At approximately 8:50 p.m., an ammonia leak occurred on the refrigeration system of an ice cream factory that was shut down for maintenance. A detector was triggered. The watchman and the foreman in charge of the work managed to stop the release at around 10 p.m. Two factories located nearby (200 m and 1,000 m) alerted the rescue services owing to the ammonia odours. Twenty-five of their employees were evacuated, and four were confined. Two of them, feeling the ill effects of the releases, were taken to the hospital. The ammonia effluents generated by the leak were collected and then taken to a treatment centre.

Five-hundred litres of liquid ammonia were released through a safety valve. The valve opened due to overpressure in the refrigeration system. The installation features an automatic make-up system fed by cylinders. It was the low-level sensor, placed in the receiver, that triggered the filling action via a PLC. On the day of the accident, an electrical problem occurred on the relay between the level sensor and the PLC. If no signal is provided by the sensor, the PLC is programmed to trigger filling. It controls the receiver’s filling operation. The pressure in the installation increased above the safety valve’s opening pressure and the leak continued until the installation was shut down manually.

The overfilling of the receiver was directly caused by:

• an electrical relay fault which cuts off the transmission of information in the automated chain;
• inappropriate programming of the PLC which, when no signal is present, orders the installation to be filled;
• a failure of the automatic device allowing the installation to be secured in the event of a pressure increase.

The magnitude of the leak could have been limited. The prefectural authorisation order stipulates that the ammonia detector in the machine room and the production workshop must trigger measures to secure the installation. This arrangement existed for the sensor in the engine room, but it had been disconnected as part of the ongoing maintenance operations. It had not been implemented for the sensors in the workshop.

The operator did not notify the emergency services or the neighbours. Doing so would have facilitated the organisation of the intervention operations.

To avoid this type of event from happening, the operator has implemented the following actions:

• removal of the electrical relays associated with safety sensors;
• review of PLC parameters in the absence of a signal;
• securing of pressure build-up on the refrigeration system by disconnecting the compressors beyond a limit pressure in the receiver;
• monitoring and return to service of the ammonia sensors and the associated safety functions.