- Home
- Categories
- Monitoring Systems
- Alarm and Shutdown Systems
Instrumentation & Control
Alarm and Shutdown Systems
Alarm and shutdown systems watch rig signals and alert the crew or trip equipment when a limit is crossed. The category covers emergency shutdown (ESD) panels, fire and gas controllers, process shutdown logic, safety PLCs, alarm annunciators and their I/O. A safety PLC's certificate covers specific hardware and software versions, so a used module must match the versions certified for your system.
Operating principle
An alarm system tells people something needs attention. A shutdown system acts on its own. On a drilling unit, the ESD system responds to confirmed gas detection, fire detection or a manual pushbutton. It isolates ignition sources, stops ventilation and fuel supplies and moves the unit to a safe state. Process shutdown protects single items such as a well test package or gas handling equipment. Most shutdown logic is de-energise to trip, so a broken wire or power loss causes a trip rather than hiding a fault.
Configurations
| Architecture | Meaning | Effect |
|---|---|---|
| 1oo1 | One channel trips | Simple, no fault tolerance |
| 1oo2 | Either of two channels trips | Safe against a failed channel, more spurious trips |
| 2oo3 | Two of three channels must agree | Fault tolerant and resists spurious trips |
| 1oo2D | Two channels with diagnostics | Common in safety PLCs |
Systems range from relay-based annunciator panels to triplicated or dual-redundant safety PLCs. Kongsberg's K-Safe, for example, combines ESD, process shutdown and fire and gas functions, with SIL certification by TÜV.
Key specifications
| Parameter | Why it matters | Typical classes or units |
|---|---|---|
| SIL capability | Highest SIL the hardware supports | SIL 1 to SIL 3 |
| Architecture | Sets fault tolerance and trip behaviour | 1oo2, 2oo3, 1oo2D |
| I/O type | Must suit detectors and valves | Digital, analogue, line-monitored inputs |
| Certificates | Approved versions and use | IEC 61508 certificate, class type approval |
| Cause and effect | Defines what trips what | Matrix version |
Standards and certification
- IEC 61508 governs how the safety PLC and its software are designed and certified, including hardware fault tolerance and safe failure fraction.
- IEC 61511 governs how you specify, install, validate, proof test, bypass and modify the safety instrumented system.
- Offshore Norge Guideline 070 gives minimum SIL requirements for common offshore safety functions and is widely used beyond Norway.
- On classed units, DNV-OS-A101 covers safety principles including ESD, and DNV-OS-D202 covers the safety system hardware and software. ABS sets equivalent requirements in its offshore unit rules.
- Field devices and panels in zones need ATEX or IECEx certification.
Failure modes and inspection
- Dangerous undetected failures, such as stuck relay contacts or a frozen input, which only proof testing finds.
- Aged power supplies and backup batteries.
- Corroded terminals and failed line-monitoring resistors on detector inputs.
- Bypasses left in place and undocumented logic changes.
Inspection compares installed hardware and software versions with the safety certificate, reviews the bypass and event logs, and runs a functional test against the cause and effect matrix.
Documentation
Ask for the safety certificate and safety manual for the exact versions, the safety requirements specification, cause and effect charts, the application software backup with its checksum or version, proof test records, the modification history, and class approval records.
Integration and compatibility
The hardware keeps its SIL capability only if its versions match the certificate. A SIL rating belongs to a complete safety function, including sensor, logic and final element. Reusing a safety PLC on a new rig means verifying each function again under IEC 61511. Check I/O compatibility with your detectors, valves and line-monitoring scheme.
Refurbishment and when used makes sense
Like-for-like spare modules for an installed safety system are the main case for buying used. Unused surplus is the better choice, because its history is known and nobody has modified it. Repaired modules should come from the OEM or a repairer the OEM authorises. A complete used system suits a rig with the same layout after reengineering and full validation. For a different rig, new hardware with fresh engineering is usually simpler to certify.
Related equipment
Detectors that trigger these systems are under gas and H2S detection and fire detection systems. Naventr lists the certificates and records the Seller provides for each unit.
FAQ
Frequently asked questions
Can a used safety PLC keep its SIL rating?
The hardware keeps its SIL capability if its versions match the safety certificate, but a SIL rating belongs to a complete safety function. On a new rig, each function needs verification, validation and proof testing under IEC 61511.
What documents should come with a used ESD system?
The safety certificate and safety manual, the safety requirements specification, cause and effect charts, the application software backup, proof test records and the modification history. On classed units, add the class approval records.
What is the difference between an alarm system and a shutdown system?
An alarm system alerts the crew and relies on people to act, while a shutdown system acts on its own. Because a shutdown trips equipment or closes valves automatically, safety standards treat it far more strictly.
Are spare modules for an obsolete safety system worth buying?
Yes, if they match the catalogue numbers and versions listed on your system's safety certificate. Unused surplus is the safer choice because its history is known. A version mismatch can break the certification.
What does 2oo3 voting mean in a shutdown system?
In 2oo3 voting, two of three independent channels must agree before the system trips. It tolerates one failed channel without losing the safety function and resists spurious trips from a single faulty sensor.
How often should an ESD system be proof tested?
At the interval set in the safety requirements specification, which comes from the SIL calculation for each function. IEC 61511 requires the interval to be defined and the results recorded. Ask for the proof test records of any used system.
Looking for alarm and shutdown systems?
Tell us what you need and we will find out what is available. We reply within one business day.