Safety System (ESD/F&G)
An ESD and fire and gas system exists to act faster and more consistently than a watchkeeper: it shuts down fuel and ventilation and raises alarms the moment a sensor crosses a set threshold, before a human could reach the same conclusion.
Read more — Safety System (ESD/F&G) explained ▾
What makes this type
Emergency shutdown and fire and gas systems are the layer of automation that protects the ship when something goes wrong faster than a person can respond: a gas leak in an enclosed space, a fire in machinery, or a process condition that has to be isolated immediately rather than investigated first. ESD covers the shutdown side, closing valves, tripping fuel supplies and stopping equipment, while F&G covers detection, using gas and flame sensors to trigger those shutdowns and alarms automatically. On many ships the two are integrated into one safety system logic rather than run as separate boxes, sharing sensor inputs and actuator outputs through a common controller.
Main components
Detectors
Fixed gas detectors for combustible or toxic gas, flame detectors using UV or IR sensing, and heat or smoke detectors feed continuously into the safety system logic, positioned according to a hazardous area study rather than evenly spaced by habit.
Logic solver
A dedicated, often triple-redundant controller separate from the general automation system, since safety functions have to keep working even if the main control and monitoring system fails or is being worked on.
Shutdown actuators
Emergency shutdown valves on fuel and cargo lines, ventilation dampers, and trip relays on pumps and generators, all wired to fail to a safe state on loss of power or signal, not to stay in their last position.
Alarm annunciation
Audible and visual alarms at the bridge, engine control room and locally at the affected space, with alarm prioritisation so a genuine emergency is not buried under routine process alarms.
Selection and sizing
Detector coverage and shutdown logic are engineered against a hazardous area classification and a documented cause-and-effect matrix for the specific ship, not selected from a catalogue by machinery space size. The matrix defines exactly which detector inputs trigger which shutdown outputs, and it has to be reviewed whenever equipment in the protected spaces changes, since an unreviewed matrix is a common source of gaps found at survey.
Regulations and class
- SOLAS Chapter II-2 requires fixed fire detection and alarm systems, and separately addresses gas detection requirements for specific ship types and cargoes.
- IACS Unified Requirements and class notations for unmanned machinery spaces set the redundancy and fail-safe requirements for shutdown logic supporting periodically unattended operation.
- Gas carriers and tankers carry additional cargo-specific gas detection requirements under the relevant IMO codes for those ship types.
- Class surveys test the cause-and-effect matrix directly, forcing simulated detector inputs and confirming the correct shutdown and alarm response, not just that the sensor reads correctly.
Typical faults
- Gas detector calibration drift over time under-reports concentration, delaying an alarm until the level is already dangerous.
- Cause-and-effect matrix left unrevised after equipment changes, so a new pump or valve is not covered by any shutdown logic.
- Shutdown valve actuator seized from infrequent operation fails to close on demand during an actual trip.
- Nuisance alarms from poorly positioned detectors lead crews to normalise and silence alarms, masking a genuine event later.
- Battery or power supply backup for the logic solver not tested, leaving the safety system without ride-through capability during a blackout.
What to look for in a supplier
- A documented, ship-specific cause-and-effect matrix delivered with the system, not a generic template.
- Detector types matched to the actual hazards present, gas type, flame spectrum and expected fire growth rate in each space.
- Redundancy and fail-safe design consistent with the ship's intended unmanned machinery space notation.
- A clear process for updating the safety logic when machinery or piping is modified later in the ship's life.
Walk the cause-and-effect matrix physically against the installed sensors and valves after any machinery modification, on paper it always matches; the gaps only show up standing next to the equipment.
4 manufacturers · 30 models
Emerson Marine
12- Controller, I/O or communication faults cause lost signals, unavailable automatic functions or system alarms
- Failed sensors or incorrect scaling causes implausible values and unnecessary alarms or control action
- Power-supply or UPS faults cause controller restarts, blank operator stations or loss of redundancy
- Network or fieldbus faults cause intermittent remote I/O and communication alarms
- Software, configuration or interlock errors cause unexpected sequences, inhibited starts or incorrect shutdown behaviour
- Power-supply, UPS, fuse, or DC-distribution faults cause controller resets, dead I/O stations, or loss of displays
- Network, switch, fiber, cable, or connector faults cause communication alarms, stale data, or loss of remote control
- I/O module, sensor, transmitter, or actuator faults create bad values, nuisance alarms, or failed commands
- Controller, server, HMI, storage, or software faults cause freezes, rebooting, unavailable trends, or loss of redundancy
- Configuration, time synchronization, or database errors after maintenance cause incorrect alarms, tags, sequences, or control behavior
- Power-supply, UPS, fuse, or DC-distribution faults cause controller resets, dead I/O stations, or loss of displays
- Network, switch, fiber, cable, or connector faults cause communication alarms, stale data, or loss of remote control
- I/O module, sensor, transmitter, or actuator faults create bad values, nuisance alarms, or failed commands
- Controller, server, HMI, storage, or software faults cause freezes, rebooting, unavailable trends, or loss of redundancy
- Configuration, time synchronization, or database errors after maintenance cause incorrect alarms, tags, sequences, or control behavior
- Power-supply, UPS, fuse, or DC-distribution faults cause controller resets, dead I/O stations, or loss of displays
- Network, switch, fiber, cable, or connector faults cause communication alarms, stale data, or loss of remote control
- I/O module, sensor, transmitter, or actuator faults create bad values, nuisance alarms, or failed commands
- Controller, server, HMI, storage, or software faults cause freezes, rebooting, unavailable trends, or loss of redundancy
- Configuration, time synchronization, or database errors after maintenance cause incorrect alarms, tags, sequences, or control behavior
- Power-supply, UPS, fuse, or DC-distribution faults cause controller resets, dead I/O stations, or loss of displays
- Network, switch, fiber, cable, or connector faults cause communication alarms, stale data, or loss of remote control
- I/O module, sensor, transmitter, or actuator faults create bad values, nuisance alarms, or failed commands
- Controller, server, HMI, storage, or software faults cause freezes, rebooting, unavailable trends, or loss of redundancy
- Configuration, time synchronization, or database errors after maintenance cause incorrect alarms, tags, sequences, or control behavior
- Power-supply, UPS, fuse, or DC-distribution faults cause controller resets, dead I/O stations, or loss of displays
- Network, switch, fiber, cable, or connector faults cause communication alarms, stale data, or loss of remote control
- I/O module, sensor, transmitter, or actuator faults create bad values, nuisance alarms, or failed commands
- Controller, server, HMI, storage, or software faults cause freezes, rebooting, unavailable trends, or loss of redundancy
- Configuration, time synchronization, or database errors after maintenance cause incorrect alarms, tags, sequences, or control behavior
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
Autronica
6- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
Consilium Marine
6- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
Hella Marine
6- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy
- Power-supply or UPS fault in control cabinets, typically indicated by loss of modules, blank operator stations or widespread communication alarms
- Network or communication failure from damaged cabling, switches or configuration issues, typically indicated by multiple device timeouts, stale values or loss of remote control
- I/O module or channel failure from electronics damage or field short circuits, typically indicated by single-point bad values, frozen signals or failed commands
- Sensor drift or actuator feedback failure, typically indicated by implausible process readings, control hunting or alarm mismatch
- Software/configuration corruption or controller fault, typically indicated by unexpected logic behavior, rebooting or loss of redundancy