Intrinsic safety, zones, and what Ex ia actually promises

Hazardous area work is the part of instrumentation where getting it wrong is not a commissioning problem, and where the rules are precise for exactly that reason.

The zones

Classification is by how often an explosive atmosphere is present.

Gas. Zone 0, present continuously or for long periods. Zone 1, likely in normal operation. Zone 2, not likely, and short lived if it occurs.

Dust. Zone 20, 21 and 22, on the same pattern.

The zone drives the protection level required, and the zone is somebody's formal assessment recorded on a drawing. It is not a judgement made on site.

The two philosophies

Containment. Flameproof, Ex d. The enclosure is strong enough to withstand an internal explosion and the flame paths are long and narrow enough that the escaping gas is cooled below ignition temperature. The explosion happens and is contained.

Prevention. Intrinsic safety, Ex i. The energy available in the circuit is limited so that no spark or hot surface can reach ignition energy, even with two faults present.

The practical consequence of the difference: an intrinsically safe circuit can be worked on live. A flameproof enclosure cannot be opened with power on, which on a plant that runs continuously is a significant operational difference.

ia, ib and ic

Three levels of intrinsic safety, distinguished by how many faults they tolerate.

• ia. Safe with two faults. Suitable for Zone 0.
• ib. Safe with one fault. Zone 1.
• ic. Safe in normal operation. Zone 2.

The level is a property of the whole loop, not just the barrier, and the loop is only as good as its least capable part.

Barriers and isolators

Zener barrier. Zener diodes clamp the voltage and a resistor limits the current, with a fuse. Excess energy goes to earth, so the barrier needs a high integrity earth, typically under one ohm, run separately and documented.

That earth requirement is the practical drawback. It has to be installed correctly, verified, and maintained, and on a plant with earth potential differences between areas it can be genuinely difficult.

Galvanic isolator. The signal passes through a transformer or optocoupler with no electrical connection between the two sides. No special earth needed, immunity to earth potential differences, and typically more expensive.

For new work, isolators are usually specified now, and the earth is the reason.

Entity parameters

The arithmetic that has to be documented, and the part that gets skipped.

The barrier declares what it can deliver: maximum output voltage, current and power, and the maximum external capacitance and inductance it can tolerate.

The field device declares what it can accept: maximum input voltage, current and power, and its own internal capacitance and inductance.

Every barrier output rating must be less than or equal to the device's input rating, and the cable's capacitance and inductance plus the device's internal values must be within the barrier's allowance.

That last one is why cable length matters. A long run has enough capacitance to exceed the barrier's allowance, and the loop is then not intrinsically safe regardless of the equipment used.

What has to be on paper

A loop is intrinsically safe because a document says the numbers were checked. Not because the parts are all marked Ex.

The verification record, per loop, is part of the installation and is what an inspector asks for. Producing it after the fact, from equipment already installed, is how projects discover that a cable run is fifty metres too long.

Practical notes

• Intrinsically safe wiring is segregated and usually identified in light blue. Not decoration: it is how somebody knows not to run a non-IS circuit alongside it.
• A calibrator taken into a hazardous area must itself be certified. An ordinary loop calibrator is a source of ignition energy.
• Anything changed on the loop, cable, device, barrier, means the entity parameters are re-checked. Every time.