendations, any shortcomings in the resolution methods, and whether any additional recommendations were needed.
* LIST TITLES OF REVIEWED INCIDENT INVESTIGATION REPORTS -- ATTEMPT TO FIND ALL FROM THE LAST FIVE YEARS, WHOSE RETENTION THE PSM RULES REQUIRE.

Subsystems List
A1. Equipment and piping in general
A2. Human factors and human errors in general
A3. Location, siting, and surroundings plus equipment, plans, and systems for emergencies, safety, and security.
A4. Charging ammonia into the ammonia-refrigeration system from tanker trucks
B1. Compressors
B2. Condensers
B3. Purging non-condensable gases
C1. Receiver(s), high-pressure and thermosiphon [IF ANY, DESCRIBE. COMBINED?]
C2. Recirculator(s) and ammonia-refrigerant pumps [UPDATE IF MULTIPLE]
C3. Transfer system
D1. Air-cooling equipment, including defrosting
D2. Liquid chillers or heaters such as ice builders, film, plate, scraped surface, tube-in-shell... for brine, glycol, water...
D3. Silos and tanks with ammonia-cooled jackets that don't contact the cooled liquid

Subsystem A1. Equipment and piping in general
* Brittle fracture of equipment (includes vessels) or piping (includes valves) risks are too high.
* Electrical loose connection, overloading, or similar causes higher temperature, especially for larger motors and loads.
* Equipment design pressure, especially if 150 PSI, is less than its internal ammonia-refrigerant pressure during shutdowns, in hot weather, or when heat loads and temperatures are moderately higher than expected.
* Instrumentation or its connection, leaks out into building or outside
* Liquid ammonia is trapped in equipment or piping, including in a vessel or heat exchanger, with little or no headspace, such as some chillers, compressor-oil coolers, heaters, refrigerant pumps, or oil pots.
* Liquid-ammonia flow, too little, to cooling equipment or a recirculator vessel.
* Liquid-ammonia flow, too much, to cooling equipment without defrost or to a recirculator vessel.
* Piping joint, bolted or threaded, problem -- with bolts, flanges, gaskets, nuts, threaded couplings, unions, and so forth.
* Pressure-relief device discharges below set pressure: slow leak-by seat to fails fully open, possibly after a pressure spike.
* Pressure-relief devices, with different opening pressures, protect vessels connected by piping that allows rapid flow.
* Pressure-relief system carries liquid or two-phase flow when built for gas only.
* Pressure-relief system(s) inadequately protects from overpressure or not installed.
* Shocks or vibrations damage equipment (includes vessels) or piping (includes valves).
* Sight glass, its housing, their gaskets, or connections -- break, crack, cut, degraded, loose, or other problem.
* Steel primary containment, exterior corrosion, possibly coupled with exterior erosion or wear -- such as of equipment (includes vessels) and piping (includes valves).
* Steel primary containment, interior corrosion -- such as of equipment (includes vessels) and piping (includes valves).
* Steel primary containment, interior erosion -- such as of equipment (includes vessels) and piping (includes valves).
* Supports for equipment or piping are corroded, degraded, damaged, inadequate, or overloaded.
* Threaded bonnet removed when hand turning a valve stem, including manual-opening stems on control valves.
* Valve stem, too much torque applied -- when closed, fully opened, or stuck.
* Valve, control, leaks out -- causing ammonia to contaminate air inside a building or outdoors.
* Valve, stop, leaks by -- so ammonia refrigerant can flow past its seat, in either or both directions.
* Valve, stop, leaks out -- causing ammonia to contaminate air inside a building or outdoors.
* Valve, stop, not present where needed for maintenance or leak mitigation.
* Valve, stop, stuck in normal position (typically open, sometimes closed).

Scenario name:
Brittle fracture of equipment (includes vessels) or piping (includes valves) risks are too high.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Force or impact too strong
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Loads added without properly evaluating.
* Shocks or vibrations cause damage.
* Vessel or piping temperature is below its minimum design metal temperature (MDMT).

Possible Consequences:
* Equipment or piping becomes more susceptible to external physical damage.
* Explosion or fire more likely.
* Hinders safety, security, health, or environmental protection.
* Human errors become more likely or more severe.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.

Existing Safeguards:
* Change management is adequate.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Temperatures of equipment and piping are kept above their minimum design metal temperature (MDMT).
* Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Recommended Actions:
None found.

Scenario name:
Electrical loose connection, overloading, or similar causes higher temperature, especially for larger motors and loads.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
20% to 90% per year (every couple-few years)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Corrosive materials in vicinity.
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.
* Temperature or humidity changes within or moderately outside of typically expected ranges.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.

Recommended Actions:
None found.

Scenario name:
Equipment design pressure, especially if 150 PSI, is less than its internal ammonia-refrigerant pressure during shutdowns, in hot weather, or when heat loads and temperatures are moderately higher than expected.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Consequences:
* Explosion or fire more likely.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Overpressure in equipment or piping.
* Shocks that could damage equipment, piping, or supports.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Air and water contamination of the ammonia refrigerant is kept adequately low.
* Air-cooling equipment and piping are adequately built, controlled, located, inspected, tested, and maintained.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Defrost, hot gas, is built and controlled adequately to handle a reasonable range of circumstances. [APPLICABLE?]
* Defrost, water, is built and controlled adequately to handle a reasonable range of circumstances. [APPLICABLE?]
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Production monitoring and quality control.
* Purging non-condensable gases is done effectively.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Sight glasses -- none are linear or tubular, and all are built, installed, and inspected properly and replaced as needed.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Instrumentation or its connection, leaks out into building or outside

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Corrosive materials in vicinity.
* Design, fabrication, construction, or installation shortcoming or error.
* Force or impact too strong
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Joint, bolted, problem.
* Joint, threaded, problem.
* Shocks or vibrations cause damage.
* Temperature or humidity changes within or moderately outside of typically expected ranges.
* Vehicle moves unexpectedly.

Possible Consequences:
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.
* Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Recommended Actions:
None found.

Scenario name:
Liquid ammonia is trapped in equipment or piping, including in a vessel or heat exchanger, with little or no headspace, such as some chillers, compressor-oil coolers, heaters, refrigerant pumps, or oil pots.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Stop valve closed without proper pump-out or manual opening of control valves.

Possible Consequences:
* Explosion or fire more likely.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.

Recommended Actions:
None found.

Scenario name:
Liquid-ammonia flow, too little, to cooling equipment or a recirculator vessel.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
20% to 90% per year (every couple-few years)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Control valve allows too little or no flow, including expansion, gas-powered, motorized, and solenoid valves and regulators.
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Design, fabrication, construction, or installation shortcoming or error.
* Filter or strainer clogged or not working as intended.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Level signal wrong -- higher than actual, or float switch stuck in high position.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Procedure is confusing, ignored, misunderstood, or wrong.
* Shocks or vibrations cause damage.

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Existing Safeguards:
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Production monitoring and quality control.
* Pump safety shutoffs are adequate, for both ammonia and cooling-water pumps, including for their motors.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Liquid-ammonia flow, too much, to cooling equipment without defrost or to a recirculator vessel.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Control valve allows too much flow or remains fully open -- but not including shocks from expansion valves too far open.
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Level signal wrong -- lower than actual, or float switch stuck in low position.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Procedure is confusing, ignored, misunderstood, or wrong.
* Shocks or vibrations cause damage.
* Spring problem.
* Valve-seat seal failure (seat-gasket degraded, debris on seat, not tight enough, etc.)

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Existing Safeguards:
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Transfer system and its piping are adequately built, controlled, located, inspected, tested, and maintained.

Recommended Actions:
None found.

Scenario name:
Piping joint, bolted or threaded, problem -- with bolts, flanges, gaskets, nuts, threaded couplings, unions, and so forth.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
20% to 90% per year (every couple-few years)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Defrost, hot gas, method or timing is unsafe normally, at the start or end of a power outage or blip, when loads are low, etc. [APPLICABLE?]
* Defrost, hot gas, time for pump down, soft gas, defrost, equalization (bleed), or freeze on (rechill) is unsafely reduced. [APPLICABLE?]
* Design, fabrication, construction, or installation shortcoming or error.
* Expansion valve open too much, shock each time solenoid valve opens.
* Fasteners, hangers, rods, or other support components -- loose or missing.
* Force or impact too strong
* Foundations move due to settling, shifting, earthquake, landslide, soil liquefaction, and so forth.
* Human error or poor judgment.
* Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Joint, bolted, problem.
* Joint, threaded, problem.
* Liquid accumulation in hot-gas or suction piping.
* Loads added without properly evaluating.
* Roof, piping, or other leak causes damage.
* Shocks or vibrations cause damage.
* Stop valve closed without proper pump-out or manual opening of control valves.
* Supports for piping or equipment inadequate, so normal vibrations are amplified into swaying, and so forth.
* Temperature or humidity changes within or moderately outside of typically expected ranges.
* Wrong substance or concentration added or used.

Possible Consequences:
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Defrost, hot gas, is built and controlled adequately to handle a reasonable range of circumstances. [APPLICABLE?]
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Metal-fatigue prevention is adequate to avoid all but small leaks.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Pressure-relief device discharges below set pressure: slow leak-by seat to fails fully open, possibly after a pressure spike.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Spring problem.
* Valve-seat seal failure (seat-gasket degraded, debris on seat, not tight enough, etc.)
* Willful misconduct.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Pressure-relief devices, with different opening pressures, protect vessels connected by piping that allows rapid flow.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Change management is adequate.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.

Recommended Actions:
None found.

Scenario name:
Pressure-relief system carries liquid or two-phase flow when built for gas only.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Condensation
* Design, fabrication, construction, or installation shortcoming or error.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Pressure-relief system inadequate.

Possible Consequences:
* Explosion or fire more likely.
* Hinders emergency actions -- communications, move-to-safety, headcount, closing valves in/from safe locations, and so forth.
* Hinders emergency response -- firefighting, entry into unsafe places for rescue, stopping leaks, and so forth.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Overpressure in equipment or piping.
* Pressure-relief system discharges liquid ammonia to the atmosphere, so more is released.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.
* Shocks that could damage equipment, piping, or supports.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Air-cooling equipment and piping are adequately built, controlled, located, inspected, tested, and maintained.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Charging ammonia -- equipment, piping, and procedures are adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Pumps, ammonia-refrigerant, and their piping are adequately built, controlled, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Transfer system and its piping are adequately built, controlled, located, inspected, tested, and maintained.

Recommended Actions:
None found.

Scenario name:
Pressure-relief system(s) inadequately protects from overpressure or not installed.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Condensation
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Pressure-relief system inadequate.
* Spring problem.
* Willful misconduct.

Possible Consequences:
* Explosion or fire more likely.
* Hinders emergency response -- firefighting, entry into unsafe places for rescue, stopping leaks, and so forth.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Air-cooling equipment and piping are adequately built, controlled, located, inspected, tested, and maintained.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Charging ammonia -- equipment, piping, and procedures are adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Piping systems that ammonia refrigerant could leak into have adequate means to relieve any resulting overpressure.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Pumps, ammonia-refrigerant, and their piping are adequately built, controlled, located, inspected, tested, and maintained.
* Purging non-condensable gases is done effectively.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Sight glasses -- none are linear or tubular, and all are built, installed, and inspected properly and replaced as needed.
* Transfer system and its piping are adequately built, controlled, located, inspected, tested, and maintained.

Recommended Actions:
None found.

Scenario name:
Shocks or vibrations damage equipment (includes vessels) or piping (includes valves).

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
06. Attention needed -- if any recommended actions, review status at least monthly.

Possible Causes:
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Defrost, hot gas, method or timing is unsafe normally, at the start or end of a power outage or blip, when loads are low, etc. [APPLICABLE?]
* Defrost, hot gas, time for pump down, soft gas, defrost, equalization (bleed), or freeze on (rechill) is unsafely reduced. [APPLICABLE?]
* Defrost, using water, method or time for pump down, defrosting, and any needed drying, equalization (bleed), or freeze on (rechill) is either inadequate normally, at the start or end of a power outage or blip, or when loads are low, or is unsafely changed. [APPLICABLE?]
* Design, fabrication, construction, or installation shortcoming or error.
* Expansion valve open too much, shock each time solenoid valve opens.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Liquid accumulation in hot-gas or suction piping.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Pressure-relief system inadequate.
* Supports for piping or equipment inadequate, so normal vibrations are amplified into swaying, and so forth.
* Temperature or humidity changes within or moderately outside of typically expected ranges.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Air-cooling equipment and piping are adequately built, controlled, located, inspected, tested, and maintained.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Charging ammonia -- equipment, piping, and procedures are adequate.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Defrost, hot gas, is built and controlled adequately to handle a reasonable range of circumstances. [APPLICABLE?]
* Defrost, water, is built and controlled adequately to handle a reasonable range of circumstances. [APPLICABLE?]
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Piping systems that ammonia refrigerant could leak into have adequate means to relieve any resulting overpressure.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Pump safety shutoffs are adequate, for both ammonia and cooling-water pumps, including for their motors.
* Pumps, ammonia-refrigerant, and their piping are adequately built, controlled, located, inspected, tested, and maintained.
* Reciprocating compressors are more tolerant of liquid-ammonia refrigerant than screw compressors.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Sight glasses -- none are linear or tubular, and all are built, installed, and inspected properly and replaced as needed.
* Transfer system and its piping are adequately built, controlled, located, inspected, tested, and maintained.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.
* Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Recommended Actions:
None found.

Scenario name:
Sight glass, its housing, their gaskets, or connections -- break, crack, cut, degraded, loose, or other problem.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Consequences:
* Equipment or piping becomes more susceptible to external physical damage.
* Explosion or fire more likely.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Sight glasses -- none are linear or tubular, and all are built, installed, and inspected properly and replaced as needed.
* Temperatures of equipment and piping are kept above their minimum design metal temperature (MDMT).
* Transfer system and its piping are adequately built, controlled, located, inspected, tested, and maintained.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.
* Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Recommended Actions:
None found.

Scenario name:
Steel primary containment, exterior corrosion, possibly coupled with exterior erosion or wear -- such as of equipment (includes vessels) and piping (includes valves).

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Condensation
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Corrosive materials in vicinity.
* Design, fabrication, construction, or installation shortcoming or error.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Roof, piping, or other leak causes damage.
* Shocks or vibrations cause damage.
* Temperature or humidity changes within or moderately outside of typically expected ranges.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Piping systems that ammonia refrigerant could leak into have adequate means to relieve any resulting overpressure.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.
* Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Recommended Actions:
None found.

Scenario name:
Steel primary containment, interior corrosion -- such as of equipment (includes vessels) and piping (includes valves).

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Oxygen, nitrogen, or other non-condensable gas content is too high.
* Stress-corrosion cracking (SCC)
* Wrong substance or concentration added or used.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Air and water contamination of the ammonia refrigerant is kept adequately low.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Charging ammonia -- equipment, piping, and procedures are adequate.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Metal-fatigue prevention is adequate to avoid all but small leaks.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Piping systems that ammonia refrigerant could leak into have adequate means to relieve any resulting overpressure.
* Post-weld heat treatment (PWHT) was done to vessels where stress-corrosion cracking (SCC) is rare but more likely to occur.
* Purging non-condensable gases is done effectively.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Steel primary containment, interior erosion -- such as of equipment (includes vessels) and piping (includes valves).

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Piping systems that ammonia refrigerant could leak into have adequate means to relieve any resulting overpressure.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Supports for equipment or piping are corroded, degraded, damaged, inadequate, or overloaded.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
06. Attention needed -- if any recommended actions, review status at least monthly.

Possible Causes:
* Concrete cracking, creep, efflorescence, sagging, or spalling.
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Corrosive materials in vicinity.
* Design, fabrication, construction, or installation shortcoming or error.
* Fasteners, hangers, rods, or other support components -- loose or missing.
* Fire, nearby and severe, or worse, and the resulting heat and temperatures.
* Flood waters reach the ammonia-refrigeration system, its supports, or the building they are in or on.
* Force or impact too strong
* Foundations move due to settling, shifting, earthquake, landslide, soil liquefaction, and so forth.
* Human error or poor judgment.
* Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Joint, bolted, problem.
* Joint, threaded, problem.
* Loads added without properly evaluating.
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.
* Roof, piping, or other leak causes damage.
* Shocks or vibrations cause damage.
* Temperature or humidity changes within or moderately outside of typically expected ranges.
* Vehicle moves unexpectedly.
* Willful misconduct.

Possible Consequences:
* Damage due forces or loads exceeding capacity.
* Equipment or piping becomes more susceptible to external physical damage.
* Explosion or fire more likely.
* Hinders emergency actions -- communications, move-to-safety, headcount, closing valves in/from safe locations, and so forth.
* Hinders emergency response -- firefighting, entry into unsafe places for rescue, stopping leaks, and so forth.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Crash, derailment, avalanche/debris flow/landslide/mudslide, flood, salinity/sea spray, sand or dust storm, tsunami, volcano, and wildfire risks are reasonable.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.
* Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Recommended Actions:
None found.

Scenario name:
Threaded bonnet removed when hand turning a valve stem, including manual-opening stems on control valves.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Consequences:
* Explosion or fire more likely.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Valve stem, too much torque applied -- when closed, fully opened, or stuck.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Human error or poor judgment.

Possible Consequences:
* Damage due forces or loads exceeding capacity.
* Hinders emergency actions -- communications, move-to-safety, headcount, closing valves in/from safe locations, and so forth.
* Hinders emergency response -- firefighting, entry into unsafe places for rescue, stopping leaks, and so forth.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.

Existing Safeguards:
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Valve, control, leaks out -- causing ammonia to contaminate air inside a building or outdoors.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Force or impact too strong
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Joint, bolted, problem.
* Joint, threaded, problem.
* Temperature or humidity changes within or moderately outside of typically expected ranges.
* Valve-stem seal failure (packing damage, not tight enough, etc.)

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Valve, stop, leaks by -- so ammonia refrigerant can flow past its seat, in either or both directions.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Human error or poor judgment.
* Temperature or humidity changes within or moderately outside of typically expected ranges.
* Valve-seat seal failure (seat-gasket degraded, debris on seat, not tight enough, etc.)

Existing Safeguards:
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Valve, stop, leaks out -- causing ammonia to contaminate air inside a building or outdoors.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Force or impact too strong
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Joint, bolted, problem.
* Joint, threaded, problem.
* Temperature or humidity changes within or moderately outside of typically expected ranges.
* Valve-stem seal failure (packing damage, not tight enough, etc.)

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Valve, stop, not present where needed for maintenance or leak mitigation.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Little or none

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
00. No action needed.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.

Existing Safeguards:
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Valve, stop, stuck in normal position (typically open, sometimes closed).

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Corrosive materials in vicinity.
* Design, fabrication, construction, or installation shortcoming or error.
* Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.

Existing Safeguards:
* Change management is adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Subsystem A2. Human factors and human errors in general
* Ammonia refrigerant gets contaminated, including with air, bad lubricants, debris, degraded gaskets, dust, filings, water, or welding slag.
* Change, misguided, is made to controls, such as changing timing, setpoints, or valve positions.
* Change, unauthorized (not hazardous), is made to compensate for something inconvenient, unsafe, or with a human-factors problem.
* Climbing, stepping, or leaning ladder on, or hanging stuff from, ammonia-refrigeration equipment and piping.
* Controls inadvertently activated.
* Controls indicate a problem but nobody notices.
* Cutting or opening, accidental, of ammonia-refrigeration equipment or piping.
* Incompetence or understaffing, of employees or contractors, due to changes in equipment, facilities, or people, such as more workload, fewer personnel, or turnover.
* Incompetence or understaffing, of inspectors with insurance companies, governmental authorities, or similar, such as due to budget cuts or other changes.
* Incompetence, of employees or contractors, due to inadequate training.
* Labels, markings, or tags do not easily identify equipment (includes vessels) or piping (includes valves).
* Lockout-tagout is inadequate for the work underway, such as opening equipment or piping, removing guarding, or electrical.
* Motor wired so it rotates in the wrong direction, for electric motors in or that could affect the ammonia-refrigeration system.
* Oil draining, from the ammonia-refrigeration system, stop valve for draining is frozen, left, propped, or stuck open.
* Oil not drained where needed from the ammonia-refrigeration system.
* Oil-drain piping is opened to the atmosphere, without isolating the equipment or piping from which oil is being drained.
* Pressure-relief valve replacement: valve removed while in service or another valve opens on shared inlet valve or outlet piping.
* Procedures are not described in writing or have little detail for some ammonia-refrigeration operations or maintenance.
* Procedures, P&ID, manuals, or other needed information are inadequate, missing, or not periodically reviewed and updated, as needed for reasonable safety.
* Purging, manually, stop valve for purging is left, propped, or stuck open.
* Replacement part, wrong one or installed incorrectly.
* Safety challenges follow-up is inadequate, including when incidents, near misses, or suggestions should have identified a need.
* Walking or working surfaces are too cluttered, dirty, or slippery.
* Work area is cold, cramped, dark, hot, or noisy, but not including inadequate access or getting trapped too likely.

Scenario name:
Ammonia refrigerant gets contaminated, including with air, bad lubricants, debris, degraded gaskets, dust, filings, water, or welding slag.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
20% to 90% per year (every couple-few years)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Fire, nearby and severe, or worse, and the resulting heat and temperatures.
* Flood waters reach the ammonia-refrigeration system, its supports, or the building they are in or on.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Joint, bolted, problem.
* Joint, threaded, problem.
* Procedure is confusing, ignored, misunderstood, or wrong.
* Wrong substance or concentration added or used.

Existing Safeguards:
* Air and water contamination of the ammonia refrigerant is kept adequately low.
* Change management is adequate.
* Charging ammonia -- equipment, piping, and procedures are adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Crash, derailment, avalanche/debris flow/landslide/mudslide, flood, salinity/sea spray, sand or dust storm, tsunami, volcano, and wildfire risks are reasonable.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Purging non-condensable gases is done effectively.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Change, misguided, is made to controls, such as changing timing, setpoints, or valve positions.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Human error or poor judgment.
* Willful misconduct.

Possible Consequences:
* Explosion or fire more likely.
* Hinders emergency actions -- communications, move-to-safety, headcount, closing valves in/from safe locations, and so forth.
* Hinders emergency response -- firefighting, entry into unsafe places for rescue, stopping leaks, and so forth.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Human errors become more likely or more severe.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Overpressure in equipment or piping.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.
* Shocks that could damage equipment, piping, or supports.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Defrost, hot gas, is built and controlled adequately to handle a reasonable range of circumstances. [APPLICABLE?]
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Change, unauthorized (not hazardous), is made to compensate for something inconvenient, unsafe, or with a human-factors problem.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Procedure is confusing, ignored, misunderstood, or wrong.

Existing Safeguards:
* Change management is adequate.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Production monitoring and quality control.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Climbing, stepping, or leaning ladder on, or hanging stuff from, ammonia-refrigeration equipment and piping.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
06. Attention needed -- if any recommended actions, review status at least monthly.

Possible Consequences:
* Damage due forces or loads exceeding capacity.
* Hinders emergency actions -- communications, move-to-safety, headcount, closing valves in/from safe locations, and so forth.
* Hinders emergency response -- firefighting, entry into unsafe places for rescue, stopping leaks, and so forth.
* Hinders maintenance or increases the need for repairs.
* Hinders safety, security, health, or environmental protection.
* Human errors become more likely or more severe.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Change management is adequate.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Temperatures of equipment and piping are kept above their minimum design metal temperature (MDMT).
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Controls inadvertently activated.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Procedure is confusing, ignored, misunderstood, or wrong.

Existing Safeguards:
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Production monitoring and quality control.
* Pump safety shutoffs are adequate, for both ammonia and cooling-water pumps, including for their motors.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Controls indicate a problem but nobody notices.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
01. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Alarm, public-address, paging, radio, or other emergency-communication system stops working.
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Willful misconduct.

Existing Safeguards:
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Production monitoring and quality control.
* Pump safety shutoffs are adequate, for both ammonia and cooling-water pumps, including for their motors.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Cutting or opening, accidental, of ammonia-refrigeration equipment or piping.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Consequences:
* Explosion or fire more likely.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Incompetence or understaffing, of employees or contractors, due to changes in equipment, facilities, or people, such as more workload, fewer personnel, or turnover.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
20% to 90% per year (every couple-few years)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.

Possible Consequences:
* Compressor package internal or seal damage, and if safeties fail, leak or fire.
* Damage due forces or loads exceeding capacity.
* Equipment or piping becomes more susceptible to external physical damage.
* Explosion or fire more likely.
* Hinders emergency actions -- communications, move-to-safety, headcount, closing valves in/from safe locations, and so forth.
* Hinders emergency response -- firefighting, entry into unsafe places for rescue, stopping leaks, and so forth.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Human errors become more likely or more severe.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Overpressure in equipment or piping.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.
* Shocks that could damage equipment, piping, or supports.
* Water contamination in the ammonia refrigerant becomes too high.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Charging ammonia -- equipment, piping, and procedures are adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Post-weld heat treatment (PWHT) was done to vessels where stress-corrosion cracking (SCC) is rare but more likely to occur.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Production monitoring and quality control.
* Pump safety shutoffs are adequate, for both ammonia and cooling-water pumps, including for their motors.
* Purging non-condensable gases is done effectively.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Security, of the facility, no shortcomings discovered by the PHA team.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Temperatures of equipment and piping are kept above their minimum design metal temperature (MDMT).
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.
* Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Recommended Actions:
None found.

Scenario name:
Incompetence or understaffing, of inspectors with insurance companies, governmental authorities, or similar, such as due to budget cuts or other changes.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
None found.

Possible Consequences:
* Explosion or fire more likely.
* Hinders safety, security, health, or environmental protection.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.

Existing Safeguards:
* Change management is adequate.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Incompetence, of employees or contractors, due to inadequate training.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
06. Attention needed -- if any recommended actions, review status at least monthly.

Possible Causes:
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.

Possible Consequences:
* Compressor package internal or seal damage, and if safeties fail, leak or fire.
* Equipment or piping becomes more susceptible to external physical damage.
* Explosion or fire more likely.
* Hinders emergency actions -- communications, move-to-safety, headcount, closing valves in/from safe locations, and so forth.
* Hinders emergency response -- firefighting, entry into unsafe places for rescue, stopping leaks, and so forth.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Human errors become more likely or more severe.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia into water or other liquids that may cause odors or flow into floor drains or similar.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Overpressure in equipment or piping.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.
* Shocks that could damage equipment, piping, or supports.
* Water contamination in the ammonia refrigerant becomes too high.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Charging ammonia -- equipment, piping, and procedures are adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Production monitoring and quality control.
* Pump safety shutoffs are adequate, for both ammonia and cooling-water pumps, including for their motors.
* Purging non-condensable gases is done effectively.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Security, of the facility, no shortcomings discovered by the PHA team.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.
* Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Recommended Actions:
None found.

Scenario name:
Labels, markings, or tags do not easily identify equipment (includes vessels) or piping (includes valves).

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Corrosive materials in vicinity.
* Design, fabrication, construction, or installation shortcoming or error.
* Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.
* Inspection, testing, or maintenance (ITM) shortcoming or error.

Possible Consequences:
* Equipment or piping becomes more susceptible to external physical damage.
* Explosion or fire more likely.
* Hinders emergency actions -- communications, move-to-safety, headcount, closing valves in/from safe locations, and so forth.
* Hinders emergency response -- firefighting, entry into unsafe places for rescue, stopping leaks, and so forth.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Human errors become more likely or more severe.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.
* Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Recommended Actions:
None found.

Scenario name:
Lockout-tagout is inadequate for the work underway, such as opening equipment or piping, removing guarding, or electrical.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
06. Attention needed -- if any recommended actions, review status at least monthly.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Design, fabrication, construction, or installation shortcoming or error.
* Filter or strainer clogged or not working as intended.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Level signal wrong -- higher than actual, or float switch stuck in high position.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Procedure is confusing, ignored, misunderstood, or wrong.
* Shocks or vibrations cause damage.
* Stop valve closed without proper pump-out or manual opening of control valves.
* Temperature or humidity changes within or moderately outside of typically expected ranges.
* Valve-seat seal failure (seat-gasket degraded, debris on seat, not tight enough, etc.)
* Willful misconduct.

Possible Consequences:
* Explosion or fire more likely.
* Human errors become more likely or more severe.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia into water or other liquids that may cause odors or flow into floor drains or similar.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Overpressure in equipment or piping.
* Pressure-relief system discharges liquid ammonia to the atmosphere, so more is released.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.
* Shocks that could damage equipment, piping, or supports.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Air-cooling equipment and piping are adequately built, controlled, located, inspected, tested, and maintained.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Pump safety shutoffs are adequate, for both ammonia and cooling-water pumps, including for their motors.
* Pumps, ammonia-refrigerant, and their piping are adequately built, controlled, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Transfer system and its piping are adequately built, controlled, located, inspected, tested, and maintained.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Motor wired so it rotates in the wrong direction, for electric motors in or that could affect the ammonia-refrigeration system.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.

Possible Consequences:
* Compressor package internal or seal damage, and if safeties fail, leak or fire.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Motor wired so it rotates in the wrong direction -- consequences at the facility. [UPDATE FOR COMPRESSORS, FANS AND PUMPS USED]
* Overpressure in equipment or piping.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pumps, ammonia-refrigerant, and their piping are adequately built, controlled, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Oil draining, from the ammonia-refrigeration system, stop valve for draining is frozen, left, propped, or stuck open.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Temperature or humidity changes within or moderately outside of typically expected ranges.
* Willful misconduct.

Possible Consequences:
* Hinders emergency response -- firefighting, entry into unsafe places for rescue, stopping leaks, and so forth.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Security, of the facility, no shortcomings discovered by the PHA team.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Oil not drained where needed from the ammonia-refrigeration system.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Change management is adequate.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Oil-drain piping is opened to the atmosphere, without isolating the equipment or piping from which oil is being drained.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Normal activity that is reasonably safe with proper precautions.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Security, of the facility, no shortcomings discovered by the PHA team.
* Transfer system and its piping are adequately built, controlled, located, inspected, tested, and maintained.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Pressure-relief valve replacement: valve removed while in service or another valve opens on shared inlet valve or outlet piping.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Procedure is confusing, ignored, misunderstood, or wrong.
* Valve-seat seal failure (seat-gasket degraded, debris on seat, not tight enough, etc.)

Possible Consequences:
* Explosion or fire more likely.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Procedures are not described in writing or have little detail for some ammonia-refrigeration operations or maintenance.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
Greater than 90% per year (almost every year or more often)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Normal activity that is reasonably safe with proper precautions.
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.

Existing Safeguards:
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Production monitoring and quality control.
* Pump safety shutoffs are adequate, for both ammonia and cooling-water pumps, including for their motors.
* Purging non-condensable gases is done effectively.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Procedures, P&ID, manuals, or other needed information are inadequate, missing, or not periodically reviewed and updated, as needed for reasonable safety.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.

Existing Safeguards:
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Production monitoring and quality control.
* Pump safety shutoffs are adequate, for both ammonia and cooling-water pumps, including for their motors.
* Purging non-condensable gases is done effectively.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Purging, manually, stop valve for purging is left, propped, or stuck open.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Little or none

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
00. No action needed.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Willful misconduct.

Possible Consequences:
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.

Existing Safeguards:
* Air and water contamination of the ammonia refrigerant is kept adequately low.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Purging non-condensable gases is done effectively.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Replacement part, wrong one or installed incorrectly.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.
* Procedure is confusing, ignored, misunderstood, or wrong.
* Willful misconduct.

Possible Consequences:
* Compressor contains liquid ammonia refrigerant, when it starts, due to refrigerant condensation while off.
* Compressor package internal or seal damage, and if safeties fail, leak or fire.
* Damage due forces or loads exceeding capacity.
* Equipment or piping becomes more susceptible to external physical damage.
* Explosion or fire more likely.
* Hinders emergency actions -- communications, move-to-safety, headcount, closing valves in/from safe locations, and so forth.
* Hinders emergency response -- firefighting, entry into unsafe places for rescue, stopping leaks, and so forth.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Human errors become more likely or more severe.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia into water or other liquids that may cause odors or flow into floor drains or similar.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Overpressure in equipment or piping.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.
* Shocks that could damage equipment, piping, or supports.
* Water contamination in the ammonia refrigerant becomes too high.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Production monitoring and quality control.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Safety challenges follow-up is inadequate, including when incidents, near misses, or suggestions should have identified a need.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.

Existing Safeguards:
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Walking or working surfaces are too cluttered, dirty, or slippery.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
07. Attention needed -- if any recommended actions, review status at least monthly.

Possible Causes:
* Human error or poor judgment.
* Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Temperature or humidity changes within or moderately outside of typically expected ranges.
* Willful misconduct.

Possible Consequences:
* Equipment or piping becomes more susceptible to external physical damage.
* Hinders emergency actions -- communications, move-to-safety, headcount, closing valves in/from safe locations, and so forth.
* Hinders emergency response -- firefighting, entry into unsafe places for rescue, stopping leaks, and so forth.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Human errors become more likely or more severe.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.

Existing Safeguards:
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Work area is cold, cramped, dark, hot, or noisy, but not including inadequate access or getting trapped too likely.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Little or none

Likelihood of above severity with existing safeguards in place:
Greater than 90% per year (almost every year or more often)

Risk Ranking:
00. No action needed.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Normal activity that is reasonably safe with proper precautions.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Change management is adequate.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Production monitoring and quality control.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Recommended Actions:
None found.

Subsystem A3. Location, siting, and surroundings plus equipment, plans, and systems for emergencies, safety, and security.
* Access to controls or valves is inadequate, normally or wearing emergency gear.
* Building, roof, structure, or supports collapse or move enough to damage ammonia-refrigeration equipment or piping.
* Combustible or flammable materials are unsafely stored or transferred in or near the refrigerating-machinery room or outdoor vessels.
* Compressed air problem -- the ammonia-refrigeration system does not use or rely compressed air.
* Electrical blip, flicker, outage then restoration, or surge (from lightning, etc.), facility-wide or smaller, possibly coinciding with an ammonia leak.
* Evacuation-route or gathering-point changes cannot be communicated fast enough, if they become unsafe.
* Fire heats ammonia-refrigeration equipment or piping until their internal pressure should cause pressure-relief valves to open.
* Ignition sources (electrical, flames, hot surfaces...) are present where an ammonia leak may cause an explosive atmosphere.
* New installations, like shelving or a door, expose ammonia-refrigeration equipment or piping to traffic.
* No records are made of everyone at the facility -- including contractors, employees, and visitors -- at a particular time.
* People, offsite, too many are often close to onsite hazards of ammonia-refrigeration leak or explosion, so risks unreasonable.
* People, onsite, too many are often close to onsite hazards of ammonia-refrigeration leak or explosion, so risks unreasonable.
* Pressure-relief discharge contaminates the air in locations where people live, work, or pass through, including building exits.
* Safety equipment or systems are inadequately built, labeled, located, inspected, tested, or maintained.
* Security, of the facility, does not reasonably protect the ammonia-refrigeration system.
* Stack, pole, or similar falls over onto ammonia piping.
* Tornado shelter air is contaminated by an ammonia leak, during or just after a tornado or when doors are opened to exit the shelter.
* Vehicle or heavy cart hits ammonia-refrigeration equipment, piping, or supports.
* Ventilation discharge, including emergency ventilation, contaminates the air in locations where people live, work, or pass through, including building exits.
* Ventilation is inadequate to prevent dangerous ammonia concentrations in the air of a room into which ammonia leaks.
* Water-supply problem -- no make-up water for condenser or [IF APPLICABLE] compressor cooling systems.
* Working alone in a mechanical penthouse, on a roof, or elsewhere people rarely go.

Scenario name:
Access to controls or valves is inadequate, normally or wearing emergency gear.

Scenario type:
All of above

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Corrosive materials in vicinity.
* Design, fabrication, construction, or installation shortcoming or error.
* Fasteners, hangers, rods, or other support components -- loose or missing.
* Fire, nearby and severe, or worse, and the resulting heat and temperatures.
* Flood waters reach the ammonia-refrigeration system, its supports, or the building they are in or on.
* Foundations move due to settling, shifting, earthquake, landslide, soil liquefaction, and so forth.
* Human error or poor judgment.
* Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Loads added without properly evaluating.
* Roof, piping, or other leak causes damage.
* Shocks or vibrations cause damage.
* Willful misconduct.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Change management is adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Building, roof, structure, or supports collapse or move enough to damage ammonia-refrigeration equipment or piping.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Multiple serious injuries, fatalities, catastrophic...

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
07. Attention needed -- if any recommended actions, review status at least monthly.

Possible Causes:
* Concrete cracking, creep, efflorescence, sagging, or spalling.
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Corrosive materials in vicinity.
* Design, fabrication, construction, or installation shortcoming or error.
* Fasteners, hangers, rods, or other support components -- loose or missing.
* Fire, nearby and severe, or worse, and the resulting heat and temperatures.
* Flood waters reach the ammonia-refrigeration system, its supports, or the building they are in or on.
* Force or impact too strong
* Foundations move due to settling, shifting, earthquake, landslide, soil liquefaction, and so forth.
* Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Joint, bolted, problem.
* Joint, threaded, problem.
* Loads added without properly evaluating.
* Roof, piping, or other leak causes damage.
* Shocks or vibrations cause damage.

Possible Consequences:
* Damage due forces or loads exceeding capacity.
* Explosion or fire more likely.
* Hinders emergency actions -- communications, move-to-safety, headcount, closing valves in/from safe locations, and so forth.
* Hinders emergency response -- firefighting, entry into unsafe places for rescue, stopping leaks, and so forth.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Human errors become more likely or more severe.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Crash, derailment, avalanche/debris flow/landslide/mudslide, flood, salinity/sea spray, sand or dust storm, tsunami, volcano, and wildfire risks are reasonable.
* Electrical, chemical, fuel, and mechanical equipment or materials that could damage the ammonia-refrigeration system are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Security, of the facility, no shortcomings discovered by the PHA team.
* Temperatures of equipment and piping are kept above their minimum design metal temperature (MDMT).
* Transfer system and its piping are adequately built, controlled, located, inspected, tested, and maintained.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.
* Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Recommended Actions:
None found.

Scenario name:
Combustible or flammable materials are unsafely stored or transferred in or near the refrigerating-machinery room or outdoor vessels.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Little or none

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
00. No action needed.

Possible Causes:
* Human error or poor judgment.
* Willful misconduct.

Possible Consequences:
* Explosion or fire more likely.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.

Existing Safeguards:
* Change management is adequate.
* Electrical, chemical, fuel, and mechanical equipment or materials that could damage the ammonia-refrigeration system are adequately built, located, inspected, tested, and maintained.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Compressed air problem -- the ammonia-refrigeration system does not use or rely compressed air.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Little or none

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
00. No action needed.

Possible Causes:
None found.

Possible Consequences:
None found.

Existing Safeguards:
None found.

Recommended Actions:
None found.

Scenario name:
Electrical blip, flicker, outage then restoration, or surge (from lightning, etc.), facility-wide or smaller, possibly coinciding with an ammonia leak.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Fasteners, hangers, rods, or other support components -- loose or missing.
* Fire, nearby and severe, or worse, and the resulting heat and temperatures.
* Flood waters reach the ammonia-refrigeration system, its supports, or the building they are in or on.
* Force or impact too strong
* Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Lightning strike

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Air-cooling equipment and piping are adequately built, controlled, located, inspected, tested, and maintained.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Defrost, hot gas, is built and controlled adequately to handle a reasonable range of circumstances. [APPLICABLE?]
* Defrost, water, is built and controlled adequately to handle a reasonable range of circumstances. [APPLICABLE?]
* Electrical, chemical, fuel, and mechanical equipment or materials that could damage the ammonia-refrigeration system are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Pumps, ammonia-refrigerant, and their piping are adequately built, controlled, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Transfer system and its piping are adequately built, controlled, located, inspected, tested, and maintained.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Evacuation-route or gathering-point changes cannot be communicated fast enough, if they become unsafe.

Scenario type:
Prior incident anywhere and facility siting

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Alarm, public-address, paging, radio, or other emergency-communication system stops working.
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* People are not kept a reasonably safe distance from dangerously malfunctioning things or higher-hazard special work.
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.
* Procedure is confusing, ignored, misunderstood, or wrong.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Fire heats ammonia-refrigeration equipment or piping until their internal pressure should cause pressure-relief valves to open.

Scenario type:
Prior incident anywhere and facility siting

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Fire, nearby and severe, or worse, and the resulting heat and temperatures.
* Human error or poor judgment.
* Lightning strike
* Vehicle moves unexpectedly.
* Willful misconduct.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Electrical, chemical, fuel, and mechanical equipment or materials that could damage the ammonia-refrigeration system are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Pump safety shutoffs are adequate, for both ammonia and cooling-water pumps, including for their motors.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Security, of the facility, no shortcomings discovered by the PHA team.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Ignition sources (electrical, flames, hot surfaces...) are present where an ammonia leak may cause an explosive atmosphere.

Scenario type:
Prior incident anywhere and facility siting

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Consequences:
* Explosion or fire more likely.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.

Existing Safeguards:
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Defrost, hot gas, is built and controlled adequately to handle a reasonable range of circumstances. [APPLICABLE?]
* Electrical, chemical, fuel, and mechanical equipment or materials that could damage the ammonia-refrigeration system are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Purging non-condensable gases is done effectively.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
New installations, like shelving or a door, expose ammonia-refrigeration equipment or piping to traffic.

Scenario type:
Prior incident anywhere and facility siting

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.

Possible Consequences:
* Equipment or piping becomes more susceptible to external physical damage.

Existing Safeguards:
* Change management is adequate.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
No records are made of everyone at the facility -- including contractors, employees, and visitors -- at a particular time.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Human error or poor judgment.
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.
* Willful misconduct.

Existing Safeguards:
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Security, of the facility, no shortcomings discovered by the PHA team.

Recommended Actions:
None found.

Scenario name:
People, offsite, too many are often close to onsite hazards of ammonia-refrigeration leak or explosion, so risks unreasonable.

Scenario type:
Prior incident anywhere and facility siting

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* People are not kept a reasonably safe distance from dangerously malfunctioning things or higher-hazard special work.

Possible Consequences:
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Air and water contamination of the ammonia refrigerant is kept adequately low.
* Air-cooling equipment and piping are adequately built, controlled, located, inspected, tested, and maintained.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Charging ammonia -- equipment, piping, and procedures are adequate.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Crash, derailment, avalanche/debris flow/landslide/mudslide, flood, salinity/sea spray, sand or dust storm, tsunami, volcano, and wildfire risks are reasonable.
* Defrost, hot gas, is built and controlled adequately to handle a reasonable range of circumstances. [APPLICABLE?]
* Defrost, water, is built and controlled adequately to handle a reasonable range of circumstances. [APPLICABLE?]
* Electrical, chemical, fuel, and mechanical equipment or materials that could damage the ammonia-refrigeration system are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Metal-fatigue prevention is adequate to avoid all but small leaks.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Piping systems that ammonia refrigerant could leak into have adequate means to relieve any resulting overpressure.
* Post-weld heat treatment (PWHT) was done to vessels where stress-corrosion cracking (SCC) is rare but more likely to occur.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Pump safety shutoffs are adequate, for both ammonia and cooling-water pumps, including for their motors.
* Pumps, ammonia-refrigerant, and their piping are adequately built, controlled, located, inspected, tested, and maintained.
* Purging non-condensable gases is done effectively.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Security, of the facility, no shortcomings discovered by the PHA team.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Sight glasses -- none are linear or tubular, and all are built, installed, and inspected properly and replaced as needed.
* Temperatures of equipment and piping are kept above their minimum design metal temperature (MDMT).
* Transfer system and its piping are adequately built, controlled, located, inspected, tested, and maintained.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.
* Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Recommended Actions:
None found.

Scenario name:
People, onsite, too many are often close to onsite hazards of ammonia-refrigeration leak or explosion, so risks unreasonable.

Scenario type:
Prior incident anywhere and facility siting

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Consequences:
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Air and water contamination of the ammonia refrigerant is kept adequately low.
* Air-cooling equipment and piping are adequately built, controlled, located, inspected, tested, and maintained.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Charging ammonia -- equipment, piping, and procedures are adequate.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Crash, derailment, avalanche/debris flow/landslide/mudslide, flood, salinity/sea spray, sand or dust storm, tsunami, volcano, and wildfire risks are reasonable.
* Defrost, hot gas, is built and controlled adequately to handle a reasonable range of circumstances. [APPLICABLE?]
* Defrost, water, is built and controlled adequately to handle a reasonable range of circumstances. [APPLICABLE?]
* Electrical, chemical, fuel, and mechanical equipment or materials that could damage the ammonia-refrigeration system are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Metal-fatigue prevention is adequate to avoid all but small leaks.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Piping systems that ammonia refrigerant could leak into have adequate means to relieve any resulting overpressure.
* Post-weld heat treatment (PWHT) was done to vessels where stress-corrosion cracking (SCC) is rare but more likely to occur.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Pump safety shutoffs are adequate, for both ammonia and cooling-water pumps, including for their motors.
* Pumps, ammonia-refrigerant, and their piping are adequately built, controlled, located, inspected, tested, and maintained.
* Purging non-condensable gases is done effectively.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Security, of the facility, no shortcomings discovered by the PHA team.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Sight glasses -- none are linear or tubular, and all are built, installed, and inspected properly and replaced as needed.
* Temperatures of equipment and piping are kept above their minimum design metal temperature (MDMT).
* Transfer system and its piping are adequately built, controlled, located, inspected, tested, and maintained.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.
* Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Recommended Actions:
None found.

Scenario name:
Pressure-relief discharge contaminates the air in locations where people live, work, or pass through, including building exits.

Scenario type:
Prior incident anywhere and facility siting

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Pressure-relief system inadequate.

Possible Consequences:
* Hinders emergency actions -- communications, move-to-safety, headcount, closing valves in/from safe locations, and so forth.
* Hinders emergency response -- firefighting, entry into unsafe places for rescue, stopping leaks, and so forth.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Transfer system and its piping are adequately built, controlled, located, inspected, tested, and maintained.

Recommended Actions:
None found.

Scenario name:
Safety equipment or systems are inadequately built, labeled, located, inspected, tested, or maintained.

Scenario type:
Prior incident anywhere and facility siting

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Willful misconduct.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Security, of the facility, does not reasonably protect the ammonia-refrigeration system.

Scenario type:
Prior incident anywhere and facility siting

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Alarm, public-address, paging, radio, or other emergency-communication system stops working.
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.
* Willful misconduct.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Security, of the facility, no shortcomings discovered by the PHA team.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.
* Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Recommended Actions:
None found.

Scenario name:
Stack, pole, or similar falls over onto ammonia piping.

Scenario type:
Facility siting

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Concrete cracking, creep, efflorescence, sagging, or spalling.
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Corrosive materials in vicinity.
* Design, fabrication, construction, or installation shortcoming or error.
* Fasteners, hangers, rods, or other support components -- loose or missing.
* Force or impact too strong
* Foundations move due to settling, shifting, earthquake, landslide, soil liquefaction, and so forth.
* Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Joint, bolted, problem.
* Joint, threaded, problem.
* Loads added without properly evaluating.
* Roof, piping, or other leak causes damage.
* Shocks or vibrations cause damage.
* Temperature or humidity changes within or moderately outside of typically expected ranges.

Possible Consequences:
* Damage due forces or loads exceeding capacity.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Electrical, chemical, fuel, and mechanical equipment or materials that could damage the ammonia-refrigeration system are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Tornado shelter air is contaminated by an ammonia leak, during or just after a tornado or when doors are opened to exit the shelter.

Scenario type:
Prior incident anywhere and facility siting

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.

Possible Consequences:
* Hinders safety, security, health, or environmental protection.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.

Existing Safeguards:
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Vehicle or heavy cart hits ammonia-refrigeration equipment, piping, or supports.

Scenario type:
All of above

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Consequences:
* Explosion or fire more likely.
* Hinders maintenance or increases the need for repairs.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Shocks that could damage equipment, piping, or supports.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Charging ammonia -- equipment, piping, and procedures are adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Crash, derailment, avalanche/debris flow/landslide/mudslide, flood, salinity/sea spray, sand or dust storm, tsunami, volcano, and wildfire risks are reasonable.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Post-weld heat treatment (PWHT) was done to vessels where stress-corrosion cracking (SCC) is rare but more likely to occur.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Security, of the facility, no shortcomings discovered by the PHA team.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Sight glasses -- none are linear or tubular, and all are built, installed, and inspected properly and replaced as needed.
* Temperatures of equipment and piping are kept above their minimum design metal temperature (MDMT).
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.
* Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Recommended Actions:
None found.

Scenario name:
Ventilation discharge, including emergency ventilation, contaminates the air in locations where people live, work, or pass through, including building exits.

Scenario type:
Prior incident anywhere and facility siting

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Ventilation is inadequate to prevent dangerous ammonia concentrations in the air of a room into which ammonia leaks.

Scenario type:
Prior incident anywhere and facility siting

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Filter or strainer clogged or not working as intended.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Willful misconduct.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Water-supply problem -- no make-up water for condenser or [IF APPLICABLE] compressor cooling systems.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Design, fabrication, construction, or installation shortcoming or error.
* Force or impact too strong
* Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.
* Inspection, testing, or maintenance (ITM) shortcoming or error.

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Existing Safeguards:
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Working alone in a mechanical penthouse, on a roof, or elsewhere people rarely go.

Scenario type:
Prior incident anywhere and facility siting

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Human error or poor judgment.
* Normal activity that is reasonably safe with proper precautions.

Recommended Actions:
None found.

Subsystem A4. Charging ammonia into the ammonia-refrigeration system from tanker trucks
* Charging hose or connection leak.
* Too much ammonia is charged, refrigeration-system overfilled.
* Wrong substance charged: from something that reacts with ammonia to has too much water, such as agricultural-grade anhydrous ammonia.

Scenario name:
Charging hose or connection leak.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Design, fabrication, construction, or installation shortcoming or error.
* Force or impact too strong
* Hose, ammonia, problem.
* Human error or poor judgment.
* Joint, threaded, problem.
* Shocks or vibrations cause damage.
* Stop valve closed without proper pump-out or manual opening of control valves.
* Temperature or humidity changes within or moderately outside of typically expected ranges.
* Vehicle moves unexpectedly.

Recommended Actions:
None found.

Scenario name:
Too much ammonia is charged, refrigeration-system overfilled.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
01. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Existing Safeguards:
* Change management is adequate.
* Charging ammonia -- equipment, piping, and procedures are adequate.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Security, of the facility, no shortcomings discovered by the PHA team.

Recommended Actions:
None found.

Scenario name:
Wrong substance charged: from something that reacts with ammonia to has too much water, such as agricultural-grade anhydrous ammonia.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Human error or poor judgment.
* Willful misconduct.
* Wrong substance or concentration added or used.

Possible Consequences:
* Compressor package internal or seal damage, and if safeties fail, leak or fire.
* Equipment or piping becomes more susceptible to external physical damage.
* Explosion or fire more likely.
* Hinders maintenance or increases the need for repairs.
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Overpressure in equipment or piping.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.
* Shocks that could damage equipment, piping, or supports.
* Water contamination in the ammonia refrigerant becomes too high.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Charging ammonia -- equipment, piping, and procedures are adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Security, of the facility, no shortcomings discovered by the PHA team.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Subsystem B1. Compressors
* Check [or stop-check] valve [is left open] or leaks by (back-flow occurs) on discharge, screw-compressor suction, or both.
* Compressor discharge blocked, by closed stop valve, check valve fails shut, plugging, downstream compressors are off (such as intermediate or high stage), or something else.
* Compressor operating range is changed (a swing compressor or permanently) without updating safety setpoints (and heads on recips) as needed.
* Compressor suction blocked, by closed stop valve, check valve (if any) fails shut, plugging, or something else.
* Compressor, reciprocating, internal pressure-relief valve, from crank-case discharge to suction sides, plugged or stuck shut.
* Compressors loads up quickly. See details in PHA safeguard named: Compressor controls and safety shutoffs...
* Gasket or shaft-seal failure on compressor, oil separator, screw-compressor oil pump, or oil piping.
* High discharge-pressure shutoff doesn't work when needed, so a pressure-relief valve opens.
* Liquid ammonia sucked into compressors, lots of large droplets or more (slugging).
* Lubricating oil and ammonia gas, both hot, spray out of ammonia-refrigerant compressors, oil separators, or nearby piping.
* Lubricating oil is too hot -- compressor overheats or lubruicating oil becomes too thin (viscosity too low), burns, carbonizes, partly vaporizes, and so forth.
* Lubricating-oil heater doesn't warm the oil to the temperature needed for adequate lubrication before the compressor starts.
* Lubricating-oil heater is operating but there is too little or no oil in the compressor.
* Lubricating-oil pressure or flow in the compressor-lubricating system is too low or uneven.
* Lubricating-oil pump for screw compressor, inlet or outlet flow blocked when pumps starts or is running, such as valve closed.
* Slide valve poorly calibrated or installed so its motor forces it against the housing, it bows and maybe scrapes a rotor...
* Vibrations, in compressor or its motor, start to become excessive.

Scenario name:
Check [or stop-check] valve [is left open] or leaks by (back-flow occurs) on discharge, screw-compressor suction, or both.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Valve-seat seal failure (seat-gasket degraded, debris on seat, not tight enough, etc.)

Possible Consequences:
* Compressor contains liquid ammonia refrigerant, when it starts, due to refrigerant condensation while off.
* Compressor package internal or seal damage, and if safeties fail, leak or fire.
* Explosion or fire more likely.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Overpressure in equipment or piping.
* Shocks that could damage equipment, piping, or supports.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Reciprocating compressors are more tolerant of liquid-ammonia refrigerant than screw compressors.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Compressor discharge blocked, by closed stop valve, check valve fails shut, plugging, downstream compressors are off (such as intermediate or high stage), or something else.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Little or none

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
00. No action needed.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Human error or poor judgment.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.

Possible Consequences:
* Compressor package internal or seal damage, and if safeties fail, leak or fire.
* Explosion or fire more likely.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Overpressure in equipment or piping.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Compressor operating range is changed (a swing compressor or permanently) without updating safety setpoints (and heads on recips) as needed.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Inspection, testing, or maintenance (ITM) shortcoming or error.

Possible Consequences:
* Compressor package internal or seal damage, and if safeties fail, leak or fire.
* Explosion or fire more likely.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Compressor suction blocked, by closed stop valve, check valve (if any) fails shut, plugging, or something else.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Little or none

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
00. No action needed.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Compressor, reciprocating, internal pressure-relief valve, from crank-case discharge to suction sides, plugged or stuck shut.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
01. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Human error or poor judgment.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Spring problem.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Compressors loads up quickly. See details in PHA safeguard named: Compressor controls and safety shutoffs...

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Little or none

Likelihood of above severity with existing safeguards in place:
20% to 90% per year (every couple-few years)

Risk Ranking:
00. No action needed.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Normal activity that is reasonably safe with proper precautions.

Possible Consequences:
* Compressor package internal or seal damage, and if safeties fail, leak or fire.
* Hinders maintenance or increases the need for repairs.

Recommended Actions:
None found.

Scenario name:
Gasket or shaft-seal failure on compressor, oil separator, screw-compressor oil pump, or oil piping.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
20% to 90% per year (every couple-few years)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Consequences:
* Compressor package internal or seal damage, and if safeties fail, leak or fire.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
High discharge-pressure shutoff doesn't work when needed, so a pressure-relief valve opens.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Design, fabrication, construction, or installation shortcoming or error.
* Inspection, testing, or maintenance (ITM) shortcoming or error.

Existing Safeguards:
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Liquid ammonia sucked into compressors, lots of large droplets or more (slugging).

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Condensation
* Control valve allows too much flow or remains fully open -- but not including shocks from expansion valves too far open.
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Level signal wrong -- lower than actual, or float switch stuck in low position.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Procedure is confusing, ignored, misunderstood, or wrong.
* Spring problem.
* Temperature or humidity changes within or moderately outside of typically expected ranges.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Reciprocating compressors are more tolerant of liquid-ammonia refrigerant than screw compressors.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Transfer system and its piping are adequately built, controlled, located, inspected, tested, and maintained.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Lubricating oil and ammonia gas, both hot, spray out of ammonia-refrigerant compressors, oil separators, or nearby piping.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Concrete cracking, creep, efflorescence, sagging, or spalling.
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Corrosive materials in vicinity.
* Design, fabrication, construction, or installation shortcoming or error.
* Fasteners, hangers, rods, or other support components -- loose or missing.
* Fire, nearby and severe, or worse, and the resulting heat and temperatures.
* Force or impact too strong
* Foundations move due to settling, shifting, earthquake, landslide, soil liquefaction, and so forth.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Joint, bolted, problem.
* Loads added without properly evaluating.
* People are not kept a reasonably safe distance from dangerously malfunctioning things or higher-hazard special work.
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.
* Pressure-relief system inadequate.
* Procedure is confusing, ignored, misunderstood, or wrong.
* Shocks or vibrations cause damage.
* Supports for piping or equipment inadequate, so normal vibrations are amplified into swaying, and so forth.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.
* Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Recommended Actions:
None found.

Scenario name:
Lubricating oil is too hot -- compressor overheats or lubruicating oil becomes too thin (viscosity too low), burns, carbonizes, partly vaporizes, and so forth.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Compressor cooling inadequate. [UPDATE - SYSTEM SPECIFIC]
* Compressor starved -- little or no inlet-gas flow and low-suction pressure shutoff does not work.
* Control valve allows too little or no flow, including expansion, gas-powered, motorized, and solenoid valves and regulators.
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Filter or strainer clogged or not working as intended.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Wrong substance or concentration added or used.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Lubricating-oil heater doesn't warm the oil to the temperature needed for adequate lubrication before the compressor starts.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.

Possible Consequences:
* Compressor contains liquid ammonia refrigerant, when it starts, due to refrigerant condensation while off.
* Compressor package internal or seal damage, and if safeties fail, leak or fire.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Human errors become more likely or more severe.

Recommended Actions:
None found.

Scenario name:
Lubricating-oil heater is operating but there is too little or no oil in the compressor.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
06. Attention needed -- if any recommended actions, review status at least monthly.

Possible Causes:
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Procedure is confusing, ignored, misunderstood, or wrong.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Lubricating-oil pressure or flow in the compressor-lubricating system is too low or uneven.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
20% to 90% per year (every couple-few years)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Compressor cooling inadequate. [UPDATE - SYSTEM SPECIFIC]
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Filter or strainer clogged or not working as intended.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Spring problem.
* Wrong substance or concentration added or used.

Existing Safeguards:
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Lubricating-oil pump for screw compressor, inlet or outlet flow blocked when pumps starts or is running, such as valve closed.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Human error or poor judgment.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Slide valve poorly calibrated or installed so its motor forces it against the housing, it bows and maybe scrapes a rotor...

Scenario type:
Human factors

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Vibrations, in compressor or its motor, start to become excessive.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Design, fabrication, construction, or installation shortcoming or error.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Shocks or vibrations cause damage.
* Supports for piping or equipment inadequate, so normal vibrations are amplified into swaying, and so forth.

Existing Safeguards:
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Subsystem B2. Condensers
* Coil corrosion or erosion, external or internal (the coil tubing is located inside the condenser housing).
* Cooling insufficient due to high temperature, humidity, or refrigeration loads, low air or water flow, scale on coils, etc.
* Cooling water freezes on condenser coils, housing, piping, support structure, or its walking-working surfaces.
* Draining of liquid, from condensers to receiver, inadequate due to stop valve closed, piping too small, etc.
* Equalization of pressure, between condensers and receiver, inadequate due to stop valve closed, piping too small, etc.
* Fan blade breaks or balancing weight falls off fan blade.
* Purging, too little, due to clogged strainer, solenoid valve stays shut, stop valve left closed, and so forth.
* Purging, too much, due to a purge solenoid valve that leaks by or stays open.

Scenario name:
Coil corrosion or erosion, external or internal (the coil tubing is located inside the condenser housing).

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Cooling-water treatment or spray patterns for evaporative condensers is inadequate.
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Design, fabrication, construction, or installation shortcoming or error.
* Inspection, testing, or maintenance (ITM) shortcoming or error.

Possible Consequences:
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia into water or other liquids that may cause odors or flow into floor drains or similar.
* Leak of ammonia that will probably cause strong odors or worse offsite.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Purging non-condensable gases is done effectively.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Cooling insufficient due to high temperature, humidity, or refrigeration loads, low air or water flow, scale on coils, etc.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
20% to 90% per year (every couple-few years)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Cooling-water treatment or spray patterns for evaporative condensers is inadequate.
* Design, fabrication, construction, or installation shortcoming or error.
* Inspection, testing, or maintenance (ITM) shortcoming or error.

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Recommended Actions:
None found.

Scenario name:
Cooling water freezes on condenser coils, housing, piping, support structure, or its walking-working surfaces.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
01. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.
* Inspection, testing, or maintenance (ITM) shortcoming or error.

Existing Safeguards:
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Draining of liquid, from condensers to receiver, inadequate due to stop valve closed, piping too small, etc.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
01. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Recommended Actions:
None found.

Scenario name:
Equalization of pressure, between condensers and receiver, inadequate due to stop valve closed, piping too small, etc.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
01. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Recommended Actions:
None found.

Scenario name:
Fan blade breaks or balancing weight falls off fan blade.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Recommended Actions:
None found.

Scenario name:
Purging, too little, due to clogged strainer, solenoid valve stays shut, stop valve left closed, and so forth.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Control valve allows too little or no flow, including expansion, gas-powered, motorized, and solenoid valves and regulators.
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Filter or strainer clogged or not working as intended.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Procedure is confusing, ignored, misunderstood, or wrong.

Recommended Actions:
None found.

Scenario name:
Purging, too much, due to a purge solenoid valve that leaks by or stays open.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Purging non-condensable gases is done effectively.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Subsystem B3. Purging non-condensable gases
* Ammonia removal from non-condensable gas flows into the Compressor Room, by condensing then water scrubbing, is inadequate.
* Back-flow of ammonia-contaminated water, from water-bubble column, into water-supply piping.
* Internal component problem, including ammonia leak past o-ring into air, float problem, valve stuck or leak-by, and so forth.
* Water-bubble column gas-outlet plugged so that pressure builds in the plastic column and one end pops off or it cracks.

Scenario name:
Ammonia removal from non-condensable gas flows into the Compressor Room, by condensing then water scrubbing, is inadequate.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia into water or other liquids that may cause odors or flow into floor drains or similar.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Purging non-condensable gases is done effectively.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Back-flow of ammonia-contaminated water, from water-bubble column, into water-supply piping.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
01. Lower priority -- track any recommended actions on action register and resolve if convenient.

Recommended Actions:
None found.

Scenario name:
Internal component problem, including ammonia leak past o-ring into air, float problem, valve stuck or leak-by, and so forth.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Human errors become more likely or more severe.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia into water or other liquids that may cause odors or flow into floor drains or similar.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Purging non-condensable gases is done effectively.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Water-bubble column gas-outlet plugged so that pressure builds in the plastic column and one end pops off or it cracks.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.

Existing Safeguards:
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Subsystem C1. Receiver(s), high-pressure and thermosiphon [IF ANY, DESCRIBE. COMBINED?]
* Ammonia-in-air concentrations near the King valve hinder access to it, during a leak.
* High-pressure receiver level too low or too high, including backs up into condensers.
* King valve sticks open (the hand-operated stop valve, also called a shutoff valve).
* King valve, automatic, causes shocks when it re-opens, such as after a power outage or emergency shutdown.
* Thermosiphon receiver level too high or low or oil accumulates in it.

Scenario name:
Ammonia-in-air concentrations near the King valve hinder access to it, during a leak.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
01. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.

Possible Consequences:
* Hinders emergency response -- firefighting, entry into unsafe places for rescue, stopping leaks, and so forth.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.

Existing Safeguards:
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
High-pressure receiver level too low or too high, including backs up into condensers.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Little or none

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
00. No action needed.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Existing Safeguards:
* Charging ammonia -- equipment, piping, and procedures are adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
King valve sticks open (the hand-operated stop valve, also called a shutoff valve).

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
01. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Corrosive materials in vicinity.
* Design, fabrication, construction, or installation shortcoming or error.
* Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Change management is adequate.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
King valve, automatic, causes shocks when it re-opens, such as after a power outage or emergency shutdown.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
07. Attention needed -- if any recommended actions, review status at least monthly.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Procedure is confusing, ignored, misunderstood, or wrong.

Possible Consequences:
* Shocks that could damage equipment, piping, or supports.

Recommended Actions:
None found.

Scenario name:
Thermosiphon receiver level too high or low or oil accumulates in it.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
01. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Recommended Actions:
None found.

Subsystem C2. Recirculator(s) and ammonia-refrigerant pumps [UPDATE IF MULTIPLE]
* All piping connected to a pump is blocked, such as stop valves closed, while running, leading to high pressure and temperature.
* Liquid droplets are entrained in gas flowing to compressors, such as because the gas-flow speed is too fast in a suction vessel.
* Liquid level too high or too low in recirculator vessel.
* Pump overheats due to inadequate ammonia-refrigerant flow to motor, sealed in same housing as pump impeller. [IF APPLICABLE]
* Pump-discharge check valve leaks by, so some flow in reverse direction.
* Pump-discharge piping or minimum-flow bypass piping has liquid speeds that cause interior erosion of piping.
* Pump-discharge pressure too high due to closed valve, design shortcoming, plugged orifice, and so forth.
* Pump-suction pressure too low due to closed valve, liquid-level low, design shortcoming, etc., causing cavitation, etc.
* Seal leak where rotating shaft from motor enters pump housing, either inboard (faster oil flow into the refrigeration system) or outboard (first faster oil flow and possibly an ammonia leak out of the refrigeration system). [IF APPLICABLE]
* Volute-vent valve left closed while pump cycles on and off, causing vapor lock or cavitation. [IF APPLICABLE]

Scenario name:
All piping connected to a pump is blocked, such as stop valves closed, while running, leading to high pressure and temperature.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Human error or poor judgment.

Possible Consequences:
* Explosion or fire more likely.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Overpressure in equipment or piping.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Liquid droplets are entrained in gas flowing to compressors, such as because the gas-flow speed is too fast in a suction vessel.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Control valve allows too much flow or remains fully open -- but not including shocks from expansion valves too far open.
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Defrost, hot gas, method or timing is unsafe normally, at the start or end of a power outage or blip, when loads are low, etc. [APPLICABLE?]
* Design, fabrication, construction, or installation shortcoming or error.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Level signal wrong -- lower than actual, or float switch stuck in low position.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.

Recommended Actions:
None found.

Scenario name:
Liquid level too high or too low in recirculator vessel.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Control valve allows too little or no flow, including expansion, gas-powered, motorized, and solenoid valves and regulators.
* Control valve allows too much flow or remains fully open -- but not including shocks from expansion valves too far open.
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Design, fabrication, construction, or installation shortcoming or error.
* Filter or strainer clogged or not working as intended.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Level signal wrong -- higher than actual, or float switch stuck in high position.
* Level signal wrong -- lower than actual, or float switch stuck in low position.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Procedure is confusing, ignored, misunderstood, or wrong.
* Shocks or vibrations cause damage.
* Spring problem.
* Valve-seat seal failure (seat-gasket degraded, debris on seat, not tight enough, etc.)

Possible Consequences:
* Explosion or fire more likely.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Overpressure in equipment or piping.
* Shocks that could damage equipment, piping, or supports.

Recommended Actions:
None found.

Scenario name:
Pump overheats due to inadequate ammonia-refrigerant flow to motor, sealed in same housing as pump impeller. [IF APPLICABLE]

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
01. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.

Existing Safeguards:
* Change management is adequate.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Pumps, ammonia-refrigerant, and their piping are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Pump-discharge check valve leaks by, so some flow in reverse direction.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Spring problem.

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Existing Safeguards:
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Production monitoring and quality control.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Pump-discharge piping or minimum-flow bypass piping has liquid speeds that cause interior erosion of piping.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Pump-discharge pressure too high due to closed valve, design shortcoming, plugged orifice, and so forth.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
01. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Existing Safeguards:
* Change management is adequate.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Production monitoring and quality control.
* Pumps, ammonia-refrigerant, and their piping are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Pump-suction pressure too low due to closed valve, liquid-level low, design shortcoming, etc., causing cavitation, etc.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Little or none

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
00. No action needed.

Existing Safeguards:
* Change management is adequate.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Pump safety shutoffs are adequate, for both ammonia and cooling-water pumps, including for their motors.
* Pumps, ammonia-refrigerant, and their piping are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Seal leak where rotating shaft from motor enters pump housing, either inboard (faster oil flow into the refrigeration system) or outboard (first faster oil flow and possibly an ammonia leak out of the refrigeration system). [IF APPLICABLE]

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Corrosive materials in vicinity.
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Spring problem.

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pump safety shutoffs are adequate, for both ammonia and cooling-water pumps, including for their motors.
* Pumps, ammonia-refrigerant, and their piping are adequately built, controlled, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Volute-vent valve left closed while pump cycles on and off, causing vapor lock or cavitation. [IF APPLICABLE]

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.

Existing Safeguards:
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Pumps, ammonia-refrigerant, and their piping are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Subsystem C3. Transfer system
* Check valve leaks by at inlet, so some hot gas flows into liquid-inlet piping and [IF APPLIC.] vessel when transfer attempted.
* Check valve leaks by at outlet [ADD WHAT WOULD LEAK BY, EXCESSIVE REVERSE SPINNING OF ANY PUMPS, AND PIPING IT MAY ENTER].
* Check valve, inlet or outlet, slams shut when transfers start or stop.
* Float switch stuck in high position, so no additional transfers and hot gas flows in outlet piping to [DESCRIBE].
* Float switch stuck in low position, so no additional transfers and [SUMMARIZE OTHER OUTCOMES].
* Pump spins in reverse direction at much higher than its design speed. [IF APPLICABLE, ADD LEAK CONSEQUENCES TO SCENARIO]
* Too little liquid is transferred due to controls, pump [IF APPLICABLE], valve, or other problem.
* Too much liquid is transferred due to controls, valve, or other problem.

Scenario name:
Check valve leaks by at inlet, so some hot gas flows into liquid-inlet piping and [IF APPLIC.] vessel when transfer attempted.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.

Existing Safeguards:
* Change management is adequate.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Check valve leaks by at outlet [ADD WHAT WOULD LEAK BY, EXCESSIVE REVERSE SPINNING OF ANY PUMPS, AND PIPING IT MAY ENTER].

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.

Existing Safeguards:
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Check valve, inlet or outlet, slams shut when transfers start or stop.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Inspection, testing, or maintenance (ITM) shortcoming or error.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders safety, security, health, or environmental protection.
* Shocks that could damage equipment, piping, or supports.

Existing Safeguards:
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Transfer system and its piping are adequately built, controlled, located, inspected, tested, and maintained.

Recommended Actions:
None found.

Scenario name:
Float switch stuck in high position, so no additional transfers and hot gas flows in outlet piping to [DESCRIBE].

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Level signal wrong -- higher than actual, or float switch stuck in high position.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Existing Safeguards:
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Float switch stuck in low position, so no additional transfers and [SUMMARIZE OTHER OUTCOMES].

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Level signal wrong -- lower than actual, or float switch stuck in low position.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Recommended Actions:
None found.

Scenario name:
Pump spins in reverse direction at much higher than its design speed. [IF APPLICABLE, ADD LEAK CONSEQUENCES TO SCENARIO]

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Design, fabrication, construction, or installation shortcoming or error.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.
* Procedure is confusing, ignored, misunderstood, or wrong.
* Spring problem.
* Valve-seat seal failure (seat-gasket degraded, debris on seat, not tight enough, etc.)

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Pumps, ammonia-refrigerant, and their piping are adequately built, controlled, located, inspected, tested, and maintained.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Transfer system and its piping are adequately built, controlled, located, inspected, tested, and maintained.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Too little liquid is transferred due to controls, pump [IF APPLICABLE], valve, or other problem.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Control valve allows too little or no flow, including expansion, gas-powered, motorized, and solenoid valves and regulators.
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Filter or strainer clogged or not working as intended.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Level signal wrong -- higher than actual, or float switch stuck in high position.
* Level signal wrong -- lower than actual, or float switch stuck in low position.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Spring problem.

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Existing Safeguards:
* Change management is adequate.
* Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Too much liquid is transferred due to controls, valve, or other problem.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Existing Safeguards:
* Change management is adequate.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Pump safety shutoffs are adequate, for both ammonia and cooling-water pumps, including for their motors.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Subsystem D1. Air-cooling equipment, including defrosting
* Check valve between drip pan (heated by hot gas during defrost) and coil leaks by. [IF APPLICABLE]
* Coil corrosion or erosion, external or internal.
* Evaporating temperature is too low, due to upstream/back-pressure regulator set wrong or other cause.
* Fan blade breaks or balancing weight falls off fan blade.
* Frost layer builds thicker than usual on coil, less heat transfer, more liquid in coil, and inadequate pump down before defrost.
* Hot gas enters evaporator or suction piping with some liquid ammonia, causing shocks, such as vapor propelled liquid slugs.
* Leak by hot-gas solenoid valve on defrosted equipment, so hot gas and liquid mix, while cooling, causing noise and shocks.
* Leak by liquid solenoid valve on defrosted equipment, so hot gas and liquid mix, while defrosting, causing noise and shocks.
* Liquid ammonia enters an evaporator coil and piping while they still contain hot gas, causing condensation-induced shocks.
* More ammonia refrigerant evaporates than suction piping can remove, including during pump down before defrost.
* Water or similar sprayed on coil, for cleaning or defrost, while it contains liquid ammonia, during cooling or before pump down.

Scenario name:
Check valve between drip pan (heated by hot gas during defrost) and coil leaks by. [IF APPLICABLE]

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Spring problem.
* Valve-seat seal failure (seat-gasket degraded, debris on seat, not tight enough, etc.)

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Shocks that could damage equipment, piping, or supports.

Recommended Actions:
None found.

Scenario name:
Coil corrosion or erosion, external or internal.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.

Recommended Actions:
None found.

Scenario name:
Evaporating temperature is too low, due to upstream/back-pressure regulator set wrong or other cause.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Existing Safeguards:
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Production monitoring and quality control.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Fan blade breaks or balancing weight falls off fan blade.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Air-cooling equipment and piping are adequately built, controlled, located, inspected, tested, and maintained.
* Change management is adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.

Recommended Actions:
None found.

Scenario name:
Frost layer builds thicker than usual on coil, less heat transfer, more liquid in coil, and inadequate pump down before defrost.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Shocks that could damage equipment, piping, or supports.

Recommended Actions:
None found.

Scenario name:
Hot gas enters evaporator or suction piping with some liquid ammonia, causing shocks, such as vapor propelled liquid slugs.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Control valve allows too much flow or remains fully open -- but not including shocks from expansion valves too far open.
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Defrost, hot gas, method or timing is unsafe normally, at the start or end of a power outage or blip, when loads are low, etc. [APPLICABLE?]
* Defrost, hot gas, time for pump down, soft gas, defrost, equalization (bleed), or freeze on (rechill) is unsafely reduced. [APPLICABLE?]
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Willful misconduct.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Shocks that could damage equipment, piping, or supports.

Recommended Actions:
None found.

Scenario name:
Leak by hot-gas solenoid valve on defrosted equipment, so hot gas and liquid mix, while cooling, causing noise and shocks.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Control valve allows too much flow or remains fully open -- but not including shocks from expansion valves too far open.
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Valve-seat seal failure (seat-gasket degraded, debris on seat, not tight enough, etc.)

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Shocks that could damage equipment, piping, or supports.

Recommended Actions:
None found.

Scenario name:
Leak by liquid solenoid valve on defrosted equipment, so hot gas and liquid mix, while defrosting, causing noise and shocks.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Shocks that could damage equipment, piping, or supports.

Recommended Actions:
None found.

Scenario name:
Liquid ammonia enters an evaporator coil and piping while they still contain hot gas, causing condensation-induced shocks.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Control valve allows too much flow or remains fully open -- but not including shocks from expansion valves too far open.
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Defrost, hot gas, method or timing is unsafe normally, at the start or end of a power outage or blip, when loads are low, etc. [APPLICABLE?]
* Defrost, hot gas, time for pump down, soft gas, defrost, equalization (bleed), or freeze on (rechill) is unsafely reduced. [APPLICABLE?]
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Willful misconduct.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Shocks that could damage equipment, piping, or supports.

Recommended Actions:
None found.

Scenario name:
More ammonia refrigerant evaporates than suction piping can remove, including during pump down before defrost.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
5% to 20% per year (every 5 to 20 years or so)

Risk Ranking:
03. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Control valve allows too little or no flow, including expansion, gas-powered, motorized, and solenoid valves and regulators.
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Design, fabrication, construction, or installation shortcoming or error.
* Filter or strainer clogged or not working as intended.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Loads added without properly evaluating.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Shocks that could damage equipment, piping, or supports.

Recommended Actions:
None found.

Scenario name:
Water or similar sprayed on coil, for cleaning or defrost, while it contains liquid ammonia, during cooling or before pump down.

Scenario type:
Prior incident anywhere and human factors

Severity with existing safeguards in place:
Injury on-site (needing treatment beyond first aid) or small off-site evacuation/shelter-in-place

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
05. Attention needed -- if any recommended actions, review status at least quarterly.

Possible Causes:
* Control valve allows too little or no flow, including expansion, gas-powered, motorized, and solenoid valves and regulators.
* Control valve allows too much flow or remains fully open -- but not including shocks from expansion valves too far open.
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Defrost, using water, method or time for pump down, defrosting, and any needed drying, equalization (bleed), or freeze on (rechill) is either inadequate normally, at the start or end of a power outage or blip, or when loads are low, or is unsafely changed. [APPLICABLE?]
* Design, fabrication, construction, or installation shortcoming or error.
* Filter or strainer clogged or not working as intended.
* Human error or poor judgment.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Procedure is confusing, ignored, misunderstood, or wrong.
* Spring problem.
* Temperature or humidity changes within or moderately outside of typically expected ranges.
* Valve-seat seal failure (seat-gasket degraded, debris on seat, not tight enough, etc.)

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia into water or other liquids that may cause odors or flow into floor drains or similar.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Overpressure in equipment or piping.
* Shocks that could damage equipment, piping, or supports.

Recommended Actions:
None found.

Subsystem D2. Liquid chillers or heaters such as ice builders, film, plate, scraped surface, tube-in-shell... for brine, glycol, water...
* Ammonia leaks across a heat exchanger into piping (for brine, glycol, water...) that cannot handle the resulting pressure.
* Chilled liquid freezes because its freezing temperature is too high or the chiller's evaporating temperature is too low.
* Corrosive liquid, like water or brine, flows in or splashes on carbon steel, such as piping above the normal liquid level.
* Ice builds up too thick on ice-builder plates.
* More ammonia refrigerant evaporates than suction piping can remove.
* Oil buildup, scale, or biofilm growth on the heat-exchanger surfaces exposed to the liquid being chilled or heated.
* Plates, tubes, other hext-exchange surfaces, their joints, or their seals leak (1) ammonia into (1.1) air directly or (1.2) the chilled or heated liquid so (1.3) possibly into air near this liquid, if and where the liquid is open to air (open tanks, falling films, spraying...) or (2) this liquid enters the refrigeration system. [MODIFY AS APPLICABLE]
* Tubes, tube sheets, or shells contract and expand differently when temperatures change -- different materials, thicknesses, etc.

Scenario name:
Ammonia leaks across a heat exchanger into piping (for brine, glycol, water...) that cannot handle the resulting pressure.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Consequences:
* Explosion or fire more likely.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia into water or other liquids that may cause odors or flow into floor drains or similar.
* Overpressure in equipment or piping.
* Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.
* Shocks that could damage equipment, piping, or supports.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Metal-fatigue prevention is adequate to avoid all but small leaks.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Piping systems that ammonia refrigerant could leak into have adequate means to relieve any resulting overpressure.
* Production monitoring and quality control.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Chilled liquid freezes because its freezing temperature is too high or the chiller's evaporating temperature is too low.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Consequences:
* Explosion or fire more likely.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia into water or other liquids that may cause odors or flow into floor drains or similar.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Water contamination in the ammonia refrigerant becomes too high.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Production monitoring and quality control.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Corrosive liquid, like water or brine, flows in or splashes on carbon steel, such as piping above the normal liquid level.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Little or none

Likelihood of above severity with existing safeguards in place:
Very unlikely (less than every 50 years)

Risk Ranking:
00. No action needed.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.

Existing Safeguards:
* Change management is adequate.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Ice builds up too thick on ice-builder plates.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia into water or other liquids that may cause odors or flow into floor drains or similar.
* Leak of ammonia that will probably cause strong odors or worse offsite.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Piping systems that ammonia refrigerant could leak into have adequate means to relieve any resulting overpressure.
* Production monitoring and quality control.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
More ammonia refrigerant evaporates than suction piping can remove.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Control valve allows too little or no flow, including expansion, gas-powered, motorized, and solenoid valves and regulators.
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Design, fabrication, construction, or installation shortcoming or error.
* Filter or strainer clogged or not working as intended.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Loads added without properly evaluating.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Existing Safeguards:
* Change management is adequate.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Production monitoring and quality control.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Scenario name:
Oil buildup, scale, or biofilm growth on the heat-exchanger surfaces exposed to the liquid being chilled or heated.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Wrong substance or concentration added or used.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Change management is adequate.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Production monitoring and quality control.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Plates, tubes, other hext-exchange surfaces, their joints, or their seals leak (1) ammonia into (1.1) air directly or (1.2) the chilled or heated liquid so (1.3) possibly into air near this liquid, if and where the liquid is open to air (open tanks, falling films, spraying...) or (2) this liquid enters the refrigeration system. [MODIFY AS APPLICABLE]

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Design, fabrication, construction, or installation shortcoming or error.
* Joint, bolted, problem.

Possible Consequences:
* Explosion or fire more likely.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia into water or other liquids that may cause odors or flow into floor drains or similar.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Overpressure in equipment or piping.
* Shocks that could damage equipment, piping, or supports.
* Water contamination in the ammonia refrigerant becomes too high.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Metal-fatigue prevention is adequate to avoid all but small leaks.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Production monitoring and quality control.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Tubes, tube sheets, or shells contract and expand differently when temperatures change -- different materials, thicknesses, etc.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Design, fabrication, construction, or installation shortcoming or error.
* Normal activity that is reasonably safe with proper precautions.
* Temperature or humidity changes within or moderately outside of typically expected ranges.

Possible Consequences:
* Equipment or piping becomes more susceptible to external physical damage.
* Explosion or fire more likely.
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.
* Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.
* Leak of ammonia into water or other liquids that may cause odors or flow into floor drains or similar.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Water contamination in the ammonia refrigerant becomes too high.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Metal-fatigue prevention is adequate to avoid all but small leaks.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Piping systems that ammonia refrigerant could leak into have adequate means to relieve any resulting overpressure.
* Production monitoring and quality control.
* Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.
* Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Subsystem D3. Silos and tanks with ammonia-cooled jackets that don't contact the cooled liquid
* Ammonia refrigeration left on when silo or tank is cleaned-in-place (CIP).
* Cooling jacket or tubing corrodes in the insulated space between inner and outer silo or tank walls, due to moisture there, etc.
* Evaporating temperature is too low or too high, due to upstream/back-pressure regulator set wrong or other cause.

Scenario name:
Ammonia refrigeration left on when silo or tank is cleaned-in-place (CIP).

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Causes:
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Design, fabrication, construction, or installation shortcoming or error.
* Human error or poor judgment.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.
* Overpressure in equipment or piping.
* Shocks that could damage equipment, piping, or supports.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Pressure-relief systems are adequately built, located, inspected, tested, and maintained.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.

Recommended Actions:
None found.

Scenario name:
Cooling jacket or tubing corrodes in the insulated space between inner and outer silo or tank walls, due to moisture there, etc.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Room evacuation or off-site nuisance

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
04. Attention needed -- if any recommended actions, review status at least twice per year.

Possible Consequences:
* Hinders maintenance or increases the need for repairs.
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]
* Hinders safety, security, health, or environmental protection.
* Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.
* Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.
* Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.
* Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.
* Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.
* Leak of ammonia that will probably cause strong odors or worse offsite.

Existing Safeguards:
* Access is adequate to ammonia-refrigeration equipment and piping.
* Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.
* Change management is adequate.
* Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.
* Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.
* Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.
* Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.
* Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.
* Separation of ammonia refrigeration from people is adequate and considered in change management.
* Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Recommended Actions:
None found.

Scenario name:
Evaporating temperature is too low or too high, due to upstream/back-pressure regulator set wrong or other cause.

Scenario type:
Prior incident anywhere

Severity with existing safeguards in place:
Nuisance on-site

Likelihood of above severity with existing safeguards in place:
2% to 5% per year (every 20 to 50 years or so)

Risk Ranking:
02. Lower priority -- track any recommended actions on action register and resolve if convenient.

Possible Consequences:
* Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Existing Safeguards:
* Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.
* Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.
* Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.
* Production monitoring and quality control.
* Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.
* Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.
* Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Recommended Actions:
None found.

Possible Causes

* Alarm, public-address, paging, radio, or other emergency-communication system stops working.
* Compressor cooling inadequate. [UPDATE - SYSTEM SPECIFIC]
* Compressor starved -- little or no inlet-gas flow and low-suction pressure shutoff does not work.
* Concrete cracking, creep, efflorescence, sagging, or spalling.
* Condensation
* Control valve allows too little or no flow, including expansion, gas-powered, motorized, and solenoid valves and regulators.
* Control valve allows too much flow or remains fully open -- but not including shocks from expansion valves too far open.
* Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.
* Cooling-water treatment or spray patterns for evaporative condensers is inadequate.
* Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.
* Corrosive materials in vicinity.
* Defrost, hot gas, method or timing is unsafe normally, at the start or end of a power outage or blip, when loads are low, etc. [APPLICABLE?]
* Defrost, hot gas, time for pump down, soft gas, defrost, equalization (bleed), or freeze on (rechill) is unsafely reduced. [APPLICABLE?]
* Defrost, using water, method or time for pump down, defrosting, and any needed drying, equalization (bleed), or freeze on (rechill) is either inadequate normally, at the start or end of a power outage or blip, or when loads are low, or is unsafely changed. [APPLICABLE?]
* Design, fabrication, construction, or installation shortcoming or error.
* Expansion valve open too much, shock each time solenoid valve opens.
* Fasteners, hangers, rods, or other support components -- loose or missing.
* Filter or strainer clogged or not working as intended.
* Fire, nearby and severe, or worse, and the resulting heat and temperatures.
* Flood waters reach the ammonia-refrigeration system, its supports, or the building they are in or on.
* Force or impact too strong
* Foundations move due to settling, shifting, earthquake, landslide, soil liquefaction, and so forth.
* Hose, ammonia, problem.
* Human error or poor judgment.
* Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.
* Inspection, testing, or maintenance (ITM) shortcoming or error.
* Joint, bolted, problem.
* Joint, threaded, problem.
* Level signal wrong -- higher than actual, or float switch stuck in high position.
* Level signal wrong -- lower than actual, or float switch stuck in low position.
* Lightning strike
* Liquid accumulation in hot-gas or suction piping.
* Loads added without properly evaluating.
* Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.
* Normal activity that is reasonably safe with proper precautions.
* Oxygen, nitrogen, or other non-condensable gas content is too high.
* People are not kept a reasonably safe distance from dangerously malfunctioning things or higher-hazard special work.
* Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.
* Pressure-relief system inadequate.
* Procedure is confusing, ignored, misunderstood, or wrong.
* Roof, piping, or other leak causes damage.
* Shocks or vibrations cause damage.
* Spring problem.
* Stop valve closed without proper pump-out or manual opening of control valves.
* Stress-corrosion cracking (SCC)
* Supports for piping or equipment inadequate, so normal vibrations are amplified into swaying, and so forth.
* Temperature or humidity changes within or moderately outside of typically expected ranges.
* Valve-seat seal failure (seat-gasket degraded, debris on seat, not tight enough, etc.)
* Valve-stem seal failure (packing damage, not tight enough, etc.)
* Vehicle moves unexpectedly.
* Vessel or piping temperature is below its minimum design metal temperature (MDMT).
* Willful misconduct.
* Wrong substance or concentration added or used.

Cause name:
Alarm, public-address, paging, radio, or other emergency-communication system stops working.

Cause description:
[Nothing has been recorded in this field.]

Cause name:
Compressor cooling inadequate. [UPDATE - SYSTEM SPECIFIC]

Cause description:
In the facility's ammonia-refrigeration system, this might be caused by [UPDATE BASED ON COMPRESSORS TYPES AND COOLING METHODS]
* for the water-cooled reciprocating compressors
- clogging or scaling in the cooling heads or their tubing,
- water supply inadequate,
- water temperature too high,
* for the ammonia-refrigerant cooled reciprocating compressors
- ammonia supply inadequate,
- stop valve closed,
- strainer clogged,
- liquid-supply solenoid valve problem causing inadequate flow,
- thermostatic expansion valve problem causing inadequate flow,
- clogging or oil-buildup in the cooling heads or their tubing, or
- suction regulator problem causing inadequate flow or too much back pressure,
* for the liquid-injection cooled screw compressors, on the ammonia-refrigerant piping for oil cooling
- ammonia supply inadequate,
- liquid-supply solenoid fails shut,
- stop valve closed,
- strainer clogged,
- thermostatic expansion valve, motorized valve, or pump problem [IF APPLICABLE],
* for the thermosiphon cooled screw compressors, on the ammonia-refrigerant piping for oil cooling
- ammonia supply inadequate,
- oil accumulation on ammonia side of oil-cooling heat exchanger,
- stop valve closed,
* for all compressors, oil-circulation problems.
* Oil circulation problems may result from:
- filter clogged,
- filter gasket failure,
- float problem in oil-return piping from an oil separator (typically for reciprocating compressors),
- oil control valve problem,
- oil feed valve closed accidentally,
- oil leak,
- oil pressure control not set properly,
- oil pump problem, on a screw compressor, while it is starting or operating for booster compressors, or
- oil separater problem, perhaps due to a problem with its coalescing filter/element, if any.

Cause name:
Compressor starved -- little or no inlet-gas flow and low-suction pressure shutoff does not work.

Cause description:
[Nothing has been recorded in this field.]

Cause name:
Concrete cracking, creep, efflorescence, sagging, or spalling.

Cause description:
[Nothing has been recorded in this field.]

Cause name:
Condensation

Cause description:
Moisture condenses onto surfaces when they are below the dew point of the air that touches them, for example,
* relief vent or other piping open to the atmosphere is partly located in spaces with temperatures below the dew point at the piping's atmospheric outlet,
* hot-gas and defrost-return piping that cools below the dew point when no gas is flowing (no defrosting occurring),
* supports of cold vessels in warm rooms (unless insulated),
* receivers, high-pressure and thermosiphon, if they are in rooms that are warmer that the condensing temperature of the condensers that feed them (so refrigerant is evaporating in these receivers, cooling them),
* walls of vessels and piping, including level columns, near the liquid level, if they contain liquid below the dew point of the air near their exteriors.

Cause name:
Control valve allows too little or no flow, including expansion, gas-powered, motorized, and solenoid valves and regulators.

Cause description:
Includes,
- hand-expansion valve opened too few turns,
- hot-gas supply to gas-powered valves inadequate or controls problem,
- motor or motor-control problem,
- orifice, for minimum flow, plugged or too small,
- solenoid coil problem on spring-closed (solenoid opened) regulators or valves,
- relief regulator or valve -- for hydrostatic or liquid pressure relief -- allows inadequate flow or opens at a pressure that is too high,
- regulator or solenoid valve pilot tube or passage clogged or other problem,
- thermostatic-expansion valve -- bulb, tubing, or other problem,
- and so forth.

Cause name:
Control valve allows too much flow or remains fully open -- but not including shocks from expansion valves too far open.

Cause description:
Includes,
- hand-expansion valve opened too many turns,
- gas-powered valves controls problem or rapid leak-by pilot hot-gas solenoid,
- leak by valve-seat seal,
- manual-opening stem (jacking stem) holds valve partly or fully open,
- motor or motor-control problem, on motorized valves,
- spring problem with spring-closed regulators or valves, like solenoid valves and many pressure regulators,
- thermostatic-expansion valve -- bulb, tubing, or other problem,
- and so forth.

Cause name:
Controls or instrumentation are broken, confusing, cumbersome, difficult, inadequate, incorrect, miscalibrated, or not connected -- including too dim, exposed, loud, quiet, sensitive, slow, or small.

Cause description:
Includes controls or instrumentation that:
* inadequately account for human factors,
* do not read correctly from the desired location because
- installed in wrong location,
- blockage, leak, or interference between sensor/instrument and desired measurement location, such as
> service valves left shut, isolating the sensor/instrument from the desired measurement location,
- interference or poor connection (wiring, wireless signal...) between sensor/instrument and controls processor or displays,
- something needed was not installed,
- and so forth.

Cause name:
Cooling-water treatment or spray patterns for evaporative condensers is inadequate.

Cause description:
Includes anything that causes
* evaporative-condenser coil corrosion or erosion, such as
- water corrosive to coil exterior surface, typically galvanized or stainless steel,
- spray-nozzle problem causing water impingement to erode galvanized finish on coil,
* reduced heat transfer, such as
- biofilm growth, like slimy coatings on coils,
- scale on coils,
- uneven water distribution and inadequate water flow over portions of the coil.

Cause name:
Corroding, cracking, deteriorating, flexing, stretching, warping, or wear.

Cause description:
For example, due to
* insulation or paint problem,
* rubbing by something loose,
* fluid impingement,
* galvanic corrosion, such as
- a smaller amount of carbon steel (less noble) in electrical contact (attached without an insulator in between) to a larger amount of stainless steel (more noble).

Cause name:
Corrosive materials in vicinity.

Cause description:
For example,
* corrosive materials are mixed, stored, transferred, or used nearby or
* cleaning or sanitizing with corrosive materials.

Cause name:
Defrost, hot gas, method or timing is unsafe normally, at the start or end of a power outage or blip, when loads are low, etc. [APPLICABLE?]

Cause description:
Some examples are below.
* An ammonia-refrigerant suction control valve rapidly opens (or regulates at a lower pressure) at the start of a power outage,
- if the evaporator was defrosting and filled with hot gas and some liquid (that condensed during defrosting) when the power fails,
> the hot gas, possibly mixed with liquid, may cause shocks in the downstream suction piping, including from vapor-propelled liquid slugs.
* An ammonia-refrigerant hot-gas or liquid solenoid valve opens before adequate pump down, either normally, when power is restored after an outage or blip, or when loads are low. In these cases, vapor-propelled liquid slugs or condensation-induced shocks may occur if:
- liquid enters a coil or piping that is mostly filled with hot gas, due to controls shortcoming or human error, such as defrosting before a power outage or blip and the controls immediately start cooling when the power outage or blip ends,
- hot gas enters a coil or piping that is partly filled with liquid, due to controls shortcoming, human error, or low loads.
* See the PHA Cause named "Liquid accumulation in hot-gas or suction piping" or similar.
* See the U.S. Chemical Safety and Hazard Investigation Board (CSB) report and safety bulletin on the
- 2010 ammonia leak, at the Millard Refrigerated Services, Theodore, Alabama, for example
- CSB, January 2015, Hydraulic Shock Safety Bulletin, Key Lessons for Preventing Hydraulic Shock in Industrial Refrigeration Systems.
* Low loads may cause liquid in a coil and piping to evaporate slower than expected, so that
- a pre-set pump-down time is not long enough, leading to
> hot gas entering a coil and piping that are partly filled with liquid.
* Low loads may be caused by:
- higher humidity in the cooled room, thicker frost layers on the coil, and so less heat transfer,
- cold air entering the cooled room,
- less heat generated in or entering the cooled room,
- and so forth.

Cause name:
Defrost, hot gas, time for pump down, soft gas, defrost, equalization (bleed), or freeze on (rechill) is unsafely reduced. [APPLICABLE?]

Cause description:
For example, for faster production or to keep temperatures adequately low in product or room air.

Cause name:
Defrost, using water, method or time for pump down, defrosting, and any needed drying, equalization (bleed), or freeze on (rechill) is either inadequate normally, at the start or end of a power outage or blip, or when loads are low, or is unsafely changed. [APPLICABLE?]

Cause description:
* The pump-down time might be reduced:
- for faster production or
- to keep temperatures adequately low in product or room air.
* Low loads may cause liquid in a coil and piping to evaporate slower than expected, so that
- a pre-set pump-down time is not long enough.
* Low loads may be caused by:
- higher humidity in the cooled room, thicker frost layers on the coil, and so less heat transfer,
- cold air entering the cooled room,
- less heat generated in or entering the cooled room,
- and so forth.

Cause name:
Design, fabrication, construction, or installation shortcoming or error.

Cause description:
For example,
* alignment is inadequate, including motor-to-compressor, bolted-joint flanges, etc.,
* equipment, piping, or the entire facility are not suited for their location, including
- a corrosive environment,
- external hazards create unreasonable risks, or
- too many people are often nearby,
* external hazards are not adequately protected against, in the USA, see
- the National Risk Index for Natural Hazards and
- ASCE 7, Minimum Design Loads and Associated Criteria for Buildings and Other Structures, which describes the means for determining dead, live, soil, flood, tsunami, snow, rain, atmospheric ice, earthquake, and wind loads, and their combinations for general structural design,
* getting somewhere or doing something is harder than it needs to be,
* guarding from potential external impacts, such as vehicle traffic, is inadequate,
* guarding of moving parts is inadequate,
* interior erosion of the steel primary-containment envelop occurs, including because
- flow speeds in ammonia-refrigerant piping are above erosional speeds, such as at elbows, or
- pressure-vessel inlets cause erosional impingement against the interior of the vessel's walls,
* a minor shortcoming creates a small risk viewed as impractical to avoid, except perhaps by administrative controls,
* and so forth.

Cause name:
Expansion valve open too much, shock each time solenoid valve opens.

Cause description:
[Nothing has been recorded in this field.]

Cause name:
Fasteners, hangers, rods, or other support components -- loose or missing.

Cause description:
[Nothing has been recorded in this field.]

Cause name:
Filter or strainer clogged or not working as intended.

Cause description:
On suction piping, this may lengthen the time needed for pump down.
This cause includes:
* filters for
- lubricating oil, including for the ammonia-refrigerant compressors,
- cooling-water for evaporative condensers,
- and so forth,
* strainers, typically upstream of control valves, on ammonia-refrigerant
- hot-gas piping,
- liquid piping,
- suction piping,
- and so forth, and
* coalescing filters/elements on compressor oil separators, if any.

Cause name:
Fire, nearby and severe, or worse, and the resulting heat and temperatures.

Cause description:
Includes all types fires, if close enough, such as
- building fires,
- transportation-related fires,
- wildfires,
- and so forth.

Cause name:
Flood waters reach the ammonia-refrigeration system, its supports, or the building they are in or on.

Cause description:
[Nothing has been recorded in this field.]

Cause name:
Force or impact too strong

Cause description:
Includes:
* impact from
- avalanche,
- airplane crash,
- debris flow, mudslide, or volcanic flows (lahars, lava, pyroclastic, etc.),
- hail,
- hit with hammer, maybe because it is stuck,
- train derailment,
- truck or other vehicle hits,
- waves (storm, tsunami, and so forth),
* pressure or weight from
- ice,
- flood waters,
- snow,
- tsunami,
- volcanic flows or ash,
- wind,
* shocks from explosions,
* stepping on piping,
* supports problem causes forces too high in supported thing, such as piping holding up the support where roof sagged,
* too much force used, including when turning a valve or tightening a threaded joint,
* tool dropped from height,
* wind loads from hurricanes, tornadoes, and other high winds,
* wind- or explosion-driven projectile,
* and so forth.

Cause name:
Foundations move due to settling, shifting, earthquake, landslide, soil liquefaction, and so forth.

Cause description:
[Nothing has been recorded in this field.]

Cause name:
Hose, ammonia, problem.

Cause description:
For example,
* damaged,
* degraded, especially if past its expiration date,
* internal pressure too high, so leaks or bursts.

Cause name:
Human error or poor judgment.

Cause description:
[Nothing has been recorded in this field.]

Cause name:
Ice, frost, snow, or other-frozen-water buildup in or on equipment, floor, piping, roofs, or supports.

Cause description:
For example,
* condenser, evaporative, water leak or excessive over-spray freezes onto the condenser, its supports, or catwalks, in cold weather,
* drip pan for evaporator with defrost, or its drain piping, in a below 32 F space and inadequately heated,
* evaporator, air-cooling, with coils below 32 F and inadequate defrosting,
* freezing of water or other liquid being chilled, then buildup, such as on a falling film or other surface chiller,
* insulation damaged or inadequate on equipment or piping below 32 F,
* snow on roof exceeds design snow load,
* water leak from roof or elsewhere drips onto equipment, floor, piping, or supports below 32 F,
* water-supply piping fully or partly blocked by frozen water inside it.

Cause name:
Inspection, testing, or maintenance (ITM) shortcoming or error.

Cause description:
For example, involving
* air entry into the ammonia-refrigeration system during or after maintenance, such as by
- inadequate isolation methods or
- inadequate evacuation and/or purging before returning opened equipment or piping to service.
* caps, plugs, blind flanges, gauges, or other instruments are not properly reinstalled after service, such as draining oil, purging, venting ammonia prior to system opening, and so forth, or they never were installed, so that piping is open to the atmosphere with only a valve containing the ammonia refrigerant.
* compressors,
* condenser spray nozzles, such that
- water spray erodes galvanized finish on condenser coils.
* fans, including for emergency ventilation of refrigerating-machinery rooms,
* gasket quality,
* grease or anti-seize quality,
* insulation,
* louvers, including for emergency ventilation of refrigerating-machinery rooms,
* lubricating-oil quality,
* oil leak, excessive, that is not noticed and fixed, including
- on shaft seals or
- that drains all the oil from a compressor while its oil heater is still running,
* oil-separators on compressors,
* paint,
* pressure-relief valves, such as not replaced when needed,
* pressure-relief discharge piping, the relief vent (RV) piping, such as any water that could block the RV piping or cause shocks is not drained,
* pipe-thread compound quality,
* pumps,
* sensors, including compressor low-suction, low-oil, or high-discharge pressure shutoffs or ammonia-in-air sensors,
* valves, such as
- left in normal position for too long without lubricating stem and exercising,
* vapor retarders or protective jackets for insulation,
* and so forth.

Cause name:
Joint, bolted, problem.

Cause description:
Examples: (A) inadequate clamping force (bolts loose, missing, unevenly tight...), or (B) mating surfaces (flanges...) damaged or inadequate or (C) any needed gaskets (including o-rings) damaged, missing, or inadequate.

Cause name:
Joint, threaded, problem.

Cause description:
Examples: (A) loose, (B) threads damaged or inadequate, or (C) any needed gaskets (including o-rings) damaged, missing, or inadequate.

Cause name:
Level signal wrong -- higher than actual, or float switch stuck in high position.

Cause description:
[Nothing has been recorded in this field.]

Cause name:
Level signal wrong -- lower than actual, or float switch stuck in low position.

Cause description:
[Nothing has been recorded in this field.]

Cause name:
Lightning strike

Cause description:
[Nothing has been recorded in this field.]

Cause name:
Liquid accumulation in hot-gas or suction piping.

Cause description:
* Ammonia-refrigerant hot gas may condense into a liquid when there is little or no flow in hot-gas defrost (HGD) piping, between defrosts, and so may need to be safely drained before enough accumulates to cause vapor propelled liquid slugs.
* Suction piping often carries some ammonia-refrigerant liquid, along with lower pressure gas, and so needs to be built so that this liquid safely flows to gas-liquid separation vessels, such as accumulators, recirculators, or suction traps.
* The following may result in shocks.
- HGD piping that does not pitch to
> a liquid drainer or
> compressor-discharge piping that would evaporate most liquid that drains into it, or carry the liquid to the condensers (typically high-stage discharge, HSD, piping).
- A liquid drainer on hot-gas piping does not drain liquid, due to
> a stop valve to/from it is left closed (human error),
> mechanical jam or plugging.
- Suction piping that both accumulates liquid, in low spots or periods of low gas flow, and also accelerates this liquid into a slug when gas flows increase.

Cause name:
Loads added without properly evaluating.

Cause description:
For example, additional:
* equipment installed on a roof or floor,
* piping installed on a rack or hanger, or
* heat or refrigeration loads added to an existing system.

Cause name:
Mechanical jam or plugging -- moving part stuck, pilot tube or orifice plugged, and so forth.

Cause description:
Includes a control valve that is stuck:
* closed,
* fully open, or
* partly open.
If a check valve fails mostly open on a pump discharge, consider if:
* a transfer-system pump, that it would rotate in the reverse direction due to the pressure drop between a compressor suction and discharge (or other large pressure drop), during a rapid leak by its outlet check valve, could spin so fast that
- the pump-to-motor shaft seal could leak or
- vibrations could crack open the pump housing leading to a rapid leak, which
> is more likely with a gear pump than a centrifugal pump.

Cause name:
Normal activity that is reasonably safe with proper precautions.

Cause description:
Includes,
* startup after a long shutdown, when ammonia-refrigerant compressor-suction pressures are high.

Cause name:
Oxygen, nitrogen, or other non-condensable gas content is too high.

Cause description:
* For example:
- automatic purger not working properly or
- manual purging neglected.
* Air can enter closed-circuit refrigeration systems when they are opened for maintenance or through leaks in any below-atmospheric pressure equipment or piping.
* Here, non-condensable gases means gases that neither dissolve in ammonia nor condense to a liquid under the temperature and pressure conditions in the refrigerant condenser. Water is very soluble in ammonia, but other components of air mostly are not.

Cause name:
People are not kept a reasonably safe distance from dangerously malfunctioning things or higher-hazard special work.

Cause description:
For example,
* employees remain in room with a small ammonia leak that may signal the possibility of a more rapid leak.

Cause name:
Policies or programs -- for contractors, human resources, safety, or training -- are inadequately designed or implemented.

Cause description:
[Nothing has been recorded in this field.]

Cause name:
Pressure-relief system inadequate.

Cause description:
For example,
* relief vent (RV) piping open to the atmosphere is partly located in spaces with temperatures
- below the dew point at the piping's atmospheric outlet, so water will condense in it,
- at 32 F or below, so water that condenses in it will freeze,
* rain or snow can enter RV piping too easily, at its outlet to the atmosphere,
* RV piping is not adequately pitched to water traps,
* water is not drained from water traps that completely fill with water and
- start to block RV piping,
- fills RV piping enough to cause shocks via vapor-propelled liquid slugs, if a pressure-relief valve opens,
* inlet to a pressure-relief system is located where liquid may be present, and the relief system isn't built for liquid or two-phase flow,
* inlet piping, including any valves, creates too much friction at needed pressure-relief flows, causing
- chattering or other excessive valve opening and closing, when pressure relief is needed,
- unacceptable pressures in the protected equipment or piping,
* a pressure-relief device is too small for the equipment (including vessels) and piping that it protects, under a reasonable design scenario or during an actual incident,
* RV piping is not sized to handle all pressure-relief valves connected to it fully discharging into it at once, such as during a major fire,
* an additional pressure-relief valve outlet is tied into existing RV piping that cannot handle the additional flows, if multiple relief valves on the existing RV piping open at once,
* RV piping outlet (the potential ammonia gas discharge location) is not reasonably safe,
* and so forth.

Cause name:
Procedure is confusing, ignored, misunderstood, or wrong.

Cause description:
For example,
* Compressor lockout-tagout procedures don't include locking out its oil heater.

Cause name:
Roof, piping, or other leak causes damage.

Cause description:
For example, leaking
* water or
* another material
that damages
* envelopes of buildings or rooms (that control air or moisture movement),
* equipment,
* floors,
* piping, or
* supports, including
- buildings,
- hangers, or
- structures.

Cause name:
Shocks or vibrations cause damage.

Cause description:
For example, damage to
* insulation,
* paint,
* steel primary containment (equipment and piping),
* supports, or
* vapor retarders or protective jackets in insulation systems.

Cause name:
Spring problem.

Cause description:
* Broken or less stiff due to
- repeated use, including pressure-relief valves that, if opened once, may open at a different pressure the next time, or
- corrosion, such as caused by exposure to moisture and oxygen, including the springs in pressure-relief valves that discharge to the atmosphere.
* Jammed or gummed up.

Cause name:
Stop valve closed without proper pump-out or manual opening of control valves.

Cause description:
For example, stop valve closed downstream of a check valve, upstream of a solenoid valve or other control valve that prevents forward flow, or two stop valves closed in series.

Cause name:
Stress-corrosion cracking (SCC)

Cause description:
Very rare in closed-circuit, mechanical, ammonia refrigeration, but, when it has occurred:
(A) it has typically initially been detected after small ammonia leaks, where a crack propagated through a steel vessel wall
(A.1) rather than by bursting steel vessels, reports of which the PHA team is not aware due to SCC,
(B) it has more often been in portions of refrigeration systems with
(B.1) higher residual stresses in the steel primary containment, such as in vessels (typically larger ones have higher residual stresses)
(B.1.1) near welded joints, both the weld metal and the heat-affected zone, or
(B.1.2) in cold formed steel, such as often the elliptical heads of vessels,
(B.2) higher pressures, temperatures, and oxygen content but lower water and lubricating oil content, such as the head spaces of
(B.2.1) high-pressure receivers,
(B.2.2) thermosiphon receivers, and
(B.2.3) others vessels exposed to hot gas, like some transfer vessels or defrosted equipment;
(B.3) conversely, the PHA team is not aware of SCC reported in
(B.3.1) compressor oil separators (perhaps because their interior surfaces are normally coated with lubricating oil).
* IIAR Bulletin 110, published in 1993, and IIAR 2, since at least the 2008 edition, have included information on SCC.
* Besides SCC, the PHA team is not aware of any reports of other internal-corrosion mechanisms of steel in closed-circuit, mechanical, ammonia refrigeration service, perhaps due to the low oxidation potential of ammonia and the protection provided by traces of lubricating oil.

Cause name:
Supports for piping or equipment inadequate, so normal vibrations are amplified into swaying, and so forth.

Cause description:
[Nothing has been recorded in this field.]

Cause name:
Temperature or humidity changes within or moderately outside of typically expected ranges.

Cause description:
* Doesn't include high temperatures from:
- severe fires or other sources of similar or higher temperatures.
* Includes temperature or humidity changes from:
- cleaning, clean-in-place, and other sanitation,
- defrosting,
- routine shutdowns,
- weather or other ambient conditions.
* Includes all affects of these temperature or humidity changes, such as
- condensation from gas to liquid, for example
> ammonia-refrigerant,
> humidity in air,
- freezing,
- refrigeration load changes,
- thermal contraction or expansion of equipment, fasteners, piping, supports,
- and so forth.

Cause name:
Valve-seat seal failure (seat-gasket degraded, debris on seat, not tight enough, etc.)

Cause description:
[Nothing has been recorded in this field.]

Cause name:
Valve-stem seal failure (packing damage, not tight enough, etc.)

Cause description:
[Nothing has been recorded in this field.]

Cause name:
Vehicle moves unexpectedly.

Cause description:
For example, for transfers, such as ammonia charging,
* tanker truck (loading or unloading) driver and others assisting forget to
- set parking brakes,
- chock wheels,
- disconnect and stow hose before driving away,
* another vehicle
- rolls over a transfer hose,
- hits the tanker truck,
- hits the transfer connection (such as the ammonia charging port),
- and so forth.

Cause name:
Vessel or piping temperature is below its minimum design metal temperature (MDMT).

Cause description:
For example,
* during normal operations or
* an upset condition, such as
- equipment or piping vented to the atmosphere while it still contains liquid ammonia refrigerant.

Cause name:
Willful misconduct.

Cause description:
For example,
* arson,
* blocking a leaking pressure-relief outlet,
* falsifying documentation, for example, not doing an inspection and marking it done,
* intoxicated, playing, or sleeping on the job (security guard watching a movie...),
* obstructing exit routes, for example, by excessive carelessness with storage or after spilling oil,
* passwords or combinations posted in plain sight of systems they protect,
* propping open a self-closing valve, such as on oil drains,
* tampering with control valves or setpoints,
* violating specifications knowingly and intentionally, such as
- to save money or time, and,
- if intentional, adding to, or using on, refrigeration-system equipment or piping
> farm-grade anhydrous ammonia,
> inadequate grease or lubricating oil.

Cause name:
Wrong substance or concentration added or used.

Cause description:
For example,
- freeze point of brine or glycol-water mixture is too high (salt or glycol concentration is too low),
- farm-grade anhydrous ammonia,
- copper based anti-seize,
- wrong lubricating oil (to thick or thin, cannot handle the temperature, and so forth),
- acid or caustic.

Possible Consequences

Consequence name:
Compressor contains liquid ammonia refrigerant, when it starts, due to refrigerant condensation while off.

Consequence description:
* This includes refrigerant condensation
- in the compressor or
- near the compressor that drained into it.
* It can happen when a cold draft blows against a compressor, its oil separator, or its discharge piping.

Consequence name:
Compressor package internal or seal damage, and if safeties fail, leak or fire.

Consequence description:
See safeguard on: Compressor controls and safety shutoffs...

Consequence name:
Damage due forces or loads exceeding capacity.

Consequence description:
Includes:
* dead, live, soil, flood, tsunami, snow, rain, atmospheric ice, earthquake, and wind loads,
* torque,
* and so forth.

Consequence name:
Equipment or piping becomes more susceptible to external physical damage.

Consequence description:
For example,
* vessels operated below their minimum design metal temperature (MDMT) during normal operations or an upset condition, such as
- equipment or piping vented to the atmosphere while it still contains liquid ammonia refrigerant.

Consequence name:
Explosion or fire more likely.

Consequence description:
* When oil droplets/mists are mixed with ammonia in air, the mixture's lower-flammability limit is lower than pure ammonia.
* The flammable range for pure ammonia (no oil droplets) in dry air is about 15% to 27% (150,000 to 270,000 ppm), and in very humid air is about 16% to 26.5%.
* Leaks in oil separators for ammonia-refrigerant compressors or in downstream discharge piping can cause:
- rapid pressure drops
- foaming in oil, as ammonia dissolved the oil boils,
- spraying of oil and ammonia mixtures from the leak, and
- fire or explosions where the compressor is located.
* If ammonia leaks across a heat exchanger into lower-pressure piping, the pressure-relief systems on the ammonia piping will not typically prevent the lower pressure piping from exploding or bursting open.
- The lower-pressure piping needs to be open to the atmosphere or protected by its own, lower-pressure, pressure-relief devices.

Consequence name:
Hinders emergency actions -- communications, move-to-safety, headcount, closing valves in/from safe locations, and so forth.

Consequence description:
* Includes anything that causes stop valves to:
- get stuck open,
- leak by, such a due to poor seat seals.

Consequence name:
Hinders emergency response -- firefighting, entry into unsafe places for rescue, stopping leaks, and so forth.

Consequence description:
* Includes anything that causes stop valves to:
- get stuck open,
- leak by, such a due to poor seat seals.

Consequence name:
Hinders maintenance or increases the need for repairs.

Consequence description:
* For example,
- damage to insulation or paint, from bumps or scratches, which can lead to rusting of underlying steel.
* Includes anything that causes stop valves to:
- get stuck open,
- leak by, such a due to poor seat seals.

Consequence name:
Hinders operations. [UPDATE - VERY SYSTEM SPECIFIC]

Consequence description:
This includes anything that
* damages products or raw materials, such as in cold storage,
* reduces production or
* increases the operation of:
- automatic purgers,
- transfer systems for liquid-ammonia refrigerant. [IF PRESENT]

Consequence name:
Hinders safety, security, health, or environmental protection.

Consequence description:
[Nothing has been recorded in this field.]

Consequence name:
Human errors become more likely or more severe.

Consequence description:
[Nothing has been recorded in this field.]

Consequence name:
Leak of ammonia contaminates the air above a roof but is unlikely to cause significant odors offsite.

Consequence description:
Includes:
* 150 PSI pressure-relief valve opens during a hot-weather power outage.

Consequence name:
Leak of ammonia contaminates the air near ground level but is unlikely to cause significant odors offsite.

Consequence description:
* The following ammonia-refrigeration equipment or piping is located near walkways, parking lots, or other outdoor areas:
[DESCRIBE ANY -- NOTE IF PEOPLE ARE OFTEN PRESENT THERE -- NOT JUST DURING WORK ON THE EQUIPMENT THERE.]
* This consequence also includes:
- ammonia leaks that occur inside or above roofs but that are likely to reach outside air near ground level, onsite, such as from
> a ventilation outlet in a wall,
> an often-open door or window,
> a pressure relief valve located low enough for this to happen, and
> a big enough ammonia leak above a roof, under conditions when air cooled by the refrigerant leak will sink.

Consequence name:
Leak of ammonia enters a room (Case A) with ammonia-in-air sensors, audio-visual alarms, and normal and emergency ventilation.

Consequence description:
* For example, an ammonia leak that contaminates the air in:
- the facility's refrigerating-machinery room.
[DESCRIBE ANY OTHER ROOMS OR SPACES AT THE FACILITY WITH THESE SAFETY SYSTEMS, INCLUDING, IF APPLICABLE AND IF AN AMMONIA LEAK MAY OCCUR OR ENTER THERE: PITS, TUNNELS, SPACES BETWEEN CEILINGS AND ROOFS, ETC.]
* Includes leaks of ammonia near the fresh-air inlets for the room, such as ventilation intakes, louvers, or sometimes-open windows or doors.
* Normal ventilation means air circulation and air exchanges for comfort and air quality, for example per the building code for the type of occupancy.

Consequence name:
Leak of ammonia enters a room (Case B) with ammonia-in-air sensors and only normal ventilation.

Consequence description:
* For example, an ammonia leak that contaminates the air in:
[DESCRIBE ROOMS AT THE FACILITY WITH AMMONIA-IN-AIR SENSORS AND ONLY NORMAL VENTILATION, INCLUDING, IF APPLICABLE AND IF AN AMMONIA LEAK MAY OCCUR OR ENTER THERE: PITS, TUNNELS, SPACES BETWEEN CEILINGS AND ROOFS, ETC.]
* Includes leaks of ammonia near the fresh-air inlets for the room, such as ventilation intakes, louvers, or sometimes-open windows or doors.
* Normal ventilation means air circulation and air exchanges for comfort and air quality, for example per the building code for the type of occupancy.

Consequence name:
Leak of ammonia enters a room (Case C) with no ammonia-in-air sensors and normal ventilation.

Consequence description:
* For example, an ammonia leak that contaminates the air in:
[DESCRIBE ROOMS AT THE FACILITY WITH NO AMMONIA-IN-AIR SENSORS AND NORMAL VENTILATION, INCLUDING, IF APPLICABLE AND IF AN AMMONIA LEAK MAY OCCUR OR ENTER THERE: PITS, TUNNELS, SPACES BETWEEN CEILINGS AND ROOFS, ETC.]
* Includes leaks of ammonia near the fresh-air inlets for the room, such as ventilation intakes, louvers, or sometimes-open windows or doors.
* Normal ventilation means air circulation and air exchanges for comfort and air quality, for example per the building code for the type of occupancy.

Consequence name:
Leak of ammonia enters a room (Case D) with ammonia-in-air sensors but little-or-no ventilation.

Consequence description:
* For example, an ammonia leak that contaminates the air in:
- [COOLERS OR FREEZERS OFTEN HAVE LITTLE-OR-NO VENTILATION, ONLY AIR CIRCULATION WITHIN THEM.]
- [DESCRIBE ROOMS AT THE FACILITY WITH AMMONIA-IN-AIR SENSORS BUT LITTLE-OR-NO VENTILATION, INCLUDING, IF APPLICABLE AND IF AN AMMONIA LEAK MAY OCCUR OR ENTER THERE: PITS, TUNNELS, SPACES BETWEEN CEILINGS AND ROOFS, ETC.]
* Includes:
- leaks caused by shocks due to an electrical power outage or restoration, such as from inadequately built or controlled defrosting.

Consequence name:
Leak of ammonia enters a room (Case E) with no ammonia-in-air sensors and little-or-no ventilation.

Consequence description:
* For example, an ammonia leak that contaminates the air in:
- a room whose ammonia-in-air sensors or ventilation fail to work, perhaps because they have no electrical power,
- [COOLERS OR FREEZERS OFTEN HAVE LITTLE-OR-NO VENTILATION, ONLY AIR CIRCULATION WITHIN THEM.]
- [DESCRIBE ROOMS AT THE FACILITY WITH NO AMMONIA-IN-AIR SENSORS AND LITTLE-OR-NO VENTILATION, INCLUDING, IF APPLICABLE AND IF AN AMMONIA LEAK MAY OCCUR OR ENTER THERE: PITS, TUNNELS, SPACES BETWEEN CEILINGS AND ROOFS, ETC.]
* Includes:
- leaks caused by shocks due to an electrical power outage or restoration, such as from inadequately built or controlled defrosting.

Consequence name:
Leak of ammonia into water or other liquids that may cause odors or flow into floor drains or similar.

Consequence description:
[UPDATE BELOW FOR THE FACILITY]
* This includes ammonia leaking and dissolving into brine, water, glycol-water mixtures, or other liquids.
* The following flow into the facility's sanitary plumbing:
- the floor drains in the Compressor Room and production rooms,
- the small flow of ammonia-scrubbing water, from the automatic purger's water-bubble column, in the refrigerating-machinery room.

Consequence name:
Leak of ammonia that will probably cause strong odors or worse offsite.

Consequence description:
[Nothing has been recorded in this field.]

Consequence name:
Motor wired so it rotates in the wrong direction -- consequences at the facility. [UPDATE FOR COMPRESSORS, FANS AND PUMPS USED]

Consequence description:
If not discovered by the facility's qualified contractors during checks before they put a newly wired motor into service, so the motor is run in the reverse direction for more than a few seconds, the following may occur.
* Compressors, screw, motor [VERIFY FOR TYPES OF COMPRESSORS AT THE FACILITY]
- gas moved inefficiently from oil separator to piping between suction check valve and compressor,
- if high-current (amp) protection does not shutoff the motor, possible overpressure and leak on suction side, though a suction-check-valve bypass may relieve some of this,
- also possible overheating, similar to compressor starved, so a high-oil temperature sensor may cause the motor to shutoff.
* Compressor, screw, oil pump motor -- oil flow in wrong direction before compressor starts, and the compressor motor won't start due to low oil pressure.
* Compressor, screw, slide valve motor -- slide valve operates in wrong direction. See compressor loads up too quickly consequences.
* Compressors, reciprocating (Vilter or similar), motor -- typically little consequence except increased wear and tear. Oil pump operates with crank shaft turning in either direction.
* Fan motors -- fan blows air inefficiently in the wrong direction.
- Fans for condensers -- inefficient heat transfer, high-condensing temperatures could cause compressors to shutoff due to high-discharge pressure.
- Fans for air-handling units or forced-air evaporators -- inefficient heat transfer and higher air temperatures in cooled spaces.
- Fans for ventilation -- inadequate ventilation,
> if emergency ventilation and ammonia leaked into the ventilated room, could lead to high, possibly flammable, concentrations of ammonia in the room air.
* Pump, centrifugal, motor -- little or no pressure developed at outlet, operational problem only (no ammonia-refrigerant or cooling water flow, depending on the pump, etc.)
* Pump, chemical feed, motor -- no chemical fed, such as for water treatment.
* Pump, gear, motor [DEPENDS ON USE, SUCH AS DESIGN OF TRANSFER SYSTEM, IF PART OF ONE].

Consequence name:
Overpressure in equipment or piping.

Consequence description:
[Nothing has been recorded in this field.]

Consequence name:
Pressure-relief system discharges liquid ammonia to the atmosphere, so more is released.

Consequence description:
[Nothing has been recorded in this field.]

Consequence name:
Severity increases, such as injuries or fatalities more likely due to leak, fire, explosion, weak condition, or unusual load.

Consequence description:
This includes combinations like:
* a material is weakened or brittle, such as from corrosion or cold and
* it is shocked or strained by an unusual force, such as someone stepping or dropping something on it.

Consequence name:
Shocks that could damage equipment, piping, or supports.

Consequence description:
[Nothing has been recorded in this field.]

Consequence name:
Water contamination in the ammonia refrigerant becomes too high.

Consequence description:
Water contamination in the ammonia refrigerant can:
* require a lower compressor-suction pressure to achieve the desired temperature of whatever is being cooled (air, water, and so forth), which reduces compressor
- capacity and
- efficiency -- more power needed to refrigerate (remove heat) at the same rate,
* cause compressor-lubricating oil degradation and, with high enough water contamination, emulsification or excessive foaming,
* result in needing to replace the entire
- ammonia-refrigerant charge and
- compressor-lubricating oil charge, in the refrigeration system,
* otherwise, special measures may be needed to remove water contamination.
See IIAR 6-2019, Appendix C, Water Contamination in Ammonia Refrigeration Systems.

Existing Safeguards

Safeguard name:
Access is adequate to ammonia-refrigeration equipment and piping.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
[IF NEEDED, EXCEPT AS NOTED IN THIS PHA'S RECOMMENDED ACTIONS...]
* Access is adequate to the facility's ammonia-refrigeration equipment and piping, for example,
- stairs, ladders, and step-over walks are installed so there is access to all ammonia-refrigeration equipment and piping on roofs,
[ADD ENOUGH DETAIL TO DEMONSTRATE REASONABLE REVIEW OF ACCESS.]
* Access to and inside the Compressor Room is described in the safeguard about the:
- refrigerating-machinery room and its safety systems.
[START SEE ALSO:
* Case History: A Study of Incidents in the Ammonia Refrigeration Industry [2005 to 2019], Peter R. Jordan, 2020 IIAR Technical Paper #7. Upshot: Mr. Jordan
- identified a total of eleven fatalities, nine near ammonia-refrigeration systems and two near ammonia storage terminals;
- three of the fatalities were caused by persons trapped in limited-access areas with an ammonia release and
- two of these releases were from oil draining. The third was from a pipe rupture;
- nine of the fatalities involved ammonia-piping opening, liquid transfer (typically charging), or oil draining.
END SEE ALSO.]

Safeguard name:
Air and water contamination of the ammonia refrigerant is kept adequately low.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
* Procedures, including for tie-in of new equipment and piping, and system-opening permits (also called line-breaking permits) call for evacuating most air from equipment and piping before placing them into service or returning equipment or piping that was opened to service.
* The suction pressure of ammonia-refrigerant compressors is kept above atmospheric pressure (not in a vacuum), normally and during known unusual circumstances to date, making air and water contamination less likely.
[OTHERWISE, DESCRIBE ANY NEEDED WATER TESTING OF THE AMMONIA REFRIGERANT. SEE IIAR 6-2019, APPENDIX C.]

Safeguard name:
Air-cooling equipment and piping are adequately built, controlled, located, inspected, tested, and maintained.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
* In the facility's ammonia refrigeration system this equipment includes:
- forced-air evaporators with hot-gas defrost,
- air-handling units with [STEAM, NATURAL GAS...] heating and ammonia refrigeration,
- [VERIFY ABOVE AND PROVIDE DETAILS, REFERENCE LISTS OF EQUIPMENT.]
* For the above equipment, access for maintenance is adequate, including to inside and the top of its housing, as needed,
- with adequate confined-space, fall-protection, and machine-guarding safeguards and policies, and
- with adequate guarding and shrouding to contain a broken fan blade or loose balancing weight, so they are unlikely to injure people or damage coils.

Safeguard name:
Ammonia has good warning properties, unlike, for example, propane or halocarbon refrigerants.

Hierarchy of controls/safeguard type:
Substitution

Safeguard description:
Most people can smell traces of ammonia in air at below harmful levels, do not have their sense of smell fatigued by continued exposure, will experience more discomfort as concentrations rise, and so will try to move to safety.

Safeguard name:
Change management is adequate.

Hierarchy of controls/safeguard type:
Administrative

Safeguard description:
The facility's change-management policies include:
* developing commissioning and decommissioning procedures as needed before equipment or piping is added (tie-in) or removed from the refrigeration system,
* in its change-management applicability checklist, asking if a change will alter:
- traffic patterns near its ammonia-refrigeration system, such as by rearranging storage racks,
- the number, qualifications, or authority of personnel with process safety, operations, or maintenance responsibilities -- such that changes to ammonia-refrigeration system chemicals, technology, equipment, procedures, or facilities are needed to accommodate these organizational changes. (See March 31, 2009, OSHA interpretation, memo to Regional Administrators.)
* See the PHA safeguard named: Separation of ammonia refrigeration from people is adequate and considered in change management.

Safeguard name:
Charging ammonia -- equipment, piping, and procedures are adequate.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
* The facility's permanently installed refrigeration-system charging piping helps avoid
- leaks from the refrigeration system if a hose or connections leaks and
- trapping liquid downstream of its charging-port check valve
because it includes, in the desired direction of flow:
- a threaded cap (removed when the charging hose is connected),
- a stop valve (the charging valve),
- a check valve (allowing only flow into the refrigeration system),
- a nipple (if needed to allow venting because there is another stop valve downstream on the charging piping), and then
- additional piping connecting to the condenser drain (CD) piping upstream of the CD shutoff valve by the high-pressure receiver or another good connection location.
* The charging port is labeled, on both the piping and the ammonia-refrigeration P&ID.
* For the facility's the ammonia-refrigeration system:
- no charging from cylinders is allowed,
- only charging from bulk-tanker trucks is allowed, and
- no transportation cylinders, vessels, or similar are left connected, except during monitored charging.
* The procedure for ammonia charging from bulk-tanker trucks includes:
- documenting understanding of this procedure, by the tanker-truck driver and the facility employee and/or contractor involved, such as by sign-offs in the procedure or other training records,
- covers needed items, such as
> verifying that the tanker truck holds refrigerant grade anhydrous ammonia (meeting IIAR 2, latest edition or equivalent),
> verifying that the tanker truck can deliver the ammonia against the pressure in the ammonia-refrigeration system, where the charging port is located,
> confirming the quantity to be added,
> an upper limit to the liquid level in the high-pressure receiver, when charging should be stopped,
> establishing communication methods between the driver and the facility employee and/or contractor involved, as needed, such as hand signals or radios,
> setting barricades to keep foot and vehicle traffic away from the area with the tanker truck and hose,
> setting brakes and wheel chocks,
> checking that the hose-expiration date has not past,
> inspecting the ammonia hose, coupling, charging valve(s), and charging piping,
> donning appropriate personal-protective equipment (may be a reference to the driver's procedure, if the driver handles the transfer),
> making and testing the connection of the hose and couplings before opening valves that would be hard to close in a leak,
> monitoring charging, carefully, including for leaks and to avoid overfilling,
> initial steps to take if an ammonia leak occurs (or a reference to emergency plans, reviewed as needed with the driver),
> safe disconnection, including testing that the facility's permanently installed refrigeration-system charging valve is holding (no leak by),
> venting the facility's charging piping, as needed, such as to prevent trapping liquid ammonia downstream of any check valve on this piping,
> and so forth.

Safeguard name:
Cleaning on or near the ammonia-refrigeration system is adequately safe, including clean-in-place.

Hierarchy of controls/safeguard type:
Administrative

Safeguard description:
[START EXAMPLES]
* Air-cooling coils and fins -- manual cleaning procedures ensure that:
- ammonia-refrigerant liquid has evaporated from coils and piping before cleaning starts, such as by completing a defrost cycle just before shutting off the refrigeration, if applicable, and that none is added during cleaning and
- cleaning methods and chemicals do not damage the coils, fins, or other equipment and piping.
* Cleaning and any chemical storage near ammonia-refrigeration equipment and piping avoids damaging their paint or insulation systems.
- [ADD DETAIL IF NEEDED]
* Jacketed silos and tanks with clean-in-place (CIP):
- the automated refrigeration and CIP controls, and [IF APPLICABLE] also procedures for personnel who initiate CIP, ensure ammonia-refrigerant liquid has evaporated from cooling jackets before CIP starts and that none is added during CIP, such as by
> shutting off refrigeration when the cooled-liquid level in the tank or silo reaches a low level that would allow enough load to evaporate most ammonia refrigerant under typical flow rates and conditions,
> a gradual initiation of CIP, avoiding thermal shocks and rapid evaporation of any remaining liquid refrigerant,
> not turning refrigeration back on until CIP is complete.
* Liquid chillers with CIP
- [DESCRIBE SAFEGUARDS]
[END EXAMPLES]

Safeguard name:
Compressor controls and safety shutoffs are adequate, including for their motors and the vessel(s) that feed the compressors.

Hierarchy of controls/safeguard type:
Engineering: Improves Instrumentation, Controls, or Machinery Reliability

Safeguard description:
At the facility, these controls and safety shutoffs include the following.
* Redundant safeguards, via local controls in the compressor packages, in addition to the central ammonia-refrigeration controls.
* On the vessel [VESSELS] that feeds the all facility ammonia-refrigerant compressors, [__LIST VESSEL(S)__], these include:
- a level probe, which outputs to controls that [OFTEN OPTIONAL]
> signal alarms at an alarm level and then, [OFTEN OPTIONAL]
> on high-level, send shutoff signals to compressor local controls, [OFTEN OPTIONAL]
- a high-high-level float switch for compressor-safety shutoff, wired fail safe (no signal or open circuit causes shut off) and independently from the central ammonia-refrigeration controls.
* In all the ammonia-refrigerant compressor packages, these compressor-safety shutoffs include, at least:
- compressor motor high current (amps) -- also called overload or overcurrent protection,
- compressor motor high temperature (thermal protection),
- high discharge pressure,
- low suction pressure, and
- low oil pressure (the differential pressure that drives lubricating-oil flow, such as shaft-seal-chamber pressure minus suction pressure in Vilter reciprocating compressors).
* In the ammonia-refrigerant screw-compressor packages, these compressor-safety shutoffs also include, at least:
- high discharge temperature, of the ammonia-refrigerant gas,
- high oil-filter differential pressure,
- high oil temperature (after cooling and typically before injection into the screw lubrication system),
- low oil temperature (also prevents the screw compressor from starting until the oil heater has adequately warmed the oil),
- oil-pump motor high current (amps), and
- oil-pump motor high temperature (thermal protection).
* All of the above compressor-safety shutoffs:
- fail safe (no signal or open circuit causes shut off) and
- cause local compressor controls to de-energize compressor-package components as needed for safe shut off, including
> the compressor motor,
> the oil heater (except in special cases when an automatic restart may be allowed),
> any oil-pump motor,
> any liquid-injection cooling pump motors and/or solenoid valves.
* Local screw-compressor controls:
- prevent all motors in the compressor package from starting too often,
- automatically unload screw-compressor slide valves (capacity control and volume ratio) when the compressor shuts off or when power is restored after a power outage,
- prevent restart until slide valves are unloaded to below 10% of their limits, and
- correct most slide-valve drift via anti-drift functions.
[OR SLIDE-VALVE DRIFT MAY BE ADDRESSED VIA ITM]
* The central ammonia-refrigeration controls:
- prevent the compressors from starting too often and
- automate their starting, loading, unloading, and shutoff.
* Inspection, testing, and maintenance (ITM) of the above controls and safeguards are scheduled, described, and documented in
- the facility's maintenance-management system.
*** The following apply to the ammonia-refrigeration system at the facility. ***
* Overheating lowers the viscosity of lubricating oil, which at high enough temperatures causes
- inadequate lubrication. This leads to
- increased wear-and-tear on internal parts,
- often, increased oil leakage from the shaft seal, and
- possibly, ammonia leakage from the shaft seal.
* Additional overheating causes friction that makes the drive shaft harder to turn, increasing the load on the compressor motor, and eventually causing the compressor to seize up (the electric motor cannot turn the shaft).
* In the reciprocating compressors, the crank shaft drives the oil pump, so the low-oil pressure switch should shutoff the compressor motor. If not, high current (amps) protection should shut off the compressor motor,
- except with a belt drive, if a problem (belt breaks, slipping , etc.) causes the motor to run faster than the compressor, the low-oil pressure switch should shutoff the compressor motor. If not, the motor many overheat and, if also not thermally protected, damage insulation, rarely but possibly leading to a small fire that might be the source of a larger fire.
* Overheating, described above, and possibly small ammonia leaks, would be the typical result of gas recirculating from the discharge to suction sides of a reciprocating-compressor crank case because:
- it is running with the discharge valve shut between the compressor and the oil separator (deadheading) and its high discharge-pressure shutoff fails when needed
> causing its internal pressure-relief valve to open, or
- rapid leak by this internal pressure-relief valve.
* The screw compressors are protected from high-oil temperatures by
- high oil temperature shutoffs,
- high discharge temperature shutoffs,
- compressor motor high current (amps) shutoffs (if friction increases due to inadequate lubrication), and
- low oil pressure shutoffs, triggered by the low-oil pressure if the screws seize up because the above shutoffs failed.
* If the following shutoffs are not installed or fail when needed, overheating, described above, and possibly small ammonia leaks, would be the typical result:
- low suction pressure (compressor starved),
- low oil pressure (inadequate oil flow for cooling, lubricating, and seals),
- high oil-filter differential pressure (inadequate oil flow for cooling, lubricating, and seals),
- high oil temperature (or cooling-water low-flow switch, if applicable),
- high discharge temperature,
- compressor motor high current (amps) -- as backup to the above.
* If the following shutoff is not installed or fails when needed, increased wear and tear would result, if not shut off on low oil pressure,
- low oil temperature.
* Compressor equalizing to suction too quickly, due to
- leak by screw-compressor suction check valve or
- reciprocating-compressor suction stop valve opened too quickly, may
- suck some oil out of the compressor or
- cause pressure in the shaft-seal chamber to be different than in the suction side of the compressor, particularly for reciprocating compressors. This may move the inner shaft seal, causing oil to spray from the shaft-seal chamber onto the compressor internal components, leading to increased wear.
* Compressor loading up too quickly:
- has little effect on reciprocating compressors,
- may lead to wear or internal damage to screw-compressor packages, including their motors,
- if this results in a rapid suction pressure drop, excessive refrigerant boiling in vessels that feed compressors may cause liquid droplets to reach compressors, see the scenario on liquid ammonia sucked into compressors, lots of large droplets or more (slugging).
* If a screw-compressor oil-pump inlet or outlet valve is closed when the oil pump starts or is running:
- the compressor local controls would not start the compressor motor, or would shut it off (for low-stage/booster compressors that run the oil pump during normal operation), due to low oil pressure,
> which, possibly after a time delay, would cause the compressor local controls to shut off the oil-pump motor, or otherwise
- the oil-pump motor may be shut off by its high current (amps) or thermal protection.
- If the oil-pump outlet valve is closed (or both the inlet and outlet valves are closed) and the oil pump motor isn't shutoff by the above safeties, this may cause:
> a leak, mostly oil, at the motor-shaft seal, a valve-stem seal, or some piping joints,
> any pump internal pressure-relief device, from outlet to inlet, to open [CHECK IF THE PUMP HAS INTERNAL PRESSURE RELIEF],
> [IF NOT LIQUID INJECTION COOLED] the oil-cooler, oil-side, pressure-relief valve to open and relieve the pressure by allowing oil flow back to the compressor oil separator that feeds the oil pump.

Safeguard name:
Condensers, evaporative, and their water treatment are adequately built, controlled, located, inspected, tested, and maintained.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
For the all the condensers in the facility's ammonia-refrigeration system, which are all evaporative condensers,
* access for maintenance is adequate, including to the fans and the inside and top of the condenser housing, as needed,
- with adequate confined-space, fall-protection, and machine-guarding safeguards and policies, and
- with adequate guarding and shrouding to contain a broken fan blade or loose balancing weight, so they are unlikely to injure people or damage coils,
* controls prevent cooling water flow to condensers when the ambient temperature is near or below the freezing point of water,
* mist eliminators prevent excessive mist and over-spray, and
* the condensers have appropriate overpressure protection, provided by:
[DESCRIBE, FOR EXAMPLE]
- the ammonia-refrigeration procedures and system-opening permits and
- check valves (followed by a nipple and then a stop valve) on piping bypassing the main stop valves at condenser-coil outlets,
* which are consistent with the following guidance:
- pressure-relief valves on condenser inlet piping, protecting their coils, are typically neither helpful nor required with proper administrative controls, such as only isolating a condenser coil from the rest of the refrigeration system (valving off the condenser) if the isolated coil and piping are promptly vented to atmospheric pressure following a system-opening permit (also called line-breaking permit) or procedure,
- check valves or relief regulators on piping bypassing the main stop valves at condenser-coil outlets are only needed if condenser coils are valved off seasonally, such as in winter, in which case they allow fluids to safely return from a condenser coil to the rest of the refrigeration system, for example, if ammonia refrigerant entered the coil due to leak by an isolating stop valve,
- in the above cases, the high-pressure receiver's overpressure protection also protects the condenser coils.
* The water-quality program, for the condenser-cooling water, is managed by the facility's authorized and qualified chemical service and supply contractor, is jointly implemented by the facility's Owner/Operator and this contractor, and includes water monitoring, testing, and treatment (filters, chemical additions, etc.)
[VERIFY ALL OF ABOVE.]

Safeguard name:
Controls and electrical systems for ammonia refrigeration are adequately built, located, inspected, tested, and maintained.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
* Alarm notifications are given to employees or contractors, by automated controls, via [LOUDSPEAKER ANNOUNCEMENTS, CALLS OR MESSAGES TO THEIR MOBILE PHONES...]
* Ammonia-refrigeration controls fail safe themselves or due to redundant controls that fail safe (no signal or open circuit causes shutoff).
* Ammonia-refrigeration controls hardware is enclosed or located so that it is unlikely to be damaged by a heat, steam, water, or other leaks or environmental conditions.
* Electrical-surge protection for ammonia-refrigeration controls is adequate.
* Thermal scans of electrical systems are completed as recommended by the facility's qualified electrical contractor.
* Variable-frequency drives and power cables are adequately grounded and shielded. [IF APPLICABLE]
* Qualified employees and/or contractors have
- secure, remote access to the ammonia-refrigeration controls that allow at least shutting off compressors, pumps, and/or refrigeration to equipment (stopping liquid and hot gas flows to equipment, and so, in effect, initiating a pump down to suction pressure),
> protected by both passwords and two-step authentication (something you know, something you have).
[OPTION] * For changes to controls that could pose hazards, such as reducing defrost pump-down times, controls
[OPTION] - send notifications to mobile phones or similar.
[VERIFY ABOVE]

Safeguard name:
Controls automate ammonia-refrigeration operations adequately, considering procedures, staffing, and training.

Hierarchy of controls/safeguard type:
Engineering: Improves Instrumentation, Controls, or Machinery Reliability

Safeguard description:
* For the facility's ammonia-refrigeration system, this includes
- adjusting for refrigeration load changes, such as production partial or full shutdowns [OTHERWISE NEED LOW-LOAD BEGIN AND END PROCEDURE (AKA FRIDAY SHUTDOWN AND MONDAY RESTART PROCEDURE) OR SIMILAR, IN THE SAFE-WORK PRACTICES... SAFEGUARD],
- unloading compressors before they start,
- shutting down safely if there is:
> a partial or full electrical-power loss, such as a circuit breaker trips or a power outage affects the entire facility,
> inadequate cooling for the condensers,
> inadequate cooling for the compressors.
* Controls record trends charts and histories, except for the following, for which hand-written logs are kept,
- automatic-purger counts,
- high-pressure receiver levels,
- transfer-system counts,
- [LIST ANY OTHERS].
* See also the safeguards, including automated shutoffs, for:
- compressors, ammonia-refrigerant, and
- pumps, ammonia-refrigerant [IF APPLICABLE].

Safeguard name:
Crash, derailment, avalanche/debris flow/landslide/mudslide, flood, salinity/sea spray, sand or dust storm, tsunami, volcano, and wildfire risks are reasonable.

Hierarchy of controls/safeguard type:
Engineering: Greater Separation

Safeguard description:
The facility's ammonia-refrigeration system is:
* [________________] miles away from the nearest airport,
* [________________] feet away from the nearest railroad track, besides low-speed spurs,
* adequately protected from vehicle traffic by barriers or distance,
* not located in an area with avalanche/debris flow/landslide/mudslide hazards [OR DESCRIBE HAZARDS AND PROTECTION/MITIGATION],
* not located in a floodplain, 0.2% or higher annual risk [OR COMPARE TO 0.2% OR 1% ANNUAL-RISK FLOOD ELEVATION, DESCRIBE PROTECTION/MITIGATION AS NEEDED],
* not located in an area with salinity/sea spray hazards, such as increased corrosion, including to steel inside reinforced concrete [OR DESCRIBE HAZARDS AND PROTECTION/MITIGATION],
* not located in an area with sand or dust storm hazards [OR DESCRIBE HAZARDS AND PROTECTION/MITIGATION],
* not located in an area with tsunami hazards [OR DESCRIBE HAZARDS AND PROTECTION/MITIGATION],
* not located in an area with volcano hazards [OR DESCRIBE HAZARDS AND PROTECTION/MITIGATION],
* not located in an area with wildfire hazards [OR DESCRIBE HAZARDS AND PROTECTION/MITIGATION].

Safeguard name:
Defrost, hot gas, is built and controlled adequately to handle a reasonable range of circumstances. [APPLICABLE?]

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
The facility's ammonia-refrigeration system has the following in place.
* Hot-gas defrost (HGD) piping pitches to
- a liquid drainer,
- high-stage discharge (HSD) piping that evaporates any condensed liquid or carries it to condensers without causing vapor propelled liquid slugs, such as because the continuous gas flow in the HSD piping is much greater than any condensed-liquid flow entering from HGD piping,
- or another safe location.
* Rules of thumb that are followed:
- soft start of hot-gas defrost (soft gas) is needed if the hot-gas solenoid valve is 1.5-inch (nominal size) or larger or if the evaporating temperature is below zero Fahrenheit (0 F),
- suction control valve slow-opening or bleed-by is needed if suction control valves are 2.5-inch (nominal size) or larger or if the evaporator coil is 15 tons refrigeration (TR) or larger, and
- each forced-air evaporator above 1 TR is served by a separate valve group, which includes the liquid, suction, and hot-gas control valves.
* Defrost, hot gas, includes adequately gradual and long delay and/or pump-down times (optionally lengthened by interlocked pressure transducers), both before and after defrost:
- the before-defrost pump-down time is adequate to remove liquid ammonia from the evaporator coil and piping that hot gas will enter, avoiding shocks, such as from:
> vapor-propelled liquid slugs and condensation-induced shock,
- the after-defrost delay and/or pump-down time (also called equalize or bleed time) is adequately gradual and long to avoid excessive shocks in both:
> the suction piping downstream of the suction control valve, when it opens or regulates at a lower pressure, and
> the evaporator coil and piping, when liquid ammonia-refrigerant enters them to restart cooling.
* Metal fatigue due to rapid temperature changes is also reduced by both of the above pump-down times.
* The before-defrost pump-down time is also long enough to remove all liquid ammonia under reasonable worst-case scenarios, based on operating experience or by assuming the evaporator coil may be mostly full of liquid due to a low load, maybe because the coil was heavily frosted up before defrost due to higher than usual humidity in the cooled air.
* There is no incentive to unsafely reduce pump-down times because doing so would not increase production [OR DESCRIBE PASSWORDS OR OTHER CONTROLS THAT PREVENT REDUCING PUMP-DOWN TIMES] and the current timing has worked well since at least [__YEAR__] [OR DESCRIBE TESTING THAT WAS DONE TO VERIFY THE PUMP-DOWN TIMES].
* At the start and end of a power outage or blip, shutoff and restart occur safely regardless of the state an evaporator was in when the power failed, for example:
- if a suction control valve automatically opens (or regulates at a lower pressure) when power fails during defrost,
> excessive shocks won't occur,
> any needed slow-opening or bleed-by function adequately when the power fails,
- for all types of suction control valves, there is adequate
> pump-down to suction pressure after power is restored, before control valves allow either liquid or hot gas into evaporators [NEEDS DEPEND ON IF CONTROLS RETAIN MEMORY OF EVAPORATOR STATE BEFORE POWER OUTAGE],
> freeze on (also called rechill) before fans start, as needed to prevent water droplets from blowing onto people, product, etc.,
> staggering of valve openings, to avoid excessive flows in piping headers or to vessels,
* If run-time clocks are reset by a power outage or blip, controls stagger them on restart so that needed defrosting happens soon but all evaporators do not defrost at once.

Safeguard name:
Defrost, water, is built and controlled adequately to handle a reasonable range of circumstances. [APPLICABLE?]

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
[DESCRIBE ANY WATER DEFROSTING, AUTOMATED OR ROUTINELY DONE, ON THE AMMONIA-REFRIGERATION SYSTEM.]

Safeguard name:
Electrical, chemical, fuel, and mechanical equipment or materials that could damage the ammonia-refrigeration system are adequately built, located, inspected, tested, and maintained.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
The PHA team only did a limited check for failures that could affect the ammonia-refrigeration system, including the following.
[START EXAMPLES]
* Boiler, flammable gas, or steam explosions. See also the fire, insurance, and other inspection, testing, and maintenance on these systems.
* Fire reasonably likely to be more severe than pressure-relief design scenarios due to any the following located near -- or in the same room as -- ammonia-refrigeration pressure vessels:
- combustible or flammable liquid piping or storage or
- electrical transformers containing oil.
* Stacks, such a for boilers and or relief vents, falling on ammonia-refrigeration equipment or piping.
[END EXAMPLES]
[DETAIL ANY APPLICABLE EXISTING SAFEGUARDS OR ADD RECOMMENDED ACTIONS.]
[START EXAMPLES]
The safety of other mechanical systems at the facility, including controls, ducts, equipment, piping, or power supplies for boilers, compressed air, heating, combustible or flammable gases or liquids (oil, natural gas...), non-ammonia refrigeration and air conditioning, steam, ventilation, or water,
- is reasonably demonstrated by their as-built documentation and inspection, testing, and maintenance records.
[END EXAMPLES]
* See also the safeguard on:
- Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, mechanical, and lockout-tagout.

Safeguard name:
Emergency-action plan, equipment, and training, for employees and contractors, are adequate and increase awareness.

Hierarchy of controls/safeguard type:
Administrative

Safeguard description:
The written emergency-action plan, or documents it references, describe:
* training that includes
- ammonia and safety awareness, covering
> where used at the facility and
> how to recognize a leak,
- "what to do if I smell ammonia or notice other hazards", including
> notifying supervisors or facility contacts and
> moving to safety if needed,
- typical exit routes and gathering places,
- when working in a mechanical penthouse, on roof, or elsewhere people rarely go
> bringing a mobile phone or other communication device,
> checking in with a facility contact before the work and reasonably often for longer work,
- extra training for people with special roles, including
> assessing and communicating routes to safe gathering places, either outside or inside (shelter-in-place),
> calling in needed resources, and
> head count,
* evacuation routes and gathering places intended to minimize risks from leaks, fires, smoke, vehicle traffic, and other known potential hazards, considering prevailing winds and the location of these hazards,
* leak mitigation and emergency shutdown, [SEE SAMPLE COMPLIANCE PRACTICE AND HAZARDOUS-SUBSTANCE PROCEDURE]
* small-leak notifications, investigation, and actions, [SEE SAMPLE COMPLIANCE PRACTICE AND HAZARDOUS-SUBSTANCE PROCEDURE, AND
- IF LIQUIDS ARE COOLED BY THE AMMONIA-REFRIGERATION SYSTEM, ENSURE THE SMALL-LEAK PROCEDURE (OR SIMILAR) WARNS AGAINST AND DESCRIBES HOW TO AVOID TRAPPING AMMONIA IN LOWER-PRESSURE LIQUID PIPING INTO WHICH AMMONIA LEAKED] (to avoid incidents like described in the 2018 Technical Safety BC report about the 2017 Fernie, British Columbia, incident),
* visitor and contractor access control, including
- sign-in/sign-out log(s),
- a facility employee attends visitors and contractors who have not been adequately trained on the facility's emergency-action plan.
[VERIFY ABOVE, SEE THE "Emergency Action Plan" COMPLIANCE PRACTICE IN THE PSM-CAP APP FOR A MORE COMPREHENSIVE LIST.]
* See also the safeguard on:
- fire-safety systems and means of egress.

Safeguard name:
Emergency-response capabilities and coordination are adequate, considering off-site populations and potential incidents.

Hierarchy of controls/safeguard type:
Administrative

Safeguard description:
* For the facility:
[SUMMARIZE, IF ANY, EMERGENCY-RESPONSE CAPABILITIES OF:
- OWNER/OPERATOR EMPLOYEES ROUTINELY AT THE FACILITY,
- AN AMMONIA-REFRIGERATION CONTRACTOR, WHO ROUTINELY SERVICES THE AMMONIA-REFRIGERATION SYSTEM,
- OTHER CONTRACTED EMERGENCY RESPONDERS, AND/OR
- COMMUNITY RESPONDERS, SOMETIMES THE LOCAL FIRE DEPARTMENT OR A HAZMAT TEAM THEY CAN CALL IN.
[IF TRUE ADD:]
* 911 [OR LIST OTHER PHONE NUMBER] can be dialed from the facility to alert local police and fire departments.
* The facility Owner/Operator makes efforts year each to ensure both its emergency plans and community emergency plans, covering the facility, are adequate and up to date.
* Other facilities near the facility use ammonia refrigeration, which helps ensure community preparedness.

Safeguard name:
Equipment and piping -- including valves, vessels, and supports -- are all suitable for their ammonia-refrigeration service.

Hierarchy of controls/safeguard type:
Engineering: Improves Primary-Containment Envelope

Safeguard description:
* The facility's ammonia-refrigeration system was built per [CODE CITATIONS, IF ANY, FOR FIRST INSTALL AND ALL ADDITIONS -- THIS MAY NOT BE KNOWN, IN THAT CASE, MORE DETAIL IS NEEDED HERE].
* Buildings or structures that serve as supports for the ammonia-refrigeration system were built per [CODE CITATIONS, IF ANY, FOR FIRST INSTALL AND ALL ADDITIONS -- THIS MAY NOT BE KNOWN, IN THAT CASE, MORE DETAIL IS NEEDED HERE.]
* Since [YEAR] the facility's PSM program, management of change, has included a design review, also called engineering review.
* All equipment in the ammonia-refrigeration system was supplied by reputable manufacturers, including
- [REFERENCE A COMPONENT LIST, CHANGE-MANAGEMENT DOCUMENTATION, OR LIST FOR AT LEAST MAJOR PACKAGES: COMPRESSORS, PUMPS, VESSELS...]
* In the facility's ammonia-refrigeration system:
- all valves have stainless-steel stems, including control-valve manual-opening stems,
- control valves do not trap liquid ammonia if controls fail or there is a power outage because
> the solenoid valves and regulators allow flow in the reverse direction,
> no motorized valves are located upstream of solenoid valves,
> no ammonia-refrigerant pumps are located upstream of solenoid valves or motorized valves, including on piping for liquid-injection cooling, unless appropriate safeguards are in place, such as minimum-flow bypass or pressure relief for the pump discharge,
- control valves, including the automatic King valve, have adequate safeguards to avoid shocks when they open, such as due to their small size, downstream hand-expansion valves, pilot valves, pressure equalization, or slow opening [PROVIDE DETAILS ON THE AUTO-KING VALVE, IF ONE IS INSTALLED],
- equipment, piping, and supports are built to withstand reasonably anticipated temperature changes or environmental conditions, including
> the resulting thermal contraction and expansion,
> low-temperature modeling documents this, if needed,
- gas-flow speeds in vessels, at their maximum operating level, are slow enough for adequate gas-liquid separation where needed, such as in vessels that feed compressors (accumulators, recirculators, suction traps...) and so
> prevent liquid droplets, entrained in gas, from reaching compressor suction inlets,
- interior erosion of the steel primary-containment envelope is negligible because
> flow speeds in ammonia-refrigerant piping are below erosional speeds and
> pressure-vessel inlets are built to avoid erosional impingement against the interior of the vessel's walls,
- suction piping, which often carries some ammonia-refrigerant liquid, along with lower pressure gas, is built so that this liquid safely flows to gas-liquid separation vessels (accumulators, recirculators, suction traps...),
> preferably this is done by pitching the suction piping so it drains liquid by gravity, over its entire length from the outlets of cooling or heating equipment (evaporators or condensers) to a gas-liquid separation vessel,
> otherwise this is done by ensuring that gas flows cause safe liquid flows, under all anticipated conditions, in suction piping that does not drain by gravity,
- [IF APPLICABLE] on the [TYPE] chillers, preventing corrosion by the cooled liquid, fatigue by different steel types expanding differently, and brittle fracture are accomplished by
> [REVIEW MATERIALS OF PLATES OR TUBES AND TUBE SHEETS FOR THESE FAILURES, CONSIDER
(1) LIQUID IN CONTACT WITH PLATES OR TUBES
(2) FATIGUE AND BRITTLE FRACTURE, ESPECIALLY WITH TUBE-IN-SHELL CHILLERS
(2.1) THICKNESS OF TUBE SHEETS
(2.2) IF CARBON STEEL, IS IT NORMALIZED,
(2.3) ANY POST-WELD HEAT TREATMENT,
(2.4) ANY EXPANSION JOINTS,
AND SO ON.]

Safeguard name:
Fire-safety systems and means of egress are adequately built, located, inspected, tested, and maintained.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
* At the facility, this includes inspection, testing, and maintenance of, properly built and located:
- emergency communications, such a loud-speaker system or radios with adequate coverage,
- heat, smoke, and fire sensor and alarm systems,
- fire extinguishers,
- fire sprinkler systems,
- means of egress, including inspections for blocked exit doors,
- wind indicators,
- and so forth.
* Fire inspectors, with local authorities, routinely inspect the facility.

Safeguard name:
Inspection, testing, and maintenance (ITM) of the ammonia-refrigeration system, its safety systems, and its supports are adequate.

Hierarchy of controls/safeguard type:
Administrative

Safeguard description:
[COMPARE ITM SCHEDULES AND PROCEDURES TO sample_ammonia-refrigeration_ITM... FILE POSTED AT https://factplusfancy.com/armp OR TO IIAR 6.]
This ITM includes, at least the following.
* Daily inspection of
- refrigerating-machinery room(s),
- condensers, at least viewed from within 100-feet,
- condenser water treatment, unless its automation allows a reduced frequency,
- any ammonia-refrigerant pumps outside the refrigerating-machinery room,
- [DESCRIBE ANYTHING REQUIRING DAILY INSPECTION THAT'S NOT IN A REFRIGERATING-MACHINERY ROOM], and
* weekly inspection of
- condensers from within about 10 feet of all sides of their enclosure, and
- all other ammonia-refrigeration equipment and piping.
* Daily to weekly inspections check all areas with ammonia-refrigeration equipment or piping for:
- access to, egress from, lighting in, housekeeping of, heat or cold unsafe for people or equipment in, or other hazards in everywhere inspected,
> moving to safety and reporting any access, egress, or other safety concerns before proceeding,
- ice or frost build-ups,
- leaks of ammonia, oil, water, or other fluids that the inspector could see, smell, or hear,
- odd noises, shaking, or vibrations,
> which can have many causes, including hand-expansion valves that are too many turns open, or
- anything else unusual the inspector notices.
* Automatic-purger and transfer-system counts [ARE LOGGED DAILY UNLESS LOGGED BY CONTROLS.]
* Liquids that are cooled or heated are tested and treated as needed based on operating experience, quality standards, chemical-supplier recommendations, or equipment-manufacturer recommendations (for example, for glycol, the freeze-point, via refractive index or specific gravity, pH, any corrosion inhibitors, and any biocides.)
* Oil and vibration analysis, including for compressors and their motors, based on manufacturer recommendations or documented operating experience.
* Yearly ITM on:
- condenser(s), per manufacturer recommendations,
- clean-in-place and hot-gas defrost -- inspecting equipment and piping while they go through one complete cleaning or defrost cycle, from when refrigeration shuts off (liquid ammonia control valve closes) to when equipment has cooled down after refrigeration restarts,
- insulation and paint on ammonia-refrigeration equipment, piping, and supports -- visual inspection and properly repairing as needed,
- safety shutoffs for rotating-electrical equipment, such as compressors, fans (if applicable), and pumps,
- safety systems, such as alarms, ammonia-in-air sensors, ventilation, and safety showers,
- supports, covering from the equipment enclosure or pipe to the foundation, if independently supported, or to the building-structural supports, floor, or roof that carry the loads, and if building structures, floors, or roofs are damaged, additional inspections are called for.
* Valve stems, including for control-valve manual opening, are lubricated and exercised per manufacturers recommendations or industry practice. [PROVIDE DETAILS ON WHAT THE FACILITY DOES.]
* See also the facility's maintenance-management system.

Safeguard name:
Labeling of equipment, pipes, and valves is adequate, inspected at least yearly, and maintained as needed.

Hierarchy of controls/safeguard type:
Administrative

Safeguard description:
* See the facility's maintenance-management system.
* [PROVIDE DETAILS, SUCH AS THE EDITION OF IIAR BULLETIN 114 OR OTHER LABELING SYSTEM FOLLOWED FOR THE FACILITY'S AMMONIA-REFRIGERATION SYSTEM.]
* [THE ADEQUACY OF LABELING MAY DEPEND ON CONTEXT, SUCH AS OTHER PIPING NEARBY, AND ADMINISTRATIVE CONTROLS, SUCH AS PRE-WORK TAGGING CALLED FOR BY SYSTEM-OPENING PERMITS, AT THE FACILITY.]

Safeguard name:
Leak detection includes ammonia-in-air sensors that trigger alarms and other actions.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
* See existing safeguards about the refrigerating-machinery room and its safety systems.
[DESCRIBE ANY AMMONIA-IN-AIR SENSORS OUTSIDE OF REFRIGERATING-MACHINERY ROOMS AND THE ACTIONS THEY TRIGGER, INCLUDING COMMUNICATING ALARMS TO PERSONNEL QUALIFIED TO MUSTER...],
START EXAMPLES WHICH MAY BE OPTIONAL:
* In addition, ammonia-in-air sensors in:
- the outlet air of all air-handling units (AHU) with ammonia refrigeration (LIST)
> trigger alarms [DESCRIBE] and shutoff the AHU when ammonia is detected.
- in coolers and freezers [LIST]
> trigger alarms [DESCRIBE] and [DESCRIBE ANY SHUTOFFS OF LIQUID OR HOT-GAS SOLENOID VALVES]
* PROVIDE DETAILS, SUCH AS HOW SENSORS ARE LOCATED TO BE LIKELY TO DETECT LEAKS.]
END EXAMPLES]
* ppm means parts per million by volume, ammonia concentration in air.

Safeguard name:
Metal-fatigue prevention is adequate to avoid all but small leaks.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
[SOMETIMES APPLICABLE TO:

* TUBE-IN-SHELL HEAT EXCHANGERS SUBJECT TO TEMPERATURE CYCLES OR WITH DIFFERENT MATERIALS FOR TUBE AND TUBESHEET.
SAFEGUARDS MAY INCLUDE:
- USE A WELDED-PLATE OR PLATE-IN-SHELL HEAT EXCHANGER -- IF STRESSES IN THEM WOULD BE LOWER OR WITHIN ACCEPTABLE RANGES.
- EXPANSION JOINTS -- PROPERLY BUILT, INSTALLED, AND MAINTAINED (ONE END OF STAND ALLOWS MOVEMENT, GREASED...)
- INSPECTION FOR CRACKS NEAR TUBE TO TUBESHEET WELDS, ESPECIALLY DURING REPAIRS.
- RATE OR AMOUNT OF TEMPERATURE CHANGE KEEPS STRESSES LOW ENOUGH THAT THE NUMBER OF ALLOWED CYCLES, PER S-N CURVE, IS NOT EXPECTED TO OCCUR WITHIN PLANNED LIFE OF THE EQUIPMENT.
- DEMONSTRATING THAT CATASTROPHIC FAILURE IS UNLIKELY BEFORE WARNING FROM A SMALL LEAK.

* COILS THAT ARE CLEANED OR DEFROSTED WITH WATER OR SIMILAR.
SAFEGUARDS MAY INCLUDE:
- RATE OR AMOUNT OF TEMPERATURE CHANGE KEEPS STRESSES LOW ENOUGH THAT THE NUMBER OF ALLOWED CYCLES, PER S-N CURVE, IS NOT EXPECTED TO OCCUR WITHIN PLANNED LIFE OF THE EQUIPMENT.]

Safeguard name:
Oil-draining equipment and piping are adequately built, located, inspected, tested, and maintained.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
In the facility's ammonia-refrigeration system,
* self-closing valves are installed on all oil-draining outlets to the atmosphere (oil drains), including
- permanently at all locations from which oils is drained more that once per year,
- at all oil drains from oil pots, and
- temporarily when oil is drained from locations without a permanently installed self-closing valve, following a system-opening permit;
* oil pots all have
- a gas pocket that fills their upper portion (a head space) where their pressure-relief nozzle (an inlet to the pressure-relief system) is located, such as
> because the liquid level in the oil pot does not rise above its vent-piping inlet,
> making liquid less likely to reach their pressure-relief valves, built for only gas flow, and the relief-vent (RV) piping;
- a 300 pounds per square inch (PSI) maximum allowable working pressure (MAWP) and pressure-relief valves with 300 PSI opening pressures, which is at least 50 PSI higher than the set points of the pressure-relief devices for the vessel that the oil pot serves, so
> the oil-pot pressure-relief valves should remain closed unless the pot is valved off (isolated), and so
> liquid from the vessel that the oil pot serves is unlikely to enter the RV piping via the oil pot's pressure-relief valve, even during a fire.
[VERIFY ALL THE ABOVE AND AS NEEDED DETAIL WHICH OIL POTS HAVE THESE SAFEGUARDS.]

Safeguard name:
Open flames and over 800 F surfaces, reasonable separation from where an ammonia leak may cause a flammable atmosphere.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
* None of these are normally inside the
- refrigerating-machinery room,
- coolers,
- freezers,
- production areas cooled by ammonia refrigeration.
* The following have combustion air supplied from where a flammable atmosphere due to an ammonia leak is reasonably unlikely
- air-handling units with gas heat,
- boilers
- other space heaters. [ANY?]
[VERIFY ABOVE]
- [DESCRIBE AND ASSESS OTHER AREAS WHERE A RAPID AMMONIA LEAK MAY OCCUR.]

Safeguard name:
Piping systems that ammonia refrigerant could leak into have adequate means to relieve any resulting overpressure.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
* Adequate means to relieve overpressure includes piping systems that are:
- protected by pressure-relief devices (sometimes on expansion tanks) that discharge to a safe location,
- normally open to the atmosphere with procedures and training that warn against closing valves that would isolate portions of the piping systems from the atmosphere,
> without first ensuring that ammonia refrigerant cannot leak into the isolated portions of the piping systems,
> such as by pumping down, isolating, and venting the ammonia-refrigerant side of heat exchangers.
* Piping systems may include tanks and other vessels.
* The above precautions are not needed if an air gap, or equivalent, separates a piping system from the ammonia refrigerant,
- such as tanks and silos with ammonia cooling jackets.

Safeguard name:
Post-weld heat treatment (PWHT) was done to vessels where stress-corrosion cracking (SCC) is rare but more likely to occur.

Hierarchy of controls/safeguard type:
Engineering: Improves Primary-Containment Envelope

Safeguard description:
Pressure vessels that received PWHT, in the facility's ammonia-refrigeration system, per their nameplates and manufacturer data reports, [OR DETAIL THE SOURCE OF THIS INFORMATION] include,
* all vessels exposed to hot gas without lots of lubricating oil, where SCC is rare:
[OFTEN THIS INCLUDES, DETAIL HERE]
- high-pressure receiver [P&ID LABEL],
- thermosiphon receiver [P&ID LABEL], and
- transfer-system vessel [P&ID LABEL],
- [ANY SURGE DRUMS OR OTHER VESSELS ROUTINELY EXPOSED TO HOT GAS, FOR DEFROST...]
* some suction side vessels without lots of lubricating oil, where SCC is very rare:
- [LIST ANY SUCTION VESSELS THAT RECEIVED PWHT].

Safeguard name:
Pressure-relief systems are adequately built, located, inspected, tested, and maintained.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
For/in the facility's ammonia-refrigeration system,
* design code -- pressure-relief systems are built per [CITE CODE AND EDITION -- DETAIL IF MULTIPLE INSTALLS PER DIFFERENT CODES OR EDITIONS].
- see [REFERENCE THE AS-BUILT DOCUMENTATION];
* discharge safety -- the relief-vent (RV) piping outlets to the atmosphere (potential ammonia-discharge locations) are reasonably safe, including
- at least 20 feet (6.1 m) in any direction from air intakes or building openings, such as doors or sometimes-opened windows,
- either at least 20 feet (6.1 m) horizontally from or at least 7.25 feet (2.2 m) above walking-working surfaces, such as catwalks, ladders, most roofs, and the tops of condensers,
- at least 15 feet (4.6 m) above grade, such as surfaces where vehicles may drive,
- not directed towards where people may be walking or working -- best if vertically upward, such as with a tractor cap (IIAR 9-2020 7.2.2.1, 7.4.1, 7.4.2, and 7.4.3),
* serviceability and weeping (slow leak by the valve seat):
- three-way valves with dual pressure-relief valves (in-service and standby) protect all pressure vessels that cannot be removed from service safely and without excessively disrupting facility operations,
> removing from service often includes pump down until any liquid ammonia is fully removed, isolating, and if needed venting the remaining ammonia gas safely, such as into an adequate amount of water that is disposed of safely,
> if the in-service pressure-relief valve is weeping, when installed on a three-way valve, the three-way-valve stem can be turned to isolate the weeping valve while putting the backup pressure-relief valve into service, and
- identifying weeping pressure-relief valves and properly operating three-way valves, if present, or otherwise removing vessels from service are described in writing in [NAME OF PROCEDURE, SUCH AS A SMALL LEAK PROCEDURE, WHICH REFERENCES VESSEL REMOVAL FROM SERVICE PROCEDURE(S)];
* water-condensation prevention -- the RV piping is not located in refrigerated or cooled spaces, where water might condense in it, instead it is only located in:
- the refrigerating-machinery room(s), which is typically warm and above the dew point outside,
- outdoors, mostly above the roof. [DESCRIBE ANY OTHER OUTDOOR LOCATIONS]
* water-entry prevention -- the RV piping outlets to the atmosphere reasonably prevent moisture entry, such as by a tractor cap,
* water draining -- the RV piping has provisions for safely collecting and draining any water the enters or condenses in it;
* maintenance -- the maintenance-management system schedules and documents:
- replacement of each pressure-relief valve within five years of its installation date (IIAR 6-2020 13.1.1)
> excepting pressure-relief valves that discharge back into the refrigeration system (IIAR 6-2020 13.1.4 and August 24, 2020, IIAR Interpretation SC 2020-2), and
- draining water from the RV piping, as needed,
* screw-compressor oil-cooler, oil-side pressure relief, is provided as part of each screw compressor package and discharges safely back into that compressor package, typically to its oil separator.

Safeguard name:
Production monitoring and quality control.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
At the facility, this includes monitoring
* temperatures of
- air, in [LIST, SUCH AS RAW MATERIAL AND PRODUCT COOLERS OR FREEZERS AND PRODUCTION ROOMS],
- [LIST ANY FLUIDS, LIKE BRINE, GLYCOL, OR WATER],
- product, and
* chemistry of [LIST ANY FLUIDS], which might discover an ammonia leak into these fluids:
- by noticing an ammonia odor when near or sampling the fluid or
- by chemistry changes.

Safeguard name:
Pump safety shutoffs are adequate, for both ammonia and cooling-water pumps, including for their motors.

Hierarchy of controls/safeguard type:
Engineering: Improves Instrumentation, Controls, or Machinery Reliability

Safeguard description:
For all pumps that serve the ammonia-refrigeration system at the facility [OR DESCRIBE IF COOLING WATER OR OTHER PUMPS HAVE DIFFERENT SHUTOFFS, CONSIDER ANY TRANSFER OR LIQUID-INJECTION COOLING PUMPS], electrical power to the pump motor is shut off if the:
* level is too low in the vessel that feeds the pump, to avoid:
- low pump-suction pressure and cavitation in the pump, near its impeller,
* electrical current flow (amps) to pump motors is too high (circuit breaker or fuse),
* oil-supply inadequate for seal where the shaft from the motor enters the pump housing, such as in the oil reservoir for this seal [IF APPLICABLE, DESCRIBE WHICH PUMPS HAVE THIS],
* temperature in pump motors is too high (thermal protection) [ASSESS IF PRESENT OR NEEDED],
* [VIBRATION SENSORS, IF ANY DESCRIBE WHERE].

Safeguard name:
Pumps, ammonia-refrigerant, and their piping are adequately built, controlled, located, inspected, tested, and maintained.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
In the facility's ammonia-refrigeration system, this includes:
* adequate piping for
- cooling and venting the pump housing or volute,
- minimum-flow bypass,
- pressure relief between check valves and downstream stop valves, unless handled by administrative controls,
* a nipple or other means to safely vent ammonia refrigerant between check valves and downstream stop valves,
* adequate net positive suction head, due to an adequate elevation difference between the liquid level in the vessel that feeds the pump and the pump impeller as well as adequately sized inlet (suction) piping.

Safeguard name:
Purging non-condensable gases is done effectively.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
In the facility's ammonia-refrigeration system,
* an automatic purger is properly installed, operated, monitored, inspected, and maintained;
* manual purging is not done. [VERIFY AND REVISE AS NEEDED.]
Notes:
* Air can only enter the facility's closed-circuit refrigeration system when it is opened for maintenance because all portions of it normally remain above atmospheric pressure. [DELETE THIS BULLET POINT IF OPERATING AT A VACUUM.]
* Here, non-condensable gases means gases that neither dissolve in ammonia nor condense to a liquid under the temperature and pressure conditions in the ammonia-refrigerant condenser(s). Water is very soluble in ammonia, but other components of air mostly are not.
* Manual purging typically involves opening stop valves, on nipples, on the condenser outlet piping and venting ammonia gas, containing higher concentrations of non-condensable gases (foul gas), into a bucket of water, or similar.

Safeguard name:
Reciprocating compressors are more tolerant of liquid-ammonia refrigerant than screw compressors.

Hierarchy of controls/safeguard type:
Engineering: Improves Primary-Containment Envelope

Safeguard description:
* This includes:
- liquid in compressor suction (slugging) or
- liquid in a compressor when it starts, due to condensation, while off, in the compressor or near the compressor that drained into it.
* This is due to the safety heads on reciprocating-compressor cylinders, which can lift and allow liquid to exit the cylinders.
* If a screw compressor tries to compress liquid, particularly while rotating quickly, it is more likely to,
- have severe internal damage, to bearings and screws,
- seal leaks, and
- possibly, but rarely, a crack or rupture of its housing, causing a rapid oil and ammonia leak.

Safeguard name:
Refrigerating-machinery room and its safety systems are adequately built, controlled, located, inspected, tested, and maintained.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
Taking into account that some ammonia leaks, either inside or outside the refrigerating-machinery room (the room) for the facility's ammonia-refrigeration system, cannot practically be controlled by the room's safety systems and so would require incident-specific evacuation or shelter-in-place -- the room:
* was built per [CODE CITATION, IF ANY],
* is adjacent to [DESCRIBE SURROUNDINGS],
* has some explosion venting provided by ventilation inlets and outlets and by its roof, which are reasonably safely located for this,
* has adequate access and egress, including
- clear heights and aisles between equipment and piping,
- that complies with the applicable building code, if any (otherwise in refrigerating-machinery rooms, without automatic sprinkler systems [unsprinklered], building-code requirements often include a maximum 75-foot "common path of egress travel", which is "that portion of exit access travel distance measured from the most remote point of each room, area or space to that point where the occupants have separate and distinct access to two exits or exit access doorways", so if a unsprinklered refrigerating-machinery room had only one exit or exit access doorway, no part of that room should be further than 75-feet from that doorway, and if such a room had more than one exit or exit access doorway, there should be neither blind aisles nor alcoves more than 75 feet deep without an exit or exit access doorway, see for example International Building Code 2018, Chapter 10, specifically Section 1006),
- no part of the room is further than 150-feet from an exit or exit access doorway, unless permitted by the building code,
- if the room's floor area is greater than 1,000 square feet, it has more than one exit or exit access doorway horizontally separated by more than half of the room's maximum horizontal dimension (one may be accessed by a fixed ladder or alternating-tread device),
- each exit or exit access doorway is equipped with panic hardware and swings open in the direction of egress travel,
- fire rating of doors is
> same as exterior wall, if to outside, or
> 1-hour, if to inside and the room is unsprinklered (IIAR 2-2021, 5.16.6 and 6.10; IIAR 9-2020 7.3.3 and 7.3.9), and
- the room is kept tidy and its floors are not slippery, such as due to oil spills or similar,
* has neither open flames nor surfaces greater than 800 F (427 C) in the room, except:
- fuel-burning appliances that
> are shutoff by a sensor upon detection of ammonia at the concentration that starts the emergency ventilation or
> have a sealed combustion chamber reliably fed by air from outside the room that is reasonably unlikely to contain ammonia during a leak and
- matches and sulfur sticks used to detect leaks if any ongoing oil or ammonia draining or charging has been stopped once the leak started (IIAR 9-2020 7.3.5),
* has access to safety showers and eye/face washes, built and maintained following ANSI/ISEA Z358.1, including
- one inside the room,
- one outside the room and a maximum 10-second travel time (typically 55 feet) from its door, and
- additional as needed for a maximum 10-second travel time (typically 55 feet), without doors or other obstructions in the travel path, from all walking-working surfaces in the room to the safety shower and eye/face wash (IIAR 9-2020 7.3.7),
* has floor drains or equivalent as needed to keep the floor reasonably free of water, with engineered or administrative means for handling oil or other liquid spills (IIAR 9-2020 7.3.8),
* has at least one tamper-resistant, off-only, ammonia-refrigeration emergency-stop switch/button (E-stop), located near the room and where reasonably likely to remain safe and accessible during ammonia releases, and which shuts off the electrical-power supply to
- all ammonia-refrigeration system
> compressors,
> pumps, and
> normally-closed control valves that are not part of an emergency-control system, such as solenoid valves for liquid and hot-gas supply, and
- all other electrically powered equipment in the refrigerating-machinery room that could serve as an ignition source, such as water and chemical feed pumps, but
- it doesn't shut off safety systems, such as ammonia-in-air sensors and alarms, emergency lighting, and emergency ventilation, which are built to have a low likelihood of creating an ignition source,
[VERIFY ABOVE AND DETAIL ANY E-STOP BUTTONS FOR ONLY PORTIONS OF THE REFRIGERATION SYSTEM.]
* has ammonia sensor(s) in the room,
- sampling where ammonia concentrations could likely be highest (so not near fresh-air inlets),
- in enough locations, considering the size of the room,
- accessible for inspection, testing, and maintenance (ITM),
- connected to detectors and alarm systems adequate to, at or below the following parts per million by volume, ammonia concentrations in air (ppm)
no ppm signal, such as due to a malfunction or a power loss on the dedicated-branch electrical circuit for these systems -- notify Owner/Operator representatives qualified to muster assistance in emergencies and likely to be reachable on holidays and off hours (so alarms in an always-attended location or the alarm system can call out to multiple people's phones or a reliable answering service with a call list),
25 ppm -- activate audible (15 decibels above average-ambient and 5 decibels above expected maximum-ambient sound pressure) and visible alarms in the room and outside its doors (automatic reset allowed once concentration falls below 25 ppm),
50 ppm (preferably 25 ppm) -- notify Owner/Operator representatives, similarly to "no ppm signal" above,
1000 ppm (preferably no higher than 150 ppm, which is half the immediately dangerous to life or health, IDLH, concentration) -- activate the room's emergency ventilation (manual reset required), and
40,000 ppm (preferably no higher than 15,000 ppm, which is approximately one tenth, 10%, of the lower flammability limit, LFL, of ammonia in dry air, but mixtures of ammonia gas and lubricating-oil mists are more flammable than ammonia alone) -- trigger the same response as the above-described E-stop (manual reset required) (IIAR 2-2021 6.13 and IIAR 9-2020 7.3.12),
* is well sealed, so that
- the fire ratings of its envelop (walls, floors, ceilings, and so forth) are maintained,
- air could not flow between the room and other interior spaces, including around or inside things that penetrate its envelop, such as piping, conduits, or ducts, and access panels for ducts were gasketed and tight fitting (IIAR 9-2020 7.3.2.1, 7.3.2.5, and 7.3.6.2),
* has adequate signs outside its entrances and for its safety systems,
* has adequately safe storage of flammable and combustible materials, if any, such as
- all of these are stored in approved fire-rated storage containers (IIAR 9-2020 7.3.4),
- their quantities are kept to the minimum needed for operations and maintenance, and
- their quantities and proximity are equal to or less that what was assumed in design scenarios for all pressure-relief systems in the room or nearby,
* has emergency, occupant/normal, and temperature-control ventilation
- with air intakes located where reasonably likely to supply clean outdoor air,
- with adequate exhaust and makeup air flows,
- that sweep the room adequately and without excessive short-circuiting,
- that don't serve other rooms,
* has emergency-ventilation inlets built to avoid failing shut, such as louvers or dampers that open or unlatch on power loss,
* has any backup power and also restart after power outages built to avoid creating ignition sources in flammable atmospheres, such as ammonia sensors that turn on emergency ventilation if needed before any equipment that could create a ignition source receives backup or restored electrical power,
* has exhaust fans that all have:
- non-sparking blades, preferably Air Movement and Control Association (ACMA) Standard 99, type A or B (Spark A or B) spark-resistant construction, and
- totally-enclosed motors, unless the motor is very unlikely to get exposed to a flammable atmosphere while energized, for example outdoors and not in the exhaust-air stream or that shuts/stays off when the emergency-ventilation starts,
* has an emergency-ventilation outlet(s) that discharges
- upward [OPTION: ADD DETAILS, PER APPLICABLE CODE, SUCH AS 2,500 FEET PER MINUTE PER IIAR 2-2010 TO 2021], above the roof of the refrigerating-machinery room,
- adequately far from air intakes, doors, ladders, property boundaries, walkways, windows that are sometimes open, and work areas,
- where it is reasonably unlikely to contaminate breathing air, in excess of 150 ppm, 220 ppm, or another reasonable target -- considering any nearby higher roofs and air recirculation (swirling and eddies) on the downwind side of the building with the ventilation outlet -- in
> areas where people are routinely present or
> exit routes from normally occupied spaces,
150 ppm is the 1-hour exposure 2016 ERPG-2 (American Industrial Hygiene Association, Emergency Response Planning Guideline 2) -- the maximum airborne concentration below which nearly all people could be exposed for up to 1 hour without experiencing or developing irreversible or other serious health effects or symptoms which could impair a persons ability to take protective action.
220 ppm is both the 10 and 30-minute exposure 2017 AEGL-2 (Acute Exposure Guideline Levels, published by the U.S. EPA) -- the concentration above which it is predicted that the general population, including susceptible individuals, could experience irreversible or other serious, long-lasting adverse health effects or an impaired ability to escape.
* has an electrical-power supply for emergency ventilation, safety alarms, and emergency lighting that is not shutoff by any emergency-stop switch/button, ammonia sensors, and similar,
* has alarms on loss of power or known failure of ventilation systems that notify Owner/Operator representatives qualified to muster assistance in emergencies and likely to be reachable on holidays and off hours (so alarms in an always-attended location or the alarm system can call out to multiple people's phones or a reliable answering service with a call list), (IIAR 9-2020 7.3.13.2)
* has temperature control via thermostat [OR DESCRIBE OTHER ADEQUATE CONTROL],
* has emergency-ventilation control via manual on/auto switch and ammonia sensors,
* has an emergency-ventilation turn-on set point of 150 ppm or lower, so the concentration in the discharged air would, at least initially, typically be below the 300 ppm IDLH concentration.
* If work needs to be done near where exposure to ammonia in emergency or normal ventilation discharges could occur, appropriate precautions are taken.
For additional information see the:
* posted signs, such as near alarm lights,
* [EMERGENCY ACTION PLAN OR OTHER DOCUMENT],
* process-safety information for as-built documentation, and
* maintenance-management system for ITM scheduling, methods, and documentation.

Safeguard name:
Replacement parts for the ammonia-refrigeration system, its safety systems, and its supports, including for controls, electrical, and motors, are fit for their service.

Hierarchy of controls/safeguard type:
Administrative

Safeguard description:
Replacement parts, for the facility's ammonia-refrigeration system, are:
* parts that the original equipment manufacturer (OEM) recommends as a replacement-in-kind for the old part,
* parts recommended by the OEM or another reputable manufacturer as a substitute that meets
- the design specification of the old part and
- the service requirements for this part, but
- only if this manufacturer recommendation is confirmed by the facility's qualified ammonia-refrigeration system contractor or the responsible individual(s), per the Owner/Operator management system, or
* otherwise, change management is required to use a replacement part that does not meet the design specification for the old part.

Safeguard name:
Safe-work practices, including for confined spaces, electrical, hot work, lifts and vehicles, lockout-tagout, and mechanical.

Hierarchy of controls/safeguard type:
Administrative

Safeguard description:
The Owner/Operator has implemented policies, notifications, and training as needed at the facility for the following.
* Ammonia-refrigeration system.
- All facility employees and contractors are notified or trained that only authorized personnel can touch the ammonia-refrigeration system, including:
> controls,
> valves, or
> work of any kind.
- If opening the ammonia-refrigeration system to the atmosphere, these authorized personnel get and follow:
> applicable lockout-tagout policies and/or procedures and
> a system-opening permit (also called line-breaking permit) and/or
> a procedure for the activity that is described in writing and approved by the facility's qualified ammonia-refrigeration system contractor or the responsible individual(s), per the Owner/Operator management system, such as for routine oil draining or for tie-in of new equipment;
- the above address and, as needed, have warnings about:
> pre-work inspection for damage or other circumstances that may require stopping and modifying the procedures and work, including problems with the work location, problems with any hoses or other equipment needed for the work, or problems with or affecting the equipment or piping that need to be opened and/or worked on,
> verifying no leak-by (backflow across) check valves when compressors or pumps are shutoff, including discharge and suction check valves, as applicable,
> ammonia buildup under rarely opened seal caps, covering valve stems without hand wheels,
> packing leaks, especially when valves are moved off their fully back-seated position,
> loosening threaded bonnets when turning the stems of control or stop valves, if applicable,
> properly lubricating valve stems (but not with copper-containing anti-seize),
> not using too much force when turning valve stems or seal caps,
> trapping liquid ammonia when shutting valves,
> leaks when equipment or piping is opened to the atmosphere, such as from leak by the seat of an isolating valve, which may be addressed by monitoring pressure after isolating but before opening part of the ammonia-refrigeration system,
> shock cooling, including by venting equipment or piping that still contains liquid ammonia to the atmosphere,
> draining oil from a compressor without shutting off and locking out its oil heater,
> accidental return of hazardous energy to opened equipment or piping,
> leaks or shocks when valves are opened to put equipment back in service.
- If connecting joints (bolted, threaded, welded...) or support fasteners, these authorized personnel:
> follow applicable good practices, procedures, and manufacturer instructions, such as
> for threaded joints, clean threads and apply pipe-thread compound or equivalent, compatible with the ammonia-refrigeration system, before properly tightening.
- If disabling safety systems for maintenance, such as emergency ventilation, these authorized personnel:
> follow a procedure for the activity that is described in writing and approved by the facility's qualified ammonia-refrigeration system contractor or the responsible individual(s), per the Owner/Operator management system,
- If replacing pressure-relief valves, these authorized personnel:
> get and follow a system-opening permit (also called line-breaking permit),
> when practical, pump down to suction pressure and safely isolate equipment and piping before replacing the pressure-relief valve(s) serving that equipment and piping (except for large vessels, like the receiver and recirculator vessels, this is often practical and safe), and
> otherwise (if not practical to isolate before replacement) they (A) check that the ammonia-refrigeration system is operating properly before starting pressure-relief valve replacement, (B) have a watcher who can initiate emergency plans, including any needed and safe leak mitigation, and (C) wear appropriate personal protective equipment, considering the possibility that another pressure-relief valve opens on a shared inlet valve or shared outlet relief-vent piping or that they accidentally remove an in-service pressure-relief valve,
- After a power failure, leak, or emergency shutdown, these authorized personnel follow (or develop for Owner/Operator approval prior to restart) procedures for these that cover:
> how the ammonia-refrigeration system, including its controls, responds to power blips, outages, and power restoration (including interrupted defrosting, if applicable),
> any needed human actions during outages or upon power restoration,
> restart after shutdowns due to a high level in a vessel that feeds compressors, and
> restart after ammonia leaks or emergency shutdowns.
* Arc flash and electrical -- see the Owner/Operator's program for the facility.
* Confined spaces -- see the Owner/Operator's program for the facility.
* Hot work -- see the Owner/Operator's program for the facility.
* Lockout-tagout for control of hazardous energy -- see the Owner/Operator's program for the facility.
* Operating lifts, vehicles, or similar at the facility -- see the Owner/Operator's program(s) for the facility covering:
- powered industrial trucks (forklifts, lift trucks, and so forth),
- contractors who work or provide services at the facility,
- employees,
- truck drivers hauling loads to or from the facility, but
- not covering visitors driving into or from the visitor or nearby employee parking spaces.
* Rigging and construction work is also limited to authorized personnel by the Owner/Operator.
* Other mechanical work is also limited to authorized personnel by the Owner/Operator, including on controls, ducts, equipment, piping, or power supplies for boilers, compressed air, heating, combustible or flammable gases or liquids (oil, natural gas...), non-ammonia refrigeration and air conditioning, steam, ventilation, or water.
* Personal-protective equipment (PPE) is called for as needed in all procedures and policies described in this existing safeguard.
* Pre-work notifications are given to supervisors whose operations or work spaces would be affected by non-routine work. At the facility,
- cooling and heating are important for production and quality control, so
- anything that would affect them, even temporarily, typically gets attention by a range of personnel,
- unusual temperature changes, that occur without a pre-work notification, will likely be reported to appropriate personnel.
* Temporary safety measures, such as ventilation or eye/face washes, are called for as needed in all procedures and policies described in this existing safeguard.

Safeguard name:
Safety and improvements ideas are encouraged and assessed through informal talking, routine meetings, and suggestion systems.

Hierarchy of controls/safeguard type:
Administrative

Safeguard description:
See the facility's plans, programs, and records for
* safety meetings and feedback,
* employee participation, including for process-safety management (PSM) compliance.

Safeguard name:
Safety, training, contractor, and human-resources policies and programs are adequate, including for process safety.

Hierarchy of controls/safeguard type:
Administrative

Safeguard description:
* See the Owner/Operator's policies and programs for the facility on:
- safety, training, contractors, and human resources, which also cover
> excessive fatigue or stress, mental health, substance abuse, and other potential causes of inadequate performance and
> communications and consequences if safety or other rules are not followed,
- ammonia-refrigeration process-safety management (PSM), in particular
> employee participation,
> process-hazard analysis,
> procedures, for operations and maintenance,
> annual review and certification of procedures, as applicable,
> training on operating and maintenance procedures, and
> contractor program.
* This includes the general expectation that employees or contractors will seek assistance if unsure about a task, before or after they start the task, which is communicated:
- through both training and informal methods,
- including on-the-job training combined with observation by and demonstration to supervisors or more experienced employees or contractors.

Safeguard name:
Security, of the facility, no shortcomings discovered by the PHA team.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
* See recommended actions in the PHA report on:
[VERIFY BELOW AND LIST ANYTHING THAT NEEDS REVIEW OR ATTENTION SUCH AS:
- CONTROLS REMOTE ACCESS AND CYBER SECURITY,
- ANY OUTDOOR OIL DRAINS THAT ARE NOT SECURED BY LOCKS OR FENCES WITH LOCKED GATES...]
* Security of the facility,
- was reviewed in overview by the PHA team but was not rigorously evaluated,
- is also driven by food-security requirements.
* Cyber security: see the
- information-technology (IT) and, if separate, operational technology (OT) policies of the facility's Owner/Operator.
* Human security: see the
- contractor and human resources policies of the facility's Owner/Operator.
* Physical security at the facility includes
- the ammonia-refrigeration system is located in buildings, in outdoor areas, or above roofs, to which access is controlled by reasonably secure
> door or gates that are locked or attended,
> fences,
> walls,
> windows, air inlets or exhausts, or other building openings -- with locks, bars, grills, or grating as needed,
- attended at all times (24/7),
- where and when reasonably needed:
> exterior lighting,
> motion sensors, door and window contacts, and/or other sensors that trigger alerts or alarms,
> security cameras that monitor and record, either continuously or if actuated by sensors.

Safeguard name:
Separation of ammonia refrigeration from people is adequate and considered in change management.

Hierarchy of controls/safeguard type:
Engineering: Greater Separation

Safeguard description:
For/at the facility, the ammonia-refrigeration system:
* valves, control and stop, [ALL, MOST, OR DESCRIBE] are located in the refrigerating-machinery room, in mechanical penthouses, above roofs, or outdoors;
* [AMMONIA REFRIGERATION EQUIPMENT OR PIPING IS ALL LOCATED IN THE REFRIGERATING-MACHINERY ROOM, IN MECHANICAL PENTHOUSES, ABOVE ROOFS, OR OUTDOORS
-- OR --
DESCRIBE ANY EQUIPMENT THAT IS NOT];
* change management includes documenting that ammonia-refrigeration equipment and piping, installed as part of a change, were
- separated from people to the extent practical, such as
> by locating them in refrigerating-machinery rooms, mechanical penthouses, above roofs, or outdoors and
> adequately far from air intakes and building openings, including doors and sometimes open windows.
[VERIFY ABOVE.]
* Tornado shelters and access to them [CONSIDER THEIR SEPARATION FROM AMMONIA REFRIGERATION.]

Safeguard name:
Sight glasses -- none are linear or tubular, and all are built, installed, and inspected properly and replaced as needed.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
See the facility's maintenance-management system.

Safeguard name:
Temperatures of equipment and piping are kept above their minimum design metal temperature (MDMT).

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
The facility's ammonia-refrigeration system:
* is normally operated, by its automated controls, with suction pressures and temperatures between [____to ____] pounds per square inch gauge (PSIG) and [____to ____] Fahrenheit (F), so
- equipment (including pressure vessels) and piping are normally well above their -20 F or lower MDMT,
- [DESCRIBE ANY BELOW -20 F PORTIONS OF THE SYSTEM AND THEIR MDMT],
* is only opened by authorized personnel, who are trained to
- pump down isolated equipment and piping to a suction pressure above their MDMT for long enough to remove liquid ammonia,
- before, if needed, venting them to atmospheric pressure or pumping them down to lower pressures, and so
- avoid cooling equipment and piping below their MDMT.
* Outdoor temperatures at the facility are rarely below -20 F; the record low was [INSERT RECORD LOW] F on [MONTH DAY, YEAR], in [NEAREST LOCATION WITH SIMILAR WEATHER], but
- insulation and refrigerant circulating in piping would keep most, not all, piping above extremely low outdoor temperatures,
- at low outdoor temperatures, internal pressures would typically be much lower than design pressures, so typically only external loads or shocks could to initiate a brittle fracture,
- no piping wall thicknesses exceed 1/4-inch [VERIFY -- TYPICALLY TRUE FOR 16" AND SMALLER PIPE SIZES] (brittle fracture is more likely in thicker steel),
- all vessels except [LIST ANY OUTDOOR VESSELS] are located indoors, and the outdoor vessels have a low likelihood of brittle fracture for the following additional reasons
> [LIST ANY REASONS, FOR EXAMPLE, IF TRUE...]
> the vessel has been post-weld heat treated and has a steel-wall thickness of [THICKNESS],
> [... FOR AN OUTDOOR RECIRCULATOR...] the vessel typically contains only suction pressure and has a MAWP of [TYPICALLY SEVERAL TIMES HIGHER THAN SUCTION PRESSURE].

Safeguard name:
Transfer system and its piping are adequately built, controlled, located, inspected, tested, and maintained.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
[SEE TRANSFER SYSTEM SCENARIOS AND CHECK DETAILS, INCLUDING VERIFYING THAT:]
* Liquid ammonia is unlikely to flow from larger vessels, through the transfer system, and into the relief-vent (RV) piping, even during a fire.

Safeguard name:
Valves are present where needed for maintenance and leak mitigation, with adequate backup and access.

Hierarchy of controls/safeguard type:
Engineering and Administrative Combined

Safeguard description:
In the facility's ammonia-refrigeration system,
* if one stop valve is stuck, a valve upstream of it can be closed, in almost all cases;
* all piping leading to each equipment package has either
- just a stop valve near the equipment package or
- a control valve serving the equipment package, with a stop valve on either side of it;
* a King valve, automatic, is properly installed, in series with the hand King valve and can be shut by or using either
- an E-stop button/switch or
- a refrigerating-machinery room ammonia sensor,
- see existing safeguards about the refrigerating-machinery room and its safety systems;
* a King valve, stop, is accessible from the floor and not in a cramped location and so
- it would normally be accessible to emergency responders wearing self-contained breathing apparatus (SCBA) and protective suits.
* Stop valves are also called hand valves or shutoff valves.

Safeguard name:
Vehicle or heavy cart traffic is unlikely to damage ammonia-refrigeration equipment, piping, supports, or their insulation or paint.

Hierarchy of controls/safeguard type:
Engineering: Greater Separation

Safeguard description:
At the facility,
* adequate guarding is in place where vehicle or heavy cart traffic comes close to ammonia-refrigeration equipment, piping, or supports, including
- [NOTE AREAS WITH EQUIPMENT, PIPING, OR SUPPORTS NEAR TRAFFIC THAT ESPECIALLY REQUIRES GUARDING]
* most ammonia-refrigeration equipment and piping is located
- in the refrigerating-machinery room, an authorized personnel only room, with less-frequent and carefully-done moving of heavy stuff,
- in mechanical penthouses, or
- above the roof,
* pipe with thicker walls is used for any threaded and 1-1/2" and smaller ammonia-refrigeration piping, except some tubing integral to compressor and other equipment packages. See the applicable edition of IIAR 2.

Recommended Actions

None found. [Templates have no recommended actions.]

Process-hazard analysis (PHA) for process Ammonia Refrigeration in facility Plant A1 owned by My Company, Inc.

Background on the process, applicable PHA rules, and past PHA or revisions history

Team qualifications and information reviewed

Method

Identification of applicable previous incidents

Possible Causes

Possible Consequences

Existing Safeguards

Recommended Actions

Process-hazard analysis (PHA) for
process Ammonia Refrigeration in facility Plant A1 owned by My Company, Inc.