The standard that tells you how good your safety device has to be

ATEX tells you what protection level equipment needs in a given zone. IEC 60079 tells you which ignition-protection method (Ex d, Ex ia, etc.) delivers it. Neither tells you how reliable a device must be when that device is itself the protection — when a temperature switch, a flow guard or a speed monitor is the thing standing between normal operation and an ignition source.

That gap is exactly what EN 50495 fills. Its title is literal: Safety devices required for the safe functioning of equipment with respect to ignition risks. It is the bridge between explosion protection and functional safety — the document that converts an ATEX/EPL requirement into a measurable reliability target (a classification level), and then lets you demonstrate that target as a SIL.

If you have ever seen a pump nameplate that says “permitted in Zone 1 provided the surface temperature monitoring is active”, EN 50495 is the standard behind that sentence.

The problem it solves

Two situations make a safety device the protection itself:

1. Zone reduction. You install a monitored measure (e.g. forced ventilation with a flow monitor, or inertisation with an O₂ analyser) so the dangerous atmosphere becomes less likely. If the measure is reliable enough, the resulting zone is lower than the base zone — and you may use cheaper equipment in it.
2. Control of an ignition source. The equipment itself can become an ignition source (a bearing overheating, a coupling running dry, a fan over-speeding). A monitor detects the precursor and forces a safe state before ignition is possible. For mechanical equipment this is protection type “b” of EN ISO 80079-37, levels b1/b2 — and the instrumented part of “b” is graded by EN 50495.

In both cases the question is the same: how good must the monitoring be? Too weak and you have a paper safeguard; over-specified and you waste money on redundancy you do not need.

Classification levels K1 / K2 / K3

EN 50495 answers with three reliability grades, each tied to a hardware fault tolerance:

Level	Hardware Fault Tolerance	Typical architecture	Meaning
K1	HFT 0	1oo1 (single channel)	A single dangerous fault may defeat it. Acceptable where the ignition source is only present after a rare fault, or via proven technology + regular testing.
K2	HFT 1	1oo2 / 2oo3	Single-fault safe: one dangerous fault must not defeat the safety function.
K3	HFT 2	1oo3	Double-fault safe: two faults in combination must not defeat it. The highest grade.

The required level rises with two inputs: the EPL/ATEX category of the equipment (how rarely it may ignite) and how often the ignition source would otherwise become effective (never / on a rare fault / on an expected fault / continuously). The German rule TRGS 725 turns this into explicit decision tables — see that page for the worked grids.

From classification to SIL

A classification level is a reliability requirement; SIL is how you prove you met it. EN 50495 (and TRGS 725, Table 10) give a one-to-one map:

Classification	Demonstrate as	Implementation
K1	SIL 1 (or SIL_CL 1)	Safety-related MSR device — a single instrumented safety function (SIF) per IEC 61511.
K2	SIL 2 (or SIL_CL 2)	Single SIF loop, single-fault safe, per IEC 61511.
K3	SIL 3 (or SIL_CL 3)	Redundant MSR safety device, SIF loop per IEC 61511.

Two routes are legitimate:

• Proven technology (bewährte Technik) + documented regular testing. For K1 / simple, non-programmable devices this can be enough — you do not need a full SIL dossier. This is the pragmatic route TRGS 725 explicitly allows for many cases.
• Quantified functional safety: a SIL demonstration per IEC 61508 (generic), IEC 61511 (process), or IEC 62061 (machinery). Mandatory once the unit is complex/programmable or the required level is high.

Use the PFD ↔ SIL converter and the RRF ↔ SIL tool to check a candidate architecture against the SIL band before committing to the full calculation.

Worked example — a Zone 1 vacuum pump

A liquid-ring vacuum pump is rated for Zone 1 gas, group IIB, temperature class T3 (≤ 200 °C) only while a surface-temperature monitor is active (a common entry in real ATEX manuals).

1. EPL / category: Zone 1 → category 2G → EPL Gb. The hot surface may become an ignition source on an expected fault (loss of sealing liquid → dry running → rapid heat-up).
2. Required classification: from the ignition-source grid this lands at K1 → HFT 0 (one level of credit needed). Higher demand profiles push to K2.
3. Function: “detect body temperature ≥ 90 °C pre-alarm, ≥ 100 °C trip → de-energise the motor (safe torque off) within the process safety time.”
4. Demonstrate: a single SIF loop (Ex-rated Pt100 → safety logic → motor contactor/STO), proven to SIL 1 per IEC 61511 — or proven technology + regular proof testing if the device qualifies.
5. Timing: the loop’s response must be faster than the heat-up rate — a SIL number alone does not guarantee this; the process safety time is a separate, mandatory check.

Where engineers get it wrong

• “Ex-rated” ≠ “SIL-rated”. Ex d / Ex ia (IEC 60079) describes the ignition protection of the device itself — it says nothing about the reliability of its safety function. A SIL 2 transmitter can be the wrong Ex type; an Ex-certified sensor can be SIL-incapable. They are orthogonal axes and you need both.
• The monitor sits in the zone too. The safety device is usually installed in the hazardous area, so it must also carry suitable Ex marking for that zone — otherwise the protection is itself a potential ignition source.
• Reaction time is not in the SIL. “Die Reaktionszeit der Überwachungseinrichtung muss diese Geschwindigkeit berücksichtigen” — the loop must act before the ignition source becomes effective. Verify the full process safety time, not just PFD.
• Grade the whole chain. Sensor + logic + final element all count; the weakest element governs the achievable K/SIL. A SIL 2 sensor behind a 1oo1 relay is a K1 function.
• You cannot just declare K2/K3. Complex (programmable) units at K2/K3 require an evidenced reliability assessment by the manufacturer or operator — not a self-assigned label.
• Don’t double-count zone reduction. A measure only earns the lower resulting zone if the monitoring actually achieves the required classification and is tested on schedule. Skip the testing regime and the credit evaporates.

How EN 50495 sits among the other standards

Standard	Answers…
IEC 60079 / ATEX 2014/34/EU	Which ignition protection / category the equipment needs in a zone.
EN ISO 80079-37 (type “b”, b1/b2)	How mechanical equipment controls its ignition sources.
EN 50495	How reliable the (instrumented) safety device controlling that ignition source must be — and how to grade it (K1/K2/K3).
IEC 61508 / IEC 61511 / IEC 62061	How to design, verify and operate that device as a SIL-rated safety function.
TRGS 725	The German implementation: explicit decision tables zone → K → SIL.

The Functional Safety app on industryhub.cloud runs the IEC 61511 lifecycle that the K2/K3 → SIL route requires: risk-graph assistant, PFD engine per IEC 61508-6, proof-test scheduling and audit trail — the evidence base EN 50495 expects for a Class I protective device.