Regulations, Safety & Documentation

The ETO certificate is not a general electrical qualification wrapped in a shipping stamp — it is issued against a specific, itemised list of competences in STCW Code Table A-III/6, and everything else in this chapter exists to protect that list. The table divides the job into function areas: monitoring the operation of electrical and electronic systems, maintaining and repairing them, controlling their operation, and contributing to the ship's safety and pollution-prevention obligations. Each competence is backed by a set of knowledge, understanding and proficiency criteria, and — crucially — by evidence.

That evidence lives in an approved training record book. It is not a diary kept for interest; it is the documentary trail an examiner, and later a flag-state or class assessor, can follow to see that a named task was actually performed, under what supervision, and to what standard. A certificate without a properly completed record book behind it is an administrative problem waiting to surface at the worst moment — a port state control inspection, a claim after an incident, or a survey where the surveyor asks to see it.

For the working ETO this matters day to day, not just at sign-on. If you are asked to sign off a job, supervise a task, or take responsibility for equipment that sits outside the areas your record book actually evidences, you are relying on a certificate that does not cover you for that specific competence — and that gap is exactly what an investigation, or a tough surveyor, will find first.

When class attends to survey the electrical installation, the inspection follows the same shape every time: the emergency source of power and its automatic start, the emergency lighting and its transitional source, the main and emergency switchboards, the insulation levels across the distribution system, and the protection arrangements — breakers, fuses, relay settings — that are supposed to isolate a fault before it cascades. None of this is arbitrary; it is the electrical half of what keeps the ship recoverable after the worst has already happened on the mechanical or fire side.

What surprises officers new to survey is how much of it is paperwork before it is testing. A surveyor who cannot see a coherent maintenance history for a piece of protective equipment has no basis for trusting a single reading taken on the day, however good that reading looks. Insulation resistance measured once, with no trend behind it, tells you the state of the cable today; it tells you nothing about whether it is degrading. The record is what turns a snapshot into evidence.

This is why the ETO's paperwork discipline between surveys is not a side task — it is half of what gets tested when the surveyor actually arrives. A switchboard that tests perfectly but has no supporting PMS history behind it will draw more scrutiny, not less, because the surveyor has no way to tell a well-run system from one that has simply not failed yet.

The emergency generator exists to answer one question: if the main source of electrical power is lost completely, what keeps the ship safe long enough to recover, or to abandon her, in an orderly way? The answer is built around a small number of hard figures, and each one exists for a reason rooted in how a real blackout actually unfolds.

Forty-five seconds is not a generous allowance for cranking an engine — modern sets do that in a fraction of it. It is the total budget for everything that has to happen before the emergency switchboard is actually carrying load: sensing the loss of main power, starting and running the engine up to speed, checking voltage and frequency are within limits, and closing the breaker. Anything that eats into that budget — a sluggish governor, an over-cautious voltage-check relay — is a real defect, not a rounding error.

Because even 45 seconds is not instantaneous, a transitional source — normally a battery bank — is required to carry the essential emergency lighting and services through the gap. Autonomy of the generator itself is set at 18 hours for a cargo ship and 36 hours for a passenger ship, long enough to run steering gear, emergency lighting, communications and navigation equipment through a realistic recovery or evacuation, not just a token half hour. The generator's physical siting outside the machinery space boundaries is the last piece of the logic: whatever event took out the main supply — fire, flood, a machinery-space casualty — should not be able to reach the emergency source as well.

A permit to work is not paperwork bolted onto a job for the sake of a procedure manual — it exists because electrical energy is uniquely good at hiding. A circuit that looks dead, that has been switched off at a local isolator, or that "should" have no supply can still be live from a back-feed, a charged capacitor bank, an interconnected bus, or simply a mistaken assumption about which breaker feeds what. The permit forces three separate things to happen before anyone touches a conductor: the isolation is proven with a calibrated tester on the actual point of work, not inferred from a switch position; the isolating device is locked in the open position; and it is tagged with the identity of the person who applied it.

The rule that matters most in practice is the simplest one: the person who applied the lock is the only person who removes it. Not their relief, not the duty officer, not the Chief Engineer if the original applier is unreachable — the lock only comes off once the person who fitted it has confirmed, in person, that the work is finished and it is safe to restore supply.

This is why the commonest fatal failure in this area is not a missed test or a wrong reading — it is a second person, working entirely correctly by their own lights, closing a breaker that someone else was still relying on being open. Multiple padlocks on a single hasp, and a personal lock that only its owner carries the key to, exist specifically to make that scenario structurally impossible rather than merely unlikely.

The planned maintenance system is where the survey argument is actually won or lost before the surveyor ever steps aboard. A record that shows insulation resistance trended over successive readings, protective relays tested against their settings on schedule, and defects logged with what was done about them, gives a surveyor grounds to extend credit — to accept the equipment's history in place of re-testing everything from scratch. A record that is blank, generic, or backfilled the week before survey does the opposite: it invites the surveyor to test everything themselves, because the paperwork has told them nothing they can rely on.

Contemporaneous is the word that matters. An entry made at the time, describing what was actually found and actually done, is evidence. An entry made in a batch afterwards, from memory, to fill a gap before survey, is not — and an experienced surveyor can usually tell the difference from handwriting, ink, or simply entries that are suspiciously uniform in wording and timing.

During the survey itself the ETO is not a spectator. You are the person who knows the actual configuration of the switchboard, which circuits are genuinely spare and which are temporarily out of service, and where the record and the equipment might have drifted apart — a relay changed under a defect report that never made it back into the PMS, for instance. Presenting a record that does not match what is actually fitted is worse than presenting no record at all, because it suggests the discrepancy has not even been noticed, let alone managed.

The two scenarios below are built the way an examiner or a surveyor actually tests this material — not "what does the rule say" but "what do you do, right now, given what has just happened".