Transport Malta has published an investigation report into a fatality that occurred relating to the boiler onboard a vessel in January 2024.
The incident
On 03 January 2024, Torc departed Agioi Theodoroi, Greece, after discharging part of its cargo of Paraffin. The vessel was bound for Genoa, Italy with an expected date of arrival of 10 January 2024. Shortly after departing from Agioi Theodoroi, the engineers changed over the boiler fuel consumption to very low sulphur fuel oil (VLSFO) for both boilers. However, the starboard boiler failed repeatedly to start. Eventually, both boilers were restarted on low sulphur marine gas oil (LSMGO).
On the morning of 08 January 2024, the engineers, in consultation with the master and chief officer, decided to change over the fuel consumption of the boilers from LSMGO to VLSFO. Just before 1400, the boiler fuel consumption was changed to very low sulphur fuel oil. Both boilers failed to fire because of low fuel oil temperature. Subsequently, the port boiler started working normally, but the starboard boiler failed to fire. Eventually, another attempt was made to restart it. While it was on the purge cycle, the second engineer went up to the burner platform to inspect it.
At 1406, a loud explosion was heard and a fire started at the top of the starboard boiler. The fire alarm sounded within a few seconds. The engineers went up to the boiler platform, to find the second engineer lying unconscious on top of the starboard boiler. The water mist system installed above the port boiler activated and the crew extinguished the fire with the help of portable extinguishers. The second engineer was carried outside onto the poop deck and placed in the dry provision room. The master sought medical advice from the company doctor and broadcast an emergency signal on the Digital Selective Calling system. Although the crew members attempted cardio pulmonary resuscitation, the second engineer passed away at around 1450.
Chemical analysis results made available to the safety investigation revealed that at the time of the explosion, the boiler was burning LSMGO and in the process of changing to VLSFO. The safety investigation believes that the cause of the explosion on boiler no. 1 was excessive vaporised LSMGO inside the unit and the likely presence of unburnt LSMGO inside the boiler.

Limitations of the safety investigation
When the investigation team attended the vessel, the starboard boiler had been secured by the Coastguard officials in Genoa, pending parallel investigation. Prohibitionary notices had been put in place to prevent further disturbance of the incident site. It was therefore not possible for the MSIU to conduct a detailed, onsite technical investigation. Moreover, the damaged boiler burner and associated components had been seized by the Italian authorities for use as evidence in potential criminal proceedings.
Fatigue and alcohol
Analysis of the hours of rest records showed that they were not in excess of those required by the STCW or the Maritime Labour Convention. Although no records on the quality of sleep were kept, manifested behaviour did not suggest that fatigue should have been considered as a contributing factor to this accident. Alcohol tests on all crew were carried out at 1630 on 08 January 2024. All the tests returned a negative result and therefore, alcohol was not considered to be a contributing factor to this accident.
Repeated attempts at fuel changeover
The starboard boiler had failed to fire on VLSFO when the engineers attempted to change from LSMGO to VLSFO. It was agreed with the Company that the vessel would continue to burn LSMGO until Genoa, where a technical superintendent would attend to resolve the defect. On examination of alarms and past records, it was observed that the starboard boiler had persistently failed on several other occasions in the past.
It was not known why there was another attempt to change over the fuel consumption of the boilers from LSMGO to VLSFO, despite having agreed to continue using LSMGO during the passage to Genoa. It was considered possible that the chief engineer undertook the initiative to try the changeover before the arrival of the superintendent to establish the competence of the engineering team. The decision to start the starboard boiler without a technical evaluation and investigation of the underlying cause for the flame failure when the VLSFO was in use can be described as an absent error identification of the boiler control system, i.e., the ways in which the boiler and the burner could fail to fire as designed.
It appears that the fact that the issue was related to the misfiring of the boiler was not perceived by the crew members to affect the boiler’s barrier systems, which were designed to either avoid an accident or neutralise the consequences of such accident. As such, this could have convinced the crew members to try and start the boiler, believing that the system would not collapse. Thus, the risk that the boiler burner would not fire may have well been considered by the crew members, but this was not seen as a potential compromise to the vessel and their own safety, given that the boiler’s barrier systems had always operated as designed. Then, the crew members had no cues, which would have suggested to them a different outcome, this time round.
Accident mechanism
When the port and starboard boilers failed on low fuel oil temperature, the port boiler was successfully restarted, but the starboard boiler failed for the second time. Soon after, it was restarted and while it was going through the pre-purge cycle, the second engineer went up to the boiler platform to check the burner. From the position that he was found in, it was highly likely that he was making his way to the burner fuel heater, which was located on the outboard side of the burner. It was not known whether he had adjusted the heater settings, as the boiler was on a firing cycle. However, it was certain that the explosion took place as the starboard boiler completed its purge cycle and the ignition electrodes were energised, and therefore, while fuel was being sprayed into the boiler furnace.
Whilst all the samples taken in close proximity to the burner confirmed that the boiler fuel was LSMGO, the presence of VLSFO was detected in the sample taken in close proximity to the three-way valve. This was suggestive that the explosion occurred during the changeover process from LSMGO and VLSFO. However, the analysis on the burner fuel system revealed that the fuel line was found empty, confirming that the solenoid valve was closed at the time of the explosion. It was noted that solenoid valves and were connected in series, and therefore, the physical condition of the two solenoid valves had to be identical at any point in time, i.e., either closed (de-energised) or open.
Review of the alarm logs and analysis of the crew statements indicated that the boiler was working fine until both boilers shut down. This was attributed to the fact that when the system was changed over to VLSFO (and the fuel pre-heater switched on), the temperature of the LSMGO, which was still running in the system, was lower than the temperature preset in the system. The restart of boiler no. 2 was successful because the pre-heater had, in the meantime, heated the LSMGO in the system, albeit to a much higher temperature than is actually necessary for its combustion.
The situation was different for boiler no. 1, which tripped again after a few seconds, on a low temperature alarm. The analysis of the burner concluded that this was correlated to the failure of the solenoid valve. The solenoid valve remaining closed had a detrimental effect on boiler no. 1 operation because, in conjunction with the hot LSMGO, this caused an overpressure upstream of the fuel system, leading to incorrect atomisation of the LSMGO. It was not excluded that this had also led to the presence of unburnt LSMGO inside the boiler furnace.
Risk awareness
The fact that the crew members had no clues that the solenoid valve remained closed at a time when its physical condition should have been open raised particular interest in its design feature. It would be safe to comment that its design feature had a bearing on the crew members’ cognition and their understanding of an already complex situation.
The status of the solenoid valves (including the solenoid valve) was not monitored by the system, which, as much as it was not a requirement, contributed to a ‘miscommunication’ between the system and the users – the engine-room crew members, who were trying to understand the system’s operational status at the time. This ‘miscommunication’ led to a gap between the crew members’ understanding of what the system was supposed to do and what was actually happening.
The absence of a monitoring function imposed a higher cognitive demand on the crew members trying to understand the ‘unexpected’ system behaviour, making fault diagnosis much more difficult, with the fault cascading to a situation that had detrimental consequences, not only to the system but also to its end-users. Typical of automated functions, the utilisation of the boiler control system, designed to ensure the safe ignition of boiler fuel, generated a new kind of system breakdown potential.
The hidden status of the solenoid valve impeded the engineers’ ability to observe its operations and restricted their ability to detect and recover from the gap. It was also clear that this impediment did not leave the crew members with a sufficient recovery interval before the boiler explosion occurred.
Maintenance history
The maintenance history on board suggested no records of preventive maintenance carried out on the solenoid valve. A review of the manufacturer’s data revealed no reference to any maintenance that had to be carried out on the solenoid valve in question. Whilst the alarm history of the boilers revealed that changing from LSMGO to VLSFO had always been accompanied by flame failure alarms, it proved not possible for the crew members to determine the exact technical reason for these failures.
In fact, the MSIU was informed that the technical investigation by the judicial authorities in the wake of the boiler explosion did not identify any issue which could have been attributed to the failures referred to above.
Fire detection and firefighting
The fire detection system functioned as expected, thereby activating the FWBFFS. This prevented the fire from spreading further and brought it under control within a short time. The quick use of the mobile foam extinguisher by the crew members aided in extinguishing the fire. The immediate response to the incident was indicative of a well-trained and drilled crew. Furthermore, the activation of the smoke and flame sensors and the subsequent energisation of the FWBFFS was also indicative of well-maintained fire detection and smothering systems.
Emergency medical response
Several crew members promptly retrieved the casualty from the location of the incident, while others engaged in extinguishing the fire. Their subsequent actions of seeking shore-based medical attention, implementing the advice provided, and carrying out CPR demonstrated their readiness to respond to a medical emergency. It was unfortunate that the injuries sustained by the second engineer were so severe that he passed away despite their best efforts.
Conclusions
Findings and safety factors are not listed in any order of priority.
Immediate cause of the accident
Excessive vaporised LSMGO inside the furnace led to the explosion inside boiler no. 1 furnace.
Conditions and other safety factors
- The LSMGO had an elevated temperature due to the bunker fuel system preheating, in preparation for the changeover to VLSFO.
- A failure in solenoid valve caused it to remain closed, resulting in an increase in pressure within the fuel circuit.
- It was very likely that unburned LSMGO was present inside the boiler furnace.
- The failure of solenoid valve was unforeseen and unexpected by the crew members.
- The physical status of solenoid valve was not designed to be monitored and therefore provided no cues to the crew members if its imminent failure.
- The decision to start the boiler without a technical evaluation and investigation of the underlying cause for the flame failure when VLSFO was in use can be described as an absent error identification of the boiler control system, i.e., the ways in which the boiler and the burner could fail to fire as designed.
- The initial misfiring of the boiler was not perceived by the crew members to affect the boiler’s barrier systems, which were designed to either avoid an accident or neutralise the consequences of such accident, and this could have convinced the crew members to try and start the boiler, believing that the system would not collapse.
- The risk that the boiler burner would not fire may have well been considered by the crew members, but this was not seen as a potential compromise to the vessel’s safety, given that the boiler’s barrier systems had always operated as designed.
Other findings
- It was considered possible that the chief engineer undertook the initiative to try the changeover before the arrival of the superintendent to establish the competence of the engineering team.
- The fire detection system functioned as expected, thereby activating the FWBFFS.
- The immediate response to the accident was indicative of a well-trained and drilled crew.
- The actions of the vessel to seek shore-based medical attention, implementing the advice provided, and carrying out CPR, demonstrated their readiness to respond to a medical emergency.