All Sectors

BSafe Case Study 1 — The Tank Wasn't Empty, and Nobody Checked a Second Way

🕑 5 min read words Safety • Incident

Vessel: Capesize bulk carrier, at anchor
Date & location: Engine room, No.2 Waste Oil Settling Tank
Outcome: Fatal — the Third Engineer sustained 2nd degree burns over a large part of his body from hot sludge splashback, died from septic shock 12 days later
Human factors: Confirmation Bias · Faulty-Equipment Assumption · Inadequate PPE for the Hazard
Source: Britannia P&I Club, BSafe Incident Case Study No. 1, drawn from Hellenic Bureau for Marine Casualties Investigation (HBMCI) Report 14/2013

1 real case studyHBMCI Report 14/2013~4 min read

A Level Gauge That Was Lying

Sludge had been pumped from the Bilge Separator Oil Tank into No.2 Waste Oil Settling Tank. The level gauge on No.2 wasn't showing the right quantity — it had malfunctioned. A Job Hazard Analysis was written up, and the Second Engineer was tasked with draining the tank's residues and fixing the gauge, with the Third Engineer assisting.

The Second Engineer opened the drain valve to let sludge run by gravity to the BSO Tank. The Third Engineer climbed on top of the tank and turned the scale reduction wheel, reporting it working. The Second Engineer noticed a small movement on the level indicator while the valve was open. Then he opened the self-closing drain valve — a small amount of water came through, then stopped. That was enough for both of them to be convinced the tank was empty.

Two Metres Up, Four Nuts Still On

The Third Engineer went to open the manhole cover, about two metres above the floorplates. He removed all the nuts except four, which he loosened but didn't take out. He saw no leakage — so he pulled the cover without removing the remaining nuts. Hot oil splashed out of the manhole bottom onto him, standing on a folding ladder. The Second Engineer pulled him clear and stripped off his oil-soaked coveralls. The Chief Officer gave first aid; a helicopter arrived roughly two hours later and got him to a shoreside hospital. He died there 12 days after the accident.

What HBMCI's Investigation Found

The hazard of an unknown quantity of hot sludge remaining in the tank, caused by the malfunctioning gauge, was never actually identified as a hazard in its own right.
A small trickle of water from the drain valve and a working scale-reduction wheel were treated as proof the tank was empty — confirmation bias, in HBMCI's own framing: information that fit what the engineers already believed was accepted without a second, independent check.
The vessel's Planned Maintenance System had no routine guideline for cleaning or maintaining the gauges to prevent them jamming with sludge in the first place.
The tank had no sounding pipe — no alternative way to verify contents once the primary gauge was known to be unreliable.
The Third Engineer wore a company-issued cotton coverall, which gave only limited heat protection and let the hot liquid through.

Recommended Actions

Drawn from HBMCI's own findings, not invented:

A malfunctioning level gauge is itself a hazard needing its own entry on the job hazard analysis — not a side detail to work around while doing something else.
Never rely on a single, indirect signal (a trickle of water, a wheel turning) to confirm a tank is empty when the primary means of verification is already known to be unreliable — use a second, independent method, or don't proceed.
Any tank subject to gauge failure should have an alternative verification method built in — a sounding pipe, sight glass, or equivalent — not left as a single point of failure.
PPE selection has to match the specific hazard, not just general engine-room practice — hot liquid contact needs heat-resistant protection, not standard cotton coveralls.
Planned Maintenance Systems should cover the equipment that, if it fails, removes a crew member's ability to verify a space is safe to open — a gauge is safety-critical instrumentation here, not routine kit.

Human Element Analysis

Confirmation bias

Both engineers wanted the tank to be empty so the job could proceed. A small trickle of water and a turning wheel were read as confirmation, not tested as evidence. HBMCI names this directly: information that fit the existing belief was accepted without independently verifying it.

Faulty-equipment assumption

Once the gauge was known to be broken, the tank's actual contents became genuinely unknown — yet the response was to work around the failure rather than treat ‘we can’t verify this tank is safe’ as the real, primary hazard.

PPE mismatch under a hidden hazard

Standard-issue cotton coveralls were adequate for the job the crew thought they were doing. They were never going to be adequate for the job that was actually in front of them — hot liquid contact — because nobody had correctly identified that risk going in.

Test Your Knowledge

Think you've got this covered? Put it to the test in Crew Connect's free Knowledge Checker — try a quick safety round and see how you score.