Knowledge / Ship systems

Crankcase oil mist: hot spots, detection and protective boundaries

Trace an oil-mist alarm from local heating through aerosol transport and detection to protective action, with a response-delay example and checks on coverage, contamination and crew exposure.

On this page

An oil-mist detector observes a consequence of a developing condition in the crankcase. It does not directly measure every bearing temperature, guarantee that all locations are sampled equally or prove that the engine is safe when its display is quiet. Its value depends on the complete chain from mist formation to timely protective action. Understanding that chain makes maintenance, testing and alarm interpretation more precise without turning a general article into an emergency procedure.

Start with the physical event, not the instrument

A local hot surface can heat lubricating oil and contribute to an aerosol capable of participating in an ignition event under suitable conditions. The initiating defect need not be the one imagined in a generic diagram. Bearing distress, rubbing parts and other abnormal contacts have different causes. The detector is therefore one protective element within a wider engine safety arrangement, rather than a replacement for controlling those initiating mechanisms.

A historical MAIB Safety Digest case concerning European Trader describes an unsuitable damper fastening arrangement, a rubbing hot spot and a subsequent crankcase explosion. The oil-mist alarm preceded the event. This is evidence of one accident sequence, not a typical warning time or failure rate. Its analytical lesson is that an alarm must connect to an effective response, and that mechanical maintenance details can create the initiating heat source.

Separate aerosol, vapour and temperature

Oil mist consists of suspended liquid droplets. Oil vapour, water droplets and hot metal are different physical quantities. An optical device responds to the interaction between light and the material in its measurement path; it does not automatically identify the chemical origin of every particle. A concentration estimate also depends on the instrument’s calibrated principle and the particle characteristics. Avoid treating any optical percentage as a direct bearing-temperature reading.

Units require equal care. An illustrative mass concentration of 0.50 mg/L is 500 mg/m³, because one cubic metre contains 1,000 litres. This is only a unit conversion, not an alarm or explosion threshold. A displayed opacity, an instrument-relative index and a mass concentration cannot be exchanged without the manufacturer’s defined conversion and applicable assumptions.

Trace how a sample reaches the sensing element

Central sampling and distributed sensing have different architectures. The Schaller VN2020 manual shows one arrangement with sample/header pipes, a suction system and an optical measuring head. Its published fault indications include optical and supply-related conditions. This demonstrates that the measurement depends on transport and supporting services, not only on a powered display. The 2019 manual is an architecture example; its settings are not transferred to other models.

Map the protected regions, sampling connections, pipe paths, any scanning arrangement, measuring chamber and signal destination. A sensor responding to a test at its own head does not necessarily demonstrate that mist from the most remote protected location reaches it in time. Pipe routing, obstruction, leakage, condensation and sample flow can all affect what is observed. Coverage and response time therefore require installation-specific evidence.

Build a transparent response-time budget

For a purely illustrative sampling path, assume internal gas volume 0.120 L and actual sample flow 1.20 L/min at that path’s conditions. A plug-flow transport estimate V/Q gives 0.100 min, or 6.0 s. Add invented allowances of 4.0 s for worst-case scanning, 2.0 s for sensing/filtering and 0.5 s for logic/output transmission. If these stages occur sequentially, the illustrative total is 12.5 s. None of these values describes an identified detector.

If the sample flow falls to 0.60 L/min and the other assumed delays remain unchanged, the transport term becomes 12.0 s and the total becomes 18.5 s. The simple result shows why degraded flow can matter even if the sensor electronics are healthy. It is not a validated response model: dispersion, droplet loss, changing source concentration and overlapping stages can alter the actual response. The available time before an adverse event must be established separately; it cannot be inferred from this arithmetic.

Treat fault indication and process alarm differently

A high-mist alarm reports a detected process condition according to the device logic. A detector fault reports that the protective measurement may be impaired. A disconnected sample line can produce a reassuringly low reading while removing coverage; a dirty optical path can produce another kind of abnormal indication. The operating team needs to know which state is being reported and which parts of the protection remain available.

The absence of an alarm is evidence only within the system’s demonstrated capability and current health. It is especially weak evidence when readiness, sample flow or coverage is uncertain. Likewise, clearing an alarm display does not demonstrate that the initiating heat source or aerosol condition has disappeared. A record should separate acknowledgement, reset, restored detector health and resolution of the underlying engine condition.

Investigate contamination without assuming a nuisance alarm

A Schaller technical bulletin retained in an NTSB docket discusses condensed water in sampling pipes and the measuring head as a cause of unwanted alarms for the listed older detector types. That documented possibility does not justify treating a new alarm as harmless water. The engine condition and the instrument condition are separate hypotheses, and both need appropriate evidence.

Repeated alarms can create pressure to disable, desensitize or ignore a detector. That response silently changes the protective function and may conceal a developing fault. The relevant question is why the alarm occurs, whether the system remains capable and how the applicable approved process handles any impairment. Generic examples do not authorize changing a threshold or bypassing a protective output.

Check the complete protective chain

A meaningful functional test defines its starting point and its acceptance criterion. Testing a lamp or a software input is different from testing aerosol transport, sensing, alarm transmission and the intended protective response. Identify which portion was actually challenged and which portion was only inspected or assumed. Confirm that any test-induced isolation or temporary configuration was restored and that the recorded final state is credible.

Multiple protective devices are not automatically independent. Oil-mist sensing, bearing-temperature monitoring, engine logic and power supplies may have shared dependencies. A common loss of power or an incorrect maintenance state can affect more than one function. The system analysis should show those dependencies explicitly, and distinguish prevention, detection and explosion-pressure relief rather than crediting each as the same type of barrier.

Include pressure control and crew location

IACS’s explanation of its M10 revision identifies interactions between crankcase pressure control, forced extraction and oil-mist detection, particularly for gas or low-flashpoint fuels. It also distinguishes explosion-relief provisions and other safety measures. This is a public overview of class requirements; the applicable detailed rules, engine scope and implementation dates must be checked for an actual installation. It is not a blanket retrofit instruction.

A more recent, specific example is Everllence’s September 2026 service letter SL2026-789. For the named two-stroke engine scope, it addresses detector relocation during upgrades because personnel inspecting equipment near relief valves can be exposed during an alarm event. The useful general lesson is to include human access and the direction of potential discharge in the protection assessment. A readable local display is not automatically a safe place to approach.

Keep the event record useful for learning

An event record should include the first indication, detector health and sample-flow information, engine load, associated temperatures and pressures, signal timestamps and the protective actions actually observed. Preserve differences between local and remote indications. Record recent maintenance, sampling-line changes or detector replacement, because those changes can alter coverage and response without changing the display label.

Interpretation should identify what the evidence establishes and what remains unresolved. A successful test afterwards may prove the tested function at that time; it does not reconstruct every earlier condition or prove that no damage occurred. During an actual alarm or suspected crankcase event, the vessel’s approved emergency procedures govern. The purpose of the engineering model is to make those protective assumptions visible and testable, not to encourage approaching or opening a potentially hazardous crankcase.

Sources