LNG Tanker Hilli - Fatal Boiler Chemical-Cleaning Explosion | Intrinsically Safe Lighting For Confined Spaces Risk Case Study

Hilli Boiler Explosion Highlights the Need for Intrinsically Safe Lighting for Confined Spaces

During boiler repairs on the LNG tanker Hilli in a foreign shipyard, a post-repair chemical clean ended in a fatal explosion on 10 October 2003. The Marine Accident Investigation Branch later used the event as a confined-space warning. Inhibited sulphamic acid had been circulated through the starboard boiler. The cleaning chemistry could generate hydrogen as the acid attacked scale and steel. By late evening, test results indicated that the inhibitor was no longer adequately protecting the boiler; circulation was stopped, and the mixture was drained. The steam-drum door was opened at about 21:45, producing noticeable suction as the seal broke.

At about 22:00, two chemical-cleaning specialists approached the open steam drum. No test had been made for toxic or flammable gases. A nearby non-intrinsically safe halogen lamp was picked up and placed just inside the drum. A small flame or spark was seen, and an explosion followed immediately. One specialist was thrown about 4.5 metres, suffered severe burns and fractures and died nine days later. The other was also burned. MAIB concluded that the evidence pointed to accumulated hydrogen mixing with incoming air when the drum was opened, creating a mixture within hydrogen’s wide explosive range. The hot lamp lens or bulb, or an electrical spark from the lamp, was identified as the likely ignition mechanism.

The risk chain to prevent

The hazard was generated by the maintenance chemistry itself. A boiler that had contained water and acid became a confined volume holding hydrogen. Opening the drum did not make it safe; it introduced oxygen. The work team then moved directly from process completion to visual inspection without verifying the new atmosphere. Contractor interfaces made the situation worse: the cleaning expert had no supporting method statement or risk assessment, and those around him accepted his specialist role without sufficient challenge.

Safety managers

MAIB’s lesson is explicit: ventilate properly, test for toxic and flammable gases, and use only intrinsically safe lighting systems in confined spaces. That wording matters when positioning SafeGlo. SafeGlo publishes Ex m encapsulated ATEX/IECEx hazardous-area lighting, but Ex m is not the same protection concept as intrinsic safety, Ex i. A safety manager should not present SafeGlo as satisfying MAIB’s “intrinsically safe” requirement unless the exact product carries the necessary approval for that application. SafeGlo may still serve surrounding classified access areas if its certification is suitable.

Operations

Operations should establish a hold point between chemical cleaning and inspection. Draining the chemical does not eliminate the hazard. Hydrogen testing, ventilation and a confined-space release certificate should precede opening or lighting the inspection area. No technician should reach for a convenient lamp nearby. A controlled lighting kit should be selected before the clean starts, with clear rules for what may cross the steam-drum boundary.

Engineering

Engineering must understand the reaction chemistry and expected gas evolution. Vent paths should prevent hydrogen accumulation at high points, and test locations must reflect hydrogen’s buoyancy. Lighting selection then follows the atmosphere assessment and marine/shipyard acceptance requirements. SafeGlo’s flexible low-voltage design may be useful for fixed or semi-fixed illumination around boiler access, but insertion into the drum requires explicit confirmation that the protection method is acceptable for the intended confined-space hazard.

Procurement / ESG

Procurement cannot treat “ATEX,” “IECEx” and “intrinsically safe” as interchangeable marketing terms. The protection concept, EPL/category, gas group, temperature class and scope of certification must match the task. The right procurement package also includes gas detection, ventilation and approved electrical accessories. Lifecycle claims come after that technical fit.

The highest-risk moment was a change of operating state. Chemical circulation had stopped, the boiler was being opened, and personnel were moving from process work into inspection. That transition needed a formal hold point: identify gases that could have been generated, ventilate high points, test before opening and entry, and control every electrical item introduced afterward. Lighting approval is therefore part of the release-to-inspect decision, not a last-minute tool choice.

SafeGlo’s role in this environment

This case is valuable precisely because it sets a limit on SafeGlo’s positioning. SafeGlo can be part of a hazardous-area lighting strategy, but the MAIB event demands application-specific approval and, for the steam-drum inspection described, intrinsically safe lighting. The product should never be used to blur that distinction.