When the Level Interlock Shared the Failed Sensor
On the morning of January 28, 2021, liquid nitrogen overflowed an immersion freezer at a prepared-foods plant in Georgia. The freezer had been in service for about five weeks. Two maintenance workers were troubleshooting it when the bath overflowed into a partially enclosed room with no mechanical ventilation. The liquid vaporized into a cloud four to five feet deep. Both workers died of asphyxiation and were not found for 30 to 60 minutes.
The release did not stop when they went down. During the evacuation, at least 14 other employees, including members of management, went into the freezer room or the area around it to investigate or to attempt a rescue. Four more employees died. Three employees and one firefighter were seriously injured. All six fatalities were asphyxiation. The nitrogen supply was finally isolated when employees closed valves at the bulk tanks outside the building, well after the overflow began.
The Chemical Safety Board’s December 2023 report traces the overflow to a single bent tube. Level in the immersion bath was measured by a bubbler. That morning the tube was bent so that its tip sat above the overflow elevation. The control system read an empty bath and called for maximum flow. The high-level safety interlock used the same bubbler as its only sensor, so it never saw a high level, and the freezer log recorded no high-level event. A post-incident water test reproduced the failure: the tub overflowed while the system measured no level. A clamp that should have secured the tube was missing. Once the tube was bent, nothing else in the design stopped the flow of liquid nitrogen.
The design-phase hazard analysis had treated a high-level alarm and interlock as the safeguard against bubbler failure and had assumed atmospheric monitoring outside the freezer. The alarm and the interlock were the bubbler. The plant had no oxygen monitoring and no alarm that would have kept people out of the room. The freezer’s emergency-stop buttons were inside the room, so using them meant entering the oxygen-deficient atmosphere. The layer that was supposed to prevent the release shared the failed sensor. The layer that was supposed to limit the consequences had not been installed.
This webinar walks through the incident at the level of the control and safety functions, and then through what an independent design would have required.
What we’ll cover
- How the immersion freezer level control loop, high level alarm, and the high-level interlock were built on one bubbler tube, and why bending that tube defeated all the protection layers
- How the foundation of a good, instrumented safeguard is selecting an appropriate technology for the instrument instead of checking for certificate of compliance to IEC 61508
- Why a safeguard that uses the same sensor as the failure it is credited against is not an independent protection layer
- What a diverse high-level shutdown looks like on a cryogenic bath: a second measurement, a trip point below the overflow, and a supply valve that does not depend on the tube
- Why oxygen detection would not have prevented the overflow, and how an alarm plus a remotely operated isolation valve would have changed the rescue attempt
- Where the emergency stop has to sit if actuating it cannot require entry into the hazard
The session is based on the CSB investigation report, *Fatal Liquid Nitrogen Release at Foundation Food Group* (2021-03-I-GA, December 2023).