Immersion Heater High-Limit Safety with Type K Thermocouple

Plastic-tank immersion heating requires an independent, fail-safe over-temperature cutoff that is not dependent on the process controller or PLC. This guide documents the safety architecture, the specific Siemens 3RT1023-1BB40 contactor and 3RH1921-1FA22 auxiliary switch block referenced in the field question, and the recommended Type K thermocouple high-limit wiring to defeat a stuck contactor.

1. Why a PLC Is Not the High-Limit Device

Field practice and the IEC 61508 functional-safety framework both treat the process PLC as unsuitable for primary over-temperature cutout on a plastic-tank immersion heater. Three reasons dominate:

1. Single point of failure. A PLC CPU, I/O module, or output card failure can latch the heater output in the on state. A dedicated high-limit controller is a hard-wired analog or electromechanical interlock that does not depend on the same scan, power supply, or output driver as the process controller.
2. Diagnostic coverage. A SIL-rated or agency-listed high limit (FM, UL 1995, CSA) carries a published Failure Mode Effects and Diagnostic Analysis (FMEDA). A general-purpose PLC does not, and cannot be claimed to meet the same Safe Failure Fraction (SFF).
3. Test interval. Standards such as IEC 60335-2-73 for commercial immersion heaters require a periodic proof test of the high-limit function. The mechanical simplicity of a latching limit relay makes this test a single button-push; testing a PLC-based limit typically requires a written procedure and a documented bypass.

The correct architecture is therefore: PLC → high-limit relay → contactor coil → immersion heater. The high limit sits in series with the contactor coil so that, regardless of what the PLC does, an over-temperature event de-energises the heater.

2. System Topology

Two sensors are mandatory. Sensor #1 feeds the dedicated high-limit controller and is the only path that can de-energise the contactor coil. Sensor #2 feeds the PLC for closed-loop process control. The two sensors should be physically separated in the tank and, where practical, on independent sheathes and cable runs so that a single damaged lead cannot defeat both protections.

3. Siemens 3RT1023-1BB40 Contactor Specifications

The Siemens SIRIUS 3RT1023-1BB40 is a 3-pole AC contactor in frame size S0 with a 24 V DC electronic coil. The following parameters are taken from the Siemens SIRIUS 3RT10 catalog:

For an immersion heater the AC-1 (resistive) rating of 40 A is the relevant limit. The AC-3 figure only applies to direct-on-line motor starting and overstates usable continuous current for a heater. When sizing, use the formula:

kVA (1-phase) = V × I / 1000
kVA (3-phase) = √3 × VLL × I / 1000

Verify heater current against the 40 A AC-1 figure at the worst-case ambient inside the enclosure, then derate to 32 A continuous (80 %) for enclosed panels per NEMA ICS 2 and UL 508A panel-build rules.

4. Siemens 3RH1921-1FA22 Auxiliary Switch Block

The 3RH1921-1FA22 is a 4-pole front-mount auxiliary block (2 NO + 2 NC, identifier 21-22, 31-32, 43-44, 53-54). Critical parameters:

Because the 3RH1921 is forcibly-linked, an NO contact cannot be closed when its paired NC contact is mechanically closed, and vice versa. This is the property the high-limit loop depends on: if a contact welds, the feedback state to the PLC must be a hard contradiction, not a stuck-high. Wire one NC (e.g. 31-32) as the "contactor proven off" feedback to a PLC input, and the matching NO (43-44) as the "contactor energised" feedback. The PLC then runs a disagreement check (energised XOR de-energised) and declares a fault if both are ever true.

5. Sensor Selection: Type K vs RTD vs Thermistor

The original install was specified as an RTD, but the final sensor was identified as a Type K thermocouple. The two are not interchangeable.

For a plastic-tank immersion heater, a PTC thermistor on a dedicated limiter is the strongest single-component protection, because the limiter only requires a short-circuit or open-circuit on the sensor element to trip. If a Type K must be used, the limiter must be configured for thermocouple break protection (most Watlow, CAL, and Ascon limiters ship with this enabled by default; verify on commissioning).

6. High-Limit Controller Function and Selection

A high-limit controller differs from a process controller in three ways that matter here:

1. Latching output. When the measured temperature exceeds the setpoint, the output opens and stays open until the operator manually acknowledges the trip on the front panel. This is the single most important property for a stuck-contactor scenario — the PLC cycling the setpoint or the operator momentarily lifting a switch cannot re-arm the heater.
2. Independent power supply. It must run from a separate 24 V rail or 120 V source. Sharing the PLC's 24 V output is not acceptable for a safety function.
3. Fail-safe sensor input. The input must drop out on a broken sensor (Type K break = ambient / out-of-range = trip on most limiters).

Examples of controllers that meet these requirements and that the owner should consider alongside the dedicated high-limit device quoted in the field discussion:

The 90 USD device referenced in the source thread is most likely a single-loop latching limiter from the Ascon, CAL, or Watlow FM21 family. Confirm the certification scope — a CE-marked device without FM/UL 1995 listing is acceptable on a non-listed panel only if the assembler is willing to take the system-level listing responsibility.

7. Wiring Procedure

7.1 Prerequisites

• Heater de-energised and locked-out per OSHA 1910.147 / NFPA 70E.
• Tank drained or isolated to a level below the heater sheath inlet.
• Multimeter with Type K cold-junction compensation, or a calibrated thermocouple simulator.
• Wiring diagram and the controller's installation manual on hand.

7.2 Conductor and Routing

1. Use shielded, twisted-pair extension wire matched to the sensor type. For Type K use ANSI Type KX (yellow sheath) or IEC KX (green sheath) per IEC 60584-3.
2. Ground the shield at the controller end only. Tape the sensor end so it cannot touch the sheath or tank wall.
3. Route the high-limit sensor cable in a separate conduit or tray from any VFD output, motor leads, or DC switching conductors. Maintain at least 150 mm (6 in) of separation, or cross at 90° if a crossing is unavoidable.
4. Route the high-limit limiter's 24 V supply from a dedicated circuit breaker, not from the same breaker feeding the PLC.

7.3 Contactor and High-Limit Wiring (Step-by-Step)

1. Mount the 3RT1023-1BB40 contactor on a 35 mm DIN rail inside a NEMA 4 / IP54 minimum enclosure for the plastic-tank environment.
2. Snap the 3RH1921-1FA22 auxiliary block onto the front of the contactor until it clicks. Verify the locator tab is seated in the slot above the coil terminals.
3. Wire the coil: A1 (+24 V DC) and A2 (DC return) to the output of the high-limit controller's alarm relay (or a series-parallel combination: PLC output → limiter output → coil A1; coil A2 → 24 V common).
4. Wire the heater load through the contactor's main poles (L1-T1, L2-T2, L3-T3). For a single-phase 240 V heater, use L1-T1 and L2-T2, leaving L3-T3 empty and the third pole unused (do not jumper).
5. Wire one NC contact of the 3RH1921 (e.g. 31-32) to a dedicated PLC input as the contactor-off proven feedback. Wire the matching NO (e.g. 43-44) to a second PLC input as the contactor-on proven feedback.
6. Connect the Type K sensor to the limiter's input terminals observing polarity (+ chromel/yellow to + terminal).

7.4 Logic Ladder Reference

The following TIA Portal STL snippet enforces disagreement detection between the two auxiliary feedbacks. I_HL_OK is the PLC input wired to a separate "limiter healthy" output from the controller (if equipped); otherwise replace with the inverse of the limit's latching-alarm contact.

// Inputs
// I_CONTACTOR_ON  : I0.0  (43-44 NO feedback from 3RH1921)
// I_CONTACTOR_OFF : I0.1  (31-32 NC feedback from 3RH1921)
// I_HL_OK         : I0.2  (high-limit healthy, true = armed)
// Q_HEATER        : Q0.0  (output to high-limit limiter)
// Q_FAULT         : Q0.1  (system fault indicator)

A       I_HL_OK
AN      I_CONTACTOR_ON
A       I_CONTACTOR_OFF
AN      I_FAULT_LATCHED
=       Q_HEATER

// Disagreement or lost limiter = latched fault
A       I_CONTACTOR_ON
A       I_CONTACTOR_OFF   // both true = welded contactor or aux fault
O       I_HL_OK_NOT       // limiter tripped
S       Q_FAULT

8. Commissioning and Verification

1. Cold check. With the heater locked out, apply control power. Confirm the limiter powers up, the sensor reads tank ambient (within ±5 °C of a hand-held reference), and the limiter output is closed.
2. Sensor break test. Disconnect one sensor lead at the limiter terminal. The limiter must trip within 2 seconds and latch. Re-connect; the limiter must not auto-reset.
3. Manual trip test. Lower the limiter setpoint to the current process temperature. The output must open and latch. Raise the setpoint above the current temperature and confirm the output does not re-arm without an operator acknowledge.
4. End-to-end test. Enable the heater through the PLC. Drive the process temperature up past the limiter setpoint. The contactor must de-energise and the heater must go cold. Measure drop-out time (target: < 2 s from setpoint crossing to coil voltage < 6 V DC).
5. Stuck-contactor test. With the heater still cold and the PLC commanding the heater ON, manually force the contactor closed with a jumper. Confirm that the limiter's output still drops the coil voltage when the sensor reaches the limiter setpoint. This is the test that proves the architecture defeats a stuck contactor.
6. Aux feedback test. From the PLC, monitor I_CONTACTOR_ON and I_CONTACTOR_OFF. Command the heater on and confirm exactly one is true. Command off and confirm the other is true. An XOR failure at any point is a fault.

Record all six results in a commissioning sheet. NFPA 86 and most agency inspectors require the sheet be retained for the life of the equipment.

9. Troubleshooting Matrix

10. Plastic-Tank-Specific Considerations

A polyethylene tank softens at roughly 80 °C and a polypropylene tank at roughly 100 °C. The high-limit setpoint must be the lower of:

• Plastic heat-deflection temperature (HDT) per ASTM D648 − 10 °C safety margin,
• Process fluid boiling point − 15 °C,
• Heater sheath rating − 20 °C.

For a typical PP tank the working limit is 90 °C and the absolute cutoff should be 95–100 °C. The limiter's setpoint is the absolute cutoff; the PLC's process setpoint is the working limit, typically 15–20 °C below it. This separation is what gives the architecture its margin: a process controller failure that drives the SP to maximum will still leave 15–20 °C before the limiter opens.

11. Maintenance and Periodic Proof Test

A high-limit function that has not been tested in 12 months is, for safety purposes, untested. At minimum, annually:

1. Repeat the sensor-break test (Section 8.2).
2. Repeat the manual trip test (Section 8.3).
3. Repeat the stuck-contactor test (Section 8.5).
4. Inspect the 3RT1023 contactor body for arc marks, oxidation, or discoloration. Replace if pitting is visible on the main poles.
5. Verify the 3RH1921 aux block is firmly seated and that the 2 NO / 2 NC assignment on the wiring diagram still matches the field wiring.

Document each test on a label affixed to the inside of the panel door per NFPA 70E and your local AHJ practice.

12. FAQ