4-20mA Safety Systems: NAMUR NE 43 and SIL Ratings

A process value can look perfectly believable after the instrument producing it has failed. That is the problem a safety loop has to solve. A 4-20mA loop gives the safety logic solver a continuous measurement, a broken-wire indication at 0mA, and—when the transmitter and receiver are configured for NAMUR NE 43—explicit fault bands outside the measuring range.

That does not make an analog loop safe by itself. The loop is one element in a Safety Instrumented Function (SIF), alongside the final element and a dedicated logic solver. Still, its live zero and fault-current conventions give a SIF a simple, testable way to reject a value when the transmitter says it cannot be trusted.

TL;DR: In a Safety Instrumented System, 4-20mA carries the process variable from 4.0mA to 20.0mA, while NAMUR NE 43 reserves currents at or below 3.6mA and at or above 21.0mA for device faults. That separation lets a safety logic solver reject an untrustworthy reading and move the process toward its predefined safe state (NotebookLM, Analog Signal Standards notebook, 2026).

This article pairs with the detailed NAMUR NE 43 fault-current guide, which maps the current bands, and with signal isolators and galvanic isolation, which explains how an electrical barrier protects the diagnostic signal from ground-current corruption.

Why Does a Safety Instrumented System Use a 4-20mA Loop?

A Safety Instrumented System uses a 4-20mA loop as its primary safety variable because the loop continuously carries the measurement while its wiring and current bands support online fault reporting. The Basic Process Control System optimizes operation; the SIS runs in parallel to identify deviations and take the process to a safe state (NotebookLM, Analog Signal Standards notebook, 2026).

A smart transmitter converts a physical parameter into proportional current and sends it to a safety PLC. Under normal conditions, 4.0mA represents 0% of the calibrated span and 20.0mA represents 100%. The solver digitizes that current, applies the SIF application logic, and uses it to decide whether the process has crossed a trip condition.

The useful distinction starts at the bottom of the scale. A reading of 4mA may mean that a tank level, pressure, or temperature is at the engineering zero. A complete 0mA drop is not another valid process value. It indicates an open circuit or loss of loop power. The live-zero arrangement therefore makes a simple wiring failure visible rather than allowing it to masquerade as a genuine zero-percent reading.

Citation capsule: A 4-20mA loop is the primary safety variable in an SIS because it continuously transmits the process measurement while its physical wiring and signal bands support online fault reporting; 4.0mA represents 0% of the calibrated span, whereas 0mA signals an open circuit or lost loop power (NotebookLM, Analog Signal Standards notebook, 2026).

How Does NAMUR NE 43 Separate a Process Excursion From a Device Fault?

NAMUR NE 43 separates a valid but out-of-range process value from a transmitter fault by reserving 3.8-4.0mA and 20.0-20.5mA for saturation, 3.6-3.8mA and 20.5-21.0mA as guard bands, and currents at or below 3.6mA or at or above 21.0mA for device alarms (NotebookLM, Analog Signal Standards notebook, 2026).

Saturation means the device remains healthy but the process is beyond its calibrated span. A pressure transmitter might hold 20.5mA when a real process excursion pushes it above its upper calibrated limit. The solver can treat that as a process condition requiring action without confusing it with a failed transmitter.

Fault signaling means something different. When internal diagnostics detect a sensor, converter, or hardware malfunction, the transmitter must not continue presenting a credible process value. It actively drives its output into a low or high fault band. Manufacturers commonly use low alarms from 3.2mA to 3.5mA and high alarms from 21.5mA to 22.8mA, subject to the device configuration.

Citation capsule: NAMUR NE 43 keeps a healthy out-of-range condition distinct from a failed instrument: saturation occupies 3.8-4.0mA or 20.0-20.5mA, differentiation zones span 3.6-3.8mA and 20.5-21.0mA, and a device alarm is at or below 3.6mA or at or above 21.0mA (NotebookLM, Analog Signal Standards notebook, 2026).

What Does a SIL Rating Actually Measure?

A SIL rating measures SIF reliability and risk-reduction performance under IEC 61508 and IEC 61511. SIL 1 is lowest and SIL 4 highest; low-demand SIF PFDavg ranges run from at least 10^-2 to below 10^-1 for SIL 1 through at least 10^-4 to below 10^-3 for SIL 3 (NotebookLM, Analog Signal Standards notebook, 2026).

The standards' evaluation has three linked parts. Systematic Capability addresses the design quality of each device; its rating must meet or exceed the SIF target unless the owner documents a prior-use justification. Architectural constraints determine whether the hardware structure and fault tolerance are adequate. The PFDavg calculation then tests whether the assembled SIF meets its risk-reduction target.

Citation capsule: IEC 61508 and IEC 61511 grade SIF reliability from SIL 1 through SIL 4; the supplied low-demand PFDavg bands are ≥10^-2 to <10^-1 for SIL 1, ≥10^-3 to <10^-2 for SIL 2, and ≥10^-4 to <10^-3 for SIL 3, alongside systematic and architectural requirements (NotebookLM, Analog Signal Standards notebook, 2026).

How Does an Analog Transmitter Contribute to a SIL-Rated Loop?

A safety-critical analog transmitter contributes through quantified failure rates, automatic diagnostics, and periodic proof tests—not merely by producing 4-20mA. Internal monitoring converts some dangerous undetected failures into dangerous detected failures, and NAMUR NE 43 communicates those detected faults to the safety PLC at or below 3.6mA or at or above 21.0mA (NotebookLM, Analog Signal Standards notebook, 2026).

Microprocessor-based transmitters can monitor sensor continuity, internal reference conditions, ADC behavior, loop supply, and actual loop output. A guided-wave radar example in the research packet also evaluates reference-pulse location and strength to identify a probe that has become compromised. When the device finds a fault, its current output becomes the immediate analog warning to the safety logic solver.

Diagnostics raise Diagnostic Coverage and can improve Safe Failure Fraction because they move failures out of the dangerous-undetected category. The packet gives one example: a Type B transmitter with HFT of zero typically needs at least 90% SFF for architectural compliance in a SIL 2 SIF, while the cited Eclipse 706 example has a nominal 93% SFF and 90% Diagnostic Coverage.

Citation capsule: A SIL-rated 4-20mA transmitter supports a SIF through FMEDA failure data, automatic diagnostics, and proof tests: the supplied example has 93% Safe Failure Fraction and 90% Diagnostic Coverage, while its analog output reports detected faults using NAMUR NE 43 bands at ≤3.6mA or ≥21.0mA (NotebookLM, Analog Signal Standards notebook, 2026).

When Does 2oo3 Voting Improve a 4-20mA Safety Function?

A 2-out-of-3 safety function uses three independent transmitters and three independent 4-20mA loops, then trips when at least two channels identify the trip condition. This arrangement can increase safety availability while reducing a nuisance trip from one faulty transmitter, but only if common-cause failures are included in the SIF design and PFDavg model (NotebookLM, Analog Signal Standards notebook, 2026).

Independence is the condition people can overlook. Three transmitters connected to one non-fault-protected power source are not fully independent. A short circuit or high-current fault on a single loop can collapse the shared supply and disable every channel at once. That common-cause event removes the very protection that three physical transmitters were meant to provide.

That is why voting must be engineered as a system rather than counted as three sensors. Use independent loops, evaluate shared power and shared infrastructure, and ensure every receiver preserves the NE 43 state. For the practical electrical controls behind that last point, see how galvanic signal isolators break ground loops and this guide to troubleshooting 4-20mA loop noise.

Citation capsule: A 2oo3 SIF requires three independent transmitters and loops, with the safety logic solver tripping when at least two channels reach the trip condition. Shared, non-fault-protected loop power can defeat that architecture because one short circuit can collapse the supply to all three transmitters (NotebookLM, Analog Signal Standards notebook, 2026).

Why Must the SIS Stay Separate From the Basic Process Control System?

The SIS must remain physically, electrically, and logically separate from the BPCS because the BPCS controls daily production while the SIS is a parallel safety layer. A shared software freeze, CPU lockup, hardware failure, or electrical fault must not disable the routine controller and the function that takes the process to its safe state (NotebookLM, Analog Signal Standards notebook, 2026).

Electrical independence backs up logical independence. Standard single-ended input cards can share a common return across channels. When field devices sit at different earth references, the shared return enables ground currents to flow and alter the loop signal. Galvanic isolation breaks that copper path while passing the analog measurement through an optical or magnetic coupling.

Isolation also contains energy. The research packet states that isolators can withstand continuous isolation voltages from 250V to 1500V. A field short, water ingress, or high-voltage spike on a BPCS loop is less able to propagate into a parallel SIS channel. The aim is not simply a cleaner signal; it is avoiding a shared electrical event that removes the safety layer.

The NE 43 diagnostic bands depend on that signal arriving intact. Leakage or ground-current effects can move a genuine fault current toward the ordinary measurement band. The safety PLC may then accept a false healthy value precisely when it should reject the channel. Separation and isolation preserve the path from transmitter diagnosis to safety action.

Citation capsule: The BPCS optimizes routine operation, while the SIS independently takes the process to a safe state during a dangerous deviation. Galvanically isolated 4-20mA I/O breaks shared ground paths and can contain faults across a 250V to 1500V continuous isolation barrier, protecting NE 43 diagnostic currents from corruption (NotebookLM, Analog Signal Standards notebook, 2026).

How Does Analog NE 43 Compare With Digital Diagnostic Channels?

Analog NE 43 and digital diagnostics serve complementary roles in safety-loop evidence: the 4-20mA current loop is the fast primary channel for real-time safety action, while HART and PROFIBUS PA provide richer secondary diagnostic information to host and asset-management systems. HART polling delivers 2 to 3 updates per second in the cited material (NotebookLM, Analog Signal Standards notebook, 2026).

The analog path has a narrow job, which is a strength in a SIF. It transmits the process variable in the normal current range and switches to a defined alarm current when the transmitter declares its measurement untrustworthy. The receiver can continuously check its input against those limits and initiate the configured safe action after its dwell time.

The digital channel adds detail that a single current number cannot carry. HART status flags can identify sensor failure, a fixed or saturated loop current, and a configuration change. Asset-management tools can also retrieve measured-value trends, trigger diagnostic simulations, and compare guided-wave-radar echo curves with a commissioning baseline.

For a fully digital safety-bus decision, assess the specific device, logic solver, network architecture, and SIF evidence rather than assuming that more diagnostic fields create a higher safety integrity level. The packet supports a narrower conclusion: richer digital information can supplement the analog safety variable, but it does not replace the need to verify the chosen safety path.

Citation capsule: The supplied evidence identifies 4-20mA as the fast primary channel for real-time safety functions and HART or PROFIBUS PA as secondary channels for richer diagnostics. HART provides status information during polling at 2 to 3 updates per second, including sensor-failure, fixed-current, and configuration-change flags (NotebookLM, Analog Signal Standards notebook, 2026).

Conclusion

4-20mA remains useful in Safety Instrumented Systems because it gives a SIF a process measurement and a compact fault-reporting path on the same pair of wires. The crucial distinction is not simply 4mA versus 20mA. It is the full, configured state map: normal measurement, healthy saturation, reserved guard bands, active device fault, and a 0mA wiring or power failure.

Before accepting a loop, trace that contract end to end. Verify the device's actual alarm settings, the analog input's upper range, status processing, dwell time, shared-power exposure, and proof-test coverage. For the signal-level details, return to the NAMUR NE 43 fault-current guide; for the electrical issues that can spoil a good fault signal, use the 4-20mA loop-noise troubleshooting guide.

Citation capsule: In a SIL-rated SIF, NAMUR NE 43 lets a 4-20mA transmitter communicate a detected fault at ≤3.6mA or ≥21.0mA instead of presenting an untrustworthy process value. That signal contributes to the SIF evidence, but the achieved safety integrity also depends on architecture, proof testing, logic, and the final element (NotebookLM, Analog Signal Standards notebook, 2026).