{"id":51729,"date":"2026-04-17T23:40:28","date_gmt":"2026-04-17T22:40:28","guid":{"rendered":"https:\/\/maritimehub.co.uk\/?p=51729"},"modified":"2026-04-17T23:40:28","modified_gmt":"2026-04-17T22:40:28","slug":"hot-work-in-tanks-and-enclosed-spaces","status":"publish","type":"post","link":"https:\/\/maritimehub.co.uk\/hot-work-in-tanks-and-enclosed-spaces\/","title":{"rendered":"Hot Work in Tanks and Enclosed Spaces"},"content":{"rendered":"
\n

ON DECK -> Working at Height & Enclosed Spaces<\/strong><\/p>\n

Position on Deck<\/strong><\/p>\n

Operation Group:<\/strong> Safety \/ Enclosed Spaces \/ Hot Work<\/p>\n

Primary Role:<\/strong> Control of ignition sources and atmospheric hazards during welding, burning, or grinding inside tanks and confined spaces<\/p>\n

Interfaces:<\/strong> Master, Chief Officer, Chief Engineer, Responsible Person, Competent Person (gas testing), fire party, shipyard (if alongside), Class surveyor, flag state<\/p>\n

Operational Criticality:<\/strong> Absolute — two independently fatal risk regimes overlap in a single operation<\/p>\n

Failure Consequence:<\/strong> Explosion, fire, or toxic atmosphere inside a space with limited egress. Multiple fatalities in a single event. Vessel loss not unknown.<\/p>\n<\/div>\n

Two deadly regimes, one steel box, and a spark. Everything that can go wrong will go wrong simultaneously.<\/em><\/p>\n

Introduction<\/h2>\n

Hot work on an open deck already demands a controlled environment: atmosphere, fuel sources, ignition control, fire watch. Enclosed space entry already demands its own layered defences: atmosphere testing, ventilation, communication, rescue readiness. Put the two together and the margin for error does not halve. It vanishes.<\/p>\n

This is not a theoretical concern. The maritime casualty record is littered with events where a welder entered a tank that had been declared safe, struck an arc, and never came out. In several cases, would-be rescuers followed and died in the same atmosphere. The common thread is not incompetence. It is the quiet erosion of each individual safeguard—a meter not zeroed, a bulkhead not checked, a fire watch released ten minutes early—until the permit becomes a signed piece of paper protecting nothing.<\/p>\n

The purpose of this article is to lay out the real failure modes, not the textbook procedure. Any officer can recite the permit conditions. The question is whether each one is actually fulfilled, every time, with the same rigour at 1600 on a Friday as at 0800 on a Monday.<\/p>\n

Contents<\/h2>\n
    \n
  • 1. The Overlap That Kills<\/li>\n
  • 2. Permit Conditions — What the Paper Actually Demands<\/li>\n
  • 3. Atmosphere Testing: The Competence Behind the Reading<\/li>\n
  • 4. Pyrophoric Residues and Crude Oil Tanks<\/li>\n
  • 5. Adjacent Compartments — The Forgotten Hazard<\/li>\n
  • 6. Fire Watch: Duration, Discipline, and the Common Failure<\/li>\n
  • 7. Ventilation — Continuous Means Continuous<\/li>\n
  • 8. Common Failures and How They Compound<\/li>\n
  • 9. Closing Reality<\/li>\n<\/ul>\n

    1. The Overlap That Kills<\/h2>\n

    Enclosed space entry and hot work are each, independently, among the highest-risk routine operations on a vessel. Each has its own permit system. Each has its own history of fatalities. When the two overlap, the resulting hazard profile is not additive. It is multiplicative.<\/p>\n

    An enclosed space presents atmospheric risk: oxygen deficiency, toxic gases, flammable vapour. Hot work introduces an ignition source into that atmosphere. More than that, it introduces heat into steel boundaries that connect to other spaces, generates fumes that alter the atmosphere being breathed, and creates slag and sparks that can travel to places no one considered.<\/p>\n

    A confined space forgives very little. Add a naked flame and it forgives nothing at all.<\/em><\/p>\n

    The phrase ‘just a small weld’ has preceded multiple fatal casualties. The size of the weld is irrelevant. A single spark in a flammable atmosphere produces the same explosion whether the welding rod was lit for two seconds or two hours. The energy required to ignite a hydrocarbon-air mixture within the flammable range is measured in fractions of a millijoule. A welding arc delivers thousands of joules per second.<\/p>\n

    There is no such thing as a small hot work job in an enclosed space. There is only a controlled one or an uncontrolled one.<\/p>\n

    2. Permit Conditions — What the Paper Actually Demands<\/h2>\n

    The hot work permit for an enclosed space is not a single document in isolation. It sits on top of the enclosed space entry permit, which must itself be valid and current. If the enclosed space permit has expired or its conditions have changed, the hot work permit built on top of it is void. This dependency is frequently overlooked.<\/p>\n

    The core conditions, stripped of company-specific formatting, are consistent across the industry:<\/p>\n

      \n
    • Atmosphere tested and confirmed safe—oxygen within range (21% by volume), LEL below 1%, toxic gases below threshold limit values.<\/li>\n
    • Continuous ventilation maintained throughout the operation.<\/li>\n
    • Adjacent spaces identified, checked for flammable or combustible contents, and where necessary inerted or emptied.<\/li>\n
    • Fire watch posted at the work site with appropriate extinguishing equipment immediately to hand.<\/li>\n
    • Firefighting equipment standing by outside the space—typically a charged hose, additional extinguishers, and breathing apparatus for the rescue team.<\/li>\n
    • Communication confirmed between the worker, the fire watch, the attendant at the entrance, and the bridge or control point.<\/li>\n
    • Re-testing of the atmosphere at defined intervals during the work, and immediately if ventilation is interrupted for any reason.<\/li>\n<\/ul>\n

      Every one of these conditions is a hard requirement. Not a recommendation. Not a guideline. A condition. If any single one is not met, the permit is not valid, and the work does not proceed.<\/p>\n

      A signed permit without the checks done is worse than no permit at all. It creates the illusion of safety where none exists.<\/em><\/p>\n

      3. Atmosphere Testing: The Competence Behind the Reading<\/h2>\n

      The atmosphere must be tested before entry, before hot work begins, and at regular intervals throughout. The instrument used must be appropriate, in calibration, and operated by someone who understands what the readings mean—not merely how to switch it on.<\/p>\n

      A multi-gas detector reading 20.9% oxygen and 0% LEL is not, by itself, a declaration of safety. The reading is only as good as the calibration behind it, the location where the sample was taken, and the competence of the person interpreting it.<\/p>\n

      LEL meters drift. They require calibration gas checks at the intervals specified by the manufacturer, which on most instruments means before each day of use. A meter that has not seen calibration gas in six months may read zero in an atmosphere that would kill. This is not a theoretical failure. Investigation reports have identified out-of-calibration instruments as a direct causal factor in enclosed space fatalities.<\/p>\n

      Sampling location matters. Hydrocarbon vapours heavier than air settle in bilges, cofferdams, and lower sections of tanks. A reading taken at the manhole does not represent the atmosphere at the tank bottom where the welder will be working. Samples must be drawn from the actual work location, and from the lowest accessible point in the space.<\/p>\n

      The meter tells the truth only if it has been taught what the truth looks like. An uncalibrated instrument is a random number generator.<\/em><\/p>\n

      Where a space has previously contained hydrocarbons, residual vapour can be released from scale, sediment, coatings, and corrosion products during the heating process itself. An atmosphere that reads safe before welding begins may not remain safe once heat is applied to contaminated steel. This is why re-testing during the work is not optional.<\/p>\n

      4. Pyrophoric Residues and Crude Oil Tanks<\/h2>\n

      Crude oil tanks present a specific and well-documented hazard that goes beyond flammable vapour. The internal surfaces of tanks that have carried crude oil, particularly sour crude, develop layers of rust scale containing iron sulphide (FeS). This compound forms when hydrogen sulphide in the cargo reacts with the steel of the tank structure over time.<\/p>\n

      Iron sulphide is pyrophoric. It ignites spontaneously on contact with air.<\/p>\n

      This is not a marginal risk. It is a certainty under the right conditions. When a crude oil tank is opened, washed, and ventilated, the scale on frames, brackets, and horizontal surfaces dries out. As moisture evaporates, the iron sulphide oxidises. If this oxidation is uncontrolled—if the scale dries too quickly, or is disturbed mechanically—it can self-ignite at ambient temperature. No spark is needed. No welding arc. The scale itself becomes the ignition source.<\/p>\n

      Now introduce hot work. A grinder or cutting torch applied to steel coated in iron sulphide scale does not merely risk ignition from the tool. It guarantees ignition of the scale itself, which then acts as a sustained ignition source for any residual hydrocarbon vapour present.<\/p>\n

      The precautions for hot work in tanks that have carried crude oil are accordingly more stringent. The scale must be removed or kept wet. Tank washing must be thorough enough to remove not just liquid cargo but the chemical deposits on structural steel. In many cases, the only safe approach is to chemically treat the surfaces before any hot work is contemplated.<\/p>\n

      Rust that burns. The phrase sounds absurd until the investigation report lands on the desk.<\/em><\/p>\n

      Gas-freeing a crude oil tank to achieve a zero LEL reading does not eliminate the pyrophoric hazard. The gas detector does not measure iron sulphide. A clean atmosphere reading and a deck of dry, FeS-laden scale is a combination that has caused explosions on tankers that were supposedly safe for hot work.<\/p>\n

      5. Adjacent Compartments — The Forgotten Hazard<\/h2>\n

      Steel conducts heat. This elementary fact is routinely forgotten in hot work planning.<\/p>\n

      A welding operation on a tank bulkhead transfers heat through that bulkhead to whatever is on the other side. If the adjacent space contains flammable vapour, cargo residue, paint stores, lube oil, or any combustible material in contact with or close to the heated surface, ignition can occur without any flame, spark, or personnel ever entering that space.<\/p>\n

      The permit system requires identification and checking of all adjacent compartments. In practice, this means every space that shares a boundary with the hot work location: the tank above, the tank below, the tanks on either side, the void space behind the longitudinal bulkhead, the pipe tunnel running beneath. Not just the obvious neighbour. Every steel surface that could conduct heat from the work site to a fuel source.<\/p>\n

      On a tanker, this check extends to cargo tanks, slop tanks, pump rooms, and cofferdams adjacent to the work site. On a bulk carrier, it includes topside tanks, hopper tanks, and any void space abutting the hold where work is taking place. On container ships, the cell guide structure connects hold plating to the weather deck—heat applied low in the hold can travel further than expected.<\/p>\n

      The fire does not always start where the welder is standing. It starts where no one thought to look.<\/em><\/p>\n

      Where adjacent spaces cannot be confirmed free of flammable material, the work does not proceed. There is no acceptable risk level for igniting a cargo tank through a bulkhead.<\/p>\n

      6. Fire Watch: Duration, Discipline, and the Common Failure<\/h2>\n

      A fire watch is posted at the hot work site for the duration of the work and for a defined period after the work ends. The industry standard minimum is one hour after the last application of heat. For heavy cutting, prolonged welding, or work on thick plate, this period extends—some operators and yards mandate two hours or more.<\/p>\n

      The purpose of the fire watch after hot work has ended is to detect smouldering material, slow-developing fires in concealed spaces behind the work area, and reignition of residues. Steel retains heat long after the arc is extinguished. Slag can remain above ignition temperature for combustible materials for extended periods. A fire that starts forty-five minutes after the welder has packed up and left is not uncommon.<\/p>\n

      The most frequently documented failure in fire watch practice is ending the watch when the work ends. The welder finishes, the fire watch packs up, both leave the space. This is the precise moment when an undetected smoulder develops into a fire, in a space that now has no one observing it and potentially reduced ventilation if fans have been secured.<\/p>\n

      A fire watch is not a spectator. The person assigned must have the means to fight a fire immediately—extinguisher within arm’s reach, not at the tank top. They must have communication to the outside. They must remain in the space, alert, for the full mandated period. Assigning the fire watch to someone who is also performing other duties, or who is fatigued from a full watch rotation, is a systemic failure dressed up as compliance.<\/p>\n

      The fire watch exists for the hour after the welder leaves. That is when it earns its keep.<\/em><\/p>\n

      7. Ventilation — Continuous Means Continuous<\/h2>\n

      Mechanical ventilation must be maintained throughout hot work in an enclosed space. This serves three purposes simultaneously: it sustains a breathable atmosphere, it dilutes any flammable vapour released by heating of contaminated surfaces, and it removes welding fumes that would otherwise accumulate to toxic concentrations in a confined volume.<\/p>\n

      The ventilation arrangement must deliver air to the work location, not merely to the tank top. A fan blowing into a manhole does not ventilate the bottom of a deep centre tank. Ducting or extension trunking is needed to direct airflow to where the work is actually happening.<\/p>\n

      If ventilation stops for any reason—power failure, fan trip, duct displacement—hot work stops immediately. Not after the current pass is finished. Not after the rod is consumed. Immediately. The atmosphere must then be re-tested before work resumes.<\/p>\n

      Welding in a confined space generates fumes containing manganese, chromium, nickel, and other metallic compounds depending on the electrode and base metal. In the open air, these fumes disperse. Inside a tank, they concentrate. Prolonged exposure without adequate extraction causes metal fume fever in the short term and serious respiratory disease in the long term. The welder may not notice the accumulation. The fire watch may not either. Continuous forced ventilation is the only reliable control.<\/p>\n

      Ventilation is not a comfort measure. It is a survival system.<\/em><\/p>\n

      8. Common Failures and How They Compound<\/h2>\n

      Individual failures in hot work control are dangerous. Combined failures are catastrophic. And the nature of organisational failure is that they rarely occur in isolation.<\/p>\n

      The documented pattern is consistent across dozens of investigation reports:<\/p>\n

        \n
      • LEL meter out of calibration.<\/strong> The atmosphere is declared safe based on a reading that cannot be trusted. No one queries it because the reading matches expectations.<\/li>\n
      • Adjacent tank not checked.<\/strong> The permit requires it. The box is ticked. No one physically entered or tested the adjacent space. Heat conducts through the bulkhead into a space containing cargo residue.<\/li>\n
      • Fire watch ended when work ended.<\/strong> The welder left. The fire watch left. The smoulder became a fire in an unattended, unventilated space.<\/li>\n
      • Ventilation secured prematurely.<\/strong> The fan was needed for another job. Or the noise was a nuisance. Or the extension lead was too short. The atmosphere in the space changed within minutes.<\/li>\n
      • Permit rolled over without re-assessment.<\/strong> The hot work permit was issued at 0800. The conditions were checked at 0800. At 1400, after a lunch break and a cargo operation in the adjacent tank, the work resumed on the same permit without re-testing.<\/li>\n
      • Rescue team not briefed or not standing by.<\/strong> The enclosed space entry permit requires a rescue team. The hot work permit requires firefighting readiness. Neither was actually in position.<\/li>\n<\/ul>\n

        None of these failures, individually, is dramatic. None involves overt recklessness. Each is a quiet omission, a small shortcut, a minor economy of effort. Stacked together, they remove every layer of defence that stood between a routine maintenance task and a body recovery operation.<\/p>\n

        The casualty investigation never finds one failure. It finds six. And every single one was survivable on its own.<\/em><\/p>\n

        9. Closing Reality<\/h2>\n

        Hot work inside a tank or enclosed space is the highest-risk planned maintenance activity on a vessel. It combines an ignition source with a potentially flammable or toxic atmosphere inside a steel box with limited escape routes. The permit regime that governs it exists because people have died, repeatedly, in exactly the configuration being described.<\/p>\n

        The permit is not the safety system. The permit is the written record that the safety system was implemented. The actual safety system is: a calibrated meter in the hands of a competent person, a genuinely checked adjacent compartment, a fire watch who stays for the full duration, ventilation that runs uninterrupted, and a rescue team that is actually standing by with actual equipment.<\/p>\n

        Every condition on that permit represents a lesson written in a fatality report. Skip one, and the same lesson will be taught again.<\/p>\n","protected":false},"excerpt":{"rendered":"

        Hot work inside confined spaces sits at the intersection of deck’s two deadliest operations. The permit regime exists because people died.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"fifu_image_url":"","fifu_image_alt":"","c2c-post-author-ip":"2a02:c7c:2ef8:2400:931:afb1:9971:4a62","footnotes":""},"categories":[1,14],"tags":[9370,9381,9375,9386,9220,9366,9387,9388],"class_list":["post-51729","post","type-post","status-publish","format-standard","hentry","category-latest","category-on-deck","tag-atmosphere-testing","tag-confined-space-entry","tag-enclosed-spaces","tag-fire-watch","tag-hot-work","tag-permit-to-work","tag-pyrophoric-iron-sulphide","tag-tank-safety"],"acf":[],"_links":{"self":[{"href":"https:\/\/maritimehub.co.uk\/?rest_route=\/wp\/v2\/posts\/51729","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/maritimehub.co.uk\/?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/maritimehub.co.uk\/?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/maritimehub.co.uk\/?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/maritimehub.co.uk\/?rest_route=%2Fwp%2Fv2%2Fcomments&post=51729"}],"version-history":[{"count":1,"href":"https:\/\/maritimehub.co.uk\/?rest_route=\/wp\/v2\/posts\/51729\/revisions"}],"predecessor-version":[{"id":51732,"href":"https:\/\/maritimehub.co.uk\/?rest_route=\/wp\/v2\/posts\/51729\/revisions\/51732"}],"wp:attachment":[{"href":"https:\/\/maritimehub.co.uk\/?rest_route=%2Fwp%2Fv2%2Fmedia&parent=51729"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/maritimehub.co.uk\/?rest_route=%2Fwp%2Fv2%2Fcategories&post=51729"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/maritimehub.co.uk\/?rest_route=%2Fwp%2Fv2%2Ftags&post=51729"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}