Wellpads, separators, tank farms, and refinery units routinely contain enough flammable gas or vapor that an ordinary electrical spark could start a fire or explosion. The I/O that reads transmitters and drives solenoids in those places cannot be built like ordinary I/O. This guide explains the two main strategies for making I/O safe near flammable atmospheres: energy-limiting barriers and isolators that protect field devices in the most dangerous zones, and ruggedized non-incendive modules that can be mounted in the hazardous area itself. It also covers entity parameters and how to pick an approach for a classified oil and gas location without over-engineering the panel.
Hazardous Area I/O in one line: Hazardous area I/O is input/output designed to operate safely where flammable gas or vapor may be present, so it cannot become a source of ignition. Two approaches dominate: intrinsically safe (IS) I/O, where a barrier or galvanic isolator limits the electrical energy that can reach a field device in a Zone 0/1 or Division 1 location so it can never spark or heat enough to ignite; and non-incendive or Division 2 / Zone 2 modules built so that under normal operation they produce no ignition-capable energy and can be mounted in the less severe hazardous area directly.
Intrinsic safety takes a completely different angle from enclosure-based methods like explosion-proof housings. Instead of containing an explosion inside a heavy box, an intrinsically safe design ensures that the electrical energy in the field circuit is too small to ignite the surrounding atmosphere in the first place, even if a wire shorts or a terminal arcs. This is achieved with an IS barrier or a galvanic isolator installed between the control system and the field device. The barrier or isolator caps the voltage and current that can pass into the hazardous area and limits the stored energy in cabling, so the transmitter, switch, or solenoid out in Zone 0 or Zone 1 can never receive enough energy to create an ignition-capable spark or hot surface.
A simple Zener barrier does this passively, referenced to a high-integrity ground, while a galvanic isolator does it with transformer or optical isolation and needs no dedicated IS ground. Isolators are generally preferred in modern designs because they remove the ground-integrity requirement and add signal isolation, at the cost of needing their own power. Either way, the safe-area side of the barrier connects to a standard analog or digital I/O module, and the hazardous-area side runs out to the field device. The whole loop, including the field instrument, the interconnecting cable, and the barrier, has to be evaluated together as an intrinsically safe system.
The practical consequence is that IS is the go-to method for the most severe locations - Zone 0 and Zone 1, or Division 1 - and for devices that need to be worked on live, because a technician can open an IS circuit under power without a hot-work permit. It is also the natural fit for low-power instrumentation like 4-20 mA transmitters, thermocouples, RTDs, and simple discrete devices, which is most of the sensing on a typical process skid.
Not every hazardous area is equally dangerous. In a Division 2 or Zone 2 location, a flammable atmosphere is present only occasionally or abnormally - during an upset, a leak, or a maintenance operation - rather than continuously. That lower probability of a hazardous atmosphere allows a different, often cheaper protection method: non-incendive equipment. A non-incendive module is built and rated so that in normal operation it produces no arcs, sparks, or hot surfaces capable of ignition, which means it can be mounted directly in the Division 2 or Zone 2 area without a barrier on every channel.
This is why many remote I/O and controller families are offered with a Class I, Division 2 or Zone 2 rating: the entire node, power supply and all, can live in a field enclosure inside the classified area, close to the instruments it serves, rather than being pulled all the way back to a safe-area control building through long home-run cables. The tradeoff is that non-incendive protection depends on the equipment operating normally, so live maintenance is restricted - you generally cannot break a connector or replace a module while the area could be gassy without first confirming the area is safe or de-energizing.
In real designs the two approaches coexist. A Division 2 rated remote I/O rack sits in the field and does the bulk of the routine monitoring, while the handful of loops that reach into a Division 1 sump, a fuel-gas skid, or an in-tank sensor are handled through intrinsically safe barriers or isolators. Matching each loop to the actual zone or division of the device it touches, rather than applying the strictest method everywhere, is what keeps the installation both compliant and affordable.
Intrinsic safety only holds if the barrier, the cable, and the field device are compatible, and that compatibility is verified through entity parameters. Every IS device carries a set of numbers: the barrier or isolator publishes the maximum voltage and current it can deliver and the maximum capacitance and inductance it can safely drive; the field device publishes the maximum voltage and current it can accept and the internal capacitance and inductance it adds. The rule is straightforward but must be checked for every loop - the barrier's output must not exceed the device's input limits, and the barrier's allowable cable capacitance and inductance must exceed the field device's internal values plus the cable's contribution. If those inequalities do not all hold, the loop is not intrinsically safe no matter what the individual parts are rated for.
Architecting a classified oil and gas or refinery location, then, is an exercise in mapping the area classification drawing onto the I/O plan. Start from the zone or division of each area, list the field devices in each, and decide per loop whether it needs IS treatment (Zone 0/1, Division 1, or any device you want to service live) or can be served by a non-incendive module (Zone 2, Division 2). Group the IS loops onto barrier or isolator racks in the safe area or in a purged enclosure, and place non-incendive remote I/O out in the field where it saves cable. Avoid the common trap of specifying intrinsic safety for the whole plant when most of it is only Division 2 - that inflates the barrier count, the panel size, and the commissioning effort with no added safety.
Documentation is part of the deliverable, not an afterthought. The loop diagrams have to show the entity-parameter calculation for each IS loop, the certification of every component has to match the gas group and temperature class of the area, and the installation has to follow the manufacturer's control drawing exactly. When an inspector or a later engineer asks why a given loop is safe, the answer lives in that paperwork, so building it correctly during design saves a great deal of trouble at the acceptance test and for the life of the plant.
Intrinsically safe I/O prevents ignition by limiting electrical energy so a spark or hot surface can never carry enough energy to ignite the atmosphere. Explosion-proof relies on a heavy enclosure that contains and cools any internal explosion so flame cannot escape. IS is favored for low-power instrumentation and for equipment you want to service live, while explosion-proof suits higher-power devices that cannot be energy-limited.
Yes, if the module carries the right rating for that area. Many remote I/O families are certified for Class I, Division 2 or Zone 2, meaning they are non-incendive and can be installed in a field enclosure inside a location where a flammable atmosphere is only occasionally present. For continuously hazardous Zone 0/1 or Division 1 devices you generally use intrinsically safe barriers or isolators back to standard I/O rather than putting the module in the field.
Entity parameters are the electrical limits published for intrinsically safe barriers and field devices - maximum voltage, current, capacitance, and inductance. They matter because an IS loop is only certified safe when the barrier's output cannot exceed the field device's input limits and can safely drive the combined cable and device reactance. Checking these numbers for every loop is how you prove the installation is intrinsically safe rather than just assuming it.
This page references the vendor products and their official documentation published by the organizations below. Editions, product capabilities, and documentation change over time - confirm current requirements and specifications directly with the source.
Last reviewed: July 27, 2026. Merobix is not affiliated with, endorsed by, or sponsored by these organizations; their names are used only to identify the standards and products discussed.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.