On an offshore platform, detection has to work before there is a fire. The system is watching for gas, not flame, because by the time something is burning the useful window has already closed. That inverts how detection is designed, maintained, and audited.
Detecting the Gas, Not the Fire
Fire detection aboard a conventional ship is largely about smoke and heat in enclosed spaces. On an offshore production or drilling installation the problem is different in kind. The dominant hazard is a pressurised hydrocarbon release into a naturally ventilated, congested module, and the interval between that release and an ignition can be very short. A system that waits for combustion has already missed the event that mattered.
That is why offshore detection is built as an integrated fire and gas system rather than a fire alarm with gas detectors added. Its primary job is to sense a release early, raise an alarm, and trigger automatic executive actions, isolating inventory, shutting down equipment, stopping ventilation, and removing ignition sources, before a flammable cloud finds one. Flame detection matters, but it is the second line, dealing with an event the gas detection layer did not prevent.
A ship’s fire detection asks whether something is burning. An offshore fire and gas system asks whether something is about to.
The Detector Has to Match the Hazard
Because the hazards vary sharply between a wellhead area, a turbine enclosure, a switchroom, and living quarters, no single detector type serves the whole installation. Getting the technology matched to the specific hazard in each area is a design decision that audits revisit, because installations get modified and the detection sometimes does not follow.
Point gas detectors: Fixed catalytic or infrared heads sensing combustible gas at a specific location, suited to known leak sources such as flanges, seals, and compressor packages.
Open path gas detectors: A beam across an area detecting a cloud crossing the path, giving area coverage where a point detector might simply be missed by the plume.
Toxic gas detection: Hydrogen sulphide monitoring where sour service applies, protecting people rather than preventing ignition, with its own alarm philosophy.
Flame detectors: Ultraviolet, infrared, or combined units for open process areas where a hydrocarbon fire produces radiation but little useful smoke.
Smoke and heat detection: Conventional detection for accommodation, control rooms, and enclosed non-hazardous spaces, where the ship-style hazard applies.
Two further constraints shape everything. Equipment installed in a classified hazardous area must be certified for that atmosphere, so a detector’s suitability is a matter of its protection concept and certification rather than its detection performance alone. And the whole arrangement sits within the installation’s fire and explosion strategy, the framework ISO 13702 sets out for controlling and mitigating fires and explosions on offshore production installations, which is what an auditor compares the as-installed system against.
Voting, and Why Single Detectors Rarely Act Alone
An offshore fire and gas system does more than annunciate. It initiates executive actions with real operational and safety consequences: emergency shutdown, blowdown, ventilation trips, and deluge release. Those actions cannot be allowed to fire on a single spurious signal, and equally cannot be so guarded that a genuine release goes unactioned.
The usual resolution is voting logic. A single detector in alarm raises an alert for investigation; coincident detection across two or more devices in a zone triggers the automatic executive action. Arrangements described as two-out-of-three, and similar schemes, exist precisely to balance spurious trips against genuine demand. The logic is documented in the cause-and-effect matrix, which defines what each detection state does to each item of plant.
The cause-and-effect matrix is the real specification of the system. Where the installed logic and the documented matrix have drifted apart, nobody actually knows what the platform will do when gas is detected.
That drift is a genuine and recurring audit finding. Modifications, replaced detectors, revised zones, and temporary changes accumulate, and unless the matrix is maintained alongside them the document on the wall stops describing the system in the field.
Where These Systems Fail Audits
As with shipboard firefighting equipment, most findings are not about detectors that cannot detect. They are about the management around them.
The first of those deserves particular attention. An inhibit is a legitimate tool: a detector under maintenance has to be bypassed to avoid a spurious shutdown. The danger is that inhibits are easy to apply and easy to forget, and a platform running with a quietly disabled zone has a hole in its protection that nobody is looking at. Audits therefore examine whether inhibits are formally registered, time-limited, authorised at an appropriate level, visible to the control room, and reviewed at handover. Where that discipline is absent, the finding is written against the management system rather than the hardware, because the hardware was never the problem.
The Alarm Nobody Believes
The last item in that list is the one that does not appear as a single deficiency but undermines everything. When a detector or a zone generates repeated false alarms, the practical response on many installations is to work around it, and eventually to stop reacting to it. At that point the system has failed in the way that matters most: it can still detect, but the organisation has stopped listening.
This is why chronic spurious alarms should be treated as a safety issue requiring root-cause correction, not a nuisance to be tolerated. The cause is usually identifiable, contamination, unsuitable detector selection for that environment, poor siting relative to ventilation, or degraded electronics, and fixing it restores confidence in every other alarm the system raises. Detection that people trust is a different asset from detection that merely functions.
Keeping It Demonstrably Ready
For an operator or duty holder, the practical discipline is narrow and repeats what makes any safety-critical system auditable. Maintain a live inhibit register with authorisation, time limits, and handover visibility. Hold proof-testing to schedule and keep the records, since the reliability claimed for a safety function is only as good as the evidence that it was tested. Keep the cause-and-effect matrix current through every modification, so the documented behaviour and the installed behaviour stay identical. Calibrate gas detection on interval with the correct gas. Keep optical windows clean. And investigate spurious alarms to root cause rather than living with them.
None of that is exotic engineering. It is the ordinary administration that turns a set of certified detectors into a system a platform can rely on, and it is exactly the ground an auditor covers. The installations that come through these reviews cleanly are not the ones with the newest detectors. They are the ones where every bypass is registered, every test is recorded, and the drawing on the wall still describes the platform as it is today.
Frequently Asked Questions
Why do offshore platforms detect gas rather than just fire?
Because the dominant hazard is a pressurised hydrocarbon release in a congested, naturally ventilated area, and the interval between release and ignition can be very short. Detecting the gas allows the system to isolate inventory, shut down equipment, and remove ignition sources before a flammable cloud finds one. Flame detection is the second line, addressing an event the gas layer did not prevent.
What is voting logic in a fire and gas system?
It is the arrangement determining how many detectors must be in alarm before an automatic action is taken. A single detector typically raises an alert for investigation, while coincident detection across two or more devices in a zone triggers executive actions such as shutdown or deluge. Schemes described as two-out-of-three and similar exist to balance the risk of spurious trips against the need to act on a genuine release.
Why are detector inhibits such a common audit finding?
Because bypassing a detector for maintenance is legitimate and easy, while restoring it depends on someone remembering. A platform running with a forgotten inhibit has an unmonitored hole in its protection. Auditors therefore check whether inhibits are formally registered, time-limited, authorised at the right level, visible to the control room, and reviewed at shift handover, and a gap in that discipline is recorded against the management system.
What is the cause-and-effect matrix and why does it matter?
It is the document defining what each detection state causes the system to do to each item of plant, and it is effectively the specification of the fire and gas system’s behaviour. Where modifications, detector replacements, or zone changes have not been reflected in it, the documented behaviour and the installed behaviour diverge, meaning nobody can say with confidence what the installation will actually do when gas is detected.
Sources: ISO 13702, Petroleum and natural gas industries, Control and mitigation of fires and explosions on offshore production installations, Requirements and guidelines · IMO Code for the Construction and Equipment of Mobile Offshore Drilling Units (MODU Code), Resolution A.1023(26), fire safety and detection provisions · IEC 60079 series, Explosive atmospheres, equipment protection and area classification · IEC 61511, Functional safety, Safety instrumented systems for the process industry sector (proof testing and safety function integrity)
MarineCraft Journal
Get the next briefing in your inbox
Safety protocols, offshore training, regulation and market analysis, written for Malaysia’s maritime and offshore industry. No sales pitches.
We use your address only to send MarineCraft Journal. Unsubscribe any time. See our Privacy Policy.
Continue reading
-
compliance Why Firefighting Equipment Audits Fail on Paperwork, Not Hardware
-
compliance Offshore Safety Officer: The Qualifications That Actually Count
-
compliance From Trained Pilot to Inspection Asset
-
compliance Permit to Work: The Failure Behind Most Offshore Incidents
-
compliance Lifejacket Compliance Beyond the Buoyancy Rating