SAVING ON INSTALLATIONS IN HAZARDOUS AREAS

Copyright Material IEEEPaper No. PCIC-2006-41

Rainer HillebrandDipl.ing. / D.I.C.Cooper Crouse-Hinds GmbHBussmatten 10-1277915 Buehl / BadenGermany

Gerhard SchwarzHead of R&D Lighting and SwitchgearCooper Crouse Hinds GmbHNeuer Weg Nord 4969412 EberbachGermany

Abstract - Today cost cutting imposes ever growing pressureon manufacturers and end users. There are differentapproaches to reach this goal. In the past all efforts resulted inthe same basic conclusions since safety and reliabilty mustnever be compromised. The conventional approaches oftenmeant that either expensive equipment or costly maintenanceprocedures had to be used in hazardous areas. Now freshideas have lead to new solutions which suddenly seem soobvious but for some obscure reason have never been triedbefore. The following chapters will show how proven principlesapplied in a new context can lead to a major step forwardmaking hazardous area instrumentation almost as easy toengineer and handle as safe area equipment. The reader willlearn how to overcome the limitations of intrinsic safety and stillmake use of its advantages regarding service and maintenanceboth in conventional field instrumentation and in bus systems.

Index Terms - hazardous area, installation, maintenancewithout hot work permit

I. INTRODUCTION

The paper presented here will offer valuable advice to theend user of instrumentation and other electrical equipment inhazardous areas. It shows how new approaches to explosionprotection can make life easier and help reduce costs in bothretrofit applications as well as new installations. Whileintrinsically safe equipment traditionally offers live maintenancefor low energy equipment, the new type of installation materialoffers the same for instrumentation with higher power. Hot-swapping increased-safety circuits without a hot work permitare now available from several manufacturers. Furthermoresome of the drawbacks of fieldbus instrumentation such astrunk line voltage drops, short circuit vulnerability, small numberof devices per bus, and other engineering limitations have beeneliminated. The principles are based on internationallyaccepted standards and the equipment discussed is fullyapproved to ATEX regulations. The latter can be found in theEuropean guidelines and standards such as Directive 94/9/EC[1] and Directive 99/92/EC [2]. Further information can be foundin the standards EN 60079-14 [3], and EN 50018 [4], EN 50019[5], EN 50020 [6].

11. CHALLENGES IN HAZARDOUS AREA INSTALLATIONS

In hazardous areas engineers are always faced with adilemma. Either they use equipment that is encapsulated orotherwise protected, making it inaccessible during operation, or

the equipment is intrinsically safe and therefore has verystringent power limitations.

A. Flame proof and pressurized equipment

Take a powered field device which is mounted inside a flameproof or pressurised enclosure. As soon as it becomesnecessary to open the enclosure for maintenance purposes itwill also become necessary either to switch off the equipmentfirst or conversely obtain a hot work permit to complete the job.The latter is often a very tedious and time consumingprocedure while the former means having to shut down theprocess. Halting production even for an hour or two can be verycostly indeed so this should be avoided if at all possible. Fig. 1outlines the conventional procedure undertaken to repair afaulty field device.

Step Zone 1 maintenance tasks1 Faulty field device is discovered2 Mechanic and electrician are called3 Hot work permit is applied for4 System is shut down5 Field device supply is disconnected6 Field device is replaced7 Field device is recommissioned8 System is restarted

Fig. 1: Maintenance steps in hazadous areas

A hot work permit will only be granted if it is absolutely certainthat there is no explosive atmosphere during the course of themaintenance work. The engineer can take a gas sniffer alarmwith him but how fast would he have to run when the gasdetector alerts him to the fact that his environment is no longersafe and the work he is doing may soon cause an explosion.These drastic terms are used to highlight the fact that

working in hazardous areas requires careful consideration andthe utmost care.

B. Intrinsically safe equipment

Intrinsic safety may seem a viable alternative. It is widelyused in measuring apparatus where the power requirement issmall enough to allow you to employ this principle. Intrinsicsafety ensures that neither a spark nor a hot surface will be

1-4244-0559-9/06/$20.00 ©2006 IEEE 1

capable of igniting an explosive atmosphere even under faultconditions.

However, intrinsic safety requires the engineer to watch anumber of parameters without which an intrinsically safe circuitmay turn out to be quite unsafe. How can that be so one mayask. The answer lies in the ATEX regulations which have to beobserved to ensure complete safety at all times. The followingparagraphs will name just a few of those rules referring to thestandard EN 60079-14 [3] and EN 50020 [6] for a more detaileddiscussion.An intrinsically safe circuit will present an open circuit voltage

and a short circuit current. The values encountered arespecified in the EC type examination certificate or the ECcertificate of conformity issued by the manufacturer anddelivered with the device. The values differ from application toapplication and they determine the maximum cable length andthe type of hazardous area apparatus which is permitted to beconnected to the intrinsically safe interface.

This is based on the fact that a cable represents an energystorage device through its inherent inductance andcapacitance. The cable capacitance will be charged by theopen circuit voltage and it can discharge when shorted creatinga spark. This spark must not contain enough energy to ignitethe flammable gas or vapor. Playing it safe one usually aims forthe best possible protection category "IIC" which permits thisenergy only to be a small as 2OpJoule. The standards say thatdepending on the voltage applied to the cable its permittedlength will vary accordingly.The cable inductance is another influencing factor. The more

current passed through the cable the higher the energy storedin the cable inductance. Interrupting the cable duringmaintenance means the inductance will try to uphold thiscurrent by creating a spark to bridge the gap between the openends. Although this may only last for a fraction of a second itmight be enough to ignite the explosive atmosphere. So it hasto be ensured that the cable inductance does not store morethan 2OpJoule for a IIC application to avoid an explosion. Thisis done by computing the permitted cable length based on therules laid down in the relevant standards and directives (Fig. 2).

Hazardous Area Safe Area

Fig. 2: Principle of an intrinsically safe circuit employing safety barriers

It is now understandable why intrinsic safety can only beused in conjunction with low energy equipment. Safety barriersensure that the maximum currents and voltages and themaximum power sent to the hazardous area do not create adangerous situation during service and maintenance even in afault condition.

These considerations alone will tell that intrinsic safetyrequires the engineer's full attention and cannot be takenlightly. Several manufacturers offer training and advice to helpin these matters.

C. Intrinsically safe bus systems

Modern instrumentation often makes use of bus systemswhich increasingly replace the conventional peer to peer 20mAloops. Buses like Foundation Fieldbus or Profibus PA aim atreducing costs by connecting several devices to a singletwisted pair instead of one pair of wires per field device. In theprevious chapter it was stated that the limited energy availablein an intrinsically safe loop will automatically limit the number ofdevices connected to an intrinsically safe (IS) bus.Where a non IS bus might service some 20-30 field devices

there would normally not be more than 6 devices connected toa single intrinsically safe bus. The savings over conventionalinstrumentation achieved that way are sometimes only marginalespecially when each bus has to be supported by a bus masteror LAS (link active scheduler).A well accepted alternative to the low input count field bus is

found in Remote 10 where a fair number of signals are joined ina hazardous area mounted interface box which linksconventional input and output loops to a Profibus or Modbus.Modern Remote 10 modules are either plug-in flame proofdevices or intrinsically safe powered to allow them to be hot-swapped in Zone 1. That way up to 80 analogue I/O or 184digitals can be found in a single slave and up to 31 slaves on asingle bus line. The savings over conventional equipment areconsiderable and range between 15 and 25% depending on thetype of installation (see chapter III.C).

Additional benefits can be gained by making use of theHART protocol for communication with field mountedtransmitters on the same bus. This gives access to the inherentfield device parameters which were formerly only accessible viahandheld devices to be individually connected to each loop.The Remote 10 interface box employs a combination of

explosion protection techniques in order to achieve hot workpermit free maintenance. Connections to field devices useintrinsic safety while the electronic input and output modulesare encapsulated plug-in devices. The hot swap principle isexplained in Fig. 9.Some manufacturers of this type of equipment make use of

an intrinsically safe bus for digital communications between theDCS and the Remote 10 slaves. Due to the energy limitationsin this intrinsically safe bus one has to be aware that thevoltage and current levels differ from the standard RS485 busnormally used for high integrity bus communications. Theimmunity to noise will therefore not be quite the same as that ofa NON IS bus. Thus increased safety buses (see IIIA) feature abetter signal to noise ratio than those employing intrinsic safety.

111. NOVEL IDEAS

Having looked at some of the obstacles encountered withconventional hazardous area installations, clear demands haveto be formulated for the next generation of instrumentation:

DCS links to hazardous areas are to become assimple to handle as for non hazardous areasno more hot work permitsno energy limitation for field devicesopen for all kinds of buses

2

* best possible noise immunityuse of standard electronic circuits

In order to achieve these goals the rules and regulations forhazardous areas have to be looked at again. It is within theseboundaries only that new solutions can be developed. Thesame level of safety has to be achieved while at the same timereaching above mentioned targets.

A. Hot work permit free maintenance

Instruments for hazardous areas are usually placed insiderugged enclosures. Most of these are flame proof enclosuresfitted with intrinsically safe electronics to permit maintenanceunder hot working conditions. Having learnt that intrinsic safetyleads to energy limitations it has become a known fact thatdevices demanding more energy than intrinsic safety can offerwill have to resort to increased safety circuits for connection tothe safe area. Increased safety circuits are based on theEuropean Standard EN 50019 [5]. The cables are mechanicallyprotected against damage and the connector terminals mustsatisfy the safety standards to ensure that neither sparks norhot surfaces can cause a hazard. These circuits areinaccessible while energized. Service operations on theseloops require the service engineer to switch off power or toobtain a hot work permit (see above). A new connector plug forthis type of application overcomes the obstacles quiteefficiently.The connector which is available from several suppliers can

be attached to a multitude of field instruments from flow metersto analysers or radar level gauges. It can handle the measuringsignal as well as the power supply since it has a live switchingcapability of up to 230V and 10A and offers a maximum of 4pins plus earth (Fig. 3).

Fig. 3: Connector attached to field device.

The connector applies a two step disconnect principle toensure that sparks generated during the procedure are keptinside a flame proof case long enough to cool down. Fig. 4shows how the connector of Fig. 5 is first pulled to themechanical blockage with a spark being generated inside theflame proof area. The precision air gaps fulfill ATEXrequirements so that the spark cannot escape into thehazardous area.

Fig. 4: Principle of safe live disconnect.

Fig. 5: Mechanical safeguards for 2 step operation.

Next the connector has to be turned 45 degrees to releasethe blockage created by a rectangular groove in the plasticmaterial (Fig. 5). Only now can the male and female parts becompletely disengaged, the spark having been extinguished inthe first step making it safe to expose the metal receptacles tothe open air. Caps can now be screwed on to the male andfemale connectors to protect them from the harsh environmentand continue to ensure IP65 ingress protection. There are nospecial tools required for this application. This is made possibleby keeping the female part of the connector carrying thevoltage hidden in the flame proof cone while the maleconnector is voltfree once it is disconnected.

B. Fieldbus gets boost from Zone I power supply

In chapter I.C it was explained how traditional hazardousarea field buses only link 6 devices because of intrinsic safetylimitations (Fig. 6). Furbishing these field devices with theconnectors of chapter III.A intrinsic safety is no longer a matterof concern. The flame proof field devices would have a hot-swap connector and could be handled as if they wereintrinsically safe in that live maintenance would now be possiblewithout a hot work permit.

DPIPA DPIPAmaster master

lEx-i OOmA31.25 kBaud

r7|8 wZONE 1 1~~~~~~~~||2E x-iC

31.25 kBau L766 devices per Bus

Fig. 6: Conventional fieldbus system.

Sticking with intrinsically safe field devices means facing theknown power limitations. Although FISCO (Fieldbus IntrinsicallySafe Concept) offers more freedom than the traditional entityprinciple the number of field devices on an intrinsically safe busis still very limited (for details refer to IEC TS 60079-27).There is another snag which many will have been annoyed

about when working with fieldbus systems; that is the voltagedrop encountered along the cable. A standard trunk cable withan impedance of 4 Ohms per 100 m will generate a voltage

3

drop of 0.4 V for every 100mA of current passing through thatcable. Careful engineering is required to make sure that all thefield devices will have the proper supply voltage taking all thevoltage drops in a typical chicken foot network intoconsideration.

Furthermore a single short on the bus will end all buscommunications for the whole segment which could lead tovery undesireable situations in the operation of a plant.A new moulded and encapsulated fieldbus barrier with an

increased safety trunk line will solve both problems. Fig. 7shows how a number of devices, sometimes called multi-barriers or field links can be directly connected to the nonintrinsically safe trunk line of a fieldbus system. Although theexample points at Profibus PA the same applies to FoundationFieldbus since both buses make use of the same hardwarelayer according to IEC1 158-2 [7].

W W m Sm -1 '\V

|11 1 \ /1 \ 12 2

Fig. 7: fieldbus barrier with extra power and short circuit protection.

Each barrier distributes the increased safety trunk line to 4intrinsically safe spurs. The spurs are galvanically isolated fromthe trunk and short circuit protected so that a short in a spurdoes not affect other spurs nor does it affect the trunk line. Thebarrier power supply is a very convenient option to avoidvoltage drops on the trunk line. That way there is as muchpower available in the field as required without the worry abouthow much power the master or LAS (link active scheduler) orits associated power conditioner and fieldbus power supply canprovide. There is also no longer any voltage drop on the trunkline to be considered. As an alternative there is a bus poweredbarrier which will impose a load on the trunk line. In contrast tothe separately powered barrier mentioned above a buspowered barrier feeds on the currents and voltages provided bythe power conditioner adding to the voltage drop on the trunkline.

Barriers can be mounted in Zone 1 hazardous areas.Combining these fieldbus barriers with the connector for hotswap power links explained in chapter III.A offers absolutefreedom regarding ONLINE service and live maintenance of afieldbus installation. It will allow the user to hot swap or addbarriers without interfering with the remaining devices on thesame bus. Fig. 8 shows how T-junctions help to achieve thisgoal very easily.

Fig. 8: fieldbus T-junction enabling live maintenance in Zone 1.

The plug and socket on the small T-junction box allows theflame proof field barrier with its increased safety bus line to beadded or removed without a hot work permit. The disconnectprinciple was shown in chapter II I.A.

C. Remote 10 brings power to intrinsic safety

Power and intrinsic safety normally exclude one another.Therefore most Remote 10 systems making use of intrinsicsafety to supply their 10 modules require very carefulengineering especially for hazardous area installations.

Applying the principles of power hot swap connectorsmentioned in previous chapters to Remote 10 does away withthe limitations imposed by intrinsically safe 10 modules andkeeps the same easy to handle serviceability. Fig. 9 shows howthe two step disconnect principle can be applied to Remote 10modules. There are two double hooks side by side locking thedevice into position until it is removed. A simple mechanical toolis used to unlock the first double hook allowing the serviceengineer to pull the device as far as the second set of hooks.Next the second pair of hooks can be released with the sametool moved over to the other side of the module.

two step disconnect hooks

44

ISconnector6_

Fig. 9: plug-in Remote 10 module with Ex-d connector.

The male and female connector keep any sparks beinggenerated during this two step disconnect procedure inside aflame proof area as in Fig. 4. That way more freedom is gainedwith engineering an 10 system allowing the planner to disregardthe power limitations normally encountered with intrinsic safety.Even the 230V power supply can be hot swapped in Zone 1without the need for a hot work permit or having to disconnectpower first. The field wiring to the sensors, actuators, andHART instruments however is intrinsically safe.

4

There is even an option to adapt increased safety circuits tothe same Remote 10 slave offering the opportunity to switchflame proof solenoids with up to 30W per loop in an 8 channel10 module.

Figures 10 and 11 present a practical example of howRemote 10 has reduced the field cabling encountered inconventional instrumentation using numerous trunk lines to just3 twisted pairs for the same number of signals. The pictureswere taken at a chemical plant in Germany.

Fig. 10: Remote 10 connected to IS field loops.

chapter 1II. Increased safety buses could also be used for anyother protocol. Cost savings at a major plant in Germanyamounted to about 15% compared with a conventionalinstallation.

IV. CONCLUSIONS

It has been shown how plug-in technology is used to simplifyengineering and maintenance for hazardous area equipment. Itis all about making use of the proven principles and methods ofexplosion protection defined by international standards butcombining them in a new and cost saving way. Increasedsafety circuits become as easy to service as intrinsically safeones while at the same time offering more power to fielddevices. The very practical examples point out a new overallconcept of hazardous area installation techniques which aim atproducing cost savings not only from the hardware point of viewbut perhaps even more so in the cost of ownership.The most attractive aspect of these new ideas is perhaps thefact this article is not talking about future developments butabout readily available products which engineers can make useof today. Several manufacturers have adopted these principlesand offer this type of equipment. Many people in the NEC worldhave adopted the IEC methods of explosion protection makinguse of the benefits and safety regulations in Zone 1applications while others prefer the Division classification as perNEC rules. The latter will only be able to make full use of theequipment as Class 1, Div 2 apparatus.

VI. REFERENCES

HART is a trademark of the HART CommunicationFoundation, www.hartcomm.org[1] DIRECTIVE 94/9/EC on the approximation of the laws of

the Member States concerning equipment and protectivesystems intended for use in potentially explosiveatmospheres.

[2] Directive 1999/92/EC on minimum requirements forimproving the safety and health protection of workerspotentially at risk from explosive atmospheres.

[3] IEC 60079-14: Electrical Apparatus for explosive gasatmospheres, part 14, electrical installations in hazardousareas (1997).

[4] EN 50018: Electrical apparatus for potentially explosiveatmospheres. Flameproof enclosures 'd' (1995).

[5] EN 50019: Electrical apparatus for potentially explosiveatmospheres. Increased safety 'e' (1994).

[6] EN 50020: Electrical apparatus for potentially explosiveatmospheres. Intrinsic safety 'i' (1995).

[7] IEC 1158-2 also IEC 61158-2: Digital datacommunications for measurement and control - Fieldbusfor use in industrial control systems, Part 2: Physical layerspecification and service definition (1996).

[8] IEC 60079-27: Electrical Apparatus for explosive gasatmospheres, part 27, Fieldbus Intrinsically Safe Conceptand Fieldbus non-incendive concept (2004).

Fig. 11: few bus lines suffice to replace conventional trunk cables.

The Remote 10 is connected to the master via an increasedsafety bus which uses the Profibus or the Modbus protocolsthus satisfying the demand for multiple choice datatransmission principles mentioned in the introduction to

5

Vil. VITA

Rainer Hillebrand has graduated from RWTH AachenGermany with a diploma in electrical engineering. Hispostgraduate studies took him to Imperial College Londonwhere he was also awarded a diploma. He was a designengineer with ABB for six years and is now a long standingmember of Cooper Crouse-Hinds GmbH in Germany. Hispresent duties comprise product management and marketingfor intrinsically safe equipment. In this capacity he alsoconducts training seminars on hazardous area installations aswell as bus technology.

Address: Cooper Crouse-Hinds GmbH, Bussmatten 10-12,D-77815 Buehl/Baden, phone (+49) 72 23 99 09 -117, fax -140,E-Mail: info-ah@ceag.de

Gerhard Schwarz, Senior Member of IEEE is head of R&Dfor lighting and switchgear in Cooper CEAG. He sits in onseveral international commitees developing explosionprotection standards.Address: Cooper Crouse Hinds GmbH, Neuer Weg 49, D-

69412 Eberbach, phone (+49) 6271 806483, E-Mail:info@ceag.de.

6