Explosion protection refers to techniques used to minimize the potential for electrical and electronic equipment to create an ignition while operating in a hazardous location. In particular, U.S. coal mines are required to use equipment in certain areas of the mine that has been approved by the U.S. Mine Safety and Health Administration (MSHA) for use in a methane and coal dust environment to limit the risk of the equipment creating an ignition-capable spark or a thermal energy ignition. In general, MSHA’s regulations for explosion protection recognize two techniques: (1) the use of explosion-proof enclosures, or XP boxes, and (2) two-fault intrinsic safety for electrical and electronic equipment.

For two-fault intrinsically safe equipment, the U.S. mining industry requirements are unique in that the equipment is certified by MSHA. The criteria MSHA uses to evaluate equipment for intrinsic safety, as required by Title 30 of the Code of Federal Regulations (30 CFR), Parts 18.20(b), 18.68(a)(1), 19.1(b), 20.1(c)(2), 22.6, 23.6 and 27.20(a), is published in a document referred to as ACRI2001 (MSHA, 2008, 2017). Outside of U.S. underground mining, many industries and countries accept equipment that is designed to a consensus-based international standard, of which ANSI/ISA-60079-11 of the American National Standards Institute (ANSI) is the U.S. version. The purpose of this study is to provide an overall assessment of the ANSI/ISA-60079-11 standard on two-fault intrinsic safety and the MSHA ACRI2001 acceptance criteria, and determine if the ANSI/ISA document can be an alternative to ACRI2001 while maintaining an equivalent or better level of safety for miners.

There are many drivers for this study. First, immediately after the 2006 Mine Improvement and New Emergency Response (MINER) Act, Public Law 109–236, was passed (MSHA, 2006), the unique MSHA requirements contributed to delays in implementing some equipment designed and approved as intrinsically safe under ANSI/ISA-60079-11 until the equipment was approved by MSHA. There was also a concern that the unique requirements would prevent or delay the ability of industry to comply with the MINER Act provisions regarding the timely introduction of new safety and health technology. Later, this concern was documented in a U.S. National Academy of Sciences (NAS) study (NAS, 2013). Accordingly, the NAS study recommended that the U.S. National Institute for Occupational Safety and Health (NIOSH) and MSHA re-examine their technology approval and certification processes to ensure they are not deterring innovation, and explore opportunities to cooperate with other international approval organizations to harmonize U.S. and international standards without compromising safety. Lastly, the National Technology Transfer and Advancement Act (NTTAA) and the accompanying Office of Management and Budget’s OMB A-119 circular mandate the use of consensus-based standards by federal agencies. However, for U.S. mining operations, MSHA cannot accept such standards unless a determination is made that such standards provide an equivalent level of protection for the miner, per the requirements of the Federal Mine Safety and Health Act of 1977 (Mine Act), the 2006 MINER Act and 30 CFR Part 18 regulations.

In determining if the ANSI/ISA-60079-11 consensus standard for intrinsic safety can be considered equivalent to the MSHA ACRI2001 criteria, there are several approaches useful for analyzing these two documents and their effect on the safety of miners in their workplace. One is to do a micro-comparative analysis of the two documents to identify specific differences and their relative effect on miner safety. A second is to do a broader comparison of the level of safety provided by all the currently permitted explosion-protected types of equipment and assess their relative contributions to miner safety. A third would be an even broader approach of performing a functional safety analysis of an entire mine operation. This would be a macro-approach considering all factors and their relative importance in contributing to the safety of miners. In these contexts, the documents in question play a diminishing role in the perceived safety of miners as the scope of the analysis broadens.

As both documents address all of the criteria needed to evaluate a specific product to determine if it qualifies to be called intrinsically safe, NIOSH decided to use the micro-option and compare the two documents directly. To date, NIOSH has put considerable effort into performing a detailed comparison of the criteria given in the two documents (Homce et al., 2013). Since the ACRI2001 criteria and the ANSI/ISA-60079-11 consensus standard are both applicable to the same explosion-protection technique (two-fault intrinsic safety), it was hoped that any differences could be reasonably resolved. However, the exercise identified many differences, with either document being more conservative than the other on a variety of issues.

The present paper provides a conclusion regarding the level of protection that would be afforded the miner by accepting ANSI/ISA-60079-11, and focuses on three questions: (1) What are the provisions of each document and how do the differences, as identified in the NIOSH-sponsored comparison, bear on mine safety? (2) What provisions are in place to keep the documents current? (3) What oversight is provided for equipment evaluated per the criteria in the documents? The third category needs to consider qualification of manufacturers, ongoing audits of manufacturers/products, and how changes to both standards and products are monitored and evaluated. In coming to its overall conclusion, the paper also considers alternative methods for comparing the level of protection, analyzes the integrity and currency of the standards, and discusses the oversight of standards implementation.

To begin this evaluation, it is important to understand that both documents were developed from the same set of fundamentals, which is the essence of intrinsic safety as given in its definition, which states that electrical equipment and wiring designated as intrinsically safe shall be incapable of releasing sufficient electrical or thermal energy under normal or abnormal conditions to cause ignition of a specific atmospheric mixture. This definition raises three questions:

How much energy will cause ignition?

All of the two-fault intrinsic safety standards that had been written on the subject were, in essence, providing answers to these questions. Simply put, the energy question was answered with the development of ignition test apparatus, abnormal conditions were defined as two faults each of low probability after which no ignition is possible, and finally, the gas mixture question was fortuitously answered by research showing that the gas groupings developed with tests for explosion-proof enclosures correlated directly with arc ignition, so the existing classification system could be used. There was and still is universal acceptance of these answers. This is why, fundamentally, all such standards could be viewed as being the same but with differences in detail. The world at large has solved these detail differences by bringing intrinsic safety experts from all interested countries together through the International Electrotechnical Commission (IEC), where all the different issues have been fully debated and proposals voted on, ultimately producing an IEC document on intrinsic safety, IEC 60079-11. This standard has been adopted by all participating countries and is available to anyone who wishes to use it. It has been adopted with national differences by the United States through ANSI and the standards developers International Society of Automation (ISA) and Underwriters’ Laboratories (UL). Furthermore, the U.S. Occupational Safety and Health Administration (OSHA) has recognized the current IEC 60079-11 standard for years.

Although the documents are similar in content, having common roots, the comparative study showed many differences. As detailed in the comparative study by Homce et al. (2013), of the more than 360 sections in ACRI2001, 68 were not relevant because the study was limited to portable products, 188 were effectively equivalent, 44 were less restrictive, and the remaining 66 were perceived to be more restrictive than the ANSI/ISA-60079-11 standard. An analysis of these 66 items showed they were in 28 technical categories. Each of these categories was further analyzed as to their effect on safety. Of these, 11 were determined to be potentially substantive, but their effect on safety could not be readily established, while the remaining 17 were considered not to affect safety.

Discussions of these differences with MSHA representatives resulted in a need to further address the issues to determine if irrefutable evidence could be found that supported the ANSI/ISA document’s criteria as providing at least the same level of safety. Although there was some success in tracing the roots of the criteria for two of the issues, this demand was essentially impossible to fulfill as most of the criteria were developed 40 to 50 years ago by standards developers who for the most part are no longer with us. Unfortunately, the supporting data and arguments for these criteria are not publicly archived, and their whereabouts are unknown.

There is one significant difference between the documents that presents a compelling argument for equivalent protection by ANSI/ISA-60079-11, because the difference is directly related to the question of safety margins. In this case, the ACRI2001 document is less conservative. In both documents, the standard evaluation process to establish whether or not ignition is possible considers (1) no faults, or normal operation, (2) the application of one fault and (3) the application of two faults producing the highest voltage/current levels. This provision specifies the application of safety factors applied to voltage or current to raise the maximum value of either to artificial levels as part of the evaluation. This in effect increases the energy in the circuit to a level that is the square of the factor applied to the voltage or current because energy is proportional to the square of voltage and current. The international standard and the ANSI standard specify a safety factor that is equivalent to 2.25 applied to available energy for the no-fault and one-fault analyses, and there still can be no ignition. By contrast, the ACRI2001 document specifies a safety factor that is equivalent to 1.5 applied to available energy for the same fault conditions and is therefore clearly less conservative for the no-fault and one-fault analyses. For the two-fault analysis, both documents apply a unity safety factor.

The difference between a safety factor of 2.25 and 1.5 as applied to energy is substantial. The U.S. standards prior to adopting the IEC 60079-11 criteria used the same safety factor as the current ACRI2001 document, but U.S. experts were unable to convince the IEC intrinsic safety committee that this was a reasonable consideration and hence established the more conservative safety factors in the latest version of IEC 60079-11. The difference in energy levels is significant because it is energy that is released in a spark that causes the ignition. U.S. experts at that time, and today, believed that the intrinsic safety criteria were already very conservative without using an excessive safety factor. This is very significant, for example, when considering allowable capacitance, which is a form of electrical energy storage, in an electrical circuit. If the maximum voltage is 10 V, applying the IEC 60079-11 safety factor of 1.5 times voltage, or 2.25 times energy, for no-fault or one-fault conditions to 10 V brings the required voltage to 15 V. and the allowable free capacitance is greater than 80 µF but less than 110 µF. Applying the ACRI2001 factor of square root of 1.5 times the voltage, or 1.5 times the energy, the voltage becomes 12.25 V and the allowable capacitance is greater than 1,000 µF but less than 2,000 µF. The difference between an allowable capacitance using the IEC-based safety factor of approximately 100 µF versus the ACRI-based safety factor of approximately 1,500 µF is very significant in establishing if ignition is possible. Therefore, in this example the IEC 60079-11 standard is much more conservative than the ACRI2001 document. The large difference is due to the fact that the ignition curves are nonlinear. The 10 V figure is a real possibility as that value is similar to those used in battery-operated personal communication devices such as personal digital assistants or handheld communication radios, under ANSI/ISA-60079-11, Annex A (ANSI, 2013b).

If one were to look at short-circuit current limits in resistive circuits or inductance limits — inductance being another form of energy storage — relative to available current, the results are similar. This, more than any other factor, strongly suggests that the two documents can be considered equivalent in evaluating the relative safety provided by one against the other, with the ANSI/ISA-60079-11 being considerably more conservative on this key provision.

In summary, based on the results of the micro-comparative analysis and consideration of the differences, it is our opinion that the two documents provide an equivalent level of protection for a miner when used as the basis for approval of portable equipment.

To accept the implementation of an international standard, changes to those standards must also be accepted without further review by the regulatory agency once the changes are reviewed and approved by the standards body. Therefore, a determination must be made by MSHA that the standards update process for international standards will maintain a high level of integrity for the standards that they choose to adopt as alternatives to their existing standards.

In the United States, ANSI is responsible for managing the process of adopting international standards as American national standards and changes to these standards. ANSI facilitates the development of these standards by accrediting the procedures of standards developing organizations.

The process for developing standards is described in the ANSI document, “Essential requirements: Due process requirements for American national standards” (ANSI, 2015), where due process consists of nine elements that apply to any activity related to the development of consensus for approval, revision, reaffirmation and withdrawal of American national standards. In this case, due process means that anyone having a direct and material interest in the subject has the right to present an issue and its justification, have that issue considered, and have the right to appeal. It is based on equity and fair play.

Some of the more important elements of due process include openness for participation, balance of interests including actively seeking participants to achieve balance, providing public notice to announce the opportunity for participation, conducting appropriate votes and providing evidence that a consensus was achieved, and being receptive to appeals and dealing with them in an appropriate manner. In relation to standards evaluation, exercising such due process in the development and maintenance of a document provides a large measure of assurance that the document is technically sound and that the opportunity to participate is afforded to those who are materially affected by the contents.

Another important aspect of standards development is ongoing maintenance to ensure their integrity and to keep them current by reflecting changes in technology as well as ongoing research results that justify altering any of the criteria in such standards. For example, all consensus standards recognized by ANSI must be reviewed at least every five years to ensure the document is current and the criteria within are valid.

The MSHA process for generating documents such as ACRI2001 is internal to MSHA and does not include inviting participation from others outside of MSHA who may be materially affected, although MSHA draws heavily on ANSI/ISA documents in its update process. Internal procedures direct appropriate levels of management to initiate the development of such documents as well as for ongoing maintenance of existing documents. The nature and frequency of the review process for existing documents is at the determination of appropriate management levels but is not supposed to exceed five years between such reviews (MSHA, 2014). Approval of the results of any such work is also relegated to internal management.

This MSHA process has resulted in a high level of integrity of the approved intrinsically safe equipment, as evidenced by the impeccable safety record of MSHA-approved equipment. However, this discussion provides a measure of assurance that if MSHA were to accept the ANSI/ISA standard criteria that the process is thorough and aimed at keeping the contents current with existing technology.

The open, inclusive, consensus process with regular formal updates required for ANSI recognition ensures that the standard represents the best science available. By adopting the ANSI/ISA document, miners should benefit by having the best safety technology at the earliest available date.

NIOSH has commissioned the preparation of a report on “Quality assurance of nationally recognized test laboratories using ANSI/ISA standards for certification of intrinsically safe equipment” (Calder, 2014a), which gives details of the ANSI and OSHA processes. As revealed in this report, the oversight performed on both the standards writing organizations — such as the International Society for Automation (ISA) or Underwriter’s Laboratories (UL) — and nationally recognized testing laboratories (NRTLs) that associate with ANSI and OSHA, respectively, is significant. For a standard to become recognized by ANSI, the writing organization is required to function against a rigorous set of procedures as set forth by ANSI. In addition, those testing laboratories recognized by OSHA as NRTLs, which use these same ANSI-recognized standards to evaluate products, are governed by an equally rigorous set of procedures administered by OSHA. Both the ANSI and OSHA systems require audits of these organizations, focusing in particular on the performance against the procedures.

If MSHA were to accept the IEC-based standard for evaluating intrinsically safe equipment, there are benefits that would accrue. For example, if a product had to be approved to both the IEC version and to the current MSHA criteria, it is likely the product designed to meet the MSHA criteria would be physically different from that designed to meet the ANSI/ISA IEC standard. The manufacturing process would have to accommodate both designs, with one of them likely to be low volume (the MSHA version), resulting in higher manufacturing costs and a more expensive product. These costs would be avoided if a common standard were used.

Another significant benefit is the oversight of both the manufacturers and their permissible products conducted by the NRTLs. NRTLs perform quarterly audits at the manufacturers’ facilities to ensure the product being produced is exactly the same product that was found permissible. These audits review current production and the procedures used by the manufacturers to maintain control of the products. This, of course, would be in addition to the oversight performed by MSHA. MSHA quality control auditing is focused not on the manufacturers but on the mining industry end-users. MSHA inspectors regularly inspect MSHA-approved equipment in service at operating mines and while it is being repaired at rebuild shops to assure it is maintained in permissible condition. Also, MSHA engineers conduct random audits of new and repaired equipment at mine warehouses.

All of the above makes a powerful statement in the quest to ensure the safe operation of electrical equipment in the workplace, whether in mines or aboveground operations. If MSHA were to accept an IEC-based standard for evaluating intrinsically safe equipment, miners would benefit from an enhanced quality control program.

Historically, the several attempts to detail the root of the differences between the ACRI2001 acceptance criteria and the ANSI/ISA document have only emphasized the difficulties encountered in such an exercise. There are several reasons for this, but the primary one is the subjective judgments used where a sound technical basis could not be established for many of the detailed requirements. Many of the requirements in the IEC intrinsic safety standard are technically supported, such as the energy required for ignition, but the major contributor to the differences are the issues where subjective judgement was used. Examples of this are numerous: Should the safety factor applied to circuit analysis be 1.5 times the voltage and/or current, or should it be 1.5 times the energy? Or should the current in a circuit having a protective fuse rate the maximum current that can flow at 1.7 times the fuse rating, or the current required to blow the fuse within two minutes? These safety factors are similar, but fundamentally different, and either can be correct. The basis for most of the subjective criteria is lost in antiquity. Some of the issues can be traced, but for the most part the trail is not easily uncovered as many of the participants have died or have long since been retired and have no idea what became of the supporting documentation. Most of the information was in private files or even in public files that have either been stored in some obscure location or discarded, as there were no rules about retaining such information.

What did happen is that a large number of recognized experts of the world assembled under an IEC committee addressing intrinsic safety, and these experts agreed to a set of criteria that may not have been perfect but resulted in a conservative protection technique that has withstood the test of time. Many of these experts had to abandon requirements developed in their own countries in order to come to a consensus. It is difficult to comprehend that such a collection of experts could be wrong.

In considering the MSHA ACRI2001 document, it is clear that several of the subjective criteria were accepted, such as the spacing criteria applied between intrinsically safe and nonintrinsically safe circuits within an enclosure, or the thickness specifications for insulating materials, or the construction criteria for isolating components such as transformers.

One specific difference that was pursued is the temperature limit relaxation for small components. NIOSH commissioned an in-depth study of this issue that resulted in a report, “Evaluation of the technical basis for specific provisions of the ANSI/ISA intrinsic safety standards, Report 1, Small component temperature ratings” (Calder, 2014b). The research uncovered specific test data of tests performed both in England and Germany, with accompanying analysis that clearly demonstrated that a large variety of small components including fine wire can be heated to temperatures considerably higher than the autoignition temperatures of all the gases that were tested. From this example, it is clear that the ACRI2001 requirements are extremely conservative when considering small electronic components.

A second issue given considerable study was the factor applied to fuse ratings for test purposes for components and circuitry beyond the protective fuse. NIOSH also commissioned a study of this issue, resulting in a report, “Evaluation of the technical basis for specific provisions of the ANSI/ISA intrinsic safety standards — Report 2, Fuse factor ratings and other issues” (Calder, 2014c). In this case, the ANSI/ISA standard specifies a factor of 1.7 times the fuse rating to establish the downstream current to be used in testing, while the ACRI2001 document uses the current required to open the fuse in two minutes or less. This current is always at a higher level than when applying the 1.7 factor. The research into this was more obscure, but those involved in the process were able to provide the history. It was developed in England more than 50 years ago when several test programs were initiated to try to determine a reasonable factor to apply to fuses. The results were so highly variable that no technically sound conclusion could be drawn. The fuse experts at that time came to a subjective judgment that a 1.7 factor would be a reasonable compromise and would represent a conservative approach based on the data they had. This number was proposed in the standards at the time and accepted by the European standards committee and ultimately adopted in the IEC standard. Years of experience have demonstrated that the 1.7 factor is reasonable for the intended purpose of assessing thermal effects beyond the fuse. Literature addressing thermal ignition has always maintained that thermal ignition is a very inefficient process due to the ideal conditions used to establish material auto-ignition temperatures versus the conditions encountered in the normal environment. Because of the large difference in conditions, the practices in use are quite conservative when considering potential thermal effects.

To resolve the fuse current issue on a technical basis would require a carefully contrived test. As stated above, our predecessors who tried to devise such tests 50 years ago were unsuccessful, and it would seem that the prospects for success today would be no more likely than the earlier attempts. At best, it would require testing literally thousands of units and a variety of types to get some kind of data to be able to compare the 1.7 factor to the two-minute criteria. Fuse manufacturers today cannot accurately predict fuse responses except generally, which is why they provide time-current blowing characteristics in plots that represent a best statistical fit in the tests that they perform. Fuse technology is not precise in that the rupture current has a range based on several factors such as temperature, the characteristics of the element, and the nature of the current increase such as a slow rise as opposed to a spike.

These examples demonstrate that the issue-by-issue comparison of the two documents is not likely to produce useful results. Yes, there are differences, but within the intrinsic safety concept, they are essentially irrelevant in affecting the potential for ignition to occur. Equipment that has been certified as meeting the IEC intrinsic safety criteria have logged millions of safe hours of operation in atmospheres far more dangerous than those posed in mines (Groups A, B and C gases. as opposed to methane, a Group D gas). Further, in the context of a total mine structure, the danger presented by intrinsically safe equipment that would be used in mines pales in comparison to that presented by all of the other equipment permitted in mines.

Another contributing factor in the ineffectiveness of the issue-by-issue comparison is the fact that the IEC criteria are based principally on European-developed standards, because the initial draft was based on existing European practice at the time. There were actually few technical differences with North American practice with the exception of the safety factor issue: 1.5 on energy as opposed to 1.5 on voltage or current. The differences that did exist were principally based on practices steeped in local history. In North America, much of the routine test criteria such as dielectric strength tests or impact tests were taken from practices of UL or FM Global. These pretty much agreed with European practice as well.

As demonstrated in this report, from the overall perspective of miner safety the differences between the ACRI2001 criteria and the ANSI/ISA-60079-11 standard are rather in-significant. It would not be prudent to disregard the work, such as opinions, knowledge and experience, of the individual intrinsic safety experts representing several countries, including the United States, which resulted in the ANSI/ISA standard. These experts have thoroughly vetted and upheld the standard in repeated reviews.

All of the evidence to date would strongly suggest that there is an equivalent level of safety for miners when either the ACRI2001 acceptance criteria or the ANSI/ISA document is used. The instances where the IEC-based standard is less conservative are more than offset by the lower safety factors applied in ACRI2001.

The additional benefits to be derived from NRTL-based oversight and quality control, as well as the potential for increasing the equipment available for use in the mines and reducing approval times, suggest that the overall level of protection afforded by the miner will not be reduced, and may be improved, by accepting the ANSI/ISA-60079-11 standard for portable equipment, as an alternative to ACRI2001.

Because the scope of the micro-comparative study was restricted to stand-alone equipment, and it was used as the basis for our evaluation, the findings are restricted to portable equipment. However, the macro arguments presented here apply to all intrinsic-safety equipment, and it is likely that with additional research our findings can be extended to other intrinsic-safety equipment.