Intrinsic safety — protecting the circuit instead of the enclosure

Every other way of making equipment safe in a flammable atmosphere works on the box. Make it strong enough to contain an explosion, or fill it with clean air, or pot it in resin.

Intrinsic safety does something else entirely. It works on the circuit, by making certain there is never enough energy in it to ignite anything in the first place.

That difference is why almost all field instrumentation uses it.

Why instruments in particular

A transmitter runs on a few tens of milliwatts. It does not need much energy, which means the energy it does need can be limited to a level below what any spark or hot surface would require to ignite the surrounding gas.

The payoff is practical and large: an intrinsically safe loop can be worked on live in a hazardous area. Terminals can be opened, a reading taken, a device swapped — without a gas test, without shutting anything down, without a hot work permit.

For anyone who maintains instruments for a living, that is the whole argument.

Barriers and isolators

Something has to stand between the safe area, where there is plenty of energy, and the hazardous area, where there must not be. Two devices do that job.

A zener barrier clamps the voltage with zener diodes, limits the current with a resistor and protects both with a fuse. Simple, cheap, entirely passive — and it works by dumping fault energy into an earth.

A galvanic isolator transfers the signal across a transformer or optical coupling, so there is no electrical connection between the two sides at all.

Matching the parameters

An IS loop is only safe if the barrier and the field device have been checked against each other. This is a comparison of six numbers and it is the core of the whole discipline.

The barrier’s output must never exceed what the device can accept:

Barrier output	must not exceed	Device input
Uo — maximum voltage	≤	Ui — maximum voltage it can take
Io — maximum current	≤	Ii — maximum current it can take
Po — maximum power	≤	Pi — maximum power it can take

Then the cable is checked against what is left over — and this is the part people are surprised by.

Levels: ia, ib and ic

Intrinsic safety comes in three grades, and they map onto zones.

• ia — remains safe with two faults applied. Suitable for Zone 0.
• ib — remains safe with one fault. Suitable for Zone 1.
• ic — safe in normal operation. Suitable for Zone 2.

Keeping IS and non-IS apart

An intrinsically safe circuit stops being intrinsically safe the moment something else energises it. A single strand touching across a terminal block is enough.

Hence the separation rules, which are physical rather than advisory:

• Separate terminals, with a defined clearance or a dividing partition between IS and non-IS.
• Separate cables, or at minimum separate cores within a properly segregated multicore.
• Light blue as the identifying colour for IS terminals, glands and cables.

That light blue marking is not decoration. It is how a technician who has never seen the loop before knows not to connect an ordinary test set to it.

Simple apparatus

Some devices neither generate nor store meaningful energy — a thermocouple, an RTD, a switch, a non-powered junction box. These count as simple apparatus and may be used in an IS loop without a certificate of their own.

The loop is still assessed as a whole. Simple apparatus is an exemption for the device, not for the assessment.

Documentation, and why it is part of the safety case

Because safety is a property of the combination, the record of which combination was assessed is part of the protection.

That record is the descriptive system document — the loop, its barrier, its field device, the cable parameters, and the calculation showing the whole thing is within limits.

Testing without destroying the protection

Connecting an ordinary multimeter or calibrator to an IS loop in a hazardous area defeats it for as long as the instrument is attached. The circuit is safe because of what is connected to it, and you have just connected something that is not part of the assessment.

Certified IS test equipment exists precisely for this, and its parameters form part of the same comparison as everything else.

What to take away

• Intrinsic safety protects the circuit, not the enclosure — which is what allows live work in a hazardous area.
• A zener barrier depends entirely on its earth, and losing that earth removes the protection while the loop keeps working normally. Galvanic isolators avoid this failure mode.
• Match Uo/Io/Po against Ui/Ii/Pi, then check the cable’s capacitance and inductance against Co and Lo.
• Cable length is a safety limit. Exceeding it changes nothing you can see.
• ia for Zone 0, ib for Zone 1, ic for Zone 2 — and the loop achieves the level of its weakest part.
• Keep IS and non-IS physically separated, and respect the light blue marking.
• A descriptive system document records the combination that was assessed. Check it before swapping a device, even for another certified one.
• Use certified test equipment, or the loop is not intrinsically safe while you are measuring it.