AN9003 - A Users Guide

to Intrinsic Safety

Reasons for selecting

the Intrinsically
Safe Concept

I-S_AN9003_MTL.indd 1 5/10/09 11:56:04 am

 1-6 pages only 1.
Why choose intrinsic safety ?
1.1 Introduction
Intrinsic safety (IS) is a low-energy signalling technique that about area classification, gas grouping and temperature
prevents explosions from occurring by ensuring that the energy classification in almost all circumstances and becomes the
transferred to a hazardous area is well below the energy required universal safe solution.
to initiate an explosion.
The energy levels made available for signalling are small g) The ‘simple apparatus’ concept allows many simple pieces of
but useable and more than adequate for the majority of apparatus, such as switches, thermocouples, RTD’s and junction
instrumentation systems. boxes to be used in intrinsically safe systems without the need
The two mechanisms being considered that could initiate an for certification. This gives a significant amount of flexibility in
explosion are: the choice of these ancillaries.

• A spark h) The intrinsic safety technique is the only technique that
• A hot surface permits live maintenance within the hazardous area without the
need to obtain ‘gas clearance’ certificates. This is particularly
1.2 The advantages of intrinsic safety important for instrumentation, since fault-finding on de-
The major advantage of intrinsic safety is that it provides a solution energised equipment is difficult.
to all the problems of hazardous areas (for equipment requiring
limited power) and is the only technique which meets this criterion. i) The installation and maintenance requirements for intrinsically
The significant factors are as follows: safe apparatus are well documented, and consistent regardless
of level of protection. This reduces the amount of training
a) The IS technique is accepted throughout the world. There is required and decreases the possibility of dangerous mistakes.
an increasing acceptance of international certificates issued
under the IEC Ex scheme but this has some way to go. Intrinsic j) Intrinsic safety permits the use of conventional instrumentation
safety is an acceptable technique in all local legislation such cables, thus reducing costs. Cable capacitance and inductance
as the ATEX Directives and OSHA. The relevant standards and is often perceived as a problem but, in fact, it is only a problem
code of practice give detailed guidance on the design and use on cables longer than 400 metres, in systems installed in Zones
of intrinsically safe equipment to a level which is not achieved 0 and 1, where IIC gases (hydrogen) are the source of risk.
by any of the other methods of protection. This is comparatively rare and, in most circumstances, cable
parameters are not a problem.
b) The same IS equipment usually satisfies the requirements for
both dust and gas hazards. Figure 1.1 - Available power curves

c) Appropriate intrinsically safe apparatus can be used in all

zones. In particular, it is the only solution that has a satisfactory
history of safety for Zone 0 instrumentation. The use of levels of
protection (‘ia’, ‘ib’ and ‘ic’) ensures that equipment suitable for
each level of risk is available (normally ‘ia’ is used in Zone 0, ‘ib’
in Zone 1 and ‘ic’ in Zone 2).

d) Intrinsically safe apparatus and systems are usually allocated

a group IIC gas classification which ensures that the equipment
is compatible with all gas/air mixtures. Occasionally, IIB
systems are used, as this permits a higher power level to be
used. (However, IIB systems are not compatible with acetylene,
hydrogen and carbon disulfide.)

e) A temperature classification of T4 (135°C) is normally

achieved, which satisfies the requirement for all industrial gases
except carbon disulfide (CS2) which, fortunately, is rarely used.

f) Frequently, apparatus, and the system in which it is used, can

be made ‘ia IIC T4’ at an acceptable cost. This removes concerns
1.3 Available power
Intrinsic safety is fundamentally a low energy technique and The first choice, however, is always to choose ‘IIC ia T4’ equipment,
consequently the voltage, current and power available is if it provides adequate power and is an economic choice, as this
restricted. Figure 1.1 is a simplified illustration of the available equipment can be used in all circumstances (except if carbon
power in intrinsically safe circuits and attempts to demonstrate disulfide (CS2) is the hazardous gas, in which case there are
the type of electrical installation in which the intrinsically safe other problems).
technique is applicable.
In practice almost all low voltage instrumentation can be made
The blue and green curves are the accepted design curves used ‘IIB ic T4’ as the limits are set by the least sensitive of the
to avoid spark ignition by resistive limited circuits in Group IIC and ignition curves in Figure 1.1 (typically 24V 500 mA). The ‘IIB ic’
IIB gases. The ‘ic’ curves are less sensitive because they do not specification does restrict application to Zone 2 and where the
require the application of a safety factor in the same way as for hazardous gas is not hydrogen, acetylene or carbon disulfide but
‘ia’ and ‘ib’ equipment. In general the maximum voltage available is still applicable to a large range of installations.
is set by cable capacitance (400 metres corresponds to 80nF
which has a permissible voltage of 29V in ‘IIC ia’ circuits) and the 1.4 Conclusion
maximum current by cable inductance (400 metres corresponds Intrinsic safety is the natural choice for all low voltage
to 400µH which has a permissible current of 300 mA in IIC ia instrumentation problems. Adequate solutions exist which are
circuits). A frequently used limitation on power is the 1.3W, which compatible with all gases and area classifications. The technique
easily permits a T4 (135°C) temperature classification. These prevents explosions rather than retains them which must be
limits are all shown in Figure 1.1. preferable, and the ‘live maintenance’ facility enables conventional
instrument practice to be used.
A simple approach is to say that if the apparatus can be operated
from a source of power whose output parameters are within the
(blue) hatched area then it can readily be made intrinsically safe
to ‘ IIC ia T4’ standards. If the parameters exceed these limits to
a limited degree then it can probably be made intrinsically safe to
IIB or ‘ic’ requirements.
2 3

MTL4500 Installation.

“Appropriate intrinsically safe apparatus

can be used in all zones”
An Introduction to Intrinsic Safety
2.

Figure 2.1 - Typical IS system

2.1 Definition of Intrinsic Safety

The definition of intrinsic safety used in the relevant IEC ‘ia’
apparatus standard IEC 60079-11 is a ‘type of protection based This offers the highest level of protection and is generally considered
on the restriction of electrical energy within apparatus and of as being adequately safe for use in the most hazardous locations
interconnecting wiring exposed to the potentially explosive (Zone 0) because the possibility of two ‘faults’ (see opposite) and a
atmosphere to a level below that which can cause ignition by factor of safety of 1.5 is considered in the assessment of safety.
either sparking or heating effects’. This is a concise statement of
intent to introduce a multi-faceted subject. ‘ib’
‘ib’ apparatus, which is adequately safe with one fault and a
2.2 Typical intrinsically safe system factor of safety of 1.5 is considered safe for use in less frequently
Figure 2.1 illustrates a typical intrinsically safe (IS) system where hazardous areas (Zone 1).
the safe performance of each piece of apparatus is dependent
on the integrity of all the equipment in the system. For example, ‘ic’
the safety of the Temperature Transmitter (Tx) depends upon the ‘ic’ apparatus which is assessed in ‘normal operation’ with a unity
amount of energy supplied by the IS Interface. factor of safety is generally acceptable in infrequently hazardous
In most process control applications, each piece of apparatus in areas (Zone 2). The ‘ic’ concept is relatively new (2005) and will
a system is individually certified. A document that confirms the safety replace the ‘energy-limited’ (nL) of the type ‘n’ standard IEC
of the whole system is then produced using the information from 60079-15 and possibly the ‘non-incendive’ concept of North
the individual apparatus certificates, in accordance with the system American standards.
standard IEC 60079-25. This system document also includes details
of cable types and simple apparatus used in the system. It is usual for a system to be allocated a level of protection as a
It is important to recognise that where pieces of intrinsically whole, depending on the level of protection of the apparatus in
safe apparatus are interconnected, it is the safety of the system the system. However it is possible for different parts of a system
that must be established. There are however some examples of to have different levels of protection where suitable segregation
apparatus which stand alone, such as mobile radios and portable exists. This must be made clear in the system documentation.
gas detectors, where the system approach is not relevant.

2.3 Levels of protection

Intrinsic safety utilises three levels of protection, ‘ia’, ‘ib’ and
‘ic’ which attempt to balance the probability of an explosive
atmosphere being present against the probability of an ignition
capable situation occurring.
2.4 Faults
If a fault can adversely affect the safety of the equipment it is Table 2.1 shows a representative gas for each group and the minimum
called a ‘countable’ fault. The situation is further complicated energy required to ignite it. IIC is clearly the most sensitive. Apparatus
because the apparatus standard permits some specially designed can be designed to be acceptably safe in any of these groups.
components to be regarded as infallible and some inadequately Usually apparatus is designed to be safe in IIC, because it can then
designed features to be failed in normal operation. Consequently be used in any gas atmosphere. Sometimes a IIB classification is
there are faults that are not considered to happen, faults, which used as this permits slightly higher powers to be available. Only
are counted, and faults, which are imposed but not counted. very rarely however is apparatus designed for the IIA classification
One of the major advantages of intrinsic safety is that ‘live because this restricts its use to this group alone.
maintenance’ on equipment is permitted without the necessity of Apparatus is usually assessed using the curves and tables included
obtaining ‘gas clearance’ certificates. A consequence of this is that in the apparatus standard which lists acceptable levels of current
during the safety analysis the possibility of open circuiting and and voltage. More complex circuits are checked with ‘spark test’
short-circuiting any field wiring is regarded as normal operation. apparatus; normally the preserve of certifying authorities.
Fortunately understanding the apparatus standard and faults is
only necessary for apparatus designers and certifying authorities. 2.8 Temperature classification
The apparatus certificates remove the necessity to consider faults, The second method of causing an explosion is normally considered
except for field wiring faults, in system design. to be ignition by a hot surface. When a gas is heated above its
ignition temperature it may spontaneously ignite. The ignition
2.5 Simple apparatus temperature varies with the gas and is not correlated to ignition
In general, intrinsically safe apparatus is certified; usually by an energy. Consequently, when selecting apparatus, both properties
independent body such as an Accredited Certification Body (ACB) of the explosive gas have to be considered.
under the IEC Ex scheme. Self-certification by the manufacturer of Apparatus is classified into temperature (‘T’) classes depending on
‘ic’ equipment is also quite commonly accepted. its maximum permitted surface temperature.
The exception to the rule is ‘simple apparatus’, which is considered
not to appreciably affect the intrinsic safety of the system. This T1 T2 T3 T4 T5 T6
apparatus is exempted from the requirement for certification. The 450°C 300°C 200°C 135°C 100°C 80°C
simple requirements are clearly specified in the apparatus standard.
‘Simple apparatus’ should always be readily demonstrable to be Table 2.2 The ‘T’ classes 4 5
adequately safe. The usual examples are switches, thermocouples,
RTD’s and junction boxes. The standard enables almost all apparatus, dissipating not more than
1.3W, to be allocated a temperature classification of T4 (135°C). Almost
2.6 Cables all intrinsically safe field mounted apparatus meets the requirements
Because cables have inductance and capacitance, and hence of T4 temperature classification, which permits its use in all industrial
energy storage capabilities, they can affect system safety. gas atmospheres except in those comprising carbon disulfide (CS2)
Consequently the system design imposes restrictions on the and air. These require a T6 classification, which is difficult to achieve
amount of each of these parameters. A great deal has been written at high ambient temperatures. There are also toxicity problems
on this subject but only rarely is there a serious limitation placed associated with carbon disulfide.
on the available cable. The other temperature that needs to be considered for each piece of
As cable faults are taken into account during the system analysis, apparatus is its ambient temperature rating, which does directly affect
the type of cable in individual installations is not closely specified the safety of the apparatus in several ways.
in the system standard. The choice is therefore determined by the Apparatus normally mounted in the safe area but which affects
need for reliable system operation. the safety of the intrinsically safe system (such as the intrinsically
Where intrinsically safe systems are combined in a multi-core, safe interface in Figure 2.1) is called ‘associated apparatus’. Such
then there are special requirements. These determine which apparatus does not need to be temperature classified but must be
additional faults have to be considered. used within its specified ambient temperature range.

2.7 Gas classification

The amount of energy required to ignite a particular gas/air mixture
varies for each gas. Industrial gases capable of being ignited are
divided, in the UK, into three classes, IIA, IIB and IIC.

Typical Gas Gas Group Ignition energy

Methane IIA 160µJ
Ethylene IIB 80µJ
Hydrogen IIC 20µJ

Table 2.1: Typical gases, their classification & ignition energies

2.9 Categories and equipment safety levels 2.10 Summary
When the European Directive (ATEX) for apparatus for use in Intrinsic safety offers an acceptable level of safety in all hazardous
hazardous areas (94/9/EC) was created, it introduced the concept locations. Arguably it is safer and less prone to accidental errors
of categories, which was intended to clarify the Zone(s) in which than other methods of protection. This combined with its flexible
apparatus could safely be used. Unfortunately, and for nothing more use of available apparatus and the ability to do ‘live working’
than pedantic reasons, it was decided that a category 0 would not means that it is the natural choice for instrumentation systems
be used and the result was the confusing situation illustrated in in hazardous areas. For example it is the only technique which is
Table 2.3, where the category and Zone numbers differ. readily applicable to Zone 0 locations.
More recently (2004) the IEC took up the concept of identifying the The introduction of the ‘ic’ concept completes the picture. The
level of protection offered by a piece of apparatus and also paid essential requirements of an intrinsically safe system are:
a little more attention to risk analysis as a method of determining
the acceptable use of equipment. The result was the creation of • The system must work.
equipment protection levels (EPLs), which are similar to ATEX • The apparatus in the system must be ‘certified’ or ‘simple’.
categories but have numbers that align with their normal Zones • The compatibility of the apparatus must be established.
of use. • The level of protection of the system established.
In practice both categories and EPLs align with the levels of • The temperature classification and ambient temperature
protection ‘ia’, ‘ib’ and ‘ic’ as indicated in Table 2.3 and, as far rating of each piece of apparatus established.
as intrinsic safety is concerned, they can largely be ignored, as • The requirements of the cable established.
the level of protection is already defined as ‘ia’, ‘ib’ or ‘ic’. They
do however appear on apparatus marking and certificates and
consequently need to be explained.

Level of Protection Countable Faults ATEX Category IEC EPL Normal Zone of Use
ia 2 1 0 0
ib 1 2 1 1
ic 0 3 2 2

Table 2.3 Relationships between different methods of assessing safety levels

MTL4500/5500 backplane and DIN-rail mounted safety isolators.

Installation & Inspection of IS apparatus 3.
- An introduction

Figure 3.1 - Typical installation drawing for IS system

6 7
3.1 General
The long term continued safety of an intrinsically safe system identification of ‘a technical person with executive function’ to be
depends on adequate inspection and maintenance. The relevant responsible for inspection related matters in each installation. This
IEC standard is IEC 60079-17, which deals comprehensively person should be known to the technician doing the inspection,
with all methods of protection. Where installations are required and should be available and able to answer questions.
to comply with the European ‘user’ Directive 1999/92/EC a The installation drawing should take into account what can be
documented inspection procedure becomes a part of the required checked on the installation. For example, quoting permissible
risk analysis. capacitance and inductance for a cable is not useful, because
Any work on a hazardous plant needs to take into account overall although it is possible to check these parameters, it is not easy to do
plant safety. Consequently it is necessary to comply with the safety so. Stating an acceptable type and length is much more useful.
practices of the particular installation (for example work permits), The use of information available from ‘intelligent’ instruments can
even though the risk of ignition from the intrinsically safe circuits is considerably reduce the routine inspection considered necessary
minimal, and gas clearance certificates are not necessary. In some on an intrinsically safe system. The use of this intelligence to
ways this is even more important in the pre-commissioning stage. reduce the inspection requirement is recognised in IEC60079-17
If there are significant changes in the plant operation, which for clause 5.3.1 but not discussed in detail.
example modify the area classification then the safety analysis The ability to identify a specific field instrument from the safe
must be reviewed, the documentation modified, and possibly the area, without having to go and read the label on the instrument,
inspection procedure changed and/or repeated. is a significant advantage. Almost all of the digital, “intelligent”
The procedure places the onus for ensuring that the equipment used instruments (HART, Foundation Fieldbus, etc) enable the serial number
is suitable for its location on the creator of the installation drawing. of an instrument to be read remotely. The computer record can then
The nature of an inspection depends on how well the installation be used to confirm that it is the specified instrument, thus ensuring it
drawing, which changes the system design drawing into a drawing satisfies all the requirements of the particular installation.
specific to a particular installation, has been carried out. This type of check can be done at frequent intervals without
If the documentation is inadequate then any inspection can only be interfering with operational requirements. The inspection of an
carried out by someone with detailed knowledge of the plant and instrument is then reduced to looking for mechanical damage or
exceptional expertise in hazardous area practice. Because such a excessive corrosion which is comparatively easy and significantly
person rarely exists, this analysis assumes that the documentation less tedious.
is adequate, and uses Figure 3.1 to illustrate the process.

If the person doing an inspection does not understand some aspect

of the drawing, or believes it could be wrong, then they should be
encouraged to question the document. IEC 60079-17 requires the
3.1 General - continued essential points of inspection can shorten the time required.
A remote check that the instrument is functioning correctly does Most modern (smart) instruments can be identified from the safe
not necessarily ensure that it is still safe but it does confirm that it area computer. It is relatively simple for the computer to check that
has not been significantly damaged and is probably still safe. the field instrument is unchanged and raise a flag if it is changed.
This does imply that any malfunction should be quickly corrected This can be done frequently. The periodic inspection for that
or the defective equipment removed or at least made safe. A apparatus is then reduced to checking for deterioration.
frequent check on functionality is a significant factor in further There is a strong link between the need for periodic inspections
reducing the risk associated with any hazardous area apparatus. for operational and safety reasons and it is usual to combine the
How far this type of automatic inspection can simplify the inspection requirements. For example, the short piece of field wiring used for
procedure is a decision for the end-user. But it is arguably a more the final connection to the instrument is often prone to mechanical
reliable technique than manual inspection and simplifies the damage and consequently is usually included in the inspection
recording of the process. A relatively simple computer system procedure even though its open or short-circuit failure would not
can give ready access to the relevant installation and system create an incendive spark.
drawings, which may be required if further investigation is thought The check for mechanical deterioration is usually a quick check
to be necessary. for corrosion, impact damage, efficiency of seals, security of
Some users may consider it desirable to do an occasional mounting and adequacy of cable glands. Some judgement on
thorough spot check as reassurance that the system is functioning the need for repair or replacement is required, and the need for
but this is a counsel of perfection. These techniques, combined operational reliability usually determines the necessary action.
with the availability of certificates and manuals on manufacturers’ There is however no substitute for a well-trained technician with
web sites, can lead to safer installations and a reduction in the the right attitude.
bureaucratic load created by safety legislation.
3.4 Testing of apparatus
3.2 Initial inspection Sometimes it is suggested that apparatus should be removed
An initial inspection to ensure that the installation complies with for periodic testing. In practice, if an intrinsically safe loop is
the installation drawing is critical. Where an adequate drawing functional then it is very unlikely to have failed in a dangerous
such as Figure 3.1 exists, the initial inspection should ensure that mode. Components critical to safety are derated, so the probability
the actual installation conforms to the drawing. of external circumstances causing them to fail without causing a
Usually this involves checking each individual loop stage by stage, malfunction is small.
which involves a good deal of opening enclosures and clambering There is a bigger risk that a mistake could be made during the
over structures. Where the technician involved is suitably qualified removal and replacement of the apparatus being tested. The
this inspection can be combined with the operational checks. argument for not interfering with a system, which has survived the
However some organisations separate the two requirements, initial inspection and is still functional, is very powerful.
preferring ‘independent’ safety inspections. A particular case sometimes cited is regarding shunt-diode safety
This separation of functions is not conducive to shortening start barriers. Failure rate statistics can always be questioned, but the
up times. Frequently the initial inspection demonstrates the undetected failure rate to danger of a barrier (i.e. the shunt diodes
inadequacy of plant labelling, and the opportunity to improve this not failing to an open circuit condition), can be readily demonstrated
feature should not be missed. to be in better than 10-10/annum. With this probability of failure
they should remain untouched forever. If they are removed for any
3.3 Periodic inspections other reason a simple continuity check has some merit.
The objective of periodic inspections is to ensure the system has If a malfunction does occur, there is a risk that safety components
not appreciably deteriorated and has not been modified in an could also have been damaged and power to the system should be
unauthorised way. The required frequency of periodic inspections removed as a precaution.
is influenced by many factors, such as the immediate environment, A repair should be carried out as quickly as possible. Apparatus or
the presence of corrosive atmospheres and the susceptibility to wiring which remains damaged or is not in use for a considerable
mechanical damage. A usual starting point is to consider a three- time, should be removed from the hazardous area as it represents
year cycle, inspecting a third of the apparatus every year. If the an unnecessary risk.
inspection shows widespread deterioration then the inspection
period should be shortened and remedial action taken. 3.5 Testing of earth connections
Establishing that the intended apparatus is still in place is relatively It is always difficult to balance the traditional methods of testing
easy providing that the apparatus has a unique identity. earth connections with the need to ensure that an unacceptable
Usually the manufacturers type number is adequate. Much has risk to the plant is not introduced. Injecting significant voltages and
been written about checking the marking on the labels but except, currents into ill-defined circuits is not compatible with avoiding
as an intellectual exercise there is little point. Providing that the unnecessary risks.
inspector is convinced that the apparatus is the intended apparatus In almost all intrinsically safe installations cable screens contribute
then he has fulfilled his function. He should be encouraged to system safety and need to be earthed. In some apparatus such
to ask questions if he is unhappy about the apparatus or if the as shunt diode safety barriers and apparatus using a particular
circumstances of use have changed but fundamentally it is not type of transformer, the earth connection is an important part of
reasonable to expect a detailed analysis of every loop. the method of protection.
It is usually worth creating separate drawings of such things as Where surge protection against induced voltages (usually from
interface cabinets and junction boxes so that they can be readily lightning) is introduced then this introduces a further complication.
checked for any sign of unauthorised modification. Similarly preparing The design of the earthing system needs to be done with some
short lists of field equipment grouped in a particular area with their care and provision made to enable the system to be tested safely.
This is frequently done by providing duplicate leads. The subject is 3.7 Reference to apparatus certificates
considered in detail in the section on earthing and it is not possible Occasionally it will be thought desirable to refer to the certificate
to adequately summarise the process. of a piece of apparatus. Sometimes a copy is available but the
If you believe in testing earths by injecting a significant current preferred technique is to check on the web for the latest version.
then think very hard about the possible paths that the current will Most manufacturers and some certification authorities make their
use to come back to its point of origin. If you are confident that the certificates available by this means. For example, MTL certificates
path is well defined and safe - then there is no point in testing it! are available on the web-site http://www.mtl-inst.com/support
and IEC Ex certificates are available on the web-site
3.6 Testing insulation http://www.iecex.com The use of the web ensures that
Insulation testing is usually carried out using a high voltage (500V the most recent version of the certificate is available
or more), which is not compatible with the intrinsic safety concept. and that the certificate is complete.
(The ignition capable capacitance corresponding to 500V rms in IIC
is 160pF. This is the capacitance of approximately 1m of cable).
Where insulation testing is considered essential, it should be
carried out using a suitably certified instrument. This instrument
will apply a low voltage only (less than 6V) and have a low current
capability (less than 10mA). However, bear in mind that it is difficult
to ensure that there is no flammable gas at all points along an
instrument circuit during the period of test.
If high voltages are applied, care should be taken to ensure that
the connected equipment can not be damaged by the testing. For
example, it may be necessary to disconnect any surge suppression
devices that are connected in the circuit. It will also be necessary
to take care to discharge any charge that may have accumulated
in the equipment during testing.
Intrinsically safe circuits are usually fully floating or earthed at one
point. The reason for this is that if a circuit is earthed at more than
one point, the differential potential between the two points will cause 8 9
an undefined current to flow through an unknown inductance.
On a well-bonded plant the voltages are low and the resultant
current may not be incendive, but it is still unknown, could possibly
be incendive and is therefore not desirable. Many intrinsically safe
circuits that use shunt-diode safety barriers are designed to ‘fail-
safe’ in the presence of an earth fault, and consequently there is
no need to test the insulation. MTL7700 Series DIN-rail mounted safety barriers.
Some circuits, but not many, are provided with earth leakage
detection systems and these do not need testing. Fully isolated
circuits would require two separate faults to earth points some
distance apart before the circuit could possibly be dangerous.
The probability is that two such faults would also create an
operational failure and consequently routine insulation testing of
these circuits is not considered necessary.
There are a few remaining circuits that are not covered by the
above, but the level of voltage and current necessary to cause an
earth fault to be incendive (arguably greater than 9V and 100mA)
would almost always causes an operational failure. Consequently,
routine insulation testing of a functioning circuit on a well-bonded
plant is not necessary or desirable.
The overall conclusion is that routine insulation testing of
intrinsically safe circuits, which are functional, is not necessary.
The emphasis on ‘functioning circuits’ does however reinforce
the argument for rapid repair of non-functional circuits
discussed elsewhere.
Theoretically, just removing the power from a circuit with multiple
earth connections does not make it safe if significant differences in
plant potential exist. If insulation testing is thought to be desirable
for other reasons it should be carried out with care using a suitably
approved tester. Where apparatus has to be disconnected during
the testing process then special care is required to ensure that the
reconnection is correct, since this is an obvious risk. This usually
involves at least a functional check.
Design of intrinsically safe systems
4.
4.1 General
Where intrinsically safe apparatus is interconnected by wiring, the documentation is an essential part of the design of an intrinsically
safety of each piece of apparatus is affected by the performance safe installation.
of the other pieces of apparatus in the circuit. The safety technique The preparation of documentation for a new installation, to satisfy
relies on the system being correctly designed and intrinsic safety the installations directive and DSEAR, is usually relatively simple
becomes a system concept. Other methods of protection are as all the equipment will comply with the apparatus directive or be
also dependent on the system concept to some extent, but it is a simple apparatus and the necessary data will be readily available.
fundamental requirement of intrinsic safety. A slightly more complex situation arises when it is thought
For example flameproof equipment is only adequately safe when desirable to incorporate existing equipment, which is not certified
provided with the correct electrical protection and a means of to the apparatus directive.
isolation, but this is not generally regarded as being as significant For example, such a situation arises if it becomes necessary to
as ensuring that the apparatus within an intrinsically safe system is replace a central processor and its related interfaces but not to
compatible. There are some pieces of intrinsically safe apparatus, replace the field devices. In these circumstances, provided the
usually portable equipment, that are used in isolation, for example field devices are considered to have an adequate level of safety
torches and radios. The following analysis of intrinsically safe and their documentation contains the necessary information to
systems does not apply to these types of apparatus. enable a system document to be prepared, an acceptable system
In addition, some Fieldbus systems are constructed to the document can be created.
FISCO/FNICO standard IEC 60079-27, which introduces some To be considered as “adequately safe”, older equipment must
simplification of the system rules. These requirements are achieve a level of safety of the same order as equipment that has
discussed in MTL application note AN9026 but not in this recently acquired documents of conformity to the ATEX apparatus
document. This document concentrates on point-to-point wired directive. In the particular case of intrinsically safe equipment
systems, which are the predominant form of instrumentation. there has been no fundamental change in the standards, which
The relevant IEC system standard is IEC 60079-25, which has thrown into doubt the safety of equipment conforming to
interacts with the IEC code of practice IEC 60079-14 to provide any of the CENELEC based standards. Arguably, even equipment
comprehensive coverage of the subject. conforming to the older SFA 3012 and SFA 3004 standards that
The system designer must accept responsibility for the adequacy were used in the UK is probably adequately safe.
of the design and the safety implications of the use of the system NOTE: There is a problem regarding equipment spares that do not
in association with hazardous areas. The designer must have have documents of conformity to the ATEX apparatus directive, as
an appropriate level of knowledge and training and the analysis they can no longer be supplied by the original manufacturer for use
should not be done without recognising the importance of getting in association with hazardous areas. Only apparatus already in the
it right. The analysis of simple systems is relatively easy and can possession of the end-user or ‘in the supply chain’ can be utilised.
be done by any competent professional engineer. It seems prudent therefore to take this potential difficulty into
However some of the more complex systems such as those account when considering the continued use of older equipment.
using a combination of non-linear and linear sources of power
require a greater degree of experience and it may be desirable 4.3 Simple systems
to approach an ‘approved certification body’ to provide an The majority of intrinsically safe systems are simple systems
analysis for such a system. that contain a single source of power in associated apparatus
connected to a single piece of intrinsically safe apparatus out in
4.2 Compliance with ATEX Directives and DSEAR the field. Such a system is discussed in detail in an appendix of
Unless they are considered to be ‘simple apparatus’ (see section IEC 60079-11.
4.4), individual pieces of equipment are required to comply with Here, we use the combination of a temperature transmitter and
the ATEX equipment directive (94/9/EC). However, the majority an intrinsically safe interface, shown in Figure 4.1, to illustrate
of intrinsically safe systems combine equipment from one or the technique.
more suppliers and these systems become an ‘installation’ and The first step is to obtain the safety data of the two pieces of
do not need to be certified to the equipment directive. There apparatus in the circuit. This data is best derived from a copy of
might, however, be rare occasions when a manufacturer places the certificate, which should be available to the system designer.
a complete system on the market, in which case the system will In particular, any special conditions of use should be taken into
have to comply with the equipment directive. account in the system design. The information placed on the
The installations directive (1999/92/EC), and the DSEAR system drawing should be the result of a clearly justifiable analysis
regulations, require a risk analysis (within their jurisdiction) of any making it relatively simple to create the installation drawing from
installation that contains one or more hazardous areas and the this reference drawing.
system documentation becomes an essential part of that analysis. NOTE:
In almost all other parts of the world similar requirements exist Copies of MTL Certificates are available from web site:
either for legal or insurance reasons. Where no such requirements http://www.mtl-inst.com/support
exist there is still the fundamental requirement to operate safely Copies of IEC Ex Certificates are available from web site:
and to be able to demonstrate that all reasonable precautions have http://www.iecex.com
been taken. For these reasons the preparation of adequate system
 - Classification ia IIC
- Cable parameters 80 nF, 3.0 mH, 55 µH/Ω isolated
Temperature Transmitter Type MTL5541 - data
Type: 365S (example) MTL Ltd, Luton, UK
Pan Inc., Boston, USA [EEx ia] IIC by EECS
Ex ia IIC T4 by FUML No. 983065 No. BASeefa07ATEX010123
T
amb = –40°Cto +80°C T
amb = –20°C to +60°C
‘B’ Terminals Safety IIC
Ui: 30 V Parameters Parameters
Ii: 120 mA Um: 250 V Co: 83nF
Pi: 1 W Uo: 28V Lo: 4.2mH
Ci: 3 nF Io: 93mA Lo/Ro: 56µH/Ω
Li: 10 mH Po: 651mW
Notes:
a) If cable ‘y’ becomes part of a multicore, then this multicore cable must be a
Type ‘A’ or ‘B’, as specified in IEC 60079-14.
b) Cable ‘y’ has capacitive limitation 80 nF in IIC; 647 nF in IIB

Figure 4.1 - Simple system of interface and transmitter

The compatibility of two pieces of apparatus should be established parameters should not exceed the relevant input parameters.
by comparing the data of each apparatus. The sequence is usually Occasionally the safety of the field device is completely
as follows. specified by only one of these parameters (usually Ui). In these
circumstances the unspecified parameters are not relevant.
a) Compare the levels of protection. If they differ then the
system takes the least sensitive level. For example if one device f) Determine the permitted cable parameters.
is ‘ia’ and the other ‘ib’ then the system becomes ‘ib’. The permitted cable capacitance (Cc) is derived by subtracting
A source of power that is certified ‘ib’ will have permitted output the input capacitance of the field device (Ci) from the permitted
10 11
parameters for use in ‘ic’ circuits. If these higher values are output capacitance of the source of power (Co), that is Cc =
used in the system design then the system becomes ‘ic’. Co – Ci. The permitted cable inductance (Lc) is derived by
subtracting the input inductance of the field device (Li) from the
b) Compare gas classifications. If they differ then the system permitted output inductance of the source of power (Lo), that is
takes the least sensitive classification. For example if one device Lc = Lo – Li.
is IIC and the other IIB then the system becomes IIB. Determining the permitted L/R ratio of the cable (Lc/Rc) is very
It is usual for a source of power certified as IIC to have easy if the input inductance of the field device is negligible, i.e.
permissible output parameters (Lo, Co and Lo/Ro) for IIB and IIA if Li less than 1% of Lo. In this case, Lc/Rc is considered equal
gas groups. If these larger values are used then the parameters to Lo/Ro. However, if the inductance of the field device is more
used determine the system gas group. significant then the equation included in IEC 60072-26 can be
used to calculate the permitted Lc /Rc. Fortunately this is not a
c) Determine the temperature classification of the field mounted frequently occurring requirement.
equipment. Apparatus may have different temperature Recently there has been increasing concern about the interaction
classifications for different conditions of use (usually ambient of system inductance and capacitance increasing the risk of
temperature) and the relevant one should be selected and recorded. ignition capable sparks.
It should be noted that it is the apparatus that gets temperature
classified not the system.

d) The permissible ambient temperature range of each piece of

apparatus should be recorded.

e) The voltage (Uo), current (Io) and power (Po) output

parameters of the source of power should be compared with the
input parameters (Ui, Ii and Pi) of the field device and the output

“The safety technique relies on the system being correctly designed and
intrinsic safety becomes a system concept”
 step
Sequence Parameter Interface Temperature transmitter System
a) Level of protection ia ia ia
b) Gas group IIC IIC IIC
c) Temperature classification T4
d) Ambient temperature - 20°C to +60°C - 40°C to +80°C
e) Parameter comparison
Voltage Uo: 28V Ui: 30V
Current Io: 93mA Ii: 120mA
Power Po: 650mW Pi: 1W
f) Cable parameters
Capacitance Co: 83nF Ci: 3nF Cc: 80nF
Inductance Lo: 3.05mH Li: 10µH Lc: 3mH
L/R ratio Lo/Ro: 55µH/Ω Lc/Rc: 55µH/Ω
g) Isolation isolated isolated isolated

Table 4.1 Simple system analysis

4.3 Simple systems - continued

This concern is confined to fixed inductance and capacitance If these criteria are all satisfied the compatibility of the two
and not to the distributed parameters of a cable. Consequently pieces of apparatus will have been established. A convenient
on those rare occasions when BOTH the lumped inductance way of recording the analysis is to create a table. Table 4.1 is an
(the sum of Li of the source of power and the field device) and example that uses values from the typical system drawing (see
the lumped capacitance (the sum of Ci of the source of power Figure 4.1) and compares the intrinsically safe interface and the
and the field device) are greater than 1% of the respective temperature transmitter.
output parameters of the source of power Lo and Co then the
permissible output parameters are both to be divided by two. 4.4 The use of simple apparatus in systems
It should be stressed that this reduction in output parameters The apparatus standard (IEC 60079-11) distinguishes between
is only applicable on very rare occasions since it is unusual complex apparatus, which normally requires some form of
for field devices to have BOTH inductive and capacitive input certification and ‘simple apparatus’ which is not required to be
parameters which are significantly large. certified. This distinction is intended to permit the use of apparatus
Frequently the Li and Ci of a source of power are not quoted that does not significantly affect the intrinsic safety of a system,
in the documentation and in these circumstances it can be without the need for ‘third party’ certification.
assumed that they are negligible. There is no suggestion that There is an implication that it is possible to demonstrate that
it is considered necessary to go back and check the safety simple apparatus is obviously safe without recourse to the detail
documentation on existing installations for this most recent application of the remainder of the standard. For example, if any
requirement. However new analyses should take this remote current or voltage limiting components are necessary then the
possibility into account. apparatus is not considered to be simple. In practice it is relatively
To summarise, check that either the lumped capacitance or easy to decide which components are simple apparatus at the
inductance is less than 1% of the respective output parameters. system design stage. If the decision is not easy then the apparatus
If it is, then the original calculation is valid. If BOTH parameters is not simple.
are greater than 1% of the output parameters then Co and NOTE: Although it is not considered essential that simple apparatus
Lo of the system should be reduced by a factor of two. If this is certified by a third party, it is not unusual for simple apparatus
reduction seems to be necessary then go back and check the that is used in significant quantities to be certified.
information used, as this is an unusual situation. This is reassuring to the end user and is a significant marketing
Where a source of power is certified ‘ia’ or ’ib’, the permitted advantage. In these circumstances the apparatus is marked as
output parameters Lo, Co and Lo/Ro are derived using a required by the apparatus standard, but can be used in the same
factor of safety of 1,5. When such a source of power is used way as other simple apparatus.
in an ‘ic’ circuit then the permitted output parameters may be The apparatus standard imposes limits of 1.5V, 100mA and 25mW
derived using a unity safety factor. This results in a significant on the values generated by simple apparatus, and it is accepted
change, which usually removes the necessity to consider cable that simple apparatus can be added to an intrinsically safe system
parameters in detail. Accurate values can be ascertained using without the need to recalculate the safety of the system. It must
the methods and tables in the apparatus standard. An acceptable be understood however, that any limitations on simple apparatus
conservative technique is to multiply the Lo and Lo/Ro by two apply to the combination of all the pieces of simple apparatus in
and the Co by three, which normally removes any concern about a system. For example, the use of one or two thermocouples in a
cable parameters. system is permitted but a combination of a large number used in
g) Check that the level of insulation from earth is acceptable, or a single, average temperature circuit might not meet this criterion.
that the system earthing requirements are satisfied.
The standard also allows capacitive and inductive components is not applicable then the possible maximum surface temperature
to be used in simple apparatus, provided that these components has to be measured or assessed. If for any reason it is not obvious
are included in the system evaluation. It is not usual to include that the maximum surface temperature is considerably lower than
inductors or capacitors of significant size, but the simple apparatus 135°C (say 100°C) then the apparatus is probably not simple.
concept does permit the use of small radio-frequency (r.f.) Simple apparatus is usually isolated from earth. However, the
decoupling components without undertaking a further analysis apparatus standard requires a 500V insulation test and if the
of the system. A useful rule-of-thumb is to ensure that the total simple apparatus cannot meet this then it introduces an earth on
capacitance and inductance added to the system is less than 1% of to the system and the system design must take this into account.
the respective output parameters of the source of power, in which A typical example of simple apparatus is the resistance thermometer
case, their effect can be ignored. If BOTH the added capacitance (RTD) shown as the sensor in the typical system drawing.
and inductance, together with any other ‘lumped’ capacitance in The RTD is a temperature sensitive resistor. It has negligible
the circuit are greater than 1% of the specified output parameters inductance (less than 4µH) because it is bifilar wound and
of the source of power then the permitted output parameters must negligible capacitance (less than 10pF). The matched power from
be halved, as explained in Section 4.3. This is another very good the transmitter terminals is 2,5mW, which is considerably less
reason for ensuring that the ‘energy storing’ components in simple than the 25mW considered negligible for simple apparatus.
apparatus are kept small. This low level of power ensures that the temperature classification
It is also necessary to temperature classify simple apparatus of the RTD is determined by the temperature being measured. (A
when it is intended for hazardous area. The apparatus standard T6 temperature sensor measuring 450°C is a common advertising
allows a T6 temperature classification for switches, plugs, sockets phenomenon.) The RTD does not meet the required 500V insulation
and terminals used within their normal rating at an ambient test and consequently this sub-cicuit is considered to be earthed
temperature of not greater than 40°C. at this point. The installation is satisfactory because of the isolation
In practice, it is not easy to design a system that can be used in the temperature transmitter.
with gases requiring a T6 (85°C) temperature classification and a The ignition energy of a gas decreases at elevated temperatures
T4 (135°C) classification is normally the level achieved. In reality, and consequently the very low fault voltage and power available
the only gas listed in the available documentation requiring a T6 to the RTD is a beneficial factor in ensuring the safety of any
temperature classification is carbon disulfide (CS2). Fortunately, measurement of high temperatures.
the use of this gas in industry is becoming rare because of its
toxicity. A T4 temperature classification is therefore adequate 12 13
normally and a claim of T6 is predominantly a marketing ploy
rather than a requirement.
The temperature classification of other pieces of apparatus (with
a surface area not less than 20mm2) normally relies on the input
power being no greater than 1,3W when the maximum ambient
temperature required is 40°C. The corresponding powers for higher
ambient temperatures are 1,2W at 60°C and 1W at 80°C. If this rule

- Classification ia IIC Temperature Transmitter

- Cable parameters 1000µF, Type: 365S (example)
350mH Pan Inc., Boston, USA
- Earthed at RTD Ex ia IIC T4 by FUML No. 983065
Ambient temperature –40°C
Note: ‘T’ class determined to +80°C
by maximum measured
temperature. Terminals ‘A’
Uo: 1.0 V
RTD Type: 350L (example) Io: 10 mA
Peter Pty, Sydney, Australia Po: 2.5 mW
Simple Apparatus to IEC Co: 1000µF
60079-11 Lo: 350 mH
Passive component to
subclause 5.4a) Note: If cable ‘x’ becomes
part of a multicore, then this
Type: PS061 multicore cable must be a
Maximum operating Type ‘A’ or ‘B’, as specified
temperature 450°C in IEC 60079-14.
Temperature classification
determined by maximum
measured temperature.

Figure 4.2 - RTD and transmitter sub-system

4.5 The use of apparatus with ‘simple apparatus’ that it is permitted to apply the fault count to the system as a
input description whole. For example if more than one piece of simple apparatus is
The other common use for the simple apparatus clause is to permit connected in the circuit, then it can be argued that only one piece
the use of certified apparatus with input parameters equivalent of apparatus is considered to fail at any one time, and hence only
to simple apparatus, to be added to an existing intrinsically safe the most adverse set of output parameters needs to be considered.
circuit with only a minor change in the documentation. The most This type of argument is acceptable in ‘ib’ systems but needs to
frequent uses of this technique are for test equipment, indicators be carefully documented. For such an argument to be valid for
and trip amplifiers. ‘ia’ systems detailed knowledge of the derivation of the output
A typical example of this type of application is the MTL 5314 parameters is required. This information is not usually readily
trip amplifier which is frequently used to monitor the 4-20 mA available and hence the technique is not normally applicable to
signals from a transmitter as illustrated in Figure 4.3. The input ‘ia’ systems. If it is known that the apparatus terminals are purely
terminals satisfy the requirements of simple apparatus and hence resistive in normal operation (as is frequently the case) then any
the insertion of this apparatus does not require that the safety number of these devices can be incorporated in an ‘ic’ system.
analysis of the existing system is modified. The presence of the
trip amplifier and the fact that it is regarded as simple apparatus
is all that needs to be recorded.
Where more than one piece of apparatus with simple apparatus
output characteristics is included in a circuit then care should be
taken to ensure that the permitted simple apparatus parameters
are not exceeded. Advantage can sometimes be taken of the fact
that the output voltage only appears under fault conditions and

Simple Apparatus, Intrinsically Safe interface,

Trip Amplifier MTL5314.
The Trip Amplifier connects in series with the 4/20
mA transmitter circuit, giving alarm signals to the
safe area via changeover relays.
Using the Simple Apparatus (Non-energy Storing)
rule the device may be connected in series with
the hazardous side of the MTL5541.
Certification & Safety Parameters
Terminals 1 and 3 meet the Simple Apparatus rules
having output parameters:
Uo: 1.0V, Io: 88mA, Po: 22mW
Certified [EEx ia] IIC by EECS
No. BAS 98 ATEX 7136
Tamb –20°C to +60°C
Um: 250 V

Figure 4.3 MTL5314 used as monitor

Maintenance and Repair of 5.
Intrinsically Safe equipment
5.1 General 5.3 Permitted practice in the workshop
The ability to do live maintenance on an intrinsically safe system The repair and testing of intrinsically safe and associated
is a major benefit of the technique. It is difficult to test an apparatus should only be carried out in favourable conditions and
instrument system with the power removed, and difficult to obtain by adequately trained technicians. The IEC standard IEC 60079-19
a meaningful ‘gas clearance certificate’ that covers the whole of provides some guidance on the approach to repair of intrinsically
the area affected by a system. Consequently live working is very safe equipment.
desirable. There are however factors, other than gas ignition, that There are always practical and economic limitations on what is
have to be considered whenever an instrument system is taken practicable. For example, shunt diode safety barriers are invariably
out of commission and consequently local safety practices such encapsulated and not repairable. Isolating interfaces are usually in
as ‘permits to work’ have still to be observed. boxes that are difficult to open, coated in varnish and impossible to
test in detail without specialist test equipment and knowledge of
5.2 Permitted practices on the plant the circuit. In general replacement by an identical unit is preferred
The design of intrinsically safe apparatus and systems ensures for both economic and safety reasons.
that the short circuit and open circuit of field wiring cannot cause Some repairs can be carried out without affecting the safety of
ignition of a gas atmosphere. The concept of live maintenance uses equipment and, usually, it is obvious what limitations apply. For
this feature but does not extend to carrying out detailed repairs; example, damage to enclosures does not usually directly affect
for example, repairing printed circuit boards within the hazardous the intrinsic safety of apparatus and consequently a repair which
areas. In practice, the permissible actions are restricted by the restores the enclosure to its original level of integrity (IP rating)
available tools hence deciding what is permissible is not difficult. is acceptable. The repair of printed circuit boards is sometimes
IEC 60079-17 restricts live ‘working’ to: considered but is usually impracticable. Removing components
i) disconnection of, and removal or replacement of electrical without damaging the board is difficult, repairing the coating
14 15
apparatus and cabling on reassembly is messy and maintaining the original creepage
ii) adjustment of any controls which is necessary for the and clearance distances may not be possible. A recent further
calibration of the electrical apparatus or system complication is that if lead free solder has been used, the use of
iii) removal and replacement of any plug in components or solder containing lead usually results in unsatisfactory joints.
assemblies A record of any repairs should be maintained. The use of before and
iv) use of any test instruments specified in the relevant after photographs (stored digitally) frequently simplifies the process.
documentation. Where test instruments are not specified in the
relevant documentation, only those instruments, which do not 5.4 Testing of IS apparatus using non-certified
affect the intrinsic safety of the circuit, may be used test apparatus
v) any other maintenance activity specifically permitted by the There are two circumstances under which non-certified test
“relevant documentation” apparatus is used to test intrinsically safe and associated apparatus
These requirements are in line with the normal practice of and systems. One is where apparatus is tested in the safe area,
maintenance on field mounted equipment and hence create no usually disconnected from the IS system, and, less frequently,
problem. Work on associated safe area apparatus, such as the when apparatus and the system is tested in the hazardous area
intrinsically safe interface is restricted in the same way, except that using a gas clearance certificate.
there is greater freedom to operate on the safe area terminals. It is sometimes questioned whether connecting non-certified
Recently developed interfaces tend to operate from 24V supplies apparatus during such procedures can result in the intrinsic
and there is no risk of electrocution. However it is not unusual safety of the apparatus or system being impaired by damage
for interfaces with relay outputs to be switching higher voltages, to the safety components. In the past, testing has not required
which may create a significant shock risk. Where this risk occurs, any special precautions to be taken to avoid this possibility. The
adequate warning labels are required and the relevant precautions current standard on inspection and maintenance IEC 60079-17
should be taken during the maintenance process. does not address this question, consequently the following is only
There is no risk of a significant electric shock being received a considered opinion and should be regarded as such.
by a technician working on an intrinsically safe circuit. There
is a hypothetical possibility but in practice this is not a real
problem actions are permitted, they are frequently embodied in
the apparatus certificate and manufacturer’s instruction. This
information should be made available to the relevant technician
on the work sheet, as he is not likely to have ready access to the
certificate and/or instructions. The apparatus marking would carry
the ubiquitous ‘X’ marking but this is almost universally applied
and consequently largely ignored.
5.4 Testing of IS apparatus using non-certified of instrument, for example a pressure transmitter, for use in all
test apparatus - continued locations on a plant. An intrinsically safe transmitter can then be
A relevant point is that during the manufacturing of intrinsically used on a temporary installation in a safe area in a conventional
safe products, the equipment used for both operational and safe area loop, and after some time be returned to the store as
safety testing relies on good engineering practice and regular a spare instrument. From the store it could be used to replace a
inspection to achieve adequate safety. It is not subject to third defective instrument in an intrinsically safe loop.
party certification or any similar constraints. The apparatus design It can be assumed that the replacing instrument is functional, and
standards address some of the more obvious risks, such as the not mechanically damaged (the majority of instrument technicians
charging of batteries, but do not make any other recommendations would check this in the workshop before putting the instrument
to cover less frequently used facilities. in the stores as a spare) and therefore the concern is that there
The factors, which justify the use of conventional test equipment is some fault which reduces the safety integrity but does not
when working on intrinsically safe apparatus, are: affect the operation of the instrument. Almost all faults from an
a) Repair and maintenance should only be carried out by ‘skilled external source would cause sufficient damage to the apparatus
personnel’. Such personnel should be adequately trained for it to malfunction, rather than cause the conservatively rated
to recognise whether a mistake could have caused damage, safety components to fail to danger without damaging any other
which might lead to a dangerous situation, and be capable of components. This type of undetected failure is just possible but is
taking any necessary corrective action. sufficiently improbable to be ignored. In the particular case of a
b) Test equipment should be checked to ensure that it is non-incendive installation then the selection of apparatus, and the
operational before connecting it to the apparatus. Particular installation code followed further reduce the probability of the IS
care should be taken to ensure that any variable controls, such apparatus being stressed.
as output voltage and current limits on power supplies, are set There are a number of circumstances where a very similar
to the correct values before making the interconnection. The test risk occurs, and the risk is considered acceptable. A very clear
equipment should be checked at the end of the test. Since the example is that the IEC standard on inspection and maintenance
test equipment is only connected for a short time the probability (IEC 60079-17), permits the use of non-certified test equipment
of it failing in a way that can cause a potentially hazardous fault under ‘gas clearance certificate’ conditions. Similar risks are
in that time is acceptably low. accepted during fault-finding procedures in instrument workshops.
c) The apparatus should be functioning correctly and be free of There are also significant risks of such faults occurring during the
mechanical damage at the end of the test or re-calibration. It is repair proedures permitted by the same standard on repairing this
possible that a safety component failure will not affect operational type of apparatus. The test equipment used in the final stages of
capability but usually an operational failure will also occur. manufacturing of IS equipment is not designed to be fault tolerant
d) The more complex operations such as re-programming and could produce undetected faults. These risks illustrate the
and downloading of apparatus memories are normally done point that where a risk is small it can be, and is, accepted.
using test rigs with specific plugs and sockets and hence the With the recent introduction of the ‘ic’ concept, this question
probability of incorrect connection is reduced. becomes more relevant to intrinsically safe circuits; for example,
e) Test equipment that satisfies the personnel safety the use of an ‘ia’ certified transmitter in an ‘ia’ system after it has
requirements of IEC 61010, is not likely to produce currents or been used in an ‘ic’ system may be questioned. The question of
voltages, which will damage safety components. For example the transfer of apparatus from an ‘ib’ system to an ‘ia’ system has
a functioning oscilloscope with high impedance probes is never been raised as far as is known.
extremely unlikely to cause a problem. The conclusion is therefore that the safety status of a field device is
There are some operations which do require special care, of which not changed provided that the device is both functioning correctly
the most obvious is high voltage insulation testing. This should and not mechanically damaged after being used in any type of
only be done when a special work instruction is available. circuit. If these two requirements are met, the field device can be
In practice such tests are best avoided and if an insulation test is used in an intrinsically safe circuit without further consideration.
thought to be necessary it should be done at a low voltage. It is
generally accepted that the testing, calibration and programming
of intrinsically safe apparatus in a safe area, or under gas clearance
conditions by a competent person using conventional high quality
test equipment does not invalidate its intrinsic safety certification.

5.5 Re-use of intrinsically safe field devices

The question is sometimes raised as to whether intrinsically
safe apparatus which has been used in circuits which are not
intrinsically safe, such as non-incendive or safe area circuits can
subsequently be used in intrinsically safe circuits. The perceived
problem is that use in the non-intrinsically safe circuits could
cause damage, which is not self-revealing but would reduce the
level of protection offered by the original certification. The relevant
IEC standards do not give any guidance on this topic and hence
the following text is only a considered opinion, which may not be
universally accepted.
The question normally arises because it is common practice
on most petrochemical installations to purchase a single type MTL4850 HART® Multiplexer.
Intrinsic Safety and Dust 6.
6.1 General
A number of finely divided materials can be ignited to create an The principal difficulty is the possibility of causing smouldering
explosion when they form a cloud in air. Almost all organic and within a dust layer, which when disturbed bursts into flames and
food product dusts together with metallic dust can readily be initiates an explosion. The mechanism of causing smouldering is
ignited. Dust explosions are generally more difficult to initiate than complex but can be simplified into keeping the dust below its ‘glow
gas/air explosions but can be devastating. The initial explosion temperature’. The majority of materials have a glow temperature,
frequently disturbs and entrains layered dust to create one or ranging from 250°C to 500°C, that is lower than the minimum
more secondary explosions, thus creating a rolling explosion and ignition temperature of the corresponding dust cloud.
extensive damage. There are also some flammable dust layers that have the fortunate
Dust explosions can be initiated by electrical sparks or by hot characteristic of melting before attaining their theoretical glow
surfaces. There are numerous factors, which influence ignition temperature and consequently they do not create this ignition risk
energy and temperature of a particular material. For example the (for example polystyrene).
air to particle ratio, the particle size, humidity, and the melting
temperature of the material. 6.2 Intrinsically safe apparatus and dusts
Note: For those requiring a comprehensive reference ‘Dust Intrinsically safe apparatus certified for use in hazardous gas
explosions in the process industries’ by Rolf. K. Eckhoff published by atmospheres has been used to ensure safety in dust atmospheres
Butterworth Heinemann. ISBN 0 7506 3270 4 is recommended. for many years. Currently a great deal of activity is taking place
The ignition energy of a dust/air mixture is high compared with that to formalise the requirements for apparatus specifically for use in
of a gas/air mixture. For example, some sensitive materials such dusts. An apparatus standard IEC 61241-11 is now published. The
as rubber, sulfur and fine wood dust require 1 to 10 mJ while less ultimate intention is to amalgamate the dust and gas requirements
sensitive materials, such as coffee, require more than 500 mJ. within the relevant IEC standards but this will take a number of
There is some concern that some very finely divided particles, for years (five?). Eventually there will be three levels of protection
example those associated with nano-technology, may have even ‘iaD’, ‘ibD’, and ‘icD’ corresponding to the equivalent gas levels of
lower ignition energies. Consequently, the decision has been made protection (see Table 6.1). The intention is that ‘iaD’ equipment will 16 17
to use the IIB gas as the test mixture (ignition energy 80µJ) for achieve the ‘very high’ level of protection required by equipment
intrinsically safe apparatus for use in dust atmospheres. This is a very designated as ‘EPL Da’ (where EPL means ‘Equipment Protection
conservative decision but presents very little operational difficulty. Level’ as defined in IEC60079-0). ‘ibD’ with a ‘high’ level of
The current state of knowledge on the spark ignition characteristics protection will achieve an ‘EPL Db’ and ‘icD’ with an ‘enhanced’
of dusts and the difficulty of creating a satisfactory test apparatus level of protection will be ‘EPL Dc’.
for dust atmospheres justifies a cautious prudent decision.
The major problem in dust atmospheres is the possibility of
thermal ignition. There are two common mechanisms, one is the
ignition of a dust cloud by a hot body and the other is the creation
of smouldering in a layer of dust on a hot surface.
The minimum ignition temperature of the majority of dusts
lies between 300°C and 600°C. Some dusts do ignite at lower
temperatures, for example finely divided sulfur has a minimum
ignition temperature of 240°C. It is quite difficult to generate these
temperatures in a dust cloud with the power levels permitted by
a IIB gas classification and hence the probability of ignition of a
dust cloud by intrinsically safe apparatus is quite low and not the
major problem.

Level of Countable Level of Equipment ATEX Normal

protection faults risk Protection category zone of use
Level - EPL
iaD 2 very high Da 1 20
ibD 1 high Db 2 21
icD 0 considerable Dc 3 22

Table 6.1 - Comparison of different levels of risk

6.2 Intrinsically safe apparatus and dusts - continued 6.4 Why use intrinsic safety?
The risk of spark ignition is avoided by satisfying the requirements for The principal reason for using intrinsic safety is because it is
apparatus intended for use in IIB gases To avoid the risk of thermal essentially a low power technique. Consequently, the risk of ignition
ignition the preferred technique for apparatus, which is intended to is minimised, and adequate safety can be achieved with a level of
be located in the hazardous area, is to exclude the dust by using confidence that is not always achieved by other techniques.
an IP 6X enclosure or by encapsulation. This involves determining It is difficult to assess the temperature rise, which can occur if
a maximum temperature rise of the exposed surface, which in the equipment is immersed in a dust because of the many (frequently
case of most intrinsically safe apparatus will be very small. unpredictable) factors, which determine the temperature rise
The preference for a dust tight enclosure is because the ‘dust within the dust layer. The safest technique is therefore to restrict
fraternity’ has implicit faith in this technique. It can be argued that the available power to the lowest practical level. A major factor
the restriction of the available power is a more reliable technique in favour of intrinsic safety is that the power level under fault
as it is less prone to maintenance errors. conditions is controlled by the system design and does not rely on
There is an exemption to the enclosure rule for apparatus that is the less well-specified limitation of fault power.
difficult to operate inside an enclosure, such as some sensors. Intrinsic safety also has the advantage that the possibility of ignition
In these circumstances the power level is restricted to avoid the from immersed or damaged wiring is minimised. It is desirable to
possibility of temperature ignition (750mW at 400°C), In practice be able to do ‘live maintenance’ on an instrument system, and
all intrinsically safe associated apparatus such as barriers the use of the intrinsically safe technique permits this without the
and isolated interfaces, which are IIC or IIB certified for gases necessity of special ‘dust free’ certificates. There is a need to clear
are suitable for use in intrinsically safe systems. It is has been layers of dust carefully and to avoid contamination of the interior of
common practice for several years for interfaces to be certified apparatus during maintenance but this is apparent to any trained
for both gas and dust applications. For example, the current MTL technician. (There is no significant possibility of a person, in a dust
range of barriers (MTL7700) and isolators (MTL4500/5500) are cloud that can be ignited, surviving without breathing apparatus).
certified for both gas and dust applications in accordance with the To summarise, intrinsic safety is the preferred technique for
requirements of the ATEX Directive and FM standards. The design instrumentation where dust is the hazard because:
of intrinsically safe apparatus for use in dusts is the subject matter • the inherent safety of intrinsic safety gives the greatest
of Part 11 of IEC 61241 assurance of safety and removes concern over overheating
of equipment and cables
6.3 Risk analysis • the installation rules are clearly specified and the system
Analysing the risk associated with a flammable dust differs from design ensures that all safety aspects are covered
the analysis of a gas risk largely because dust does not disperse • live maintenance is permitted
in the same way as a gas, it has to be removed. • equipment is available to solve the majority of problems
A decision was made some years ago to only area classify dust clouds
and to treat the possibility of a smouldering dust layer as a source of
ignition. (a decision largely influenced by the ATEX Directives).
The area classification of dust clouds follows the pattern of gas
clouds. Zone 20 corresponds to Zone 0 (where the hazard is
present continuously or for long periods) Zone 21 to Zone1 and
Zone 22 to Zone 2 as the probability of the dust cloud being
present reduces.
Area classification of dusts is the subject matter of Part 10 of IEC
61241. If the combination of area classification and sources of
ignition is pursued too diligently this can create some tortuous
thinking. Fortunately, the application of a little pragmatic common
sense solves most instrumentation problems.
For example, if a temperature sensor is buried in a mound of grain
for a considerable length of time, then it is reasonable to use a level
of protection ‘iaD’ since deciding the area classification is difficult
and if the grain is smouldering it will probably burst into flame
when disturbed and could possibly explode. As it is not expensive
to make the system ‘iaD’, this becomes the obvious solution.
However if a temperature monitor is measuring temperature in
a location where it is infrequently covered by dust and can be
readily and frequently cleaned then a level of protection ‘icD’ is
adequate. It might still be expedient to use ‘iaD’ equipment but it
is not essential to do so.
 18 19

The principal reason for using intrinsic safety

is because it is essentially a low power technique,
consequently the risk of ignition is minimised.
 GLOBAL LOCATIONS
AUSTRALIA INDIA SINGAPORE
MTL Instruments Pty Ltd, 9 /12 Billabong Street, MTL India Pvt. Limited, No.36, Nehru Street MTL Instruments Pte Ltd, 31 Ubi Road 1
Stafford, Queensland 4053 Off Old Mahabalipuram Road #04-01 Aztech Building
Australia Sholinganallur, Chennai - 600 119 Singapore 408694

Tel: + 61 1300 308 374 Fax: + 61 1300 308 463 Tel: + 91 (0) 44 24501660 /24501857 Fax: + 91 (0) 44 24501463 Tel: + 65 6 487 7887 Fax: + 65 6 487 7997
E-mail: enquiries@mtlaus.com.au E-mail: sales@mtlindia.com E-mail: sales@mtlsing.com.sg

CANADA ITALY UNITED ARAB EMIRATES

MTL Canada Safety Instrumentation MTL Italia srl, Via Cantù 11 MTL Instruments, Villa No. 4, Sector 2-17
#102, 4249 97 Street, Edmonton I - 20092 Cinisello Balsamo MI Street 6, PO Box 53234
Alberta, T6E 5Y7 Abu Dhabi, UAE
Tel: + 39 02 61802011 Fax: + 39 02 61294560
Tel: + 1 780 485 3132 Fax: + 1 780 485 3122 E-mail: info@mtl-inst.it Tel: + 971 2 446 6840 Fax: + 971 2 446 6841
E-mail: cinfo@mtlnh.com E-mail: mtlgulf@mtl-inst.com
JAPAN
CHINA MTL Instruments KK, UNITED KINGDOM
MTL Instruments China Co. Ltd. Room 1002A, The Gateway MT Building MTL Instruments, Great Marlings,
No 10 Yabao Road, Chaoyang District, Beijing 100020 3F 2-7-5 Shiba Daimon, Minato-ku, Butterfield, Luton
Tokyo 105-0012 Bedfordshire LU2 8DL
Tel: + 86 010 8562 5718/5720/5721 Fax: + 86 010 8562 5725
E-mail: bjsales@mtl-inst.cn Tel: + 81 (0)3 6430 3128 Fax: + 81 (0)3 6430 3129 Tel: + 44 (0)1582 723633 Fax: + 44 (0)1582 422283
E-mail: sales@mtlkk.co.jp E-mail: enquiry@mtl-inst.com
FRANCE
MTL Instruments sarl, Les Carrés du Parc NETHERLANDS USA
10 rue des Rosiéristes, 69410 Champagne au Mont d’Or MTL Instruments BV, de Houtakker 36, Cooper Crouse-Hinds MTL Inc.
6681 CW Bemmel, 3413 N. Sam Houston Parkway W.
Tel: + 33 (0)4 78 64 98 32 Fax: + 33 (0)4 78 35 79 41 Suite 210, Houston TX 77086
E-mail: info@mtl-inst.fr Tel: + 31 (0) 481 450250 Fax: + 31 (0) 481 450260
E-mail: info@mtlbenelux.com Tel: + 1 281-571-8065 Fax: + 1 281-571-8069
GERMANY E-mail: csinfo@mtl-inst.com
MTL Instruments GmbH, An der Gümpgesbrücke 17
D-41564 Kaarst

Tel: + 49 (0)2131 718930 Fax: + 49 (0)2131 7189333

E-mail: info@mtl.de
ZL-B-AN9003-EN-0809

www.mtl-inst.com enquiry@mtl-inst.com

I-S_AN9003_MTL.indd 20 5/10/09 12:01:31 pm