On 5 October 2004, at 12:18 pm, I began draining oil from an ammonia refrigeration pressure vessel. I had completed the task many times before. What happened next changed my view of safety, competence and hazard management in an instant.
An accident is often described as an unfortunate, unintended event. That label can imply bad luck. Yet serious incidents usually contain a sequence of conditions and actions that could have been identified, controlled or interrupted.
This is difficult to share because it exposes my own failures as a professional. That is precisely why it matters. If we hide the gritty detail, others are denied the opportunity to learn from it.
“Accident” is a label. It is not an explanation.
A routine job
I was servicing a large two-stage ammonia cold-storage plant. The oil rectifier had been prepared the week before. I arrived to drain it with minimal task planning: no job safety analysis, a spanner in my pocket and respiratory protection hanging from a compressor lifting eye several metres away.
When I opened the drain valve, its shaft failed. After the oil discharged, an ammonia and oil mixture began to appear. I attempted to close the valve, but the flow continued.
The flexible hose attached to the outlet froze rigid. Liquid ammonia splashed across my body while a dense aerosol formed around me. Ammonia contacted moisture on my skin, eyes and respiratory tract, producing both cryogenic and corrosive injury.
The decision to stay
The vessel remained connected to a system containing approximately 3,000 kg of ammonia. A primary school was less than 200 metres away. In that moment I believed I had to isolate the system, even if doing so killed me.
That belief was itself a critical warning. No task or plant condition should place a technician in a position where remaining in an immediately dangerous atmosphere feels like the only responsible choice.
The plant room rapidly filled with aerosol. I could no longer see or breathe normally, and the respirator that should have been on my face could not be located. The vapour-return valve that should already have been closed was extremely difficult to operate. Eventually I isolated the circuit and escaped while the residual vessel contents continued to depressurise.
Safeguards that were not there
Leaving the room blind and breathless, I stood on a garden rake and was struck in the face. I reached the emergency shower and pulled the chain. No water came out. Its supply had been isolated because the shower leaked, the valve handle had been removed and the control was out of reach.
My tools and vehicle keys were inside the contaminated room. I damaged my vehicle to access a spare spanner, climbed onto a box and restored the shower supply. By then I had removed most of my contaminated clothing and was in shock. Workers watched, but no one came forward to provide assistance or activate an effective response.
The ammonia alarm was bypassed for maintenance. The emergency ventilation and evacuation alarm did not operate. There were no suitable external controls, and no effective automatic action removed potential ignition sources.
The response after exposure
I reached the office and told the staff to call emergency services and evacuate. Half-dressed, soaked and visibly affected, I was not taken seriously enough. The site continued around me.
I then drove myself to medical care. The first facility did not know how to manage the exposure and directed me elsewhere. The next facility was also poorly prepared. I eventually demanded a tepid shower and further decontamination.
One equipment failure had developed into a much larger event because safeguards across the task, plant and emergency system were missing, unavailable or ineffective.
Fourteen lessons from the chain
A routine task still needs a safe system
Past success is not proof that a task is safe. Oil draining requires a plant-specific procedure, defined valve sequence, verified isolation, suitable equipment and clear stop conditions.
Isolation must limit the credible release
The work should be arranged so that a component failure does not expose the worker to the connected system charge. Appropriate double isolation and self-closing oil-drain arrangements materially reduce the possible release.
Do not perform high-risk ammonia work alone
A second competent person can challenge the plan, raise the alarm, initiate emergency actions and provide assistance without entering the contaminated area. Supervision must also know where the work is occurring.
Protection must be worn, not nearby
Respiratory protection hanging several metres away is unavailable when a sudden release removes visibility and breathable air. Selection must reflect the assessed concentration and the possibility of an unknown or IDLH atmosphere.
Use suitable drain equipment
Drain pipework, valves and discharge arrangements must be rated for the service and secured against movement. The discharge should be directed away from the worker, controls and escape route.
Manage gas-detection bypasses
A maintenance bypass must be authorised, limited, visible and time-bound. The site needs compensating controls, and critical emergency detection, notification or shutdown functions should remain available wherever the design requires them.
Provide dependable ventilation and shutdown
Emergency ventilation and shutdown actions must follow the site’s risk assessment and system design. Controls should be accessible without entering the release area, and discharge must not contaminate doors, air intakes or evacuation paths.
Protect the escape route
Housekeeping is an emergency control. Tools, hoses and stored items must not obstruct a technician who may need to leave without normal vision, balance or dexterity.
Prove emergency irrigation is available
Showers and eyewash facilities must be accessible, routinely tested and checked before higher-risk ammonia work. The flushing supply should be suitable for prolonged decontamination and local climatic conditions.
Everyone must recognise the alarm
Site personnel need enough ammonia awareness to take a warning seriously, activate the emergency plan, evacuate or shelter as directed, summon help and avoid becoming additional casualties.
Plan for the direction of the release
Ventilation outlets, wind direction and the potential movement of an ammonia cloud affect whether people should evacuate or shelter. The decision cannot be invented after the release begins.
Prepare medical information and transport
First aiders and receiving medical facilities need reliable ammonia exposure information. A person with chemical burns, inhalation exposure or shock should not be expected to drive themselves between treatment facilities.
Make the safer response psychologically possible
No technician should feel compelled to remain in a contaminated plant room to save equipment or protect production. Escape, alarm activation and controlled response must be reinforced before the task.
Learn from the whole chain
The broken valve was only one event. Procedure, design, lone work, PPE, alarm bypass, irrigation, housekeeping, emergency response and medical readiness all influenced the outcome. Effective investigations examine the system, not only the worker.
Experience is not a control
I was a qualified refrigeration technician with around ten years of ammonia experience. I had been taught by people with decades in the industry. None of that compensated for the absence of a sound procedure, suitable isolation, effective engineered safeguards and a prepared site.
Repeated success can create confidence while the underlying exposure remains unchanged. The task appears safe because the failure has not happened yet. When it finally does, the worker’s experience may help them survive, but it should never be the principal barrier.
Learning without blame
I made poor decisions that day. A useful investigation must acknowledge them. It must also ask why those decisions were normal, why the task had no effective procedure, why I was alone, why the drain arrangement could release the connected charge, why protection was not worn, why the alarm bypass disabled critical functions and why emergency irrigation and medical arrangements failed.
Stopping at “the technician was complacent” would have preserved every condition needed for the incident to happen again.
The lesson that remained
Prevention. Preparedness. Both.
Good ammonia safety reduces the likelihood of release and prepares people for the moment prevention fails. Procedures, engineered safeguards, competence, alarms, irrigation and response capability must operate as one system.
Review your ammonia critical controlsAdapted and updated from Pádraic Durham’s original LinkedIn article. Read the original on LinkedIn ↗