It powers the detectors, applies alarm logic, drives outputs and provides the interface people use.

Individual detectors produce signals; the controller turns them into decisions.

It is where alarm thresholds, voting and executive actions are configured.

It also provides the display through which anyone understands the plant's state.

Event logging and trending are normally provided for investigation.

Without it, a set of detectors is a set of independent instruments rather than a system.

A low alarm warns and prompts investigation; a high alarm triggers executive action.

That separation lets a small release be investigated without shutting a plant down.

It also gives escalation, so a growing release produces a stronger response.

Levels are set from local exposure or explosive limits and from how long response takes.

Setting them too low produces nuisance alarms; too high removes the warning margin.

The values are a design decision recorded rather than adjusted informally.

Requiring two detectors to agree before executive action, which greatly reduces spurious shutdowns and discharges.

A single detector fault or a localised interference can otherwise trip a whole plant.

The cost is some sensitivity, since one detector alone will not act.

Voting is usually applied to executive action and not to the warning alarm.

It is a risk decision rather than a technical preference.

Detector placement has to support voting, since two detectors must plausibly see the same release.

Shutting down a process, starting ventilation, isolating fuel or releasing suppression.

These are what make a gas detection system consequential rather than informational.

Each carries its own risks, so triggering them wrongly has real cost.

The cause-and-effect matrix documenting what triggers what is a controlled document.

It is tested at commissioning and after any modification.

Undocumented configuration changes are a recurring source of unexpected plant behaviour.

Because a failed sensor, an open circuit and a clean atmosphere all otherwise look the same.

A controller must distinguish no gas from no signal.

Open circuit, short circuit, sensor fault and power loss are all reported separately.

Without that, a system can be entirely non-functional and appear healthy.

Fault conditions should present differently from alarms and demand a different response.

A fault left unaddressed for weeks is a common finding and removes the protection entirely.

From standalone units serving a few detectors to addressable networked systems with redundant controllers.

Small installations often use a simple panel with a channel per detector.

Larger sites use addressable networks that reduce cabling and simplify expansion.

Redundant controllers allow the system to survive a single controller failure.

Integration with fire alarm, process control and building management systems is common.

The scale decision follows detector count, criticality of executive actions and availability requirements.

Functional testing of the whole chain - detector, controller, output - rather than each part alone.

Applying test gas at the detector and confirming the output operates is the proof.

Cause and effect is verified against the controlled document rather than from memory.

Fault conditions are simulated to confirm they report correctly.

Executive actions are tested in a planned way because they shut things down.

Two documents usually govern this: the applicable regulations and the site's own safety case.