Sub-topic · 9 min read · ETO & Electrical
ETO → Fundamentals, Safety & Distribution
Operation Group: ETO / Electrical Engineering — Safety
Primary Role: Ensuring electrical isolation, hazard control, and safe working practice on energised systems from 230 V single-phase up to 11 kV three-phase.
Interfaces: Chief Engineer, second engineer, ETO, electrical ratings, contractors, manufacturer commissioning engineers, classification surveyors during witness tests.
Operational Criticality: Absolute. The boundary between routine maintenance and a fatality is a written permit, a tested isolation, and an honest answer to the question is it dead.
Failure Consequence: Electrocution. Arc-flash burns — survivable injuries are rare above 11 kV and uncommon at 6.6 kV. Equipment destroyed by uncontrolled fault current. Vessel left without power. Criminal investigation, MAIB report, P&I claim, loss of competency endorsement.
The cable does not know your name. It does not know that you are tired, or that the chief said it was off, or that the indicator lamp went out. It only knows whether it is energised.
Introduction
Most electrical injuries on ships do not happen because someone made a daring decision. They happen because someone made an assumption — that the breaker was open, that the indicator was reliable, that the colleague who isolated it had done so correctly, that the residual voltage had bled off, that low voltage is not dangerous.
The discipline of electrical safety on a ship is the discipline of replacing every assumption with a verified fact. The procedure that does this is lockout/tagout (LOTO), the hazard analysis that quantifies it is arc-flash assessment, and the legal framework that authorises the work is the permit-to-work system, with HV work imposing additional procedural layers on top of all of it.
These are not separate topics. They are one continuous safety system, and a weakness in any link breaks the whole chain.
Contents
- The Permit-to-Work Discipline
- Lockout/Tagout: What Each Word Actually Means
- Proving Dead: The Step Most Often Skipped
- Earthing Down on HV Systems
- Arc-Flash: The Hazard People Underestimate
- PPE Categories and What They Actually Protect Against
- The HV-Specific Procedural Layer
- Working on Live Equipment — When and Why Not
- Closing Reality
1. The Permit-to-Work Discipline
Every significant electrical task on a ship — and many that do not feel significant — should be authorised through a permit-to-work. The permit is not a form. It is a contract between the person authorising the work and the person doing it, and it specifies four things: what is being worked on, who has isolated it, who has tested it dead, and what the limits of the work are.
A permit signed by a chief engineer who has not personally verified the isolation is a permit that has failed before the work has started. The signature is not authorisation; it is acknowledgement that the steps below it have been completed correctly.
The permit closes when the work is complete, the system is restored to a safe condition, and the authorising engineer has confirmed it. A permit left open at watch handover is a permit that no longer means anything, because the conditions it described may no longer be true.
A permit is a snapshot of the ship’s safe state at the moment it was signed. Every hour after that, its accuracy decays.
2. Lockout/Tagout: What Each Word Actually Means
Lockout means a physical device — a padlock, a hasp, a mechanical interlock — that prevents the energising of equipment until the device is removed. The lock is applied by the person doing the work, and only that person has the key.
Tagout means a written tag attached to the isolation point, identifying the work, the worker, the date, and the reason. The tag is information; the lock is enforcement. Tagout without lockout is paperwork. Lockout without tagout is anonymous and dangerous.
The principle is simple and unforgiving: one isolation, one lock, one key, one person. If two people are working on the same circuit, each applies their own lock. The circuit cannot be re-energised until every lock is removed by every locker. There is no shared key. There is no spare. There is no override.
The single most common LOTO failure on ships is the lock that gets removed by someone other than the person who applied it, “because he had gone ashore”. If the procedure permits this, the procedure is broken. The whole point is that the lock is the personal guarantee of the worker’s safety. Removing it without them is removing their guarantee.
3. Proving Dead: The Step Most Often Skipped
Isolation is not the same as proving dead. An open breaker can have voltage on the load side. A withdrawn drawer can have backfeed from a UPS, an inverter, or a parallel feeder. A “switched-off” circuit can be alive because someone wired it wrong years ago and nobody noticed.
The proving-dead procedure is test-prove-test:
- Test the voltage tester on a known live source.
- Use it to verify the circuit is dead — phase-to-phase, phase-to-earth, every conductor.
- Re-test the voltage tester on the known live source, to confirm it did not fail between steps 1 and 2.
Skipping any step turns the test into a guess. A voltage tester that has just confirmed a circuit is dead may have failed during the test itself, and you would not know unless you re-tested it on something you know is alive.
The known live source matters. On HV systems, this is typically a dedicated proving unit because there is no convenient nearby live HV source to test against. On LV systems, an adjacent live circuit will do — but the ETO must know it is live, not assume it.
A multimeter is not always a voltage tester. Many digital multimeters have input impedances high enough to read induced or capacitively-coupled voltages on a dead conductor, giving false-positive readings that confuse the proving-dead procedure. A dedicated voltage tester — typically a two-pole tester with a low-impedance load — gives unambiguous results. Use the right tool.
4. Earthing Down on HV Systems
On HV systems, isolating and proving dead is not enough. The circuit must be earthed before work begins.
The reason is energy storage. HV cables, transformers, and capacitor banks store significant electrical energy that does not dissipate immediately when the supply is removed. A long HV cable can hold a lethal charge for hours after isolation, and a back-energisation event — from an adjacent circuit, from inductive coupling, from a switching error elsewhere — can re-energise an isolated circuit instantly.
The earthing arrangement creates a deliberate path to hull/earth across the conductors. Any residual or induced voltage discharges harmlessly. Any back-energisation is short-circuited to earth, which is detected by the protection system and clears immediately rather than passing through whoever is in contact with the conductor.
Earthing is applied through dedicated earthing switches, portable earthing leads with rated cross-section, or both. The earthing point is part of the LOTO arrangement — the earth lead is locked on alongside the breaker — and it is removed only at the very end of the work, after the area has been cleared.
The procedural sequence is fixed and not negotiable:
- Isolate.
- Lock out and tag out.
- Prove dead with a tested instrument.
- Apply earths.
- Then the work permit is valid and work can begin.
Removing earths in a different order, or before the work is fully complete and the area cleared, is the procedural error that produces HV fatalities.
5. Arc-Flash: The Hazard People Underestimate
Electrocution is not the only way HV — or even LV — kills people. Arc-flash is the other.
An arc-flash event is the sudden release of energy when a fault arc is established between conductors or between a conductor and earth. The arc temperature reaches around 20,000°C — roughly four times the temperature of the surface of the sun. The plasma cloud expands explosively, vaporising metal, projecting molten copper droplets, and generating a pressure wave that throws bodies across switch rooms.
The energy released is calculable. It is measured in calories per square centimetre at a specified working distance, and it is what determines the PPE category required for any given task. The calculation depends on the prospective fault current, the clearing time of the upstream protection, the working distance, and the equipment configuration.
This is not abstract. Modern marine switchboards — particularly on vessels with multiple parallel generators — can have prospective fault currents high enough that an arc-flash incident energy at the breaker compartment exceeds 40 cal/cm². At that level, no commercially available PPE provides full protection. The only safe approach is to avoid the work being done with the equipment energised.
A ship without an arc-flash study is a ship where every electrical task above LV is being authorised on guesswork. The study should be available, current, and posted on or near the relevant switchboards. If it is not, that is a deficiency the ETO should be raising up the chain.
The arc-flash study is the document that tells you whether a task is survivable. The PPE is what makes it survivable. Skipping the study and wearing the PPE is wearing a parachute without checking the rip cord.
6. PPE Categories and What They Actually Protect Against
Arc-rated PPE is categorised by the level of incident energy it is rated to withstand. The categories range from Category 1 (around 4 cal/cm²) through Category 4 (around 40 cal/cm²). The PPE includes:
- Arc-rated coveralls or jacket and trousers — flame-resistant fabrics that do not ignite or sustain combustion under arc exposure. Cotton work clothing is not arc-rated. Synthetics are dangerously flammable and melt onto skin.
- Arc-rated face shield or hood — the hood for higher categories. The face shield must be arc-rated polycarbonate; an ordinary visor is not.
- Arc-rated gloves with appropriate voltage rating. Leather over-gloves protect rubber insulating gloves from mechanical damage.
- Hearing protection — the pressure wave from a serious arc event causes permanent hearing damage at close range.
- Safety glasses under the face shield, against UV and infrared radiation that escapes the polycarbonate.
The PPE protects against thermal energy. It does not stop the pressure wave. It does not stop molten metal driven through it at high velocity. It buys you survival time, not invulnerability. The intent is that you walk away with second-degree burns rather than die of third-degree burns and cardiac arrest.
The most common PPE failures on ships are wearing the wrong category, wearing damaged or expired arc-rated clothing, and wearing arc-rated outer layers over flammable inner layers — synthetic underwear that melts is what kills people inside an arc-rated coverall.
7. The HV-Specific Procedural Layer
Working on HV systems above 1 kV adds requirements on top of the LV safety system, not in place of it.
Authorised personnel only. HV work requires the STCW HV endorsement and competence verified by the company. An ETO without the endorsement does not work on HV, full stop. They may observe, learn, and assist within the bounds of their qualification, but the breaker withdrawal, the proving-dead, the earthing, and the work itself are done by qualified personnel.
Two-person discipline. HV work is not done alone. The minimum is two qualified persons — one performing the work, one as a safety observer with rescue capability. The observer’s job is not to help with the work; it is to watch for hazards the worker cannot see and to act if the worker is incapacitated.
Rescue equipment available. Insulated rescue hooks, first-aid equipment specifically for electrical injuries (including a defibrillator on vessels that have one), and a clear evacuation route are part of the work setup, not an afterthought.
Restricted access to the work area. HV work areas are demarcated and access is controlled. The arc-flash boundary — the distance at which incident energy drops to 1.2 cal/cm² (the threshold for second-degree burns) — defines who needs PPE and who can be in the room at all.
Communications discipline. Radio silence in the area, clear verbal communication between worker and observer, defined hand signals where verbal communication is impractical. A misheard instruction during an HV switching sequence is an incident waiting to be filed.
8. Working on Live Equipment — When and Why Not
The default position is that electrical work is done dead. Working live is the exception, justified only when the consequences of de-energising the system are themselves dangerous — typical examples are taking measurements during fault diagnosis, where the fault only manifests under load, or operating in a continuous-process plant where shutdown introduces greater hazards than the live work.
When live work is unavoidable, the controls intensify rather than relax:
- A separate live-work permit, distinct from a standard electrical permit
- An explicit risk assessment justifying why the work cannot be done dead
- A second-person standby with rescue capability
- Full PPE for the worst credible arc-flash event, not the expected one
- Clearance from chief engineer and master, not just authorising engineer
- Time-limited authorisation — the permit expires when the specific task is complete, not at the end of the watch
The temptation to do “quick” live work — a measurement, a setting change, a check — is the source of a disproportionate share of electrical injuries. Quick work on live equipment is exactly the kind of work where the discipline lapses, the PPE is skipped, and the assumption is that nothing will go wrong because it never has before.
The arc-flash event does not consult the ETO’s track record before deciding to occur.
9. Closing Reality
Electrical safety procedures are the product of fatalities. Every step in LOTO, every requirement in arc-flash assessment, every line in an HV permit traces back to a specific incident in which someone was killed because that step was not yet a requirement.
LOTO is not paperwork. The lock is the worker’s personal guarantee that nobody is going to re-energise the circuit they are standing inside. The tag is the explanation for anyone who finds it. Both are required.
Proving dead is not a formality. A circuit that the breaker says is open is a circuit you have not yet tested. A test instrument that has not been verified before and after the test is an instrument you cannot trust.
Arc-flash is not a fringe hazard. It is the most likely cause of serious injury in marine electrical work above LV, and the PPE that protects against it is rated, dated, and not interchangeable with general workwear.
HV work is not LV work with bigger numbers. The procedural layers are different because the failure modes are different and the consequences are not survivable in the same way.
The procedure is not bureaucracy. It is the residue of every fatality the industry has had time to document. Read it, follow it, and add nothing of your own to the list.
Related articles:
- Electrical Principles & Standards →
- HV Power (3.3–11 kV) →
- Switchboards & MCCs →
- Protection & Coordination →
- Maintenance, Testing & CMMS →
Tags: LOTO · lockout tagout · arc-flash · marine electrical safety · HV work · HV endorsement · permit to work · proving dead · earthing down · PPE category · ETO safety