A chemical reactor has a pressure transmitter measuring vessel pressure. The same 4–20 mA signal goes to two different input modules in two different PLC racks: one general-purpose analog input for the process control loop, and one safety-rated analog input wired to a separate transmitter for the overpressure shutdown function. Two transmitters, two input modules, two controllers, two final elements — the architecture of functional safety is defined by separation. But what actually makes a safety analog input different from a general-purpose one, and when can a single transmitter serve both functions?
The answer is not "whenever the transmitter is safety-rated." A SIL-rated transmitter feeding a general-purpose analog input creates an unsafe combination. The input module is in the safety loop, and if it is not designed to fail safely, the safety function is compromised at the point of data acquisition — before the logic solver even sees the value.
What is different inside a safety-rated analog input module?
A general-purpose analog input channel typically has one ADC (analog-to-digital converter), one signal path, and diagnostics that detect open-circuit and out-of-range conditions. A safety-rated analog input (SIL 2 or SIL 3 per IEC 61508 / IEC 61511) has at minimum two independent channels sampling the same input signal through separate ADCs, with a hardware comparator continuously cross-checking the two digital values. If the two ADCs disagree beyond a configurable tolerance (the discrepancy time), the module sets the channel to the safe state — typically de-energizing the output, driving the process value to a fail-safe default, and flagging a diagnostic fault. This internal redundancy is transparent to the application program: the safety PLC sees one process value, but that value is the result of a voted comparison between two independent measurement paths.
How does a safety input handle failures differently from a general-purpose input?
A general-purpose analog input can fail in ways that produce a plausible-but-wrong reading: a damaged input protection diode can clamp the signal at 12 mA regardless of the transmitter output; a drifted reference voltage can offset all readings by 0.5 mA without triggering an out-of-range alarm; a single ADC bit error can flip a reading from safe (below trip) to dangerous (above trip) without any diagnostic flag because a single ADC has no internal comparator. A safety-rated input catches these failures because the two independent ADCs would disagree — one reads the drifted value, the other does not. The diagnostic coverage (DC) of a general-purpose analog input is typically 60–90%; the DC of a SIL 2 safety analog input is ≥90%; the DC of a SIL 3 safety analog input is ≥99%. These are not marketing numbers — they are IEC 61508-2 architectural constraints verified by third-party assessment.
When is a general-purpose analog input sufficient?
A general-purpose analog input is sufficient when: the signal is used for monitoring only (indicating, trending, data logging) and no safety function depends on the reading; the signal is used for process control (PID loop) where a failed reading produces an off-spec product or a nuisance alarm — not a hazard; or the signal is a secondary input to a safety function where the primary safety input is already a dedicated safety-rated sensor on a safety-rated input module, and the general-purpose input serves only as a comparison reference or operator display value. In the chemical reactor example: the process control input can be general-purpose; the overpressure shutdown input must be safety-rated. The boundary is not the transmitter. The boundary is whether the signal initiates a safety action.
When must the analog input be safety-rated?
The input must be safety-rated when it is part of a safety instrumented function (SIF) as defined in the plant's Safety Requirements Specification (SRS). Specifically: the sensor (transmitter) is safety-rated and certified for the required SIL, the input module is safety-rated and certified for the same or higher SIL, the logic solver (safety PLC) is certified for the required SIL, and the final element (valve, contactor, VFD STO input) is certified for the required SIL. The entire signal chain — sensor, input, logic, output, final element — must meet the SIL target. A single non-safety component in the chain downgrades the entire SIF to the reliability of that weakest link. A SIL 3 pressure transmitter feeding a general-purpose analog input produces a general-purpose (non-safety) function, because the input module's dangerous undetected failure rate dominates the probability of failure on demand (PFDavg) calculation.
| Signal Function | Required Input Module | Example |
|---|---|---|
| Process control (PID loop) | General-purpose analog input | Level transmitter controlling a fill valve |
| Operator indication only | General-purpose analog input | Stack gas temperature display |
| Alarm (non-safety) | General-purpose analog input | High vibration alert for maintenance |
| SIL 1 safety function | SIL 1 or higher safety-rated input | Simple over-temperature shutdown |
| SIL 2 safety function | SIL 2 or higher safety-rated input | Overpressure shutdown on a chemical reactor |
| SIL 3 safety function | SIL 3 safety-rated input | Furnace fuel-gas shutoff on flame failure |
Can one transmitter feed both a safety and a general-purpose input?
Yes — with constraints. A single SIL-rated pressure transmitter with two independent 4–20 mA output channels (a dual-output transmitter, or a transmitter with a HART pass-through to a signal splitter) can feed a safety analog input and a process control analog input simultaneously. The critical requirement is that the safety channel's signal path must be electrically independent of the process channel — a failure in the process input (shorted termination, power supply fault on the process PLC side) must not affect the signal arriving at the safety input. This is typically achieved with galvanic isolation between the two transmitter outputs or with a certified signal isolator/splitter. The alternative — connecting two input modules in series on the same 4–20 mA loop — is technically possible but introduces a common-cause failure point (a single open circuit drops both inputs) and is generally not accepted by functional safety assessors for SIL 2 or higher.
The Siemens ET 200SP F-AI 4×I is a SIL 3-certified 4-channel analog input module for 0(4)–20 mA signals — the kind of safety-rated input that reads the same 4–20 mA transmitter as a general-purpose card but acts on the value to execute a safety function with ≥99% diagnostic coverage.
What does "fail-safe state" mean for an analog input?
For a digital safety input, the fail-safe state is unambiguous: de-energize (open the circuit, remove voltage), and the connected safety relay drops out. For an analog safety input, the fail-safe state is application-defined. It could be: substitute a pre-defined safe value (typically 0 mA, equivalent to "zero flow" or "zero pressure," which may or may not be physically safe); hold the last valid value (useful for a level measurement where the actual level cannot change quickly and a sudden jump to zero would trigger a false trip); or set a fault flag that the safety logic uses to initiate a defined shutdown sequence. The safety application program must handle the fail-safe value explicitly — the module provides the mechanism, but the safety logic defines what "safe" means for that specific measurement.
The audit consequence: why misclassifying an input gets expensive
During a functional safety assessment or a regulatory audit, every input in a safety instrumented function is verified against the SRS. If the SRS specifies a SIL 2 pressure shutdown and the input module is a general-purpose analog card with no safety certification, the auditor issues a finding: the SIF does not meet its target SIL because the input subsystem's PFDavg cannot be calculated without hardware fault tolerance data from a certified safety module. The plant has three choices: replace the input module with a safety-rated equivalent (a hardware cost plus re-wiring and re-validation downtime), install a separate safety sensor and safety input module for that function (added hardware), or accept the finding and operate with a known safety gap (increasingly rare in regulated industries). None of these is cheap. The general-purpose analog input saved $300 at purchase; the retrofit costs $15,000.
The question is not whether a safety analog input is "better" than a general-purpose one. It is objectively more reliable — that is what the certification means. The question is whether the signal it reads is part of a safety function. If the signal initiates a safety action, the input must be safety-rated — full stop, no exceptions. If the signal controls a process or drives a display, a general-purpose input is sufficient. The boundary is written in the Safety Requirements Specification. If no SRS exists for the machine or process, the boundary is wherever a hardware failure at the analog input could produce a hazard without the operator having time to intervene.
