When a tanker is connected to a marine terminal and product is flowing, two separate crews - one on the vessel, one on the jetty - share responsibility for stopping the transfer if anything goes wrong. The ship/shore ESD link is the connection that lets either side trip the whole transfer, so a problem noticed on the ship stops the shore, and a problem noticed on the shore stops the ship. It is one of the most important safety connections at a marine berth, and there is a defined discipline for the types of link used and the handshake before transfer begins. This page explains what the link does, the pneumatic, electric, and fiber-optic link types, the two-step handshake, and how the link is monitored in SCADA.
Ship/Shore ESD Link in one line: A ship/shore ESD link is the emergency-shutdown connection between a tanker and a marine terminal that lets a trip from either side stop the transfer, closing the marine loading arm ESD valve and shutting down the shore pumps. It commonly uses pneumatic, electric, or fiber-optic link types matched to the vessel and jetty, and a two-step handshake before transfer confirms the link works both ways. The link status and any trip events are monitored in the terminal control system so operators can see the connection is healthy and know instantly when it has been activated.
The purpose of a ship/shore ESD link is to make emergency shutdown a shared, two-way capability rather than something only the terminal or only the ship can invoke. During a transfer the vessel's cargo system and the terminal's loading system are hydraulically connected through the loading arms, so an emergency on one is an emergency on both. If the ship spots an overfill, a leak, a fire, or a mooring problem, it needs to be able to stop the shore's pumps, not just close its own valves against a running pump. If the terminal spots a problem on its side, it needs to be able to signal the ship to shut down as well. The link carries that trip in both directions.
When the link is activated from either end, the shore side executes its emergency shutdown sequence: it closes the ESD valve on the marine loading arm and stops the transfer pumps, so product stops moving through the arm. Bringing the pumps down and closing the arm valve in a controlled sequence matters, because slamming a valve shut against full-flowing pumps can cause a damaging surge in the line, so the ESD logic is designed to stop the flow safely rather than merely quickly. The ship, in turn, takes its own protective actions on its cargo valves. The link ties these together so the two systems shut down as one.
This shared trip is fundamental to marine transfer safety because neither crew has full visibility of the other's situation. The ship's officers can see their tanks and moorings, the terminal can see its pumps and berth, and a hazard can become visible to one before the other. Giving each the power to stop everything means the response does not wait for a phone call or a radio message to be understood and acted on. The link turns a two-party operation into one with a single, instantly available stop that either party can pull.
Because ships and terminals are built by different parties and must be able to connect to each other around the world, the industry recognizes a defined set of link types so a vessel and a jetty can establish a compatible ESD connection. The common types are pneumatic, electric, and fiber-optic. A pneumatic link uses air pressure through a hose so that loss of pressure signals a trip; an electric link uses a wired connection where a change of state signals a trip; and a fiber-optic link uses light through an optical connection, which suits the intrinsically safe requirements of a hazardous marine environment because it carries no electrical energy into the connection.
The choice among them at any given berth depends on what the vessel and the terminal can support and on the practices in that trade, particularly for gas carriers and other high-hazard cargoes where the guidance on compatible systems is well established. A terminal often provides connection options so it can match a range of visiting vessels, and the ship and shore agree before transfer which link is in use. The important property common to all of them is fail-safe behavior: the healthy, transfer-permitted state is a maintained signal, and loss of that signal, whether air, current, or light, is interpreted as a trip, so a broken or disconnected link fails toward shutdown rather than toward continuing to flow.
This fail-safe design is why the link types are specified rather than improvised. A link that failed toward keeping the pumps running if the connection were damaged would be worse than no link at all, because it would give false confidence. By defining the link types and requiring the permitted state to be an actively maintained signal, the standard ensures that whatever goes wrong with the connection itself, the result is a stopped transfer and not a silently disabled safeguard.
Before any product moves, the ship and shore establish and test the ESD link, and this is where the two-step handshake comes in. Rather than simply plugging in and assuming it works, the crews confirm that a trip initiated from each side actually reaches and acts on the other, so both parties know the two-way stop is genuinely functional before they rely on it. This pre-transfer check is part of the ship/shore safety routine, alongside agreeing the transfer rates, the communications, and the emergency signals, and it is documented so both sides have committed to a working link. Starting a transfer on an untested ESD link would defeat the point of having it.
Once transfer is under way, the terminal's control system monitors the link so operators can see it stays healthy and know at once if it activates. The link status, connected and permitting or tripped, is a live indication, and an activation is an event the system captures with its time so the operators and any later review know exactly when the shutdown was called and from which side, where the link type supports that detail. Combined with the ESD valve position and the pump status, this gives the control room a coherent picture of the emergency shutdown chain rather than a set of disconnected indications.
For a terminal supervising a berth through SCADA or a cloud monitoring layer, having the link status and trip events visible remotely matters because a marine transfer can run for many hours and the people responsible are not always at the berth. A live indication that the link is healthy is reassurance that the two-way stop is armed, and an immediate, timestamped record of a trip tells the wider organization that an emergency shutdown occurred and prompts the investigation into why. A platform such as Merobix can historize these link and ESD events so a berth's shutdown history is available for review, turning each activation into a documented event rather than a moment that lives only in the memory of the crew who were there.
Because during a transfer the vessel and the terminal are hydraulically connected through the loading arms, so an emergency on one is an emergency on both, and each crew can see hazards the other cannot. Giving both sides the power to stop everything means the response does not wait for a radio message to be understood and acted on. A trip from either end closes the arm ESD valve and stops the shore pumps.
The commonly recognized types are pneumatic, using air pressure so loss of pressure trips; electric, using a wired connection; and fiber-optic, using light, which suits the intrinsically safe needs of a hazardous marine environment. All are designed to be fail-safe, meaning the transfer-permitted state is an actively maintained signal and loss of that signal is treated as a trip. The ship and shore agree which compatible link is in use before transfer begins.
It is the pre-transfer check where the ship and shore establish the ESD link and confirm that a trip initiated from each side actually reaches and acts on the other, so both parties know the two-way stop works before they rely on it. It is part of the ship/shore safety routine alongside agreeing transfer rates, communications, and emergency signals. Starting a transfer on an untested ESD link would defeat the purpose of the link.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.