All Sectors

Scot Stuttgart: The Checklist Said Isolated. The Drawings Said Otherwise.

🕑 5 min read words Safety • Incident • Engineering

Vessel: Scot Stuttgart (Chemical Tanker, built 2006, 5,145 GT, Marshall Islands flag)
Date: 17 May 2025
Location: Puerto Nuevo Terminals, San Juan, Puerto Rico
Outcome: Engine room fire, $333,525 damage — no injuries, no pollution
Human Factors: Isolation Verification · Checklist Completion vs. Checklist Effectiveness · Fire Suppression Discipline
Source: NTSB Marine Investigation Report MIR-26-29, published 27 August 2026

2 decision points · 4 outcome paths · 6 min read

What Happened

On 16 May 2025, the port auxiliary diesel generator aboard Scot Stuttgart was tagged out for routine maintenance — cleaning the turbocharger and aftercooler, and checking valves and injectors. The second engineer completed a lockout/tagout permit and a cold work permit, both authorised by the chief engineer. The permit's safety checklist required checking the vessel's fuel piping drawings to identify every valve and circuit needing isolation. Both checklist items were marked complete.

Crewmembers removed the aftercooler and the fuel return tubing from the generator. What the checklist didn't catch: the fuel return line ran back into the top of the diesel day tank through a connection with no check valve — and nobody isolated or capped the now-open return port.

Cargo operations continued overnight. The vessel's fuel oil purifier kept running, filling the port day tank at about 85 gallons an hour. As the tank filled, fuel backflowed out through the open, disconnected return line, filled the generator's containment skid, and began spilling through the grated deck onto the second deck below — directly onto the exhaust gas economizer's thermal oil lines (running at 356–392°F) and the 400-volt start air compressor control panel.

The Fire

At 0429 on 17 May, a fire alarm sounded in the second engineer's cabin. He found thick white smoke pouring from the port engine room. The crew responded fast and by the book: engine and fuel pumps stopped, ventilation and electrical power to the space secured, general alarm sounded, full muster taken. With the space sealed, the master ordered the release of the fixed CO2 system — but only half the bottles (7 of 14), reasoning that since no flames had actually been seen, a full release wasn't justified.

Local firefighters arrived, found no elevated heat readings outside the space, and asked the master for permission to open the door and investigate — about 40 minutes after the CO2 release. He agreed. Firefighters found diesel fuel across the deck and 580°F readings near the generator. They then set up extraction fans to clear smoke for visibility. Within minutes, the smoke turned thick and black — the moving air had fed a fire that was still smouldering, not out. The master ordered everyone out, resealed the space, and released the remaining 7 CO2 bottles. The space stayed sealed for 24 hours before anyone re-entered.

What the Investigation Found

NTSB's probable cause finding is direct: the crew did not isolate the fuel return line during maintenance, allowing diesel to backflow and cascade onto a powered electrical panel or the economizer's hot thermal oil lines, where it ignited. The local fire marshal traced ignition to an electrical arc in the diesel-contaminated start air compressor control panel.

The checklist had asked the second engineer to consult the vessel's fuel drawings and identify every valve or circuit needing isolation. He marked it done. NTSB's conclusion: given the return line was never isolated, it's unlikely the drawings were actually reviewed — if they had been, the backflow path to the day tank would have been obvious. A completed checklist box is not proof the underlying check happened.

Contributing separately to the extent of the damage: the master's decision to let firefighters unseal and ventilate the engine room roughly an hour after the CO2 release. That introduced oxygen back into a space that hadn't yet been smothered for long enough, and the smouldering fire reignited into something worse.

Recommended Actions

Before isolating a fuel, lube, or hydraulic system for maintenance, physically trace the system on the vessel's own drawings — identify every line that could backflow into the work area, not just the lines being directly disconnected.
A fuel return line without a check valve is not self-isolating just because the pump feeding it is stopped — cap or physically isolate any open return port before leaving it disconnected.
Treat a completed isolation checklist as a starting point for verification, not proof of safety — spot-check that the isolation actually matches what the drawings show.
Release the full calculated charge of a fixed CO2 system for the space and hazard it was designed for — a partial release, chosen because "no flames were seen," is a guess the system's own design doesn't support.
Keep a space sealed for the full recommended duration (up to 24 hours) before any re-entry or ventilation, even under pressure to inspect quickly — introducing oxygen too early can reignite a fire that looks out.

Human Element Analysis

Isolation Verification

The permit process existed and was followed on paper — a real lockout/tagout permit, a real cold work permit, a real chief engineer sign-off. The gap wasn't a missing procedure; it was a checklist item marked complete without the underlying drawing review actually happening.

Checklist Completion vs. Checklist Effectiveness

A tick in a box measures that a step was performed, not that it caught what it was meant to catch. This is the same failure mode behind countless permit-to-work incidents ashore: the paperwork is real, the verification behind it isn't.

Fire Suppression Discipline

Two separate decisions — releasing half the CO2 charge, and unsealing the space early to inspect — both came from a reasonable-sounding instinct (don't waste suppressant on a space with no visible flame; get eyes on the problem quickly). Both worked against the system's actual design margins.

Industry	Incident	The Parallel
Nuclear	Davis-Besse reactor head corrosion, USA, 2002	A required inspection/verification step was signed off as complete without the underlying check actually being performed to the required depth — paperwork integrity failure, not procedure failure.
Aviation	British Midland Flight 92, Kegworth, UK, 1989	Crew acted on an incomplete read of which engine had actually failed and shut down the wrong one — a fast decision made on partial information under pressure, similar to judging "no flames seen" as sufficient basis for a partial suppressant release.
Oil & Gas	Piper Alpha platform explosion, North Sea, 1988	A permit-to-work system existed and was used, but a critical isolation gap between two overlapping work permits wasn't caught — the system's existence didn't guarantee the isolation was real.

Test Your Knowledge

Think you've got this covered? Put it to the test in Crew Connect's free Knowledge Checker — try a quick engineering round and see how you score.

Try the Decision Simulator

Would you have caught the backflow risk before it caught fire? Work through the same two decisions the Scot Stuttgart's crew faced — from isolation to fire response — in the Scot Stuttgart decision simulator.