What is ESD?
ESD (Emergency Shutdown) is a safety system or function that automatically or manually brings a process plant to a safe state when a hazardous situation develops, by closing valves, tripping equipment and, where needed, depressurising the plant. In the process industry, an ESD system is usually an application of a SIS (Safety Instrumented System) and is designed to IEC 61511. It works independently of normal process control in the DCS or PLC, so that a fault or error in that control layer cannot disable the protection.
In electronics, ESD also stands for electrostatic discharge. This article covers the process safety meaning.
An ESD prevents escalation by stopping, isolating and, where needed, depressurising a process immediately.
🎯 What does an ESD system do?
An ESD system has the same three building blocks as any safety function: sense, decide and act.
- Sense - sensors and transmitters measure critical conditions such as pressure, temperature, level or flow, and the fire and gas (F&G) system reports gas leaks, flames or smoke
- Decide - a logic solver, usually a certified safety PLC or, in simple cases, a hardwired relay circuit, compares the signals with trip limits and executes the logic from the cause and effect matrix
- Act - actuators close emergency shutdown valves (ESDVs), open blowdown valves (BDVs) to the flare, stop pumps and compressors and isolate electrical supplies
- Manual activation - operators can initiate an ESD from push buttons in the control room or in the field; an emergency stop on a machine can be one such trigger
A key design principle is de-energise to trip: on loss of power or a broken cable, the system falls back to the safe state. This is the fail-safe idea applied to process safety.
🔧 Which ESD actions belong to which situation?
| Situation | Typical ESD actions |
|---|---|
| Gas leak detected by F&G | Isolate feeds with ESDVs, isolate ignition sources, adjust ventilation |
| Overpressure developing in a vessel | Close the feed, stop the process; mechanical relief valves remain the last barrier |
| Fire in a process area | Isolate the zone, start blowdown to the flare, start fire pumps |
| Fire in an electrical room | Isolate power, release the gaseous extinguishing system via F&G |
| Manual ESD button pressed | Execute the associated shutdown level according to the cause and effect matrix |
🧱 Which shutdown levels exist?
Large facilities such as refineries, offshore platforms and LNG terminals organise their shutdown system as a hierarchy. A higher level normally also performs the actions of the levels below it. Numbering differs per company and per project: in many offshore conventions the lowest number is actually the most severe level, with an Abandon Platform Shutdown (APS) above it.
| Level | Scope | Typical actions |
|---|---|---|
| Unit shutdown | One item of equipment or unit | Stop the unit, the rest of the plant keeps running |
| Process shutdown (PSD) | A process train or the whole process | Stop the process, utilities keep running, no blowdown, so restart is quick |
| Emergency shutdown (ESD) | Whole facility or fire zone | Isolate the process, blow down to the flare, close export pipelines |
| Abandon / total shutdown (APS) | Whole site or platform | Utilities and power also off, only emergency systems such as emergency lighting and communications remain on UPS or battery power |
Offshore, the Norwegian standard NORSOK S-001 describes a typical shutdown hierarchy, together with ISO 13702 for fire and explosion control. For blowdown, the widely used design rule from API 521 is to reduce pressure within about 15 minutes to half the design pressure or 6.9 barg (100 psig), whichever is lower. In LNG transfer, ESD-1 means stopping cargo transfer between ship and shore, and ESD-2 means physically disconnecting the loading arms.
🔄 What is the difference between ESD, SIS, BPCS and emergency stop?
| System | Role | Example action |
|---|---|---|
| SIS | Overall instrumented safety system with one or more safety functions | Contains or drives the ESD |
| ESD | Shutdown and isolation function for (parts of) the plant | Isolate and depressurise the process |
| BPCS (DCS / SCADA) | Normal process control and monitoring | Control, generate alarms, log trends |
| Alarm system | Reports deviations to the operator | Warn the operator before a trip |
| Interlock | Local interlock within the control system | Prevent a pump starting with a closed valve |
| Emergency Stop | Manually operated stop of one machine (NEN-EN-ISO 13850) | Stop the machine immediately |
An ESD is therefore not an alarm: an alarm asks the operator to intervene, an ESD intervenes itself. In LOPA, the ESD counts as a separate, independent protection layer, alongside process control, alarms with operator response and mechanical relief valves.
📏 How reliable does an ESD need to be?
Each ESD function receives a Safety Integrity Level (SIL) from the risk analysis, usually a HAZOP followed by LOPA. For ESD functions in the oil, gas and chemical industries, SIL 2 is common and SIL 3 occurs for the most severe scenarios.
| SIL | Average probability of failure on demand (PFDavg) | Risk reduction |
|---|---|---|
| SIL 1 | 10⁻² to 10⁻¹ | 10 to 100× |
| SIL 2 | 10⁻³ to 10⁻² | 100 to 1,000× |
| SIL 3 | 10⁻⁴ to 10⁻³ | 1,000 to 10,000× |
To achieve that level, designers use redundancy and voting: three transmitters in 2oo3 (two out of three) reduce the likelihood of both missed trips and spurious trips, because a single faulty transmitter neither blocks the function nor causes a trip. The shutdown valves are often the weakest part of the chain. Companies therefore test them with a proof test, whose interval follows from the PFD calculation and often coincides with the planned turnaround. An intermediate partial stroke test, in which the valve moves only a small distance, finds part of the hidden failures but does not replace the full proof test.
🔐 Why does ESD cybersecurity matter?
An ESD is the last instrumented barrier before an incident escalates, which makes it an attractive target. In 2017 the TRITON malware manipulated Triconex safety controllers from Schneider Electric at a petrochemical plant in Saudi Arabia. The attack came to light because the controllers unexpectedly shut the plant down.
Since the 2016 edition, IEC 61511 requires a security risk assessment of the SIS in clause 8.2.4, and clause 11.2.12 requires a design that is resilient against the threats identified. In practice this means:
- Separation - the ESD in its own zone according to IEC 62443, separated from the BPCS by network segmentation and an industrial firewall
- No remote write access - the key switch of the safety controller in RUN, programming only locally from a managed engineering station
- Bypass and change control - log every override of a trip function and make it time-limited through change management
- Monitoring - detect unusual connections to the safety controller as part of defence in depth
🏭 How do you approach ESD in Dutch and EU practice?
Companies holding large quantities of dangerous substances fall under the Seveso III Directive, implemented in the Netherlands as the Major Accidents Risks Decree 2015 (Brzo 2015). No law literally prescribes an ESD, but these companies must demonstrate that they take all necessary measures, and regulators treat IEC 61511 as the state of the art. Since 15 August 2026 the Dutch Cybersecurity Act also applies to many of these companies, which makes the digital side of the ESD legally relevant as well. See also Seveso and Cybersecurity.
A common step-by-step approach:
- Risk analysis - HAZOP and LOPA determine which scenarios require an ESD function and at which SIL
- Specification - record per function the trigger, trip limit, response time and safe state in the Safety Requirements Specification and the cause and effect matrix
- Design - choose certified components, voting and a fail-safe implementation, and show everything on the P&ID
- Verification and testing - FAT, SAT and a full functional test of every trip before start-up
- Operation - perform proof tests, monitor bypasses and route every modification through a management of change process
❓ Frequently asked questions
What does ESD mean in the process industry?
In the process industry, ESD stands for Emergency Shutdown. An ESD system automatically or manually brings a plant to a safe state by closing valves, tripping equipment and, where needed, blowing down pressure to the flare.
Is an ESD the same as a SIS?
An ESD is usually a part or application of a SIS. The SIS is the complete safety system with all its safety functions, whereas the ESD specifically covers the shutdown and isolation functions for the plant.
What is the difference between ESD and PSD?
A process shutdown (PSD) stops the process but keeps utilities running and does not depressurise the plant, so restart is quick. An emergency shutdown (ESD) goes further: it isolates the plant, starts blowdown to the flare and closes export or supply pipelines.
What SIL does an ESD system have?
The SIL of an ESD is determined per safety function by the risk analysis, not for the system as a whole. In the oil, gas and chemical industries SIL 2 is common, and SIL 3 is required for the most severe scenarios.
What is an ESD valve?
An ESD valve (ESDV) is a fast-closing shut-off valve with a spring-return actuator that closes automatically on loss of power or instrument air. ESD valves are periodically tested through their full stroke, because they are often the least reliable part of the safety function.
Can an ESD system be hacked?
Yes, an ESD system can be hacked when it is network-connected, as the TRITON attack in 2017 demonstrated. That is why IEC 61511 has required a security risk assessment since 2016, and companies separate the ESD from process control according to IEC 62443.
📌 In summary
An ESD system detects hazardous conditions, decides through an independent logic solver and acts through shutdown valves and electrical isolation. It is organised in shutdown levels from unit to whole site, receives a SIL per function from HAZOP and LOPA, and must be tested periodically. Because it is the last instrumented barrier, separation and cybersecurity according to IEC 61511 and IEC 62443 deserve attention too.
An ESD system intervenes automatically or manually to stop hazardous situations immediately, and as an independent protection layer it is crucial for the safe operation of industrial installations.