Not every part of a facility handling flammable gas or combustible dust carries the same explosion risk, and zone classification exists to make that difference explicit — matching the level of ignition-source control in any given area to how often, and for how long, an explosive atmosphere is actually likely to be present there.

Areas where flammable gas or vapour is handled are classified into three zones based on how frequently an explosive atmosphere is expected: Zone 0 covers areas where an explosive atmosphere is present continuously or for long periods, Zone 1 covers areas where it is likely to occur during normal operation, and Zone 2 covers areas where it is not expected during normal operation and, if it does occur, only briefly. This is a probability-based classification, not a severity-based one — a Zone 0 area is not necessarily more dangerous per incident than a Zone 1 area, but an explosive atmosphere is expected there far more often.

Combustible dust areas use a parallel classification — Zone 20, 21 and 22 — following the same continuous, likely, and unlikely-but-possible logic as the gas zones, but applied to a combustible dust cloud rather than a gas or vapour. Dust hazards are frequently underestimated relative to gas hazards because dust does not disperse and reappear the way a gas leak does; instead it settles, accumulates, and can be redistributed into an explosive cloud by something as simple as a passing air current or vibration disturbing a settled dust layer.

A zone classification reflects the process and equipment as they exist at the time of assessment, and any change — a new vent point, a modified process, different material handling — can shift where the actual zone boundaries should sit, whether that means expanding a zone or, sometimes, allowing it to be reduced. Treating zone drawings as a fixed, one-time document rather than something reviewed whenever the underlying process changes lets the classification drift out of step with the actual physical risk.

Full reference: Understanding ATEX Zone Classification: Gas and Dust ↗

Standard electrical equipment is built around the assumption that a spark or hot surface inside its enclosure stays inside that enclosure, an assumption that simply does not hold in an explosive atmosphere, where the equipment itself has to be specifically engineered to prevent that internal ignition source ever reaching the surrounding atmosphere.

ATEX-rated equipment is categorized by the level of protection it provides, and this category needs to match the zone it will actually be installed and operated in — equipment rated for the less demanding requirements of a Zone 2 area is not automatically suitable for installation in a Zone 0 or Zone 1 area, where an explosive atmosphere is present far more often. Installing equipment rated for a less severe zone than the one it is actually placed in is a genuine and sometimes overlooked gap, particularly when equipment is relocated after an initial, correct installation.

Different equipment achieves its rating through different protection concepts — flameproof enclosures that contain an internal explosion and cool escaping gases before they exit, intrinsic safety that limits electrical energy below the level needed to ignite the atmosphere, and increased safety designs that eliminate arcing and sparking contacts entirely, among others. Understanding which protection concept a given piece of equipment uses matters for maintenance and modification decisions, since altering equipment in a way that compromises its specific protection concept — drilling into a flameproof enclosure, for instance — can invalidate its certification even if the equipment still appears to function normally.

The certification of ATEX-rated equipment depends on correct installation, including properly sealed cable entries and glands maintaining the enclosure's rated integrity, and an otherwise correctly rated piece of equipment installed with an incorrect or poorly sealed cable gland loses the protection its certification was based on, in a way that is not obvious from the equipment's visible rating label.

Full reference: Selecting ATEX-Rated Electrical Equipment ↗

Non-sparking tools and intrinsically safe equipment are often mentioned together as if they solve the same problem, but they address two entirely separate ignition mechanisms — mechanical impact and electrical energy — and using one where the other is needed leaves the actual hazard unaddressed.

Non-sparking is a relative rather than absolute property, and these tools can still produce sparks under sufficiently severe impact, particularly when contaminated with grit, rust particles or aluminium residue that can act as an ignition catalyst on impact. They also tend to be softer than steel equivalents, wearing faster and requiring more frequent inspection and replacement, and treating them as an absolute guarantee against mechanical ignition rather than a meaningful risk reduction overstates what they provide.

Intrinsically safe equipment is designed so the electrical energy available within the circuit, under both normal operation and specified fault conditions, remains below the level capable of igniting the surrounding atmosphere through either a spark or a hot surface. This is achieved through circuit design limiting current, voltage and stored energy, rather than by containing an ignition source the way a flameproof enclosure does, which is why intrinsically safe equipment can often be opened and worked on in a live hazardous area where flameproof equipment cannot.

An intrinsically safe circuit's certification depends on the whole loop — the field device, the cable parameters, and the associated barrier or isolator — and substituting a component, extending cable length beyond certified parameters, or connecting a non-certified device into the loop can invalidate the intrinsic safety of the entire circuit. This makes intrinsic safety a system property rather than a per-item label, which is a frequent source of unintended non-compliance during maintenance work.

Full reference: Non-Sparking Tools and Intrinsically Safe Equipment ↗

A mobile phone is an ignition source that people carry into hazardous areas without thinking about it, precisely because it does not resemble the industrial equipment that ignition source controls are obviously written about.

Standard phones, tablets, cameras, torches and wearables contain batteries, circuitry capable of arcing, and surfaces that can heat during charging or heavy use, none of which are designed or certified with an explosive atmosphere in mind. The risk is not primarily the device operating normally in a sealed state but the fault conditions: a damaged battery, a cracked case exposing circuitry, a device dropped and impacted, or a battery in thermal runaway.

A device that is switched off still holds a charged battery and internal circuitry, and physical damage to it in a hazardous area can still produce a spark or thermal event regardless of its power state. Policies framed as switch devices off in hazardous areas therefore address only part of the risk, and a prohibition on carrying non-certified devices into classified zones is a materially different and more complete control than requiring they be powered down.

Intrinsically safe phones, radios, cameras and torches certified for the relevant zone exist and are the appropriate route where a device genuinely needs to be used inside a classified area, rather than making an informal exception for a standard device on the basis that the task is brief. As covered for intrinsically safe equipment generally, these devices remain certified only with their specified batteries and accessories, and substituting a standard battery or charging them inside the zone undermines the certification.

Full reference: Personal Electronic Devices and Ignition Source Control ↗

The energy needed to ignite many flammable gases is remarkably small — far below what a person can feel as a static shock — which means a discharge that goes completely unnoticed by the person who generated it can be more than sufficient to ignite an explosive atmosphere.

Static charge builds through charge separation, where two materials in contact and then separated leave one with a surplus and the other with a deficit of electrons, and this happens constantly in industrial settings: liquid flowing through pipe, powder moving through a chute or being poured, a person walking across a floor, plastic sheeting being unrolled, or clothing rubbing against itself during ordinary movement. None of these activities look like they involve electricity at all, which is exactly why static as an ignition source is easy to overlook compared to more obvious sources like electrical equipment or open flame.

Different flammable materials require different amounts of energy to ignite, expressed as minimum ignition energy, and many common flammable gases and vapours have a minimum ignition energy well below the energy in a static discharge a person would perceive as a mild shock. Fine combustible dusts generally require more energy than gases, but the most easily ignited dusts still fall within the range a static discharge can readily produce, which is why static control applies to dust handling operations as much as to flammable liquid work.

Non-conductive materials — plastic containers, plastic sheeting, non-conductive hose and pipe, insulating floor coatings — are particularly problematic because they can hold accumulated charge without any path for it to dissipate safely, releasing it later as a single discharge rather than bleeding it away continuously. Substituting a plastic container for a metal one, or laying down a plastic sheet in a hazardous area for a practical reason unrelated to electrical concerns, can inadvertently introduce a charge accumulator into an environment specifically designed to avoid them.

Full reference: Static Electricity as an Ignition Source ↗

Ordinary workwear can become an ignition hazard in an explosive atmosphere without the wearer doing anything unusual at all — simply walking, removing a jacket, or brushing against equipment can generate a static discharge from untreated synthetic fabric that is more than enough to ignite a flammable gas or dust cloud.

Synthetic fabrics not specifically designed to dissipate static charge can accumulate a significant charge through everyday movement and friction against other surfaces, including the wearer's own body, and this charge can discharge as a spark carrying more than enough energy to ignite many flammable gas and dust mixtures. This risk exists independent of anything else happening in the work area — it comes from the clothing itself, worn by a person simply moving normally through a classified zone.

EN 1149 covers protective clothing with electrostatic properties, designed to dissipate accumulated static charge to earth through the wearer's body and footwear rather than allowing it to build to a level capable of an incendiary discharge. This function depends on the whole chain working together — the garment dissipating charge is only effective if it is also earthed through conductive or antistatic footwear and, ultimately, a conductive floor or grounding point, which is why antistatic clothing and antistatic footwear need to be considered as a connected system, not independent choices.

Antistatic protection needs to cover the whole body consistently, since a gap in coverage — an ungrounded undergarment showing at the wrist or neck, or an outer layer removed and left as the only static-dissipating garment while an underlying synthetic layer is exposed — can reintroduce the exact risk the outer garment was meant to eliminate. Removing an antistatic outer layer while remaining in a classified zone, even briefly, should be treated as a genuine change in risk exposure, not a minor comfort adjustment.

Full reference: Selecting Antistatic and Flame-Resistant Clothing: EN 1149 ↗

Footwear is the final link in the chain that carries static charge safely away from the body to earth, and if that link fails — the wrong sole material, a worn conductive path, the wrong floor underneath — every other antistatic precaution taken further up the body becomes ineffective.

Antistatic clothing dissipates charge from the garment to the body, but the body itself still needs a path to earth, and footwear provides that final connection through a conductive or antistatic sole in contact with a suitably conductive floor. A person wearing correctly rated antistatic clothing but standing on insulating footwear, or on an insulating floor surface, can still accumulate a dangerous static charge despite every other precaution being correctly followed.

The floor surface itself needs to be sufficiently conductive for antistatic footwear to actually complete the grounding path, and a well-rated antistatic boot standing on a non-conductive floor coating, a dry, non-conductive floor surface, or an insulating mat placed underfoot for comfort still leaves the wearer effectively ungrounded despite wearing correctly rated footwear. Checking floor conductivity as part of the same assessment that specifies footwear, not assuming any warehouse or industrial floor is automatically conductive, closes this gap.

Thick insulating socks or an aftermarket insole inserted between the foot and a conductive footbed can interrupt the conductive path from the foot to the sole, even though the boot itself is correctly rated, which is a subtle failure mode that has nothing to do with the footwear's own certification. This is worth specific awareness since it is a common, well-intentioned modification made for comfort that unintentionally defeats the footwear's protective function.

Full reference: Antistatic and ESD-Safe Footwear for Hazardous Areas ↗

Bonding and grounding are frequently spoken about as a single concept, and treating them that way is precisely where installations go wrong — they address two genuinely different failure modes, and satisfying one does not automatically satisfy the other.

Bonding connects two or more conductive items together so they share the same electrical potential, eliminating any voltage difference between them and therefore any possibility of a spark jumping between them. Grounding connects the bonded system to earth, providing a path for accumulated charge to drain away entirely rather than sitting on the system as a whole. A bonded but ungrounded system cannot spark internally between its bonded components, but can still carry a charge relative to earth and discharge to any grounded object it later contacts.

Metal pipework is often assumed to be electrically continuous because it is physically continuous, but gasketed flanges, non-conductive pipe sections, corroded joints and painted mating surfaces can all interrupt the electrical path even where the mechanical connection is entirely sound. Bonding straps across flanges and joints restore this continuity deliberately rather than relying on incidental metal-to-metal contact that may or may not actually be conductive.

Visual inspection confirms a bonding conductor is physically present and attached, but it cannot confirm the connection is actually conductive, since corrosion under a clamp, paint beneath a connection point, or a loose fixing can all leave a visually correct installation electrically ineffective. Periodic resistance testing of bonding and grounding connections, rather than visual inspection alone, is what actually verifies the system is performing its function.

Full reference: Grounding and Bonding for Fixed Equipment and Structures ↗

Combustible dust has a failure mode nothing else in industrial safety quite matches: the settled dust layer that looks like a housekeeping nuisance is also the fuel for a secondary explosion far more destructive than whatever initial event disturbs it into the air.

A relatively small primary event — a dust cloud igniting inside a piece of equipment, or a minor deflagration in a confined space — produces a pressure wave that lifts settled dust off beams, ledges, ductwork and floors throughout the surrounding area, creating a far larger dust cloud that then ignites from the primary event itself. The secondary explosion is typically the one that causes catastrophic structural damage and casualties, and it is fueled entirely by dust that had simply been allowed to accumulate rather than by anything about the process itself.

A surprisingly thin layer of settled combustible dust across a large surface area contains enough material to create an explosive cloud when disturbed, which is why dust accumulation thresholds in guidance are measured in fractions of a millimetre rather than in visibly significant depths. A layer thin enough that the surface underneath is still visible through it can still be well past the point where it represents a genuine secondary explosion fuel load.

Routine housekeeping tends to address floors and accessible work surfaces, while the surfaces that matter most for secondary explosion risk — overhead beams, cable trays, ductwork tops, light fittings, and the tops of equipment enclosures — are precisely the ones outside normal cleaning reach and outside normal sight lines. A facility can look genuinely clean at floor level while holding a substantial dust fuel load overhead, which is why elevated surface cleaning needs to be a scheduled task in its own right rather than something addressed opportunistically.

Full reference: Housekeeping and Combustible Dust Control ↗

A gas detector answers a very specific question — how much of a particular gas is present, at this exact point, right now — and most gas detection failures come not from the instrument malfunctioning but from that specific answer being applied to a broader question it was never capable of answering.

Combustible gas detectors typically read as a percentage of the lower explosive limit rather than as an absolute concentration, meaning a reading of ten percent LEL indicates the atmosphere has reached a tenth of the concentration needed to become explosive, not that it is ten percent gas. Alarm thresholds are usually set well below the LEL specifically to provide warning margin, and treating a low but non-zero LEL reading as acceptable simply because it is far from one hundred percent misunderstands both the margin the threshold provides and how quickly conditions can change.

Fixed detection systems monitor a specific location continuously and can trigger automated responses such as ventilation or shutdown, while portable detectors travel with a worker and answer what the atmosphere is where that person actually is, which can differ substantially from what a fixed detector some distance away is reading. Neither substitutes for the other — a fixed system does not protect a worker who has moved away from its sampling point, and a portable detector does not provide the continuous area coverage or automated response a fixed system does.

Different sensor technologies respond to different gases with different sensitivity, and some sensors respond to gases other than the one they are calibrated for, producing readings that appear to indicate one gas when another is actually present. Understanding what a specific detector is calibrated for, and what else might trigger a response on that sensor, prevents both false confidence when a sensor cannot detect the gas actually present and misinterpretation when it responds to something unexpected.

Full reference: Gas Detection and Atmospheric Monitoring for Explosive Atmospheres ↗

Purging and inerting both work by removing one leg of the fire triangle rather than by controlling ignition sources, which makes them fundamentally different from every other explosive atmosphere control — and also means an incomplete purge can leave a system in a more dangerous state than not purging at all.

Purging generally means displacing a flammable atmosphere from a vessel or system, typically with an inert gas such as nitrogen, to bring it below the lower explosive limit before work begins. Inerting means maintaining an inert atmosphere in the system during operation so an explosive mixture cannot form in the first place. The distinction matters because the two have different success criteria: a purge is verified complete and then work proceeds, while inerting must be continuously maintained and monitored for as long as the protection is required.

Introducing air into a vessel containing flammable vapour, or introducing flammable material into a vessel containing air, takes the mixture through the explosive range on the way to either extreme, and this transitional period is the most hazardous part of the operation. Purging with an inert gas first, so the transition happens between flammable-rich and inert rather than between flammable-rich and air, avoids passing through the explosive range entirely, which is the core reason inert purging exists rather than simply ventilating with air.

An inerted vessel or space is oxygen-deficient by design, and this creates a life-threatening asphyxiation hazard that is invisible, odourless and can cause loss of consciousness within a very small number of breaths without any warning sensation. Nitrogen asphyxiation incidents frequently involve a second casualty attempting rescue, since the hazard gives no sensory warning to the person entering. Any inerted space must be treated as a confined space entry with full atmospheric testing and rescue arrangements, never entered on the basis that the flammability hazard has been controlled.

Full reference: Purging and Inerting Procedures ↗

A vehicle is a collection of ignition sources on wheels — a hot exhaust, an electrical system, friction surfaces, a battery, and static-accumulating tyres — which is why bringing one into a classified zone is a decision that needs specific authorization rather than being treated as routine movement.

Standard vehicles present multiple simultaneous ignition risks in a hazardous area: exhaust system surfaces hot enough to ignite many flammable atmospheres, unprotected electrical systems capable of arcing, hot brake and clutch friction surfaces, battery terminals, and static charge accumulating on tyres and bodywork. Addressing one of these while overlooking others provides limited benefit, since any single unaddressed source is sufficient on its own.

Equipment specifically designed and certified for hazardous area operation addresses these sources as an integrated design rather than as a series of retrofitted modifications, and this generally provides more reliable protection than adapting a standard vehicle. Where a standard vehicle must be modified for hazardous area use, that modification needs certification covering the vehicle as a whole, not just the individual components changed, since a partially addressed vehicle can present a false impression of being suitably protected.

Vehicle entry into a classified zone should require specific authorization confirming the atmosphere has been tested, the vehicle is appropriate for the zone classification, and the duration and route of the movement are defined, rather than being permitted on the basis of general site access. Where a vehicle must enter a zone that is not currently gas-free, this should follow the same escalated assessment applied to any other deliberate introduction of an ignition source into a live hazardous area.

Full reference: Mobile Equipment and Vehicles in Hazardous Areas ↗

Hot work is the deliberate introduction of an ignition source, and an explosive atmosphere is an environment where an ignition source is the one thing that must never be present, which makes hot work in or near a classified zone a fundamentally higher-stakes proposition than the same task performed anywhere else.

The first question for any hot work request in a classified area is whether the work can be relocated outside the zone entirely, or whether the process creating the hazardous atmosphere can be shut down and the area made genuinely gas-free for the duration of the work. Permitting hot work inside a live classified zone should be the option of last resort, considered only after relocation and shutdown have both been genuinely assessed and ruled out, rather than the default response to a hot work request.

Atmospheric testing before hot work begins confirms the area is genuinely below the lower explosive limit at the time of the test, but conditions can change during the work, and continuous monitoring throughout the task — not a single clearance test at the start — is what actually catches a developing hazardous atmosphere while there is still time to stop. Testing needs to cover the full work area including low points and enclosed spaces where heavier-than-air gas could accumulate unnoticed at a single sampling point.

Pipework, vessels, and equipment near the hot work location may contain residual flammable material even when the immediate atmosphere tests clear, and isolating, draining and where necessary purging this equipment before hot work begins removes a source that atmospheric testing of the surrounding air would not necessarily detect. This is a distinct step from testing the atmosphere itself, and one that testing alone cannot substitute for.

Full reference: Hot Work Permits in Explosive Atmospheres ↗

Maintenance work is where hazardous area protection is most likely to be temporarily dismantled — enclosures opened, circuits broken, equipment removed — which makes the maintenance period itself a distinct high-risk window rather than simply a continuation of normal operation.

Normal operation in a classified zone relies on equipment protection concepts remaining intact, and maintenance deliberately breaches those concepts: a flameproof enclosure is opened, an intrinsically safe loop is broken, a sealed gland is removed. For the duration of the work, the protection the area's safety case depends on is not present, which is why maintenance requires its own controls rather than inheriting the assumptions that apply during normal running.

The preferred approach is making the area genuinely gas-free before work begins, verified by testing rather than assumed from process shutdown, so that breaching equipment protection no longer matters because there is no explosive atmosphere to ignite. Where live working in a classified area cannot be avoided, the controls required escalate substantially, and this should be a documented, specifically authorized exception rather than a routine practice adopted because gas-freeing is inconvenient.

The reinstatement step is where hazardous area maintenance most often fails: flameproof enclosure faces need cleaning and correct fastener torque, gaskets need replacing rather than reusing, cable glands need correct reassembly, and all fasteners need refitting rather than a subset that holds the lid on adequately. An enclosure that is closed and looks correct but has three of its bolts missing or a damaged flame path no longer provides the protection its certification represents, and this is not visible from outside once closed.

Full reference: Maintenance and Permit Work Inside Hazardous Areas ↗

An emergency shutdown system spends essentially all of its life doing nothing, and that is precisely the problem — a safety function that is never exercised can degrade silently for years and only reveal its failure at the single moment it was installed to handle.

Emergency isolation systems stop the flow of flammable material into an area and remove energy sources, limiting the size of a release and removing what feeds a developing incident. The distinction from process control is important: a control system optimizes normal operation, while a safety instrumented system exists solely to bring the process to a safe state when defined limits are exceeded, and combining both functions in shared equipment means a fault in the control system can disable the protective function simultaneously.

Safety instrumented functions are generally designed to be independent of the basic process control system, so that a failure in the control layer — a failed sensor, a controller fault, a software issue — does not simultaneously remove the protective layer that exists to handle exactly that kind of failure. Where a shared sensor or shared final element is used for both purposes, the independence that protection depends on is compromised in a way that is not visible during normal operation.

Because emergency systems are dormant, faults accumulate undetected between demands, and periodic proof testing — deliberately exercising the full function from sensor through logic to final element — is what reveals these dormant faults. Testing only part of the chain, such as confirming a button operates without verifying the valve actually closes, leaves the untested portion's dormant faults exactly as hidden as before the test.

Full reference: Emergency Isolation and Shutdown Systems ↗

An explosion gives no warning and leaves no time for decision-making, which means the entire value of emergency response planning for explosive atmospheres is realized before the event — in what people already know, and in what has already been put in place.

Unlike a developing fire, where there is often time to assess and choose a response, an explosion has already happened by the time anyone is aware of it, and the plan's function is to govern what happens in the seconds and minutes afterward: evacuation, accounting for people, isolating what feeds any continuing release, and preventing the secondary events that frequently cause more harm than the initial one.

Initial explosions frequently damage the systems intended to contain the consequences, rupturing pipework, disabling detection or shutdown systems, and creating new releases that feed a subsequent fire or a further explosion. Response plans that assume the situation after an initial event resembles the situation before it, only with damage added, tend to underestimate how quickly a second event can follow and how different the conditions may already be.

Knowing quickly and reliably who is on site and who is accounted for determines whether emergency responders search a damaged, still-hazardous area, and an unreliable count means either an unnecessary and dangerous search or a genuine casualty left unlocated. Systems that track contractors and visitors as reliably as permanent staff matter disproportionately here, since these are the people least likely to be missed informally.

Full reference: Explosion and Fire Emergency Response Planning ↗