Control Systems, ESD & F&G Systems: A Clear Guide for Instrumentation Engineers

🏭 Introduction

In modern industrial plants (oil & gas, chemical, petrochemical, power, etc.), control systems ensure the processes run smoothly under set conditions. But when things go wrong, safety systems must act fast to protect people, equipment, and environment. Two key safety systems are ESD (Emergency Shutdown) and F&G (Fire & Gas) systems.

In this post you'll learn:

What a control system is, and how it differs from safety systems
How an ESD system works, when it's used, and design principles
What F&G systems do, and how they integrate with control and shutdown systems
Key standards, architecture, and best practices

Let’s begin.

1. What is a Control System?

A control system (often called a Process Control System, PCS) is the “brain” that monitors, regulates, and maintains process variables (like temperature, pressure, flow, level) within desired limits during normal operation.

Key components of a control system:

Sensors / transmitters: measure process variables
Controllers / logic: compare measured value with the setpoint and decide corrective action
Final control elements: e.g. control valves, pumps, dampers
Human-Machine Interface (HMI) / SCADA: for operators to monitor and intervene

The control system is not primarily designed to handle emergencies — it works during normal, stable conditions.

2. Safety Systems: ESD and F&G (Why separate them?)

A control system ensures steady operation. But what if something fails (a leak, overpressure, fire)? That’s where safety systems come in.

2.1 Emergency Shutdown (ESD) System

The ESD system is a protective layer that intervenes when process conditions cross safe limits. It shuts down equipment, isolates sections, depressurizes, or brings a safe state.
It’s sometimes also called a safety shutdown system or Process Shutdown (PSD) in lower layers.
ESD acts before a catastrophic event — to prevent disasters. In contrast, F&G acts after or during a hazardous event to detect and mitigate.

Example: If a reactor’s pressure rises beyond a safe threshold, ESD may close valves and stop feed pumps to avoid explosion.

Design principles:

SIL (Safety Integrity Level): ESD systems are often designed to meet a certain reliability (e.g. SIL 2, SIL 3) according to IEC 61508 / IEC 61511 standards.
Fail-safe behavior: often, ESD devices are “de-energize-to-trip” (i.e. loss of power triggers shutdown) so that failure tends to a safer state.
Isolation from control logic: The safety system should be independent from the normal control system (“no common hardware/shared logic”) to reduce risk of interference.

2.2 Fire & Gas (F&G) System

An F&G system is not directly controlling process variables — instead it monitors environment for fire, smoke, gas leaks and triggers alarms or mitigation actions.
It is facility-level safety, not process-level. It deals with hazards external to the controlled process boundary (e.g. ambient gas leaks).
F&G is considered a mitigation layer — it acts after detection of a hazard, rather than preventing the event itself.

Functions of an F&G system:

Detection: flame sensors, gas detectors, smoke detector.
Alarm / warning: visual and audible signals.
Trip / communication: send signals to ESD or control systems to initiate action
Actuation / suppression: e.g. water deluge, gas suppression, isolating sources

3. How ESD and F&G Systems Work Together (Integration & Separation)

While ESD and F&G have different roles, they often need to communicate and coordinate in a plant safely.

3.1 Independence but Communication

Standards and good practice demand that F&G systems remain independent (a failure in control should not compromise F&G, and vice versa). The systems should not share critical failure modes.

Yet, during emergencies, F&G must communicate events (e.g. “gas leak detected”) to ESD or PCS so that process actions (like shutdown) can be taken.

3.2 Integration Approaches

Hardwired or contact closures (simple, but limited diagnostics)
Addressable / loop-based systems (diagnostics, fault tolerance)
Integrated architectures (common platform but segregated logic) — e.g. some SIS platforms support both ESD and F&G logic with proper isolation.

For example, Emerson’s DeltaV SIS can host both ESD and F&G logic while maintaining segregation.

4. Architectures, Voting Logic & Safety Integrity

4.1 Voting and Redundancy

To ensure trustworthiness, safety systems often use voting logic — combining multiple sensor inputs/diverse paths so that one failure doesn’t trigger spurious shutdowns.
For example: 1-out-of-2 (1oo2) means if either sensor trips, action is taken; 2-out-of-3 (2oo3) means at least two must agree.

F&G systems may need more complex voting due to the higher risk of false alarms (e.g. a lone gas sensor reading may be false)

4.2 Safety Integrity Level (SIL)

SIL is a measure of how reliable a safety function is (how rarely it fails dangerously).

ESD systems often require moderate to high SIL levels (e.g. SIL 2, SIL 3)
F&G systems are more complex — sometimes they are designed for lower SIL because their role is mitigation, not prevention.

The challenge is balancing risk reduction vs spurious trips (false alarms). Too many false trips lower plant availability; too few reduce safety.

5. Key Design Considerations & Challenges

5.1 Avoiding Common-mode Failures

Don’t let a single failure (e.g. power, wiring, software bug) cripple both control and safety layers. Keep them independent physically and logically.

5.2 Diagnostics & Health Monitoring

Good safety systems continuously monitor themselves (cable integrity, detector health, power supply) so faults are detected early.

5.3 Response Time vs Reliability

Some hazards need very fast detection and action (e.g. gas cloud ignition). The system must respond fast but not so sensitively that false alarms dominate.

5.4 Environmental & Installation Constraints

Sensors must be suitable for location (temperature, humidity, corrosion, explosion-proof) and be certified.

5.5 Standards & Regulations

You must comply with standards like IEC 61508 / IEC 61511, NFPA 72, EN 54, and local regulations.

6. Example Use Case: How these systems respond in an emergency

Imagine a gas leak in a hydrocarbon processing plant:

Detection (F&G): A gas detector senses increased concentration and sends a signal to the F&G controller
Alarm / warning: F&G issues alarms to operators and area audibles
Trip signal: F&G signals ESD that a hazardous event has begun
ESD action: ESD may isolate valves, shut pumps, depressurize lines
Control system response: PCS may reduce feed rates or shut down certain units in coordination
Suppression / mitigation: F&G might trigger deluge water or gas suppression measures

Because of the independence, even if PCS fails, the safety logic can still act.

7. Summary & Takeaways

Control systems manage normal operation; ESD prevents catastrophic failure by shutdown; F&G detects and mitigates fires or gas leaks.
ESD is preventative; F&G is mitigation.
Systems should be independent, but able to communicate in emergencies.
Voting logic, redundancy, diagnostics, and standards compliance are critical.
In design, balance risk, availability, and false alarms.