Intrinsic safety—fieldbus style

Devices and barriers for intrinsically safe areas are designed so the energy released by an electrical fault is insufficient to cause ignition, even in a single- or double-fault condition. The ignition point is a function of available power-voltage and electrical current. How much segment electrical current, voltage, barrier choices, and devices permitted per barrier depends on the type of hazardous atmosphere in which the devices are located, and which intrinsic safety model is used.

By Control Engineering Staff January 15, 2003

Return to the January 2003 version of the article .

SIDEBARS: Alternative IS Choice | An end-user asks…

From a software addressing and segment-communication perspective, all 14 devices are on a single segment. However, from an electrical perspective each segment is considered separate with individual segment power provided by the repeating barriers. Also it’s worth noting, some fieldbus technologies allow a maximum of four repeater barriers per segment.

Devices and barriers for intrinsically safe areas are designed so the energy released by an electrical fault is insufficient to cause ignition, even in a single- or double-fault condition. The ignition point is a function of available power-voltage and electrical current.

How much segment electrical current, voltage, barrier choices, and devices permitted per barrier depends on the type of hazardous atmosphere in which the devices are located, and which intrinsic safety model is used.

Two models

Fieldbus installations can choose between the entity and the fieldbus intrinsically safe concept (FISCO) models.

The entity model assumes all intrinsically safe apparatus are approved as separate entities including the connecting wire. This conservative approach permits a maximum dc electrical current of 83 mA in the wire and a maximum of 18.4 V.

The entity model is recognized worldwide.

The FISCO model considers the electrical wiring parameters to be distributed along its entire length, thus reducing the energy available at a fault, and permitting more devices on a wire pair. The result is a maximum dc electrical current of 110 mA for Class II C environments and 240 mA for Class II B environments.

By connecting six temperature measurements to a multiplexer and substituting a 4-wire Coriolis meter, the previous design can be simplified and overall power requirements significantly reduced.

The FISCO model is not a worldwide standard, however it is gaining European acceptance and is part of the FOUNDATION Fieldbus physical layer profile specification.

Intrinsic safety barriers are certified on the basis of the model they support. Field devices can be certified for use in one or both models.

Ignition curve

Each type of explosive atmosphere requires a minimum amount of power for ignition. The plot of voltage and current points that provide that power is called the ignition curve.

Because power is voltage times current, as voltage increases, the maximum amount of electrical current required for ignition decreases. The converse is also true.

Using the FISCO model in a Class IIC environment, the maximum current draw allowed for all devices connected to a single barrier is 110 mA.

Designing a safe segment

Because each device type likely has a different current draw, add individual current draws of each device and include wiring resistance losses to calculate the number of devices a single barrier can support.

When using the FISCO model, as long as the total current draw is less than 110 mA, the segment in the hazardous areas is intrinsically safe. It’s also important to consider the electrical parameters of each device to ensure each is below the amounts permitted for hazardous area classification.

Referring to the ”Safe FISCO segment” diagram, the following illustrates calculations used to determine the maximum number of field devices allowable on this segment type. (NOTE: The electrical current consumption listed in this example is for illustration purposes and does not reflect actual electrical current consumption of specific devices or device types.)

Temperature transmitter example calculation: For a Class IIC installation (110 mA maximum), if each temperature transmitter requires 16 mA current, the maximum number of temperature transmitters that can be placed in the hazardous area using a single barrier is six (110 / 16=6.8 rounded down to 6).

For a Class IIB installation, the maximum allowable electrical current is 240 mA, thus the maximum number of temperature transmitters on a single barrier is 15.

Pressure/temperature compensated mass flow control calculation: In this example, the temperature transmitter uses 16 mA, a pressure transmitter and a differential pressure (flow) transmitter each use 20 mA, and a control valve uses 25 mA. All four devices could be connected to the same barrier in a Class IIC (110 mA maximum) hazardous environment (16+20+20+25=81).

Combine safe and hazardous

There may be occasions when it’s desirable to have both safe and hazardous areas on the same fieldbus segment. This isn’t a problem as long as a few simple rules are followed.

In the diagram, ”Single-segment, safe & hazardous areas” there are n devices in the safe area and k devices in the hazardous area.

The maximum number of devices allowed on the fieldbus segment is 32, thus k+n must be less than or equal to 32. (If good practices, experience, and/or corporate policy dictate some other limitations as a maximum, i.e., 16 devices per segment, then adjust k+n accordingly.)

Additionally, k must equal the total number of devices with a combined power consumption of 110 mA or less (remember the ignition curve) using FISCO approved safety barriers in a Class II C environment.

If more devices are desired in the hazardous area, use multiple segments, multiple barriers on one segment, or devices with lower power consumption.

Applying multiple barriers

Some fieldbus technologies use multidrop bus architecture, thus permitting multiple barriers on a single segment-each on a separate drop. However, if more than two barriers are placed on a single segment, galvanically isolated barriers are required to prevent signal distortion, and it’s best to use a repeater barrier to correct the signal’s shape.

For example, a process requires six temperature measurements, a mass flow control loop, a liquid flow control loop, and a liquid level control loop. As shown in the diagram, ”Single-segment, multiple-barriers: one approach,” the design places each process measurement on a separate barrier. While perfectly acceptable, it’s not very cost efficient.

Among advantages of fieldbus technology is that digital devices can communicate multiple parameters.

By carefully considering and selecting intrinsically safe devices it’s possible to simplify the previous example. (See, ”Single-segment, multiple-barriers: simple approach” diagram.)

Maximum current draws

Maximum current draw for a segment depends in part on the physical-layer type of each device. Fieldbus Foundation (Austin, TX classifies devices as one of two types depending on whether it’s self-powered or externally powered, and whether its electrical current consumption is constant or variable:

  • Physical-layer device types 111 and 112 have a constant electrical current draw while transmitting and receiving; and

  • Physical-layer device types 121 and 122 have different electrical current draws for receiving (lower) and transmitting (higher).

The Foundation’s list of registered devices (available at shows the physical-layer type for each device.

Maximum current draw for an entire segment is equal to the total current draw for all devices on the segment having a constant current draw, plus the transmitting current draw for the device with the largest incremental transmitting current draw requirement.

In addition to current draws for installed devices, temporary current loads may be imposed on the segment. These added loads can include current draw for bus analyzers or for configuration and maintenance tools.

These additional devices generally provide their own power-but intrinsic safety requires these devices not add power to the bus. To ensure no power is added, each device must draw a minimum of 8 mA from the segment while communicating. Therefore, it’s wise to provide an extra 10 mA of available current to support the connection of temporary devices.

Other considerations

Equipment located in the ”safe area” of an intrinsically safe installation is also subject to rules and regulations. Violating any of the rules and regulations jeopardizes the integrity of the installation.

For example, no equipment supplying or sourcing more than 250 V rms ac or dc power can be connected to any part of the safe segment.

Another rule to remember is the entire system in the ”hazardous area” is certified according to the lowest certification category and gas group of any apparatus installed in the hazardous area. For example, if the segment certification must meet category IIC and one installed device is classified IIB, the entire system becomes a IIB classification.

Type and use of power supplies is also an area where rules and regulations are misunderstood. For example, a power supply with galvanic isolation and a nominal 80 mA current draw can be connected directly to devices in a hazardous area. However, a power supply providing a nominal 400 mA current draw requires an intrinsic barrier between the power supply and the hazardous area.

Intrinsic safety provides the most practical means of working on field instrumentation while they remain powered, thus eliminating the need for hot permits and fire watchers. However, like any engineered solution, intrinsic safety design and specification requires knowledge of what’s allowed and what’s not.

Comments? E-mail

This article was prepared from readily available online material at Emerson Process Management’s free online PlantWeb University , MTL , and R. Stahl .

Alternative IS choice
The FISCO model relies on empirical techniques and explosion testing of system components, rather than systems designed to standardized ignition curves. This means FISCO certifying authorities must restrict segment length to 1,000 m, spurs to 30 m, and all active components-cables, devices, terminators, etc.-must be FISCO compatible.

An alternative (patent-pending) intrinsic safety (IS) design that has received Factory Mutual (FM) approval and is being used in the U.S., is available from Hawke International USA (Houston, TX).

What Hawke has done is effectively split the typical (110 ohm) IS current-limiting resistor into two parts. The first part (22 ohms) is installed on the IS interface backpanel. The remaining resistance resides in a field-located device coupler.

Hawke’s design helps overcome segment-capacity limitations of Ohm’s Law by reducing the voltage drop traditionally incurred at the barrier. Overall effect of the Hawke design permits 350 mA per IS segment, allows use of conventional IS fieldbus devices, and can drive 16 devices with 500-meter cable, even in hydrogen risk areas.

However, it’s not all good news. One drawback of the Hawke design is that the main segment cable between the IS barrier and the device coupler is only approved for Group CD areas.

Most sites don’t have a great deal of Group AB areas, however most, if not all, instrumentation device manufacturers produce IS devices to a common Group ABCD specification. This seems practical and logical until users begin pricing motors, lighting fixtures, etc. with Group ABCD certification. That’s when users tend to carefully review ”requirements.”

For more information, visit

An end-user asks.

A recent online conversation concerning the pros and cons of applying intrinsically safe (IS) versus explosion-proof devices cited benefits of being able to work on powered instruments in IS environments.

Much of the discussion indicated IS eliminates the need to remove fieldbus segment power before servicing or attaching a new device in a classified area.

Eventually it was pointed out that good practices associated with ”hot work” permits include using ”sniffer” instrumentation to determine the presence/absence of explosive concentrations with the intent of declaring an area temporarily safe to work on powered (hot) devices.

These discussions prompted one end-user to post an insightful response. The following is part of that response.

”If you make it foolproof, they’ll make a better fool.” Sometimes IS strikes me as a technique that attempts to eliminate a risk where we’ve already done an excellent job of managing the risk. I’d be curious if anyone can cite any explosions, fires, fatalities, environmental releases, or other accidents in the past 20 years that were the result of misapplied or carelessly applied devices in hazardous areas. That is, where has a spark created by an instrument, or any powered device, caused an incident or accident?

I’m not suggesting we should be lax in the application of appropriate devices in hazardous locations, or that we should be casual about local codes and standards. I am saying we shouldn’t increase cost and complexity to fix a problem that doesn’t exist.” The end-user/author poses an interesting question and has a valid point of view.

-Comments? E-mail