A device is installed in a hazardous area. The nameplate looks reassuring: Ex ia IIC T4. It has been assessed for intrinsic safety under IEC 60079-11, the loop parameters have been checked, and the equipment is suitable for the intended zone and gas group.

For many projects, this feels like the hazardous-area question is closed. But if the same device is part of a safety instrumented function under IEC 61508 or IEC 61511, another question remains: will it perform when the plant needs it most?

Explosion protection asks whether equipment can become an ignition source. Functional safety asks whether a safety function can achieve the required risk reduction. A device can be correctly Ex-certified and still need further evidence if it supports a shutdown function, protective loop or safety device.

This gap often appears late in a project. The ATEX or IECEx file may look complete. Then, during SIL review, HAZOP follow-up or commissioning, a new question appears: what is the probability that this safety function will fail when demanded?

Consider a 4–20 mA pressure transmitter that freezes at a normal value while the real pressure continues to rise, with nothing in the loop diagnosing the failure. Its Ex ia certificate remains valid. Yet if that transmitter protects against overpressure, this dangerous undetected failure could be the difference between a shutdown and an incident.

In functional safety, the failure that matters most is the one nobody sees coming: a dangerous failure that no diagnostic detects. This rate, λDU, is the driver of how often a safety function fails to act on demand. Alongside diagnostic coverage, safe failure fraction, hardware fault tolerance and proof-test interval, it determines whether the complete function meets its SIL target.

For this reason, two important standards have been published to address the challenges created when Ex equipment depends on a safety device or safety-related function. EN 50495 addresses safety devices required for safe functioning with respect to explosion risks. IEC TS 60079-42 brings this thinking into the IEC 60079 series for safety devices used to control potential ignition sources from Ex equipment.

These standards show why Ex evidence and functional safety evidence must speak to each other.

For manufacturers and integrators, the practical message is simple: do not treat Ex and functional safety as two separate files that meet only at the end. Align the evidence early by asking:

What is the safety function?
What SIL or risk reduction is required?
Which assumptions are made for diagnostics and proof testing?

Does the Ex assessment support the same operating limits as the functional safety case?
Are the proof-test assumptions consistent with how the equipment will actually be maintained?

This is the gap ExVeritas and NMi Group are addressing with the Functional Safety service: helping customers go one step beyond Ex certification and prove that the complete safety function can achieve the required risk reduction.

An Ex certificate remains essential. But the better question is no longer only: Is it Ex-certified?

It is: Can we prove the complete safety function?

www.exveritas.com