Skip to content

LTI: person crushed in watertight door

What happened

An electrician was crushed and severely injured while working on a watertight door on a vessel. He was evacuated by helicopter. The incident happened when the door opened unexpectedly, during adjustment of a proximity sensor for the door.

Just before this adjustment, the electrician had closed a ball valve in the hydraulic system, believing this was a safety valve which would prevent the door from opening. Once working on the system, the selector switch on the primary operating system, which is used to open and close the watertight door, did not return to the neutral position enabling a signal to be sent to the PLC (programmable logic controller). When the electrician manually aligned the sensor which he had to repair, a signal went to the PLC and the door opened unexpectedly crushing him between the door and the deck.

Vertical watertight door
Watertight door opening on dummy (DEMONSTRATION)

What went wrong

  • The system was not isolated at the time of the incident – no Lock-out/Tag-out of system was in place;
  • There was no request for a Permit To Work (PTW) nor was a Job Safety Analysis (JSA) prepared for the activity;
  • The ball valve did not isolate the hydraulic system:
    • The ball valve was not a safety valve;
    • The ball valve was leaking.
  • The door opened when the command “open” came in from the PLC. This command came in because the selector switch was damaged and did not return to the neutral position once released;
  • When the door is operated, visual and audible alarms are initiated. The alarms and signals were not fully operational nor working.

Lessons learned

  • Ensure there is a Permit To Work in place, a Lock-out/Tag-out procedure, and a suitable and sufficient job safety analysis before you start;
  • Hydraulic system ball valves are not “safety valves”. Take care that you fully understand what you’re working on, and ensure systems are fully de-energizing before putting yourself in the line of fire;
  • The switch on the primary operating system was not in working condition but there were not sufficient spares on board to replace them. Sufficient spare parts should be on board, so these can be replaced immediately.

Members may wish to refer to:


IMCA Safety Flashes summarise key safety matters and incidents, allowing lessons to be more easily learnt for the benefit of all. The effectiveness of the IMCA Safety Flash system depends on Members sharing information and so avoiding repeat incidents. Please consider adding [email protected] to your internal distribution list for safety alerts or manually submitting information on incidents you consider may be relevant. All information is anonymised or sanitised, as appropriate.

IMCA’s store terms and conditions (https://www.imca-int.com/legal-notices/terms/) apply to all downloads from IMCA’s website, including this document.

IMCA makes every effort to ensure the accuracy and reliability of the data contained in the documents it publishes, but IMCA shall not be liable for any guidance and/or recommendation and/or statement herein contained. The information contained in this document does not fulfil or replace any individual’s or Member's legal, regulatory or other duties or obligations in respect of their operations. Individuals and Members remain solely responsible for the safe, lawful and proper conduct of their operations.