Permits to Work on Deck

A permit is not evidence that work may proceed. It is evidence that someone confirmed it was safe to proceed. If no one confirmed anything, the signature is a lie on company letterhead.

Introduction

Every serious maritime casualty investigation involving maintenance or non-routine work asks the same question early: was a permit to work issued? And almost always, the answer is yes. The permit existed. It was signed. It was filed. And it changed nothing, because nobody treated it as what it is — a live control barrier that must trigger real checks by real people in the real workspace before the first tool comes out of the locker.

The permit-to-work system is one of the few points in shipboard safety management where the SMS explicitly demands that someone stops, goes to the site, verifies conditions, and then — only then — authorises exposure. It sits at the intersection of planning, authority, communication, and physical verification. When it works, it catches the thing that would have killed someone. When it fails, it does something worse than nothing: it creates a paper trail that says the checks were done, which discourages anyone else from checking again.

This article is not about how to fill in a permit form. It is about what permits are supposed to do, why they fail, and what the patterns of failure look like on a working deck.

Contents

• 1. The Permit as a Control Barrier
• 2. Categories of Permit and What Each One Guards Against
• 3. The Chain of Authority: Who Issues, Who Signs, Who Accepts, Who Monitors, Who Closes Out
• 4. Pre-Work Checks the Permit Is Supposed to Trigger
• 5. The False Paper Trail
• 6. Escalation When the Permit Is Unclear
• 7. Common Failures on Deck
• 8. Closing Reality

1. The Permit as a Control Barrier

A permit to work is not an administrative task. It is a physical barrier. It belongs in the same conceptual category as a locked valve, a blanked flange, or a tested atmosphere. Its function is to prevent harm by forcing a structured pause between the intention to do work and the commencement of work, during which specific hazards are identified and specific precautions are verified at the work site.

The Swiss cheese model applies directly. The permit is one slice. The toolbox talk is another. The risk assessment is another. The physical isolation is another. But the permit is the slice that is supposed to confirm all the other slices are in place. It is a verification layer. If it is completed without verification, the slice has a hole in it the exact size and shape of whatever is about to go wrong.

A permit that lives only on the clipboard in the CCR is not a barrier. It is furniture.

The distinction matters because it determines how the document is treated. If a permit is understood as paperwork, it will be completed at a desk, often in bulk, often in advance, often by someone who has not visited the space. If it is understood as a control, it will be completed at the site, one task at a time, by someone with the authority and competence to confirm conditions.

2. Categories of Permit and What Each One Guards Against

Most shipboard SMS frameworks recognise a core set of permit categories. The names vary between companies; the hazards they guard against do not.

Hot Work

Welding, burning, grinding — any operation producing heat, sparks, or open flame. The hazard is ignition: of cargo residues, tank atmospheres, paint, insulation, hydraulic oil, or combustible material on the other side of a bulkhead. A hot work permit demands atmospheric testing, fire watch, and confirmation that adjacent spaces have been checked. On deck, this is routinely the most abused permit category. Grinding a pad-eye on the fo’c’sle feels benign. It is not, if the chain locker below has been freshly painted and the vent is open.

Cold Work

Mechanical work that does not produce ignition sources but involves breaking containment, working on pressurised systems, or opening pipelines. The hazard is uncontrolled release of energy or substance. Cold work permits are often overlooked because the work feels routine. Unbolting a hydraulic connection on a deck crane is cold work. It requires isolation and depressurisation to be confirmed, not assumed.

Enclosed Space Entry

The permit that guards against the single most lethal scenario in merchant shipping. Atmosphere testing, ventilation, rescue arrangements, communication, and a standby person are non-negotiable preconditions. The enclosed space permit is not simply a form — it is, in practice, the last line of defence against the oxygen-depleted or toxic environment that gives no warning. This category deserves and receives its own detailed treatment elsewhere on this site, but the principle here is absolute: no atmospheric reading, no entry. No standby, no entry. No rescue plan, no entry.

Every enclosed space fatality investigation finds a permit. Almost none of them find the atmospheric readings that should have preceded it.

Working Aloft

Any task requiring a person to work above deck level where a fall would cause injury. The permit triggers confirmation of harness condition, anchor points, tool lanyards, weather assessment, and communication with the bridge (to prevent mast or crane movement). The hazard is gravity. It is always present and does not fluctuate with cargo type.

Working Over the Side

Staging, painting, hull work from rafts or platforms. The permit must confirm lifejacket provision, communications, a dedicated lookout, propulsion and thruster lockout, and notification to the bridge. The hazard is immersion, crushing, or propeller contact. At anchor or alongside, this category overlaps with port requirements and may require coordination with the terminal.

Diving Operations

Typically managed by specialist dive teams, but the vessel’s permit system must interface with the dive plan. The ship’s obligation is to confirm propulsion and discharge lockout, cathodic protection isolation, and communication protocols. The permit is the ship’s formal acknowledgement that it has made the hull environment safe for the diver.

Electrical Isolation

Any work on electrical systems requiring lockout/tagout. The hazard is electrocution or unintended energisation. The permit confirms that circuits have been isolated, tested dead, earthed where necessary, and that the person performing the work holds the lock and the tag. On deck, this most commonly applies to cargo gear, deck lighting circuits, and heating coils.

These categories are not decorative. Each one exists because people died doing exactly that type of work without exactly those precautions.

3. The Chain of Authority: Who Issues, Who Signs, Who Accepts, Who Monitors, Who Closes Out

The permit chain is a chain of accountability, and every link must be a different person with a distinct role. When the chain collapses into one or two people, the system is dead.

The Issuing Authority is the senior officer authorised to grant permission for the work — typically the Master or Chief Officer for deck permits, the Chief Engineer for engine-side permits. The issuing authority confirms that preconditions are met and the risk assessment is adequate. This person must visit the site or have it verified by a competent delegate before signing.

The Responsible Person (or Performing Authority) is the person who will lead or carry out the work. This person signs to confirm they understand the scope, the hazards, the precautions, and the boundaries of the permit. They accept the permit, not just the task.

The Monitoring Authority is whoever is responsible for ongoing oversight — the OOW, the duty officer, the safety officer. Monitoring is not passive. It means checking that conditions have not changed: wind has not shifted, atmosphere has not deteriorated, tide has not altered freeboard. Monitoring authority is often the weakest link because it is assigned by default to whoever has the watch, and that person may have six other responsibilities competing for attention.

Close-Out is the formal confirmation that work is complete, the space is restored to its normal condition, all personnel are accounted for, and no residual hazard remains. Hot work permits carry an additional requirement: fire watch for a defined period after work stops. Close-out must be signed by both the responsible person and the issuing authority. An unclosed permit is an open wound in the safety system — it implies work may still be in progress, or that conditions have not been restored.

If the same person issues the permit and performs the work, there is no independent check. There is only one person’s opinion, written down twice.

4. Pre-Work Checks the Permit Is Supposed to Trigger

The permit form is a checklist, but the purpose of the checklist is not to be ticked. The purpose is to force the person with authority to physically confirm conditions before signing. Each tick should correspond to a verifiable action.

For a hot work permit on deck, the pre-work checks include:

• Atmospheric testing of adjacent enclosed spaces where flammable or toxic atmospheres may exist.
• Inspection of the work area for combustible materials, paint stores, oily rags, cargo residues.
• Confirmation that fire-fighting equipment is laid out and ready — not stowed in the nearest locker, but physically present at the site.
• Verification that the area below, behind, and adjacent to the hot work point has been inspected for fire risk.
• Confirmation that a dedicated fire watch has been posted and briefed.
• Communication with the bridge regarding the work location, especially if near aerials, navigation lights, or vent heads.

For an enclosed space entry permit, the checks include atmosphere testing at multiple levels, confirmation of ventilation, deployment of rescue equipment at the entrance, confirmation of communications, and a muster of all persons entering.

The specific checks vary by category, but the principle is constant: the permit does not record an intention. It records a confirmed state. If the atmosphere was not tested, the box must not be ticked. If the fire extinguisher was not laid out, the box must not be ticked.

A tick without a check is a lie. And lies on permits kill people.

5. The False Paper Trail

This is the central failure mode of the entire permit-to-work system, and it is endemic in the industry.

A signed permit without the checks done is worse than no permit at all.

Without a permit, there is at least the possibility that someone will notice the absence and stop the work. With a signed permit, the assumption is that checks have been completed. The document actively discourages further questioning. It radiates authority. It says: this has been assessed, this has been authorised, proceed.

If the assessment was not done, the permit is not a safety document. It is a liability document. It tells the flag state investigator, the P&I surveyor, and the prosecutor exactly who signed off on a fiction.

The false paper trail usually starts with time pressure. The work needs to happen now. The bosun is waiting. The Chief Officer is on the bridge for arrival. The permit gets signed at the desk, the boxes get ticked from memory or habit, and nobody goes to the forepeak to check whether the atmosphere is actually safe.

The most dangerous moment in shipboard maintenance is not when the grinder starts. It is when the pen touches the permit and nobody has been to the site.

Port State Control inspectors and vetting inspectors have learned to cross-examine permits: when was the atmospheric reading taken? With which instrument? Who calibrated it? Where is the calibration log? If the answers do not align, the permit is void regardless of the signatures on it. And the ship has a finding that goes beyond paperwork — it speaks to the integrity of the safety culture aboard.

6. Escalation When the Permit Is Unclear

Permits sometimes present ambiguity. The scope of work changes. The conditions described on the form no longer match the conditions at the site. A check cannot be completed because the required equipment is defective. The weather has shifted and the original risk assessment no longer holds.

In every case, the correct response is to stop work and escalate.

The escalation path is straightforward: the responsible person informs the issuing authority. The issuing authority reassesses. If the issuing authority cannot resolve the ambiguity, the Master is informed. If the work involves contractors or class, the DPA or technical superintendent may need to be consulted.

What actually happens, too often, is that the responsible person makes a judgment call on site and continues working. The permit remains as issued. The gap between what was authorised and what is happening grows. And if something goes wrong, the investigation will find a permit that authorised work under conditions that no longer existed.

A permit is valid for the conditions it was issued under. When conditions change, the permit is dead. It must be reissued or the work must stop.

There is no grey area here. The system does not accommodate drift. A permit is binary: valid or invalid. If any precondition has changed, the answer is invalid until proven otherwise.

7. Common Failures on Deck

Certain failure patterns appear repeatedly in incident reports, PSC detentions, and casualty investigations. They are worth naming directly because they are present on ships right now.

Blanket Permits for Whole Shifts

A single permit issued at 0800 to cover all maintenance work on deck until 1700. This is not a permit. It is a general licence. It cannot possibly reflect specific conditions at specific locations for specific tasks. It eliminates the structured pause that is the entire point of the system. If the bosun is grinding on the poop deck at 0800 and chipping in the paint store at 1400, those are two different hazard profiles requiring two different assessments.

A blanket permit is a blank cheque written against the crew’s safety. It always bounces.

Self-Issued Permits

The person requesting the work is the same person who issues the permit. This is the most fundamental structural failure. The independent check — the entire reason the issuing authority exists as a separate role — is eliminated. The person assesses their own work, authorises their own exposure, and monitors their own compliance. No competent auditor would accept this, and no investigation will treat it as anything other than a systemic breakdown.

Permits That Survive Changed Conditions

A hot work permit issued at 0900 in calm conditions. By 1100, the wind has shifted and is now blowing sparks toward an open vent. The work continues because the permit is still valid — it was signed this morning, it covers until 1600. This is the drift-to-failure that Sidney Dekker wrote about. The permit was valid at 0900. It stopped being valid the moment the wind changed. Nobody cancelled it because nobody was monitoring.

Permits Completed After the Work

Retrospective permits. Work was done, the paperwork caught up later. This is not uncommon, particularly with minor tasks that escalated or with overnight work that the day team discovers and documents after the fact. A retrospective permit is not a permit. It is a confession that no permit system was in place when the exposure occurred.

Permits With No Close-Out

Stacks of permits in the safety file, signed and issued, with the close-out section blank. Each one represents work that, on paper, may still be in progress. Each one represents a space that may not have been restored to normal condition. The close-out is not optional. It is the confirmation that the hazard window has been shut.

8. Closing Reality

A permit to work is the last deliberate decision before a person is exposed to a hazard that can maim or kill them. It is not paperwork. It is not compliance. It is not a box to be ticked for the vetting inspector.

It is a control barrier. It exists to force a pause, a visit to the site, a physical check, a conscious authorisation by someone with the rank and competence to say: I have confirmed the conditions, and this work may proceed safely.

When that pause is skipped, when the pen moves faster than the feet, when the signature lands before the atmospheric reading, the permit becomes the most dangerous document on the ship. It tells everyone the checks were done. It tells no one they were not.

A signed permit without the checks done is worse than no permit at all. It is the industry’s most reliable path from complacency to catastrophe.