Solvent rooms and powder suites: explosive atmospheres on a pharmaceutical site, and what they ask of automation

A high-shear granulator, an ethanol-based binder, an operator panel on the wall beside the bowl. The panel dies on a night shift. The technician on call finds the same brand and screen size in the stores, swaps it in forty minutes, and the batch carries on. The GMP side is done properly: work order, functional check, recipe screens verified. Weeks later an electrician on a routine walk-round reads the rating plate and stops. The old panel was certified for the zone. The new one is the general-purpose version of the same product.

The scene is a composite, but anyone who has worked in pharmaceutical production will recognise it. Nobody was careless. The quality system asked the right questions about the product and none about the room. Explosion protection lives in other documents, owned by other people, and the automation team sits where the two meet: it chooses the panels, barriers, instruments and enclosures, and it changes them more often than anyone else.

Two directives, two readers

Directive 2014/34/EU speaks to whoever places equipment on the market. It replaced Directive 94/9/EC from 20 April 2016. Surface-industry equipment is Group II, in three categories: category 1 for places where an explosive atmosphere is present continuously, for long periods or frequently, categories 2 and 3 for lower likelihood. The manufacturer marks the product with the Ex symbol, the group, the category and G for gas or D for dust.

Directive 1999/92/EC speaks to the employer. The site classifies its places into zones (Article 7) and keeps an explosion protection document (Article 8), drawn up before work starts and revised when the workplace, the equipment or the organisation of work changes significantly. Annex II links the two texts: category 1 equipment in zone 0 or 20, category 1 or 2 in zone 1 or 21, category 1, 2 or 3 in zone 2 or 22.

The supplier answers for the equipment. The site answers for where it is installed, how it is connected and maintained, and what happens when it is replaced. A certificate on a panel PC says nothing about whether the right panel PC is on the wall.

Where it burns in a pharmaceutical plant

Most writing on hazardous areas comes from oil, gas and chemicals, and dust gets a line at the end. A pharmaceutical site has both problems, often in neighbouring rooms.

Ethanol and isopropanol are everywhere: granulation binders, coating solutions, cleaning, crystallisation in API plants. NIOSH gives their flash points as 55 °F and 53 °F, about 13 °C and 12 °C, so both give off a flammable vapour at room temperature. A dispensing booth, a solvent store or a reactor headspace can all be zoned for gas.

Dust is the side people underestimate. Milling, sieving, blending, fluid-bed drying and their extraction handle fine organic powders, and the directive has zones 20, 21 and 22 for them, adding that layers and deposits of dust count as a source in their own right. IEC 60079-10-2:2026 still assumes effective housekeeping: where cleaning slips, the zone drawing describes a better plant than the real one.

Then there is the case that belongs to pharma: a dryer taking granules still wet with solvent. Vapour and powder are present together, a hybrid mixture, and IEC 60079-0 notes that this often warrants additional protective measures. It is a process-safety question first, but it decides which instruments and drives may go on the unit.

North American texts speak in Classes and Divisions, under NFPA 70 (2026 edition) and CSA C22.1:24. A European site works in zones, and so does this article.

Reading the plate before reading the manual

Every Ex device carries two sets of marking, one from the directive and one from the IEC 60079 series. Reading them takes ten minutes to learn and would have stopped the night-shift swap.

The equipment protection level is the field most worth teaching. Ga, Gb and Gc match zones 0, 1 and 2; Da, Db and Dc match zones 20, 21 and 22. A higher level may always go in a lower zone.

Three ways to stop an ignition

Keep the atmosphere out. For automation, this mostly means pressurisation (IEC 60079-2): a cabinet is purged with clean air or inert gas before power is allowed, then held above room pressure. The site inherits a small control system: purge controller, timer, pressure switch, the bypass key someone will ask for during a shutdown, and the reaction to a pressure loss (alarm, trip or both, as the type and certificate require). That controller is explosion protection.

Contain the explosion. The flameproof enclosure, type d, lets an internal ignition happen and stops it getting out. Its safety sits in machined flame paths, cable entries and every bolt being present and tight. It is robust, which is why motors and junction boxes use it, and it is the type a quick maintenance job defeats most easily: one missing bolt, one gland from the wrong drawer.

Limit the energy. Intrinsic safety, type i, keeps the energy in the circuit below what can ignite the atmosphere. It suits instrumentation: transmitters, switches, solenoid valves, fieldbus. It comes in three levels, and the difference is often lost. Under IEC 60079-11, ia must not ignite with two countable faults applied, ib with one, and ic only has to be safe in normal operation. "Intrinsically safe" does not mean zone 0 by default. Nor is it the only way into zone 0: IEC 60079-26 covers equipment reaching EPL Ga through separation elements or combined levels of protection.

The barrier choice is an automation decision with a long tail. A Zener barrier is passive and cheap, but it needs a dedicated intrinsic safety earth, kept and tested for the life of the plant. An isolated barrier provides galvanic isolation and needs no such earth, at the cost of its own power supply. On a site whose earth system nobody has measured for years, that settles it.

Intrinsic safety also brings paperwork that belongs to the instrumentation team. A loop is safe only as a system: the barrier’s output parameters must cover the field device’s input parameters plus the cable. IEC 60079-14 asks for a descriptive system document for each intrinsically safe system. On many sites it was written once, by the installer, and has followed no instrument change since. Replace a transmitter with a newer model, or reroute a cable, and the calculation has changed whether anyone redid it or not.

Fieldbus moved the problem rather than removing it: PROFIBUS PA has an intrinsically safe version that is the usual choice in hazardous areas (see Siemens networks from PPI to PROFINET), and IEC 60079-0:2026 now lists two-wire intrinsically safe Ethernet (IEC TS 60079-47) among its supplements.

The panel PC on the wall

Granulators, coaters, dryers and solvent dispensing all want a screen beside the equipment. There are three classic answers, each with a lifetime cost the project rarely puts on the table.

Portable devices need their own line in the explosion protection document: the tablet carried in for the electronic batch record, the laptop opened at a junction box. Each is electrical equipment in a zone.

When an Ex standard mentions cyber

The eighth edition of IEC 60079-0, published in June 2026, lists among its significant changes a note "to caution about cyber security risk" and a clarification on user-controlled limit settings. Part of explosion protection now sits in settings: the trip point of a purge controller, the limits of a configurable isolator, the alarm levels of a gas detector. A setting that can be changed from the network is a protection that can be changed from the network. The answer is the one given for safety systems in Safety or security?: know which parameters protect, restrict who can change them, log every change.

Inspection, repair and the people who do them

Ex equipment does not stay compliant by itself. IEC 60079-14:2024 now carries the initial inspection in its title, as part of the installation. IEC 60079-17:2023 sets three grades of inspection in service: visual (a missing bolt), close (a loose bolt, found with tools or steps) and detailed (a loose termination, found with the enclosure open). IEC 60079-19, revised in 2025, covers repair and overhaul. The directive adds that a workplace with zoned areas must have its overall explosion safety verified by competent persons before first use.

Competence is what a pharmaceutical site most often assumes rather than proves. The electricians know the zoned areas; the automation engineers and contractors who change panels and instruments often do not. The IECEx scheme offers a personal Certificate of Personnel Competence, unit by unit, from basic awareness (Ex 000) to design (Ex 009) and audit inspection (Ex 010), reassessed every five years. Someone on the automation team needs the units that match what the team touches.

The permit to work is the oldest lesson. On Piper Alpha in 1988, 167 men died; in the Commons debate on the Cullen report, the failure of the permit to work system was described as having led directly to the accident, with shift handovers a major factor. Directive 1999/92/EC asks for permits in hazardous places wherever the explosion protection document requires them. Opening an Ex enclosure to swap a card, plugging a laptop in at a field box or bypassing a purge to find a fault are exactly those jobs.

Five common mistakes

1. The identical spare. Same brand, same size, different certificate. An equivalent part is not like-for-like until someone has compared what matters, as argued for qualified equipment in When does a repair become a requalification?; the Ex marking belongs on that list.
2. Dust forgotten. Gas zones drawn with care, powder rooms left out because "it is only lactose". Organic powders burn, and layers count.
3. "IS" read as "anywhere". An ib device where the drawing says zone 0, or a barrier swapped for one with different output parameters and the loop never recalculated.
4. The permanent purge bypass. Set for commissioning, never removed, never on a permit.
5. Two document sets that never meet. Safety owns the explosion protection document; engineering and quality own the equipment lists and change records. Neither hears when the other changes.

Where to start

• Put the Ex question in change control. One mandatory field on every change and work order in a zoned area: same or higher Ex marking, checked against plate and certificate.
• Walk the zones with the drawing. Compare plates with zones, EPL by EPL, starting with the rooms that changed most since the last revision of the explosion protection document.
• Rebuild the IS loop files. Barrier, field device, cable and calculation as installed today, starting with loops whose instruments were replaced.
• List the protective settings. Which parameters protect against ignition, who can change them, from where, and whether the change is logged.
• Match competence to the work. Decide which Ex competences the automation team and its contractors need, and make the permit system check them.

On a pharmaceutical site, the explosion risk is rarely in the process design. It comes in later, through a door, in the hands of someone fixing something quickly.

References

• Directive 1999/92/EC on the protection of workers potentially at risk from explosive atmospheres (EUR-Lex)
• Directive 2014/34/EU on equipment and protective systems intended for use in potentially explosive atmospheres (EUR-Lex)
• IEC 60079-0:2026, Explosive atmospheres, Part 0: Equipment, General requirements (IEC Webstore)
• IEC 60079-14:2024, Explosive atmospheres, Part 14: Electrical installation design, selection and installation of equipment, including initial inspection (IEC Webstore)
• IEC 60079-17:2023, Explosive atmospheres, Part 17: Electrical installations inspection and maintenance (IEC Webstore)
• IECEx Certification of Personnel Competencies scheme, overview
• NSW TestSafe, Intrinsic safety Ex i: levels of protection ia, ib, ic
• Jack Smith, Protecting Hazardous Locations from Explosion, InTech FOCUS Control Systems, September 2022, and Automation.com, 5 December 2022