Safety Barrier

What is a Safety Barrier

A safety barrier is an electrical protection device installed in the safe area of a plant whose single job is to guarantee that the energy flowing toward a field instrument in a hazardous area can never ignite the explosive atmosphere around that instrument. Intrinsic safety, designated type of protection "i", achieves this not by containing an explosion (as a flameproof Ex d enclosure does) but by limiting energy so low that ignition is physically impossible. The barrier is the component that enforces that energy limit, which is why standards call it the "associated apparatus": it is not itself located in the hazardous area, but the safety of the hazardous-area circuit depends on it.

The principle is energy limitation. An explosive mixture ignites only when a spark or a hot surface delivers more than a minimum ignition energy, which for hydrogen in air is on the order of a few tens of microjoules. By capping the maximum voltage, maximum current and maximum power that can appear at the field terminals even under fault conditions, the barrier ensures that the worst credible spark from a broken wire, a short circuit, or a power-supply failure stays below that ignition threshold. Because the protection is built into the electrical design rather than into a heavy enclosure, intrinsically safe loops can be worked on live, calibrated, and disconnected in the field without a hot-work permit, which is the single biggest operational advantage of the method.

Structurally every barrier performs three protective functions. First, voltage limitation, usually by zener or forward diodes or by a regulated isolated supply, caps the open-circuit voltage Uo. Second, current limitation, by an infallible resistor, caps the short-circuit current Io. Third, fault isolation, by a fuse or by galvanic separation, guarantees the first two functions cannot be defeated. The standards demand redundancy: an Ex ia barrier must remain safe with two independent faults applied, so voltage limiting typically uses two or three diode stages in parallel and the current-limiting resistor is rated infallible, meaning it cannot fail to a lower resistance.

The governing standard is IEC 60079-11, "Equipment protection by intrinsic safety i", supported by the general requirements of IEC 60079-0. IEC 60079-25 defines how a complete intrinsically safe system is assessed, including the entity parameter matching that links a barrier to its field device. IEC 60079-27 adds the Fieldbus Intrinsically Safe Concept (FISCO) for digital fieldbus segments. Regionally these circuits are certified under the European ATEX directive 2014/34/EU, the global IECEx scheme, North American UL 913 and FM, and China NEPSI, and a single cross-border project frequently carries several of these certifications on the same part.

Historically, intrinsic safety grew out of UK coal-mine signalling investigations in the early twentieth century, where low-energy telegraph circuits were proven incapable of igniting firedamp. The shunt-diode zener barrier was commercialized in the 1960s and remained the standard for decades. Galvanic isolators, which remove the dependence on a perfect earth, became dominant for new process plants from the 1990s onward as distributed control systems made guaranteed low-impedance grounding harder to assure across large sites.

Zener Barriers vs Galvanic Isolators

The first and most consequential decision is the protection technology. A shunt-diode zener barrier and a galvanic isolator both deliver intrinsic safety to IEC 60079-11, but they do so by opposite mechanisms, and they impose very different installation requirements. Getting this choice wrong leads either to wasted cost or, worse, to an earth-dependent installation that silently loses its protection when the ground connection degrades. The table below contrasts the two technologies on the parameters that actually drive the decision.

Zener barriers use two stages of pulse-tested zener or forward diodes that clamp the voltage, an infallible terminating resistor that limits current, and a fuse that protects the diodes. Under a safe-area fault the diodes conduct the excess voltage and the resulting current flows through the fuse to the intrinsically safe earth, blowing the fuse and isolating the fault. A representative voltage-type unit, the Eaton MTL7728+, clamps at 28 V, terminates in a 300 ohm minimum resistor, limits short-circuit current to about 93 mA, and is certified Ex ia IIC for all zones. The critical dependency is the earth: each barrier rail must connect to a dedicated IS earth with resistance below 1 ohm, because without that low-impedance path the fuse cannot clear and the protection is compromised.

The zener approach is attractive because it is passive, compact, and the cheapest per channel. It draws no operating power and adds almost nothing to panel heat. Its weaknesses follow directly from the earth dependency: the hazardous-area field ground is electrically common with the safe-area panel ground, so ground potential differences appear as signal error, and a degraded or corroded earth connection removes the protection without any obvious symptom. Voltage-type barriers also insert a high end-to-end resistance into the loop, while loop-powered transmitter barriers add only a few ohms (the Pepperl and Fuchs Z787, a 28 V, 50 mA fuse, diode-return barrier, lists about 3.41 ohm end-to-end), but in all cases that resistance subtracts from the voltage available to the field transmitter.

Galvanic isolators break the electrical connection between the hazardous-area circuit and the safe-area circuit using a transformer, an optocoupler, or both, with a minimum 0.5 mm clearance and reinforced insulation between the intrinsically safe and non-intrinsically safe sides as required by IEC 60079-11. Because there is no current path to ground, no IS earth is needed at all. The isolator regenerates the field supply on its hazardous side, so it presents the transmitter with a clean isolated voltage and eliminates ground loops, which markedly improves the stability of 4-20 mA and HART signals on long or electrically noisy runs.

The price of galvanic isolation is cost and power. Each isolated channel needs operating power from the panel rail and costs more than the equivalent zener channel. The advantages usually outweigh this in modern plants: a representative isolated transmitter power supply, the Pepperl and Fuchs KFD2-STC4 SMART series, supplies two-wire and three-wire transmitters in the hazardous area, transfers HART digitally in both directions, provides a 250 ohm internal HART communication resistor, and carries functional safety approval up to SIL 2 or SIL 3. As a working rule, choose a zener barrier only where a certified low-impedance IS earth is genuinely available and the loop is simple, and default to a galvanic isolator everywhere else.

Barrier Types by Signal

Beyond the zener versus isolator split, barriers are catalogued by the signal they carry. A barrier is not signal-agnostic: an analog transmitter barrier cannot drive a solenoid valve, and a frequency-input barrier will mangle an RTD measurement. The signal class determines the internal circuit, the entity parameters, and whether the device is passive or powered. The table below maps the common signal classes to their typical function and direction.

Analog input barriers are the most common, supplying a two-wire 4-20 mA transmitter in the field and returning the measurement to the control system. In galvanic form these are "transmitter power supplies" because they generate the loop supply on the isolated field side. They almost always pass HART digital communication transparently in both directions, which is why a 250 ohm communication resistor is built in: HART needs a minimum loop impedance to develop its frequency-shift-keyed signal.

Analog output barriers reverse the direction, taking a 4-20 mA command from the control system and driving a current-to-pressure positioner or actuator in the hazardous area. They are sometimes called "valve positioner interfaces" and likewise pass HART so a smart positioner can be configured remotely.

Digital input barriers, often called switch amplifiers, interface to NAMUR proximity switches built to EN 60947-5-6, which present roughly 2.2 mA in the unattenuated state and below 1.2 mA when damped. The barrier senses this small current change and additionally provides lead-breakage and short-circuit monitoring, a key reason NAMUR is preferred over dry contacts in hazardous areas. Digital output and solenoid drivers work the other way, switching an intrinsically safe solenoid valve or indicator while keeping the delivered power below the ignition limit.

Temperature barriers for Pt100 RTDs and thermocouples are sensitive low-level interfaces; because RTD and millivolt signals are tiny, the barrier must add negligible resistance and offset, and galvanic isolation is strongly preferred to reject ground-potential errors. Frequency and pulse barriers serve turbine flow meters and speed pickups, converting the raw pulse train into a scaled output. Fieldbus couplers built to the FISCO concept of IEC 60079-27 power an intrinsically safe trunk and distribute multiple device spurs, replacing one barrier per point with one segment coupler per bus, which is why fieldbus and intrinsic safety are usually specified together on large projects.

Zones, Gas Groups and Grounding

A barrier cannot be selected without first classifying the hazardous area it will serve. The classification has three axes: the zone (how often an explosive atmosphere is present), the gas group (how easily that atmosphere ignites), and the temperature class (how hot a surface it can tolerate). Each axis maps onto a marking the barrier must carry, and the entity match in Chapter 5 depends on the gas group. The table below summarizes the IEC zone and protection-level scheme.

Zones classify gas and vapor risk into Zone 0 (present continuously or for long periods), Zone 1 (likely during normal operation), and Zone 2 (unlikely, and only briefly if at all); the equivalent dust zones are 20, 21 and 22. Each zone is matched to an equipment protection level, Ga, Gb or Gc, and to an intrinsic safety subdivision. Ex ia, safe with two faults applied, covers Zone 0. Ex ib, safe with one fault, covers Zone 1. Ex ic, added in the fifth edition of IEC 60079-11 with no fault margin, covers Zone 2 only. A barrier must carry a protection level equal to or better than the zone it serves, so a Zone 0 measurement requires an Ex ia loop even though the barrier itself lives in the non-hazardous control room.

Gas groups rank ignition sensitivity. Group I is mining (methane). Group II is surface industry, subdivided into IIA (propane reference, least sensitive), IIB (ethylene), and IIC (hydrogen and acetylene, most sensitive). Certification for a higher group is automatically valid for lower ones, so an IIC barrier also covers IIB and IIA. Crucially, the more sensitive the group, the lower the permitted external capacitance Co and inductance Lo, because less stored energy is needed to ignite the atmosphere. A given barrier therefore publishes a much smaller Co for IIC than for IIB, which directly caps the cable length the loop can run.

Temperature class caps the maximum surface temperature, from T1 (450 degrees C) down to T6 (85 degrees C). For intrinsically safe circuits the limiting surface is usually the field device, but the barrier output power Po also contributes, so the barrier and field instrument are assessed together. The full hazardous-area marking strings these together, for example "II 2 G Ex ia IIC T4 Ga", read as surface industry, category 2 gas, intrinsic safety level ia, gas group IIC, temperature class T4, equipment protection level Ga.

Grounding is where zener and galvanic technologies diverge most sharply. A zener barrier is only as safe as its earth: standards and manufacturers require a dedicated intrinsically safe earth, separate from the noisy power-system earth, with the connection from each barrier to the plant reference point kept below 1 ohm and verified. Good practice provides two independent earth conductors per barrier, each below 1 ohm, and the DIN-rail mounting clamp itself often forms part of that earth path. A galvanic isolator removes this entire concern, because its protection comes from insulation rather than from a fault-diverting earth, so no IS earth conductor is needed and a field-side ground fault cannot defeat the protection. This single difference is the strongest practical argument for isolators on sites where earth integrity cannot be guaranteed over the plant lifetime.

Entity Parameters Decoded

The defining skill in barrier selection is the entity match, the formal proof under IEC 60079-25 that a specific barrier may be connected to a specific field device over a specific cable. The barrier publishes what it can deliver, the field device publishes what it can absorb, and the loop is certified only when every parameter pair is satisfied. The table below lists the parameters, their meaning, and the matching rule that must hold.

Uo (also written Voc) is the highest voltage the barrier can present at its field terminals under fault, fixed by the zener clamp or the regulated isolated supply. It must be less than or equal to the field device's Ui (Vmax). For the 28 V class of zener barrier, Uo is around 28 V, so the field device must be rated to accept at least that. Io (Isc) is the highest current the barrier can source into a short, set by the infallible resistor; for the 300 ohm, 28 V class this works out to roughly 90 to 93 mA. It must not exceed the device's Ii (Imax).

Po is the maximum output power, which the barrier limits and which must stay at or below the device's Pi. Po also feeds the temperature-class assessment, because power dissipated in the field device raises its surface temperature. Co (Ca) and Lo (La) are the most error-prone parameters because cable counts against them. Co is the largest external capacitance the barrier can safely drive; the field device's internal Ci plus the cable capacitance must fit underneath it. Lo is the equivalent for inductance, with Li plus cable inductance fitting underneath. Because IIC permits far less stored energy than IIB, the published Co for IIC can be five to ten times smaller, which is often the parameter that limits the maximum cable run on a hydrogen-service loop.

A practical entity check proceeds in order. First read the barrier's Uo, Io, Po, Co and Lo for the correct gas group. Second read the field device's Ui, Ii, Pi, Ci and Li. Third confirm Uo is less than or equal to Ui, Io is less than or equal to Ii, and Po is less than or equal to Pi. Fourth obtain the cable's capacitance per metre and inductance per metre (typically about 100 to 200 pF/m and 0.7 to 1 microhenry/m for instrument cable), multiply by the run length, and confirm that Ci plus cable capacitance stays below Co and Li plus cable inductance stays below Lo. If any line fails, the loop is not certified and either the cable must shorten, the gas group requirement must relax, or a different barrier must be chosen.

One refinement applies to capacitance and inductance limits in gas groups IIB and IIC: some certificates allow a higher combined Lo and Co only when an Lo/Ro inductance-to-resistance limit is observed instead of a plain inductance limit, reflecting that a resistive cable dissipates spark energy. Always read the specific certificate rather than assuming a generic figure, and treat the manufacturer's published entity table, not a rule of thumb, as the authority. The FISCO concept of IEC 60079-27 simplifies this for fieldbus by predefining conservative segment limits so individual entity arithmetic is not repeated for every spur.

Selection Decision Factors

With the technology, signal classes, area classification and entity arithmetic understood, selection becomes a fixed sequence. Most mistakes come not from a single wrong parameter but from deciding the model before the area is classified or the entity match is run. The eight steps below can serve as a standing RFQ template for any intrinsically safe loop.

1. Classify the hazardous area: Determine the zone (0, 1 or 2), the gas group (IIA, IIB or IIC, or dust IIIA to IIIC), and the temperature class (T1 to T6). This fixes the minimum protection level the barrier must carry, for example Ex ia IIC T4 for a Zone 0 hydrogen loop.
2. Identify the signal: Analog input, analog output, digital input (NAMUR), digital output or solenoid, RTD or thermocouple, frequency or pulse, or fieldbus. The signal class selects the barrier family before any brand is considered.
3. Choose zener or galvanic: Select a galvanic isolator unless a certified IS earth below 1 ohm is genuinely guaranteed for the life of the installation and the loop is simple enough to justify the cost saving of a passive zener barrier.
4. Run the entity match: Confirm Uo is less than or equal to Ui, Io is less than or equal to Ii, Po is less than or equal to Pi, and that Ci plus cable capacitance is below Co and Li plus cable inductance is below Lo, using the gas-group-specific column and the actual cable length.
5. Check loop voltage budget: Verify the field transmitter receives its minimum terminal voltage (often 10 to 12 V) after subtracting the barrier's series resistance and the cable drop, particularly for voltage-type zener barriers on long runs.
6. Confirm certifications: ATEX 2014/34/EU, IECEx, UL 913 or FM, and NEPSI as the destination demands, plus functional safety to IEC 61508 with the required SIL rating (commonly SIL 2 or SIL 3) where the loop is part of a safety instrumented function.
7. Fix the mechanical and panel details: DIN-rail mounting and power-rail or individual 24 V DC feed, channel density (single, dual or multi-channel), terminal type and test sockets, ambient temperature rating, and panel heat budget for powered isolators.
8. Total cost of ownership: Compare purchase price, panel space, power draw, spare-part availability, and the lifecycle cost of maintaining a verified IS earth for zener barriers versus the higher per-channel cost of isolators. A clean-earth assumption that fails in year five can be far more expensive than the isolator premium.

A frequently overlooked dimension is serviceability and documentation. Intrinsic safety certification covers the whole loop, so the barrier's certificate, the entity calculation, and the loop diagram must be retained and kept current; a later cable change or transmitter swap can invalidate a previously certified loop. Replaceable backup fuses, removable terminal blocks, and clear channel labelling reduce maintenance error. Established suppliers including Eaton MTL, Pepperl and Fuchs, Phoenix Contact, Stahl, Turck and Knick provide full entity data, FISCO support and global certification, while NEPSI-certified domestic suppliers serve cost-sensitive, non-critical loops; match the chosen series to the protection level, gas group and signal type before requesting a quote.