When the Level Interlock Shared the Failed Sensor
On January 28, 2021, liquid nitrogen overflowed an immersion freezer at a food plant in Georgia and filled an unventilated room with an oxygen-deficient cloud. Six people died, including four who entered the area to investigate or attempt a rescue, and four more were seriously injured.
The Chemical Safety Board traced the overflow to a single bent bubbler tube. The bent tube made the control system read an empty bath and call for maximum flow. The high-level alarm and interlock relied on that same bubbler, so they never tripped. The hazard analysis had credited those safeguards and assumed atmospheric monitoring, but no oxygen detection was installed, and the emergency stops were inside the hazardous room.
This webinar examines the incident at the level of the control and safety functions, then shows what a truly independent design would have required.
What we cover:
- How the level control, alarm, and interlock all depended on one bubbler tube
- Why sound instrumented safeguards start with choosing the right measurement technology, not with checking for an IEC 61508 certificate
- Why a safeguard sharing a sensor with the failure it protects against is not an independent protection layer
- What a diverse high-level shutdown on a cryogenic bath looks like
- How oxygen detection with remote isolation would have changed the rescue response
- Where emergency stops must be located so they can be used without entering the hazard
Based on the CSB report “Fatal Liquid Nitrogen Release at Foundation Food Group” (2021-03-I-GA, December 2023):
https://www.csb.gov/csb-releases-final-report-into-2021-fatal-liquid-nitrogen-release-at-foundation-food-group-facility-in-georgia/