Process Safety · Lesson 58 · 9 min read

A Diesel Air Intake Can Become an Uncontrolled Fuel Path

A running diesel engine does not depend only on the fuel delivered by its injection system. If released hydrocarbon vapour reaches the air intake, the engine can burn that external fuel, accelerate beyond its normal governed speed and become an ignition source inside the same gas cloud. Turning off the normal fuel supply may not stop it. The intake location, gas detection, shutdown logic and air-shutoff device therefore form one process-safety barrier.

The hazard mechanism: the engine can draw fuel from the atmosphere

A diesel engine compresses intake air until injected fuel can ignite. When flammable gas or vapour enters with that air, the atmosphere becomes an additional fuel supply. The governor can reduce normal diesel injection, but it cannot control fuel arriving through the intake. Engine speed and temperature may rise, mechanical parts can fail, and a hot surface, exhaust event or backfire can ignite the surrounding cloud.

This interaction matters offshore because temporary and permanent diesel equipment may sit near process areas, vents, drains or work that can release hydrocarbons. Wind and ventilation change which intake is exposed, and a unit outside expected detector coverage may still draw in a plume.

Official offshore evidence

A U.S. offshore investigation published by BSEE's predecessor describes a coil-tubing operation in which gas from an opened gas-buster clean-out path migrated toward a diesel pump engine. Witnesses heard the engine speed increase. The engine then backfired and ignited the gas plume, producing a flash fire around the operator's work station. The investigation also found that an air-intake shutdown on a replacement pump unit was stuck open, the job analysis did not capture the gas and ignition hazards, and the simultaneous-operations planning was inadequate.

NOPSEMA's guidance for vessel facilities warns that gas ingress into machinery spaces can cause diesel-engine runaway, overspeed, excessive temperature, destruction, fire and explosion. It also notes that air-aspirated engines can draw air into a machinery space even without powered ventilation. This means stopping a ventilation fan is not automatically proof that the engine is protected from gas ingress.

Why normal shutdown may not stop the hazard

A normal stop command usually removes the engine's intended fuel. It does not necessarily block an external vapour entering through the intake. A suitable air-shutoff device acts on the other side of the combustion triangle by denying the engine combustion air and the external fuel carried with it. The device, actuator, linkage, position confirmation, overspeed or gas-detection signal, trip logic and final closure all have to work as one function.

United States offshore rule 30 CFR 250.856 requires specified diesel air intakes to have runaway shutdown devices, with different arrangements for attended and unattended engines and stated exceptions. It is jurisdiction-specific, not a universal installation requirement. Every FPSO must apply its own safety case and approved requirements.

Critical controls

Release and dispersion control: identify credible hydrocarbon sources, assess where gas can travel, and include engine intakes in the receptor review. HSE's FPSO cargo-tank venting notice specifically calls for dispersion to machinery intakes and other ignition sources to be evaluated.

Engine siting and intake design: keep temporary and permanent engines outside hazardous exposure where practicable. Confirm intake height and orientation, ventilation paths, exhaust condition, hazardous-area controls and the effect of prevailing and low-wind conditions.

Detection and automatic action: define which detectors can identify the threat, what voting or trip logic applies, which engines stop, and whether an air shutoff closes automatically. Alarm-only protection is weak if a person must reach a local control inside the developing cloud.

Functional assurance: inspect and test the complete shutdown function at approved intervals and before temporary equipment enters service. BSEE Safety Alert 504 recommends verifying air-shutoff devices and alarms, testing according to manufacturer instructions or before use, and independently testing each flap where an engine has more than one.

Hypothetical FPSO example: a temporary generator is downwind

Hypothetical example—not a documented incident: An FPSO plans controlled depressurisation of a hydrocarbon line to the approved disposal system. A temporary diesel generator supporting maintenance is located outside the process module, but its air intake is downwind of a possible low-level release point. The generator's normal emergency stop has been tested; the team has not confirmed the separate intake-shutoff function or the gas detector coverage at the intake.

The operation is paused. The team reviews the release envelope, wind and low-wind cases, generator location, intake path and detector map. They either relocate the generator or establish an approved engineered arrangement with verified automatic shutdown and air isolation. The complete function is tested by competent personnel using the manufacturer's method. The control room receives clear status, stop criteria and responsibility for responding to gas detection. No one assumes that a fuel-solenoid test proves protection against atmospheric fuel.

Leadership actions

Leaders should maintain an inventory of fixed, mobile and hired diesel engines that could encounter hydrocarbons. Procurement and mobilisation checks must cover hazardous-area suitability, air-intake shutdown, detector interfaces, proof-test evidence and impairment management.

Performance standards should connect release scenarios to engine response and safe states. Review temporary equipment whenever venting, SIMOPS, wind restrictions or locations change. A failed intake shutdown is a barrier impairment requiring formal control.

Three practical actions

• Trace the air path: identify every diesel intake that a credible gas release could reach, including temporary units and enclosed machinery spaces.
• Test the full function: verify detector input, logic, actuator, each air flap, position feedback and actual engine shutdown using an approved method.
• Control the change: reassess siting and shutdown protection whenever a generator, pump, venting activity or simultaneous operation is added or moved.

Official video availability

No directly relevant official incident video on offshore diesel-engine gas ingestion was identified during this review. No unrelated animation has been embedded. The official BSEE investigation report provides the primary incident evidence.

Takeaway and team discussion

Key takeaway: if a diesel engine can breathe the gas cloud, its air intake is part of the hydrocarbon-release barrier strategy.

Discussion question: which fixed or temporary diesel engine on our installation could ingest a credible release, and what evidence proves its complete air-shutoff function will work?

Continue in the Process Safety hub, and connect this lesson with complete gas-detection function, SIMOPS control and shutdown-system resilience.

Verified primary references

1. U.S. BSEE predecessor offshore accident investigation: diesel engine backfire ignited a gas plume.
2. U.S. BSEE Safety Alert 504: Malfunction of Rental Generator's Engine Air Shutoff System Led to Fire.
3. NOPSEMA: Vessel facilities subject to external hydrocarbon hazards.
4. UK HSE: Assessment of venting arrangements for cargo oil tanks on FPSO and FSU installations.
5. U.S. eCFR: 30 CFR 250.856—Engines.

Published and sources checked 9 November 2026. Educational discussion only: apply the installation's safety case, hazardous-area classification, engine performance standards, equipment instructions and approved operating procedures.

Discuss this article in the comments →

Register interest in future HSSE email updates