Permit-to-Work

A Permit-to-Work (PTW) system is the shipboard safety management protocol used to control high-hazard work. It forces a documented sequence of hazard identification, isolation of energy sources, atmosphere verification, personal protective equipment specification, communication + rescue planning, and authorised sign-off before work can commence. PTW is required under the ISM Code (SOLAS Ch. IX) and elaborated by OCIMF ISGOTT (International Safety Guide for Oil Tankers and Terminals) + INTERTANKO TSGuide + BIMCO Standards. All modern vessels operate a permit system whose structure follows the same essential logic even where individual forms differ.

The four principal permit types

Hot Work Permit

Covers any work generating heat, sparks, or flame: welding, gas cutting, grinding, disc-cutting, hot-tapping, use of blowtorches. Ignition risk in atmospheres containing HC vapours or flammable dusts. Requires atmosphere test + isolation of fuel + fire watch + first-aid preparedness. On tankers, hot work in cargo areas requires additional inerting + hot-work-in-cargo-area permit under ISGOTT.

Cold Work Permit

Covers non-heat-generating hazardous work: opening pressurised systems, dismantling of piping, work at heights, work over water, handling of hazardous chemicals, work involving energized electrical circuits below the LOTO threshold. Less stringent than Hot Work but still requires atmosphere test + isolation + PPE specification.

Enclosed Space Entry Permit

Covered separately at /reference/enclosed-space-entry. Interlocks with the general PTW system. SOLAS XI-1/7 sets specific requirements.

Working Aloft / Overside Permit

Work above deck level or over the side. Requires harness + fall-arrest attachment + secondary safety line + weather assessment (wind, sea state, temperature). Lifebuoy + boat crew standing by for overside work.

Lockout/Tagout (LOTO) — energy isolation

LOTO (also called "isolation certificate" or "lockout-tagout") is the sub-system for isolating energy sources during maintenance work. Standard LOTO steps:

Identify all energy sources. Electrical (mains + backup), pneumatic, hydraulic, mechanical (springs, gravity, stored motion), thermal, chemical (piped systems).
Notify affected personnel. Bridge, engine room, cargo control all informed of imminent isolation.
Shut down + isolate. Close feed valves, open breakers, disconnect drives, release stored energy (blowdown, bleed).
Lock the isolation devices. Physical padlocks with the maintenance team's key. Multi-lock hasps allow multiple padlocks + multiple maintainers.
Tag the isolation devices. Tag identifies the work team, work order, and date. Prevents inadvertent re-energisation by other crew.
Verify zero energy. Try-out the isolated system (attempt to start, test with meters, check pressure gauges) to confirm de-energisation is real.
Work. Perform the maintenance.
Restore. Remove tags + locks in reverse order. Verify system is safe before restart. Notify affected personnel of restoration.

Roles under the permit system

Issuing Authority. The Master or a designated officer authorised to raise permits. Verifies the work, verifies the isolation, signs the permit before work commences. Usually the Chief Officer for deck work, Chief Engineer for engine work.
Receiving Authority. The person responsible for the work party. Receives the permit + briefing from Issuing Authority, briefs the crew, executes the work, returns the permit for closure on completion.
Isolating Authority. The person who physically isolates the energy sources (typically the Duty Engineer for engine-side, Chief Officer for deck-side).
Fire Watch. Designated crew member with fire-fighting equipment ready during hot work + for 30 minutes after work completes.
Attendant / Buddy. Person stationed outside the space (for enclosed space) or watching the worker (for aloft work). Communicates continuously with the worker.

Permit validity + reissue

Permits are typically valid for a single work shift, up to 12 hours. If work extends beyond the shift, the permit must be closed at shift end and re-issued at the start of the next shift with fresh atmosphere test + fresh sign-off. Conditions that void a permit: change in atmosphere; opening or closing of adjacent compartments; new personnel joining without brief; new hazards emerging (weather change, sea state change, adjacent operations); loss of ventilation.

Interlock with other systems

ISM Code (SOLAS Ch. IX). PTW is a required element of the Safety Management System (SMS). Non-conformance in PTW procedures is a common ISM audit finding.
ISGOTT (product/chemical tankers). Provides tanker-specific permit templates + hot-work-in-cargo-area procedure.
SIRE 2.0 / TMSA. Tanker vetting inspections routinely audit PTW records.
PSC inspection. Port State Control officers can review permit records + hot-work log during inspection. Non-conformance is a Category 1 or 2 finding depending on severity.