Hazardous zone requirements for robots and actuators

·by Val

A robot that inspects a refinery or a gas terminal has to answer two questions before anyone asks what it can see. Can it ignite the atmosphere it walks through? And can dust and water get inside it? The first is answered by explosion protection ("Ex") certification, the second by an IP rating. They are separate systems with separate tests, and a robot needs both.

This article is an overview of both, written for people who buy, specify or build robots for classified areas. It is a map of the territory and no substitute for the standards or for a certification body.

How a plant is divided into zones

The site operator classifies the plant, area by area, according to how often an explosive atmosphere is present. The international method is in IEC 60079-10-1 for gas and IEC 60079-10-2 for dust. In the EU the duty comes from Directive 1999/92/EC.

For gases, vapours and mists:

• Zone 0: present continuously or for long periods, for example inside a tank
• Zone 1: likely to occur in normal operation, for example near a vent, a sampling point or a pump seal
• Zone 2: not likely in normal operation, and brief if it does occur

Combustible dust uses the same scale as Zone 20, 21 and 22.

North America has traditionally used Classes and Divisions from the National Electrical Code. Class I Division 1 roughly covers Zones 0 and 1 together, and Division 2 roughly matches Zone 2. The NEC also allows the zone system, so equipment may carry either kind of marking or both.

Most inspection routes pass through Zone 2 with pockets of Zone 1. A robot rated only for Zone 2 has to route around those pockets, which are often the places most worth inspecting. That is why Zone 1 is the practical baseline for an inspection robot.

What the equipment has to prove

The zone tells you how reliable the protection must be. Three more things appear on every Ex nameplate.

Equipment protection level. Each zone needs a matching equipment protection level (EPL). The EU ATEX directive expresses the same thing as a category. Equipment for a more demanding zone may be used in a less demanding one.

Gas group. Gases are grouped by how easily they ignite and how well a flame passes through a narrow gap. Group IIA is typified by propane, IIB by ethylene, and IIC by hydrogen and acetylene. IIC equipment may be used with IIA and IIB gases but not the other way round, so a IIB robot is not suitable for a hydrogen plant. Equipment can also be certified for one named gas on top of its group, marked for example IIB + H2.

Temperature class. No surface that the atmosphere can reach may get hot enough to ignite it. The class only holds over the ambient temperature range the equipment was certified for. The 2026 edition of IEC 60079-0 requires that range to be marked, for example −20 °C ≤ Ta ≤ +50 °C. On older certificates an unmarked range meant −20 °C to +40 °C, which a sunlit deck in a hot climate can exceed.

Reading a real marking

ANYbotics publishes this marking for ANYmal X, the first legged robot certified for Zone 1:

Ex db eb ib op is pxb sb IIB T4 Gb

The first six codes are protection concepts, covered in the next section. Then come gas group IIB, temperature class T4 and protection level Gb. So the robot may work in Zone 1 and Zone 2 around gases up to group IIB with ignition temperatures above 135 °C, and not around hydrogen. The marking also shows that one robot needed six different protection concepts. That is normal for a machine with motors, batteries, computers, radios and lasers in it.

Protection concepts

Each concept is a different way of making sure a spark or a hot surface never meets the gas. Each has its own part of the IEC 60079 series. These are the ones that reach Zone 1:

Dust zones add protection by enclosure, Ex t (IEC 60079-31), which depends on a dust-tight housing and a limit on surface temperature.

IEC 60079-0 sets the general requirements that apply whatever the concept. Some that shape a robot:

• Impact. Enclosures take a 1 kg mass dropped from 0.7 m. A 0.4 m test is allowed for equipment at low risk of mechanical damage, but then the certificate carries a condition of use.
• Light metals. For Zone 1, enclosure material may hold at most 7.5 % magnesium, titanium and zirconium in total, because these can spark on impact. Aluminium is not limited at this level, so aluminium housings are allowed. Zone 0 limits aluminium too.
• Static. External plastics, paint and coatings have to be shown not to build up an igniting charge.
• Radio. Transmitter power is capped by gas group: 6 W for IIA, 3.5 W for IIB and 2 W for IIC.
• Test order. Enclosure tests run in sequence: impact, then ingress, then the tests of the protection concept. Plastic parts, and elastomer seals that a required IP rating depends on, go through heat and cold endurance first, so they are judged after ageing.

Ingress protection: what IP67 and IP68 mean

The IP code comes from IEC 60529. The first digit rates protection against solids and the second against water.

Five points get lost in datasheets:

1. IP68 has no fixed depth or time. The manufacturer declares them. "IP68" alone tells you little. "IP68, 5 m, 24 h" tells you something.
2. Immersion does not cover water jets. The standard treats an enclosure rated only 7 or 8 as unsuitable for jets. Equipment that must survive both carries two ratings, such as IP66/IP68.
3. The test uses fresh water on a clean, new sample. Salt water, solvents and worn seals are outside it. Whether the sample is powered or moving during the test is left to the product standard or the manufacturer, and for an actuator that is the question that matters, since a shaft seal behaves differently when it turns.
4. Passing does not mean dry. The requirement is that no water enters in a quantity that causes harm: it must not reach live parts or windings, or interfere with operation.
5. The standard defines the tests but not who runs them. Many ratings are the manufacturer's own declaration. Ask who ran the test and ask for the report.

Where a protection concept requires an IP rating, the Ex certificate makes it a stronger claim than an ordinary one, because the ingress test comes after the ageing and impact tests above. A higher rating than the concept requires, such as IP68 on a flameproof housing, is an extra. The certificate says whether it was tested after that sequence or separately to IEC 60529 alone, so read the wording. Within Ex certification, rotating electric machines are tested to the motor standard IEC 60034-5, not IEC 60529.

What this asks of an actuator

An actuator packs a motor, gearbox, bearings, brake, encoder and often drive electronics into one housing with a moving shaft coming out of it. Each part raises its own question.

• Windings and brake can arc and run hot. They are usually placed in a flameproof housing, built to increased safety rules, or encapsulated. IEC 60079-0 has supplementary rules for electric machines and applies them to servo motors "where they are appropriate", which leaves room for discussion with the certifier.
• The drive is part of the assessment. A motor fed from a converter is marked for converter duty with its speed range, minimum switching frequency and torque limits.
• Encoder and drive electronics can be intrinsically safe where power is low enough, and otherwise sit inside the protected enclosure.
• Surface temperature sets a limit on continuous torque. An actuator that can deliver more torque than its temperature class allows has to be derated or cooled, so certified torque is lower than the torque on a standard datasheet.
• Bearings can ignite gas when they fail, and stray currents through the shaft and bearings are an ignition source in their own right. The standard admits that no test can show a bearing is low risk, so this rests on rated life, lubrication and design.
• The gearbox is non-electrical equipment with its own standards, ISO 80079-36 and ISO 80079-37.
• The output shaft is where sealing is hardest. A rotating seal wears, and the IP rating has to hold after wear and thermal cycling.
• Cable entries, connectors and coolant lines each have their own requirements and have to match the IP rating of the housing.

What a flameproof housing involves

IEC 60079-1 turns the flameproof idea into dimensions and tests.

• Joints. Every joint has a minimum length and a maximum gap that depend on the gas group and the free volume inside. For a housing of 100 to 500 cm³ with a cylindrical joint 12.5 mm long, the gap may be at most 0.20 mm on the diameter for IIB and 0.15 mm for IIC.
• Shafts. A shaft passes through a cylindrical or labyrinth joint. It needs a radial clearance of at least 0.05 mm, and it must not be subject to wear in normal service, so the shaft may not rub. Around a shaft on rolling bearings the same 12.5 mm joint may have a gap of 0.30 mm for IIB and 0.25 mm for IIC.
• Strength. The explosion pressure is measured, then the housing is tested above it. The maker either tests every unit at 1.5 times that pressure, or proves the design at 4 times and skips the routine test.
• Surfaces. Joint surfaces may not be painted or powder coated. A non-hardening grease is allowed for corrosion protection.

Where sealing and explosion protection pull apart

A flameproof joint is a controlled gap. A waterproof joint has no gap. The flameproof standard does not ask for any IP rating, and it allows a gasket or O-ring for sealing only if the seal neither counts toward the length of the flame path nor interrupts it. So a housing that needs both has a metal-to-metal flame path with the seal placed beside it. On a rotating shaft, the flame path, the bearing and the shaft seal all have to fit in the same few millimetres.

A sealed housing also breathes as it heats and cools, which pulls water past seals. Flameproof housings may be fitted with breathing devices that arrest flame, but a breather on an immersed actuator also has to keep water out at depth.

Pressurization fits poorly with immersion too, since water pressure at depth can exceed the protective pressure inside. And a sealed housing sheds heat less readily, which makes the temperature class harder to meet. These choices shape the mechanical design from the first sketch, which is why protection concepts are chosen before detailed design starts.

What this asks of a whole robot

A robot adds hazards that a fixed motor or junction box does not have.

• Batteries are an ignition source on their own. Only listed cell chemistries may be used, and all cells in a battery must be the same type from the same maker. Inside a flameproof enclosure, vented cells are banned and only sealed cells may be recharged, behind safety devices that survive a single fault. The standard notes that some lithium-ion cells can act as strong ignition sources, and its flameproof battery rules do not cover thermal runaway.
• Charging means making and breaking a power connection. Either the dock sits in a safe area, or the dock and the connection are certified too.
• Radios and lidar emit energy. Radio power is capped by gas group as above, and focused laser light has its own standard.
• Static electricity builds up on feet, tracks, wheels and plastic covers as the robot moves.
• Impacts and falls happen to mobile machines. Beyond the impact test above, portable equipment is dropped four times from 1 m onto concrete. Ask what a robot's certificate assumes about falls.
• Maintenance and software are part of the certificate. Opening an enclosure, swapping a part or changing safety-related software outside the documented procedure can invalidate it. IEC 60079-17 and IEC 60079-19 cover inspection and repair.

Who certifies

EU: ATEX. Directive 2014/34/EU makes third-party assessment mandatory for Zone 1 electrical equipment. A notified body carries out an EU-type examination of the design, and the manufacturer's production is assessed as well. The product then carries the CE mark, the Ex hexagon and a marking such as II 2 G.

International: IECEx. A voluntary scheme that many operators outside the EU require. An IECEx certification body issues a certificate of conformity based on a test report and an audit of the manufacturer's quality system. Certificates are public and can be checked online. The tests largely overlap with ATEX, so manufacturers usually pursue both together.

United States. OSHA 29 CFR 1910.307 and the National Electrical Code require equipment approved for the classified location, usually listed by a nationally recognized testing laboratory, and the local authority having jurisdiction has the final say. UL 6260, an outline of investigation for remotely operated inspection and maintenance robots and drones in hazardous locations, saw its first certification in June 2026.

Components and complete equipment

An actuator can be certified as an Ex component. Its certificate number ends in the letter U and states that it is not an equipment certificate: the part is incomplete and needs further evaluation when it is built into equipment. A component gets no temperature class and no ambient range. Its certificate carries a schedule of limitations, including the temperature range it may see in service, and the equipment maker has to stay inside it.

Certified components shorten the assessment of the finished machine but do not replace it. A robot built from certified actuators is not a certified robot until the robot itself has a certificate.

An equipment certificate number ending in X means specific conditions of use apply, such as protection from impact or restricted mounting positions. Read them before buying.

Questions to ask a supplier

1. What is the complete Ex marking, and which certificate covers it? Is it for the whole robot or for components?
2. Which gas group and temperature class, over what ambient range?
3. Does the certificate number end in X or U, and what are the conditions or limitations?
4. For IP68: what depth, what duration, what water? Was it tested by a third party, on a new unit or an aged one, and with the joints moving?
5. Is there a rating for water jets as well as immersion?
6. What torque and duty cycle are available within the temperature class?
7. Who may repair it, and what happens to the certificate after a repair or a software update?

Where Ferradyne stands

We are building robots for industrial inspection in Zone 1, and we make our own actuators because sealed, explosion-protected actuators are hard to buy. The requirements above are design inputs for us from the start, since a protection concept cannot be added to a finished actuator afterwards. We will publish our markings, certificates and IP test conditions as we obtain them.

Sources and further reading

The general requirements, the flameproof details and the IP material here are drawn from IEC 60079-0:2026, IEC 60079-1:2026 and IEC 60529 edition 2.2. The other protection concepts and the certification schemes are described in general terms. Limits change between editions, so work from the current text and a certification body for any design or purchasing decision.

• IEC 60079 series, Explosive atmospheres, and IEC 60529, Degrees of protection provided by enclosures (IP Code), from the IEC webstore
• Directive 2014/34/EU (ATEX equipment) and Directive 1999/92/EC (ATEX workplace)
• IECEx, the international certification scheme and its public certificate database
• UL 6260 certification for inspection and maintenance robots and drones
• ANYmal X technical specifications, the source of the example marking