Explosion protection and SIL address two completely different levels of safety issues: explosion protection is about ensuring that "the device cannot become an ignition source," while SIL is about whether "the safety function can operate reliably." An instrument may have explosion protection certification but no SIL rating at all, or it may have SIL capability but not require explosion protection certification-they each respond to entirely different risk issues.
I. What Problem Does Explosion Protection Certification Solve?
The core definition of explosion protection certification is to confirm that when electrical equipment is used in an explosive atmosphere, it will not ignite the surrounding combustible gas or dust due to sparks, arcs, or high temperatures generated by the equipment itself. Its logical starting point is "the presence of a flammable and explosive mixture," and its endpoint is "the equipment is designed so that it cannot become an ignition source."
Explosion protection requirements should be determined based on the intended application and installation conditions. First, the classification of the hazardous area must be clarified: whether it is Zone 0, Zone 1, or Zone 2, and whether it is a gas environment or a dust environment; second, the gas group and temperature class of the target gas must be confirmed. Different types of explosion protection-such as intrinsic safety (Ex ia), flameproof enclosure (Ex d), and increased safety (Ex e)-are suitable for different areas and operating conditions. When selecting, one cannot simply look at "whether there is explosion protection," but must look at "which type of explosion protection is suitable for this area."
What else needs attention beyond explosion protection certification? One cannot only look at "whether there is an explosion protection certificate," but must also check whether the certificate covers the target product model, target operating conditions, hazardous area classification, and gas/dust group. An explosion protection certificate is typically bound to a specific product model and specific temperature range and electrical parameters. If the actual operating conditions fall outside the scope of the certification, the product may not be used in accordance with that certification. In addition, explosion protection certification is concerned with "not igniting"-it does not guarantee measurement accuracy, nor does it guarantee timely alarms in the event of overpressure-that is a matter for another system.
II. What Is International Market Access?
International market access, simply put, means that for a product to enter the market of a certain country or region, it must meet the mandatory requirements of local regulations and standards. Explosion-proof products are particularly prominent in this regard, because safety supervision in hazardous locations is mandatory in countries around the world.
The typical practices of different countries can be summarized into three types. The direct conversion type refers to certain countries or regions accepting test reports or certificates issued by the other party's certification bodies through mutual recognition agreements, without the need for repeated testing. The audit certification type refers to the importing country requiring an independent review and certification by a certification body recognized by that country; even if the exporting country already has certification, the local process must still be followed. The additional requirements type is based on accepting international common standards while superimposing the country's special differential requirements, such as specific voltage levels, label language, or marking styles. The goal of the IECEx system is precisely to promote international mutual recognition of "one standard, one certificate, one mark," reducing the burden of repeated certification. But the reality is that, out of consideration for safety supervision, countries still retain a large number of localized requirements.
III. Definition and Classification of SIL
SIL = Safety Integrity Level, which comes from the functional safety standard system (IEC 61508 and its process industry application standard IEC 61511). SIL defines the degree of confidence that a safety instrumented system will successfully execute a safety function when action is required.
How many levels does SIL have? There are four levels in total, with SIL 4 being the highest and SIL 1 the lowest. The higher the level, the lower the probability of safety function failure must be. For low-demand mode (i.e., no more than one action per year), SIL 1 corresponds to an average probability of failure of 10⁻² to 10⁻¹, SIL 2 is 10⁻³ to 10⁻², SIL 3 is 10⁻⁴ to 10⁻³, and SIL 4 is 10⁻⁵ to 10⁻⁴. The most common requirements in the process industry are SIL 2 and SIL 3, and SIL 4 is generally associated with applications requiring the highest levels of safety integrity.
Which Applications Require SIL?
Which applications require SIL is essentially not determined by the type of instrument, but by the result of the risk assessment. It is not that "a pressure transmitter requires SIL," but rather that "a certain safety function is assessed as requiring SIL, and the instruments participating in that function must be suitable for the required SIL." The core of the judgment is: once this safety function fails, how severe are the consequences, how high is the frequency of occurrence, and can it be promptly avoided by other protection layers. In the process industry, the most typical SIL applications are concentrated in scenarios such as overpressure protection, high/low level interlocks, emergency shutdown, combustion management, and toxic/combustible gas monitoring. For example, failure of reactor overpressure protection may lead to vessel rupture or even explosion; failure of storage tank high-level interlock may cause tank overflow and fire; failure of boiler combustion management may cause furnace deflagration; and failure of the emergency shutdown system may allow process deviations to go uncorrected in time. The common feature of these scenarios is that once the safety function fails, the consequences may include explosions, fires, fatalities, injuries, or major environmental damage, so SIL 2 or even SIL 3 is usually required.
Another category of applications requiring SIL is toxic gas monitoring and interlocking, high-integrity pressure protection systems, etc. Although they do not necessarily directly involve explosions, the consequences of failure are equally serious. It should be particularly emphasized that SIL is assigned to the entire safety instrumented function, not attached to a single instrument. A transmitter can "support SIL 2 applications," but whether the entire loop truly achieves SIL 2 still depends on the logic controller, actuating valves, loop architecture, diagnostic coverage, and test intervals. Conversely, not all instruments in hazardous areas require SIL: an explosion-proof pressure transmitter used only for local display or ordinary process control does not require SIL assessment if it does not participate in any safety instrumented function; it only needs explosion protection certification. Therefore, "which applications require SIL" ultimately comes back to risk assessment: after this function fails, are the consequences severe enough that a safety instrumented system must be used to reduce the risk? If so, SIL is required; if the conventional control system or other protection layers are sufficient, it is not required.
IV. SIL Levels and Probability of Dangerous Failure
PFDavg: Average probability of dangerous failure in low demand mode - the smaller the value, the lower the probability of failure and the stronger the safety capability.
PFH: Probability of dangerous failure per hour - used in high- demand/continuous mode.
V. Relationship Between Explosion Protection and SIL
The relationship between explosion protection and SIL can be summarized in one sentence: they answer different questions and cannot replace each other. Explosion protection answers "will the device ignite the surrounding environment," while SIL answers "can the safety function operate reliably when needed."
A transmitter used in a hazardous area typically needs to meet two levels of requirements simultaneously: it must have a suitable explosion protection type to adapt to the hazard rating of the installation area; and if it participates in a safety instrumented function, it also needs to have the corresponding SIL capability. However, these two certifications are evaluated independently. Explosion protection certification focuses on the enclosure, circuit energy limitation, and surface temperature; SIL certification focuses on the probability of dangerous failure, diagnostic coverage, hardware fault tolerance architecture, and safety lifecycle management.
Conversely, a common misunderstanding is that "having SIL certification means explosion protection is not needed," or "having an explosion protection certificate means it can be used in a safety loop." Both of these ideas are wrong. SIL certification does not assess ignition risk, and explosion protection certification does not assess the reliability of safety functions. An instrument truly suitable for a safety loop in a hazardous area needs to hold both a valid explosion protection certificate and a SIL assessment report, and the applicable scope of both must cover the actual operating conditions.
