Most tanker accidents start with something small and ordinary: a checklist item ticked without being checked, a permit signed in the wrong place, a valve lineup nobody walked. Cargo operations are procedural by design. Every stage has a protocol, and every protocol exists because someone once skipped it and the result was a fire, an explosion, a spill or a death.
If you are training for tanker work, the best way to understand tanker safety procedures is to follow one cargo operation from the ship’s arrival to its departure. Names and details vary between oil, chemical, and gas carriers, and your company’s Safety Management System (SMS) always dictates the exact wording. The sequence below gives you a mental picture of the work before your first contract.
For the certificates that sit behind this work, see which specialist certificates your vessel type actually requires. This article covers what happens on deck.
Why a tanker’s safety culture starts before the first hose is connected
A tanker carries cargo that releases flammable or toxic vapor, and the ship’s tanks, pipelines, and pumps are built to contain it. A fire or explosion needs three things: fuel, oxygen, and an ignition source. Most tanker procedures work by removing one of the three, or by keeping them apart.
The fuel is the cargo vapor, and you cannot remove it, only control where it goes. You can control oxygen inside the tanks with inert gas. You can control ignition sources everywhere else: on deck, in the accommodation, at the manifold, and on the jetty. Nearly every rule you meet on a tanker traces back to one of those three.
Safety culture here means that the people on board follow the procedure when nobody is watching and stop the job when something looks wrong. A trainee will see this in small details: who carries a gas detector, how the permit board is kept, how quickly a deck rating says “stop” when a hose looks wrong. Those habits are set in the first hours of an operation, before any cargo moves.
Arrival and the ship/shore safety checklist: what both sides must agree before cargo moves
Once the ship is alongside and moored, nothing starts until the ship and the terminal agree on how the operation will run. The tool is the Ship/Shore Safety Checklist, based on the industry guide ISGOTT (International Safety Guide for Oil Tankers and Terminals) and adapted by many terminals and operators.
The checklist is a conversation conducted item by item, and both sides sign it. Its contents typically cover:
- The communication method between ship and shore, including a backup if the primary system fails.
- The agreed signal to stop cargo and the emergency shutdown procedure.
- The cargo plan: grades, quantities, transfer rates and maximum pressures.
- Mooring condition and gangway or access arrangements.
- Fire-fighting equipment ready for use, and the emergency plan for both ship and terminal.
- Restrictions on smoking, naked lights, galley use and hot work.
- Hose or arm connections, tested and inspected, with the right gaskets and bolting.
What you are expected to do
As a cadet or rating, you will probably not fill in the checklist, but you may be asked to check items on deck. Check them by looking, not by remembering. If the checklist says the scuppers are plugged, go and look at the scuppers. If it says the hose is in good condition, look at the hose.
Where lapses start
The usual failure is the checklist treated as paperwork. Someone fills it in from the previous port’s copy, or both sides sign it at the office without a walk-through. When an item is marked “agreed” that was never discussed, the two sides begin the operation with different assumptions, and those differences show up later during the transfer.
Permit to work: hot work, enclosed space entry, and who can sign what
A permit-to-work (PTW) system controls any job that could introduce an ignition source or put a person in danger. The most common permits on a tanker cover hot work, working aloft, working overside, electrical work and enclosed space entry.
The principle is that a normally prohibited task can be done only after a responsible person has assessed the hazard, set precautions, and confirmed in writing that conditions are safe. The master or a delegated senior officer usually authorizes the permit. The person doing the work, and often a second person supervising it, acknowledges the conditions and signs.
Hot work
Hot work means welding, cutting, grinding or anything else that produces heat or sparks. Alongside a terminal, it is generally restricted or forbidden. If it is allowed at all, the area must be gas-tested, the surroundings protected, a fire watch in place, and the terminal must agree. Your company’s SMS spells out where hot work may take place and who can approve it.
Enclosed space entry
Tanks, pump rooms, cofferdams, and void spaces can hold too little oxygen, toxic gas, or flammable vapor, and the air inside can look and smell normal. The permit for entry depends on the space being ventilated and tested, with oxygen at 20.9% by volume, before anyone enters. A trained attendant stays outside in communication with the entrant, with rescue arrangements ready. No one enters to rescue a collapsed colleague without breathing apparatus; many enclosed space deaths are of would-be rescuers.
Where lapses start
Permits go wrong when people treat them as a signature to obtain rather than a safety check. Typical lapses include a permit remaining in force after conditions change, a gas test done once and never repeated, and work carried out outside the permit’s scope. If you see work that no longer matches the permit, stop and tell the officer on watch.
Gas detection, inert gas and venting: keeping the atmosphere in the tanks under control
Controlling the atmosphere in cargo tanks is central to tanker safety. You will meet three tools: gas detection, inert gas and venting.
Gas detection
Portable gas detectors measure different things. A combustible gas meter reads flammable vapor, usually as a percentage of the lower flammable limit (LFL). An oxygen analyzer reads oxygen content. Toxic gas detectors measure specific hazards such as hydrogen sulfide or benzene, depending on the cargo.
Each reading answers a different question, and using the wrong instrument for a given atmosphere gives a misleading result. For example, an instrument designed for air may read incorrectly in an inerted tank because many combustible gas meters need oxygen to work. Learn which instrument is used for which test on your ship and check that it has been calibrated and function-tested before each use.
Inert gas
On many oil tankers, an inert gas (IG) system supplies low-oxygen gas to the cargo tanks, usually from boiler flue gas or an inert gas generator. The aim is to keep the tank’s oxygen content low enough that the vapor cannot burn. The commonly cited limit for tank atmospheres is 8% oxygen by volume or less. The deck officers monitor the IG system’s oxygen content and pressure continuously during cargo and ballast operations.
Cargo tank pressure matters too. A positive pressure keeps air from being drawn in. A rating on watch should know where the pressure readout is and what it means when the pressure drops.
Venting
As cargo goes in, vapor must leave the tank, and as cargo goes out, gas must come in. Tanks are fitted with pressure/vacuum (P/V) valves and, depending on the ship and cargo, venting arrangements such as high-velocity vents or vapor return lines to the shore. The cargo plan and the terminal’s rules dictate what is vented, where, and when. Vapor released on deck is hazardous to anyone nearby and poses a potential ignition risk.
Where lapses start
Lapses begin when people accept readings without questioning them. An uncalibrated sensor, an IG oxygen reading left unchecked for hours, a P/V valve not inspected: each is small, and each removes one of the safeguards that keep the tank atmosphere under control. Check the instrument, then check the reading.
Static electricity, ignition sources and the small habits that prevent them
Static electricity is generated when liquids move through pipes, filters and tanks, and when mist or droplets form, as during tank washing. Under the wrong conditions, a static discharge can ignite flammable vapor. This is why many tanker rules look strict about things that seem trivial.
Ignition sources are controlled by habit as much as by rule:
- Personal electronics. Mobile phones, tablets, torches and radios used on deck must be intrinsically safe or approved for hazardous areas. A normal phone is an ignition risk and stays in the accommodation.
- Tools and footwear. Use non-sparking tools where required, and avoid anything that can strike or scrape steel in a gas-hazardous area.
- Clothing. Cotton or other approved materials are generally preferred to some synthetics. Your company’s PPE rules set out what is accepted.
- Smoking. Allowed only in designated places and only when the Officer of the Watch has permitted it. Keep lighters and matches out of the cargo area.
- Accommodation openings. Keep doors, ports, and vents to the accommodation closed during cargo operations so vapor cannot enter, and manage air conditioning intakes accordingly.
- Sampling and ullaging. After a tank is loaded, a settling time is required before manual dipping or sampling because the product can hold a static charge. ISGOTT provides guidance, and your company procedures set the wait time.
Where lapses start
Static and ignition rules seem tedious because nothing visible goes wrong when you skip them. That is exactly why they decay: someone carries a phone to the deck “just for a minute,” or a tool is left uncovered. Cadets are watched for these habits early, and a trainee who corrects them quietly and without fuss is noticed for the right reasons.
During transfer: watchkeeping, communication and stopping the operation
Once the hoses or arms are connected, valves are lined up, and cargo is moving, the work becomes continuous watchkeeping. A cargo watch typically includes a deck officer in charge, a deck rating or cadet on patrol, and a pump or control-room operator. Everyone’s task is to notice what has changed.
Routine duties include:
- Rounds of the manifold, hoses and deck to check for leaks, drips and vapor.
- Monitoring tank levels, pressures and temperatures against the cargo plan.
- Checking the moorings as the ship’s draft and trim change.
- Watching for weather, passing traffic and anything alongside that could affect the operation.
- Keeping a log of times, quantities and events.
Communication
Ship and shore stay in contact throughout, usually by radio and often with a backup. Messages are repeated back and confirmed. When transfer rates change, a tank is about to be topped off, or a valve is opened or closed, the person doing it says so, and the responsible person acknowledges. A ship with a loose communication culture has lapses that start here: assumed instructions, unrepeated messages, and “I thought you meant…”
Stopping the operation
Anyone on a cargo watch must know the stop signal and the emergency shutdown (ESD) arrangements, and anyone is expected to use them when there is danger. Reasons to stop include a leak, a mooring failing, a fire, an unexpected tank level, or a loss of communication. Stopping is normal, and you should never be criticized for halting an operation that looks unsafe. Restarting an operation after the cause is fixed costs a few hours, while continuing past an unsafe condition can cost lives.
Where lapses start
Lapses start with fatigue and routine. A long operation at night, a watch standing alone, a monotony of readings: attention drifts. Our piece on managing fatigue for ships’ crew during long voyages covers this and is worth reading before a first contract, because fatigue changes how well every protocol in this article is followed.
Spill prevention and emergency response: drills, SOPEP thinking and who does what
Preventing a spill is built into the earlier stages: tested hoses, plugged scuppers, correct valve lineups, tanks monitored so none are overfilled. Equipment for containing small deck spills sits near the manifold, and drip trays collect leaks at connections.
If a spill happens anyway, the ship follows its Shipboard Oil Pollution Emergency Plan (SOPEP), required under MARPOL Annex I for oil tankers. Ships carrying noxious liquid substances in bulk have an equivalent plan, and its contents vary by cargo. The plan lists who to notify, what to do first, and what equipment is available.
The general shape of the response is:
- Stop the cargo operation and sound the alarm.
- If safe, stop the source by closing valves, stopping pumps, or activating shutdown.
- Contain the spill on deck and stop it going overboard.
- Notify the terminal, the company and the relevant authorities as the plan requires.
- Clean up using the equipment and procedures listed in the plan.
Who does what
During an emergency, the muster list and emergency organization set roles. The master or a nominated officer directs the deck crew to carry out containment and shutdown, and engineers support. Your own duty will appear on the station bill in your cabin. Read it on the first day and learn where your station is.
Drills
Drills are where the plan becomes practical. The crew regularly rehearses fire, abandon ship, spill response, and enclosed space rescue. The value of a drill is that it shows what does not work: a locker that is stuck, a radio that is not charged, a crew member who does not know where to go. Take part properly and say what you noticed.
Where to focus on this next: simulator practice, ISM Code records, and asking your senior officers the right questions
Reading procedures helps, but they become reliable only when you’ve practiced and checked them. Three areas are worth your time before and during your first tanker contract.
Simulator practice
Cargo-handling and emergency simulators let you rehearse loading, discharge, inert gas control, and emergency shutdown without real consequences. Not all simulators are equally useful, and our guide on how to judge a maritime simulator before you pay for a certification course gives you questions to ask before you commit.
ISM Code records
The ISM Code (International Safety Management Code) requires the company and ship to document how safety is managed, and the records show what actually happens on board. On a tanker, you will see:
- Drill and training records.
- Permit to work files.
- Cargo operation checklists and logs.
- Near-miss and incident reports.
- Non-conformity reports and corrective actions.
Ask to review how your ship keeps records, and learn how to write a near-miss report. A near-miss is an event that could have injured someone or damaged the ship or environment but did not. Reporting one is a normal part of the job and gives the ship a chance to fix the cause before it becomes an accident.
Questions for your senior officers
The people who run cargo operations are usually willing to explain them if you ask specific questions. Good ones include:
- What do you check first before you sign the ship/shore checklist?
- Which instrument do you trust least, and how do you verify it?
- What was the last time an operation was stopped on this ship, and why?
- What do you want a new cadet to notice that they usually miss?
- How do you know when a permit is no longer valid?
Questions like these show that you are paying attention, and the answers teach you what the written procedures cannot: how this particular ship, terminal, and crew handle the work.
If you are weighing tanker work against other ship types, our piece on what offshore supply vessel work demands that tanker and bulk carrier time never did gives the comparison. Tanker safety procedures are demanding, but they are also consistent. Once you know the sequence of arrival, permits, atmosphere control, transfer and emergency response, each new ship and terminal is a variation on something you have already seen.
This article was created with AI assistance and reviewed by a human editor.
Disclosure: This post contains Amazon affiliate links. If you buy through them, we may earn a small commission at no extra cost to you.
