The quantitative definition you are looking for is not a sentence, it is a family of curves. ANSI/UL 913 (Intrinsically Safe Apparatus and Associated Apparatus for Use in Class I, II, and III, Division 1, Hazardous (Classified) Locations) carries the ignition curves; IEC 60079-11 carries the equivalent international treatment and the formal definition of the protection concept. Everything else in the stack — the National Electrical Code (ANSI/NFPA 70), ISA-RP12.6, ISA-TR12.2 — tells you how to install, assess, and document a design against those curves. So the answer to "how close am I?" is: plot your open-circuit voltage, short-circuit current, stored capacitance, and stored inductance against the Group D curves, then check the worst-case surface temperature against your T-code.
The Four Numbers That Decide the Design
Intrinsic safety restricts electrical energy in the hazardous-area apparatus and in the interconnecting wiring to a level below what can ignite the atmosphere by spark or by heating. That definition, from IEC 60079-11, is doing real work: it names two independent ignition paths, and both must be closed under normal operation and under specified fault conditions.
The spark path is governed by four entity parameters. On the barrier or isolator side you get Voc (or Uo), Isc (Io), Ca (Co), and La (Lo). On the field device side you declare Vmax (Ui), Imax (Ii), Ci, and Li. ISA-TR12.2 is explicit that Vmax and Imax taken together may land in the ignition-capable region of the ANSI/UL 913 curves — the entity parameters alone do not prove safety, the curve comparison does.
The relationship you are trying to satisfy for a Class I, Division 1, Group D loop:
Voc <= Vmax
Isc <= Imax
Po <= Pi
Ca >= Ci + C_cable
La >= Li + L_cableThe cable is not a wire, it is a distributed capacitor and inductor in series with your device, and on a long run it can consume most of your Ca allowance before the field instrument sees a single picofarad.
Spark Energy and Surface Heating Are Separate Failures
This is heat, not logic. A capacitor discharged through a break in the loop delivers 0.5·C·V² into an arc of a few microseconds. Raise the voltage and the permitted capacitance falls hard, because the stored energy goes as the square of the voltage. The inductive curve behaves the same way against current: 0.5·L·I² released when the circuit opens, so X amps allows Y henries and no more. Those are the two charts every IS designer works from, and they are the substance of ANSI/UL 913. If your device has no energy storage at all — no capacitor, no inductor, no transformer winding — the spark path is essentially closed by inspection and the barrier does the rest.
The thermal path is independent. A resistor, a semiconductor junction, or a shorted PCB trace can sit below spark-ignition energy and still hold a surface above the auto-ignition temperature of the gas. That is the T-code, and it is evaluated with the fault conditions applied, not at nominal load.
Where to Read Each Limit
| Quantity | Constraint | Where to read it |
|---|---|---|
| Spark ignition, resistive/capacitive/inductive | Group-specific ignition curves (Group D is the least restrictive of the Class I gas groups) | ANSI/UL 913; IEC 60079-11 |
| Entity parameter matching | Voc≤Vmax, Isc≤Imax, Ca≥Ci+C_cable, La≥Li+L_cable | ISA-TR12.2, Intrinsically Safe System Assessment Using the Entity Concept |
| Simple apparatus (thermocouple, photocell, RTD, switch) | Must not generate more than 1.5 V, 100 mA, 25 mW | IEC 60079-11 definition of simple apparatus |
| Fault tolerance | Ex ia for Zones 0, 1, 2; Ex ib for Zones 1 and 2 | IEC 60079-11 levels of protection |
| Installation, separation, earthing | Wiring methods and segregation for IS circuits | ANSI/NFPA 70 Article on intrinsically safe systems; IEC/EN 60079-14; ANSI/ISA-RP12.6 |
| Surface temperature | T-code under fault, referenced to the gas AIT | Apparatus certificate; ANSI/UL 913 thermal tests |
Redesign Procedure
- Fix the target first: Class I, Division 1, Group D, and the required T-code. Group D sets which ignition curve applies; the T-code sets the thermal ceiling.
- Inventory every energy store in the hazardous-area circuit. Bulk decoupling caps, bypass caps, EMI filter capacitors, relay coils, transformer primaries, motor windings, cable capacitance. Sum them into
CiandLi. Ceramic bypass capacitors across a supply rail are the usual overlooked contributor. - Set
VmaxandImaxfrom what the barrier or isolator will actually deliver into a fault, not from the operating point. - Plot the pair against the ANSI/UL 913 curves for Group D. If you sit in the ignition-capable region, the fix is almost always to drop the rail voltage or cut capacitance — voltage buys you more than anything else because of the V² term.
- Apply the no-single-fault rule to every element you rely on for limiting. If one resistor limits current into an inductor, use two in series so that a single shorted component cannot raise the current. The same logic applies to voltage-clamping zeners: they are used in redundant pairs or triples.
- Calculate the cable allowance. Take the cable capacitance and inductance per unit length from the manufacturer's data at your maximum run length and subtract them from
CaandLabefore comparing againstCiandLi. - Run the thermal fault case: short the output, stall the load, open the feedback path, and measure hotspot temperature against the T-code.
Barrier Selection and Installation Verification
Two barrier types dominate. A Zener barrier shunts fault energy to earth and therefore depends absolutely on that earth path — the standard permits an impedance to earth of up to 1 ohm, and the conductor is sized accordingly: two separate 1.5 mm² conductors, or a single 4 mm² copper conductor. A galvanically isolated barrier removes the earth dependency and is the easier choice on floating or long-haul loops, at higher cost per channel.
Verification items that fail audits more often than the circuit design does:
- Clearance inside junction boxes between IS and non-IS terminals must exceed 50 mm; the same separation applies between AC power terminals and the IS output terminals of a module.
- Minimum ingress protection for enclosures containing IS circuits is IP20, with glands rated to match.
- Unused cable cores are terminated at both ends or earthed at one end; screens are earthed at one end only, to keep circulating current out of the IS loop.
- IS field wiring is identified (light blue is the usual convention) and physically segregated from non-IS wiring along its whole route, not just at the terminals.
- The loop calculation sheet — entity parameters, cable constants, barrier certificate numbers — belongs in the file. Without it the installation is not verifiable by anyone else.
Recurring Pitfalls
Designers assume the barrier makes the device safe. It limits what the hazardous area can receive; it does nothing about energy stored inside your enclosure or generated by your own transducers. A thermocouple, photocell, or piezo element counts as an energy source and must stay under 1.5 V, 100 mA, 25 mW to qualify as simple apparatus.
Second: the fault condition is not the operating condition. Ex ia tolerates two countable faults, Ex ib one. A design that limits current cleanly at nominal load and then delivers full rail current when a transistor shorts has not met the requirement.
Third: adding a large output capacitor late in the design to fix a noise or EMC problem quietly pushes Ci past Ca, which invalidates the loop calculation without changing anything a functional test would catch. Any change to passive component values in the hazardous-area circuit reopens the entity assessment.
Fourth: cable length. A loop certified at 100 m of one cable type is not certified at 500 m of another. Recompute C_cable and L_cable whenever the route or the cable part number changes.
Frequently Asked Questions
What happens if Ci plus cable capacitance exceeds the barrier's Ca?
The loop is no longer intrinsically safe: an open or short in the field wiring can release enough stored charge to produce an ignition-capable spark. Reduce the hazardous-area capacitance, shorten the cable, switch to a lower-capacitance cable, or select a barrier with a lower Voc, since the permitted capacitance rises sharply as voltage falls.
What happens if my device passes the spark test but runs hot?
It fails on the thermal path and cannot carry the required T-code. Spark energy and surface temperature are evaluated separately under fault conditions, so a component that stays below the ignition curve can still hold a surface above the gas auto-ignition temperature and must be derated or heat-sunk.
What happens if the Zener barrier earth connection is lost?
The barrier has no path to divert fault energy and the protection is defeated while the loop keeps working normally, so the failure is invisible in operation. Verify the earth path measures within the permitted 1 ohm and is wired with two 1.5 mm² conductors or one 4 mm² conductor; on installations where that path is hard to guarantee, use a galvanically isolated barrier instead.
Stop self-assessing once your design sits anywhere near the Group D ignition curve or once you need a fault-tolerance credit you cannot demonstrate on paper. Purchase ANSI/UL 913 and IEC 60079-11 from the issuing bodies and take the design to a certification body — UL, FM Approvals, or an equivalent notified body — before you build production hardware. Apparatus for Class I, Division 1 is not self-certifiable, and the entity parameters you publish are only meaningful once a listing body has tested them.