The short answer: An ammonia refrigeration system with 10,000 pounds or more of anhydrous ammonia in a process is covered by OSHA's Process Safety Management standard, 29 CFR 1910.119, because anhydrous ammonia is a listed highly hazardous chemical with a 10,000-pound threshold quantity in Appendix A. The same 10,000-pound threshold triggers EPA's Risk Management Program under 40 CFR Part 68. PSM is a program, not a permit: it requires process safety information, a process hazard analysis, written operating procedures, mechanical integrity, management of change, and emergency planning, among fourteen elements. The 2010 Millard Refrigerated Services release, investigated by the U.S. Chemical Safety Board, shows why each of those elements exists.
What happened at Millard Refrigerated Services, and why does it define ammonia PSM?
The Millard case is the clearest illustration of what a covered ammonia system can do when the PSM elements are not working, which is why it anchors this article. The failure was not exotic. It was a restart, a foreseeable pressure surge, and a piece of equipment that could not take it, in a facility that had already seen the warning twice.
A U.S. Chemical Safety Board investigation examined the August 23, 2010 release at Millard's cold-storage warehouse in Theodore, Alabama. The day before, the facility lost power for more than seven hours; when an operator reset the control system, a freezer evaporator switched into refrigeration mode while hot, high-pressure gas was still in the coil, producing a rapid pressure surge known as hydraulic shock. Roof-mounted evaporator piping failed and released roughly 32,000 pounds of anhydrous ammonia. According to EPA, which reached a $3 million settlement with the company, 152 people were treated for ammonia exposure and four were admitted to intensive care, and Millard had two prior smaller releases caused by hydraulic shock. The transferable point is that the mechanism was known, repeated, and preventable, which is exactly the gap PSM is written to close.
When does OSHA PSM apply to an ammonia refrigeration system?
PSM applies once a process contains at least the threshold quantity of a listed highly hazardous chemical. 29 CFR 1910.119(a) ties coverage to Appendix A, and Appendix A lists Ammonia, anhydrous (CAS 7664-41-7) with a threshold quantity of 10,000 pounds. "Process" is defined broadly to include interconnected vessels, so the charge across a connected refrigeration system is aggregated, not counted vessel by vessel. A mid-size food plant's engine room and evaporators can cross 10,000 pounds well before operators think of the system as a "chemical process," which is the most common way a facility is covered without realizing it.
The threshold does double duty across two agencies. EPA's Risk Management Program lists anhydrous ammonia in 40 CFR 68.130 at the same 10,000-pound threshold, so a facility over the line typically owes both an OSHA PSM program and an EPA Risk Management Plan, and EPA's Program 3 prevention requirements deliberately mirror the PSM elements. Aqueous ammonia is treated separately, with a 20,000-pound threshold at 20 percent concentration or greater, so a plant using ammonia solutions rather than anhydrous should count against the correct listing. For a covered system, the practical implication is that the refrigeration engine room is a regulated process with a defined program behind it, not just a maintenance asset.
Which PSM elements would have caught the Millard failure?
Read against the incident, several of the fourteen elements point straight at the failure path. Each is a place where a routine, documented step would have interrupted the sequence that put ammonia on the roof.
- Process hazard analysis, 1910.119(e). The PHA is the systematic study of what can go wrong, including equipment failures and human factors. A hazard analysis that took hydraulic shock seriously, especially after two prior releases from the same mechanism, would have flagged restart-after-power-loss as a scenario with catastrophic potential and driven a safeguard.
- Operating procedures, 1910.119(f). Written procedures have to cover startup, normal and emergency operation, and shutdown, with safety limits. A restart procedure that prevented switching an evaporator into refrigeration while hot high-pressure gas remained in the coil addresses the exact step the operator performed.
- Mechanical integrity, 1910.119(j). Vessels, piping, relief systems, and controls must be maintained, inspected, and tested. Mechanical integrity is what keeps the roof-mounted evaporator piping and its protective devices able to withstand a surge, and it is where a system's ability to survive an upset is either built in or missing.
- Management of change, 1910.119(l). Changes to process, technology, or equipment require review before they are made. MOC is also the discipline that forces prior incidents to change something: two hydraulic-shock releases should have driven a documented change to controls or procedures rather than a return to the same operation.
None of these elements is a document for its own sake. Each one is a scheduled point at which a person is required to look at a specific way the process can fail and do something about it, which is the difference between a program that prevents a release and a binder that describes one after the fact.
What is hydraulic shock, and how do you keep it out of the system?
Hydraulic shock is a sudden, localized pressure surge caused by a rapid change in the velocity of a flowing liquid or by condensing high-pressure gas against trapped liquid, and in ammonia refrigeration it can spike pressure far above design and rupture piping. It clusters around abnormal operations: restarts after a power loss, defrost sequencing, and valve operations that let hot gas meet cold liquid or trapped liquid meet a fast pressure change. The Millard restart is the textbook case, and the CSB treated it as the central lesson rather than a footnote.
Following the investigation, the CSB issued a 2015 safety bulletin and the safety video "Shock to the System," setting out key lessons to prevent hydraulic shock in industrial refrigeration. The preventive work is engineering and procedure, not vigilance: sequencing valves and controls so hot gas is never introduced against trapped liquid, designing and maintaining the system to handle credible surges, and writing restart and defrost procedures that hold after an upset. For a food plant, the operational implication is that the highest-risk moments are not steady-state running but the restarts and abnormal operations around a power interruption, which is precisely when procedures and interlocks have to be trusted.
What must the emergency plan cover for an ammonia release?
Coverage does not stop at prevention. 29 CFR 1910.119(n) requires an emergency action plan for the whole plant, and it has to account for a release that reaches people beyond the fence line, because anhydrous ammonia is acutely toxic and travels. The Millard release drifted over a worksite where crews were working, and the people treated were largely outside the immediate engine room, which is why the plan has to address detection, alarming, evacuation or shelter, and coordination with responders rather than only in-plant response.
The EPA side reinforces the point. Because the same 10,000-pound threshold triggers a Risk Management Plan under 40 CFR Part 68, a covered facility owes offsite consequence analysis and coordination with local emergency planners, and Millard's EPA settlement included violations for failing to report releases promptly to state and local emergency planning bodies. For safety leaders, the takeaway is that an ammonia program is judged on both halves: keeping the release from happening through the PSM elements, and being ready to protect workers and neighbors when detection, alarming, and coordinated response are what stand between a leak and a mass exposure.
Reading the standard through the incident
Ammonia refrigeration earns its place in food processing because it is efficient and effective, and it carries a catastrophic-release potential that the 10,000-pound threshold recognizes. 29 CFR 1910.119 answers that potential with a connected program: know the process, analyze how it fails, write and follow procedures, maintain the equipment, manage change, and plan for the release you are trying to prevent. The Millard investigation shows what it looks like when those links are open, a restart nobody had proceduralized, a surge the design could not take, and a warning that had already sounded twice. A facility that treats each PSM element as a scheduled decision point, and that lets a prior incident force a documented change, is the one that keeps the refrigerant in the pipe.
