The permit to work is the document that authorises a specific task, in a specific place, after checking the hazards are under control. In industrial diving it coordinates propeller and sea-chest isolations, hot work and simultaneous operations. It's the barrier that stops two teams killing each other without knowing it.
Anyone new to professional diving is surprised by how much paper has to be signed before getting wet. The usual reaction is to think it's the company's defensive bureaucracy. With a bit of experience, that impression changes: the paperwork is what stops someone starting a pump while you're right in front of the sea chest.
What a permit to work is
A permit to work is a formal, written authorisation, limited in time and in scope, to carry out a specific task in a specific place. It doesn't authorise "working": it authorises that task, that day, in that area, with those pre-conditions verified.
The system is usually built around three distinct roles:
- The applicant, who describes the work and its risks.
- The area authority, who knows what's happening in that part of the facility and checks the work is compatible with everything else going on.
- The performing authority, who takes responsibility for the task being done within the permit's conditions and hands it back closed when finished.
A permit expires. It's closed at the end of the shift and reopened the next day if the work continues, precisely to force a review of conditions. And it's cancelled if anything relevant changes: the weather, the state of the facility, the availability of a safety team.
What's specific to diving: the isolations
This is the heart of the matter. With a diver in the water, near a vessel or a facility, there's a list of systems that must be locked out and tagged before anyone goes in:
- Propellers, thrusters and rudders, including dynamic positioning thrusters if the vessel isn't in authorised diving mode.
- Sea chests and overboard discharges, which can suck in or expel with enough force to trap a person.
- Pumps and ballast systems capable of generating a current at the work point.
- Impressed current cathodic protection, which can cause shocks.
- Sonar, echo sounders and acoustic transmitters of high power.
- Crane operations or submersible vehicle operations directly above the diver.
Isolation doesn't mean warning over the radio. It means physically disconnecting, locking the control with a padlock and hanging a tag with the name of whoever put it there. Only that person removes it. It's the lockout-tagout principle, and it's one of the very few things in the trade that admits no flexible interpretation.
Risk assessment
The permit authorises; the risk assessment explains why authorising is acceptable. It's done beforehand, in writing, and breaks the task down into steps. For each step, hazards are identified, consequence and likelihood are assessed, and control measures are defined. The risk is then reassessed assuming those measures are already in place.
What matters isn't the colour-coded matrix, which is just a communication tool. What matters is the structured conversation it forces. A risk assessment done properly brings up things nobody had thought of: that the planned thermal cutting is going to fill an enclosed compartment with gas, that the planned scaffold leaves the umbilical rubbing against a sharp edge, that the night shift coincides with a fuel transfer.
There's also a dynamic, informal, ongoing version: the assessment the diver themselves makes on reaching the work point and finding something different from what was expected. The rule there is unambiguous: stop, report it, reassess. Nothing gets improvised.
Simultaneous operations
The most dangerous scenario on a facility usually isn't one complicated task, but two simple ones happening at the same time without anyone having cross-checked them. Diving and lifting loads. Diving and offloading tanks. Diving and hot work on deck. Diving and manoeuvring a submersible vehicle.
The permit system exists, above all, for this: to give a place and a person where every activity for the day is put on the table and someone spots the incompatibility. An offshore facility's daily coordination meeting is exactly that moment.
The lesson of Piper Alpha
The accident on Piper Alpha in 1988 is the standard case study, and at its core is a failure of the permit system: a pump was out of service with a safety valve removed, and that information wasn't effectively passed on at shift change. The incoming shift started the pump. 167 people died.
The subsequent investigation reshaped safety management across the United Kingdom's offshore industry and led to the safety case regime. The practical conclusion it left, repeated in every induction course in the sector, is that a badly closed or badly communicated permit isn't an administrative defect: it's an active hazard.
The pre-job briefing
The last link is the safety talk before starting, with the whole team present. It covers what's going to be done, who does what, what could go wrong, what warning signs to watch for and what to do if something fails. It doesn't take long and is logged with signatures.
Its real value isn't in the content — which everyone often already knows — but in two side effects: it forces anyone with a doubt to say it out loud in front of everyone, and it makes clear to the group that anyone can stop the work. How that authority is structured is covered in the chain of command on a diving operation.
In the end, the paperwork of industrial diving comes down to one simple idea: almost no serious accident in the sector happened because someone didn't know how to do their job. It happened because two people had different information about the state of the facility. The permit to work is the mechanism that forces them to share it. Anyone wanting to see how this is taught from the start can look at commercial diving schools y the sector's certifications, or look for employers in the jobs section.
Common failures of the permit system
A badly used permit system gives a false sense of control, which is worse than having no system at all. The failure modes recur with discouraging regularity in the sector's investigation reports:
- The blanket permit. Written so broadly it authorises almost anything and therefore controls nothing. A permit that says "maintenance work in the north zone" isn't a permit.
- Signing without checking. Whoever authorises it hasn't gone to look. It's the most common failure and the hardest to spot from outside.
- The permit that survives a change in conditions. The sea worsens, the state of the facility changes, another team starts working nearby, and the paper stays valid because nobody has revoked it.
- The incomplete handover at shift change, which is exactly what happened at Piper Alpha.
- Copying the previous risk assessment. Reusing the document from a similar task saves time and strips out the one thing it was supposed to provide: thinking through this specific task.
The practical test of whether a system is working is simple, and any experienced auditor applies it: ask any team member what the permit they're working under says. If they know, the system is alive. If they have to go and look it up, it's just paper.
Frequently asked questions
What is a permit to work?
A formal, written authorisation to carry out a specific task, in a specific place and for a limited time, after verifying that the identified hazards are under control. It expires at the end of the shift and is cancelled if conditions change.
What gets isolated before putting a diver in the water?
Propellers and thrusters, sea chests and overboard discharges, pumps and ballast systems, impressed current cathodic protection, high-power acoustic transmitters, and any crane or submersible vehicle operation directly above the diver.
What is lockout-tagout?
A procedure in which the control of an isolated system is physically locked with a padlock and tagged with the name of whoever put it there. Only that person can remove it, which rules out an accidental start-up.
How does risk assessment differ from the permit to work?
The risk assessment breaks the task down, identifies hazards and defines control measures; it explains why the work is acceptable. The permit is the formal authorisation granted once those measures have been confirmed as in place.
What are simultaneous operations and why do they matter?
Distinct activities happening at the same time on the same facility that can interfere with each other, such as diving while a load is being lifted or hot work is under way. The permit system exists largely to catch these incompatibilities.
What does Piper Alpha have to do with permits to work?
The 1988 accident originated in a communication failure over a permit at shift change: a pump out of service with a safety valve removed was started by the incoming shift. It's the standard case study in the sector.
Published 24 August 2026 · By Arthur More, professional saturation diver
Photo: Robb North · CC BY via Openverse