14.1 Hazardous-Area Methods and Intrinsic Safety

A control-systems PE item about classified locations is rarely asking you to recite a code article number. It is asking whether the circuit you just designed can ignite the process. The field transmitter sits in a process unit that may contain flammable gas, vapor, or dust. The analog input, power supply, and surge gear sit in a rack room that is supposed to stay unclassified. Everything between those two points — cable, tray, barrier, shield, and spare pair — is part of the ignition analysis.

The working vocabulary comes from North American Class/Division practice (NEC Articles 500–506 and 504) and from IEC/ISA explosive-atmosphere practice (IEC 60079 and the ISA-RP12 family, including RP12.6 for IS installation). Treat those documents as professional-practice language for design and for this exam. Do not assume a particular edition is in the NCEES 2027 supplied-standards list; the engineering still has to be right when the handbook is silent.

Division versus Zone, qualitatively

The Division system asks one likelihood question. Division 1 means an ignitable concentration is expected under normal operation (or is present often enough that you design as if it were). Division 2 means the flammable material is normally in closed piping or vessels and appears in the atmosphere only after an abnormal release, or only for a short time while it is diluted away.

The Zone system asks the same likelihood question with three bins instead of two:

Dust uses Zones 20 / 21 / 22 with the same continuous / likely / unlikely logic. The exam trap is treating “Division 1” as a single installation recipe. Explosion-proof conduit that is acceptable in many Division 1 rooms is not automatically acceptable in Zone 0. Zone 0 almost always wants an energy-limited method such as Ex ia, not a heavy enclosure you plan to open.

Gas groups and T-codes

Gases are grouped by how easily a spark or a hot surface will ignite them — Maximum Experimental Safe Gap and Minimum Igniting Current, in the lab language. You do not need the lab numbers on the exam; you need the ranking and the representative gases.

Equipment certified for a more severe group may be used in a less severe group (IIC covers IIB and IIA). The reverse is false: a Group D / IIA solenoid is not a hydrogen device. Mining firedamp is IEC Group I; process plants are Group II.

Temperature codes cap the hottest surface the equipment is allowed to reach, including dust blankets and process heat conducted into the housing:

The marked T-code must be colder than the autoignition temperature of the atmosphere. A gas with AIT of 160 °C cannot use T3 (200 °C) equipment. T4 (135 °C) or a finer NEC subdivision that still stays under 160 °C is the first legal family. T6 is the most conservative mark, not the “highest temperature rating.”

Protection methods you actually specify

Explosion-proof (North America) and flameproof Ex d (IEC) are containment methods. The enclosure is strong enough to hold an internal explosion and the flame path is long and cool enough that escaping gases cannot ignite the outside atmosphere. The circuit inside can spark. Live maintenance means opening that flame path, so explosion-proof instruments are not a live-work method. Seals, covered threads, and intact flanges are the safety function.

Increased safety (Ex e) is a prevention method for equipment that does not spark in normal service: extra creepage and clearance, impact resistance, IP rating, and a controlled temperature rise. Junction boxes and some motor terminals in Zone 1 are the usual CSE applications. It is not an energy-limit; it is a promise that the box will not make a spark or a hot spot in normal operation.

Non-incendive (and IEC Ex n families) is a Division 2 / Zone 2 method. Under normal operation — and, for non-incendive field wiring, under opening, shorting, or grounding of the field conductors — the circuit cannot ignite the atmosphere. Stored energy and make/break sparks that would fail an IS ignition curve can still be legal in Division 2. Non-incendive is not a ticket into Division 1 or Zone 0/1.

Purged and pressurized cabinets (NFPA 496 Types X / Y / Z; IEC 60079-2 px / py / pz) keep a protective gas inside an enclosure so that an external flammable atmosphere cannot enter, after a timed purge has flushed the interior.

A Type Z cabinet in Division 1 is the classic wrong answer: Z never bought you a Division 1 reduction.

Intrinsic safety (Ex i) is the energy-limiting method. The field circuit cannot release a spark or a hot surface capable of ignition, including after the countable faults in the protection level (ia two faults / Zone 0, ib one fault / Zone 1, ic normal operation / Zone 2). Because the energy is limited, live maintenance of IS field devices is the operational reason plants pay for barriers.

Barriers, the entity concept, and transients

The device in the rack room that enforces the energy limit is associated apparatus. Two constructions dominate analog loops.

A zener barrier is a passive clamp: series resistance, shunt zener diodes, and a fuse. If the analog input or a 24 V bus faults high, the zeners clamp voltage and dump current into a dedicated IS earth. That earth path has to stay low impedance (a common installation target is on the order of 1 Ω from the barrier earth bar to the main earth electrode). If the IS earth is missing, corroded, or shared through a noisy cable armor, the clamp voltage rises and the field circuit is no longer the circuit on the control drawing.

A galvanic isolator (transformer, opto, or equivalent) breaks the metallic path between the safe-area circuit and the field. It still energy-limits the hazardous-side terminals, but it does not rely on an IS earth for the safety function. Isolators cost more and often drop less loop voltage than a resistive zener barrier. They are the usual choice when the analog input cannot share an earth with a dirty plant ground, or when you cannot guarantee the zener earth.

Entity parameters let you mix a certified field device with a certified barrier without a system certificate for that exact pair. Compare associated-apparatus outputs to apparatus inputs:

• Vmax (Ui) ≥ Voc (Uo) — field device can tolerate the barrier’s open-circuit voltage
• Imax (Ii) ≥ Isc (Io) — field device can tolerate the barrier’s short-circuit current
• Pmax (Pi) ≥ Po — field device can tolerate the barrier’s available power
• Ci + Ccable ≤ Ca (Co) — stored capacitance on the field side cannot exceed what the barrier allows
• Li + Lcable ≤ La (Lo) — stored inductance likewise

Worked numbers: barrier Voc = 28 V, Isc = 93 mA, Po = 0.65 W, Ca = 0.083 µF, La = 4.2 mH. Transmitter Vmax = 30 V, Imax = 100 mA, Pmax = 0.75 W, Ci = 5 nF, Li = 0. Cable 500 m at 150 pF/m and 1 µH/m adds 75 nF and 0.5 mH. Voltage, current, power, and inductance all pass. Capacitance is 5 nF + 75 nF = 80 nF, which is still under 83 nF — but another 50 m of the same cable (7.5 nF) would fail Ca even though V/I/P still look comfortable. That is the usual entity miss: people stop after the voltage comparison.

Simple apparatus (dry contacts, thermocouples, RTDs, LEDs, non-inductive resistors that cannot store igniting energy) does not need an IS certificate, but it still belongs on the IS control drawing and still consumes cable C and L. Non-simple devices (transmitters, I/P converters, solenoids) need entity parameters or a system certificate.

Transient / surge protectors on an IS pair are extra capacitance and extra energy storage. Use SPDs that are part of the IS control drawing. A generic MOV or gas tube added at a field junction box can fail the entity sum, or can fail short in a way that the barrier never evaluated.

Worked placement: why the analog input needs a barrier in the associated-apparatus room

A 4–20 mA transmitter is mounted on a nozzle in a Zone 1 compartment. The DCS analog input is a general-purpose card: it can put bulk 24 VDC, and under a card or backplane fault it can put still more energy, onto whatever copper is landed on that terminal. That energy, run straight to Zone 1, is an ignition source.

The associated apparatus (zener barrier or galvanic isolator) is the device whose hazardous-side terminals are the only energy the field is allowed to see. Those terminals are certified as IS. The safe-side terminals, the 24 V feed, and the analog-input card are not field Ex equipment. They stay in the unclassified associated-apparatus room (or inside a cabinet that is independently protected). Putting the barrier in the Zone 1 tray “to shorten the IS cable” leaves an uncertified energy source in the classified location unless you add a second protection method to the barrier itself — which is not how analog marshalling is built.

Field wiring from the barrier’s IS terminals to the transmitter is IS wiring. It is identified (light blue insulation is the IEC convention), segregated from power and non-IS 24 V, and entered on the control drawing. Wiring from the analog input to the barrier’s safe-side terminals is ordinary control wiring.

Exam trap: mixing IS and non-IS in one cable or tray

Entity matching on two nameplates does not survive a crushed tray. If an IS pair shares a cable, an undivided multi-pair, or a tray without the designed grounded metal partition or specified air-gap (IEC 60079-14 / NEC 504 installation practice commonly uses about 50 mm / 2 in when a partition is not used), a 120 VAC or non-IS 24 V conductor can impress voltage onto the IS pair by insulation failure or by inductive coupling. The field circuit then carries energy the barrier never limited. Spare pairs in an IS cable are treated as IS, not as convenient 24 V home-runs. Shields and armors are terminated as the control drawing shows; they are not a second, unanalyzed conductor.

If the loop must share a route with power, the design has to show the partition, the distance, and the identification — not a hope that “it is only 24 volts.”