Short answer: a NEMA 4 or IP67 marking on a proximity switch covers the housing — water, dust and oil — and nothing about ignition. In a Class I Division 2 area the standard 24 V DC solid-state prox is lawful because it makes no arc in normal operation; the can strike that smashes its housing ends that and turns the loop into a possible ignition source. The worked example below assumes a loop fused at 2 A running 100 m of cable; swap in your own cable length, fuse rating and barrier data before ordering parts. The fix is one of three: guard the sensor so no strike reaches it, put the loop behind an intrinsically safe barrier, or fit a sensor certified for Class I Division 2.
Does a NEMA 4 or IP67 rating make a prox safe in Class I Division 2?
No — the rating covers water, dust and ice on the housing and nothing about ignition: a 24 V prox in a Class I Division 2 area stays lawful because of its non-arcing solid-state output, and a strike that smashes the housing takes that basis away.
Two different standards answer two different questions here. NEMA 250 and IEC 60529 rate what the housing keeps out. The NEC hazardous-location articles, 500 through 506, decide whether the electronics inside can ignite the vapor around it. A sensor can pass every hose-down and immersion test and still be an ignition risk once its live circuit meets the air. So read the housing marking as a washdown spec, and treat the Division 2 judgment as a separate decision you make about the circuit, the fuse and the mounting. The NEMA enclosure types guide and the IP rating chart cover the ingress side in depth.
What does the NEMA 4 or IP67 marking actually test?
IP67 means dust-tight and 1 m of immersion for 30 minutes, NEMA 4 adds hose-down water and rain, and neither test ever checks what the electronics inside can spark, short or heat.
IEC 60529 gives IP67 its two digits: 6 is dust-tight and 7 is temporary immersion at 1 m for 30 minutes. NEMA 250 rates Type 4 against rain, splashing and hose-directed water, and Type 4X adds corrosion resistance for the washdown chemicals. Those benches wet and dust a sealed box; no step in either standard puts a spark, a fault or a flammable atmosphere near the electronics.
Housings carry manufacturer ratings, not UL listed approvals: our stock boxes are rated NEMA 4X / IP66 by the manufacturer; not UL listed, and the sensor's IP67 marking is the same kind of manufacturer claim you read on ours. NEMA writes the standards; it does not test or certify enclosures. The housing also says nothing about what migrates in over years, which is why an IP67 sensor enclosure is sealed against water, not against vapor. The ignition question lands on the equipment approval line of the sensor datasheet instead.
Why can a standard 24 V prox stay in Division 2 at all?
Division 2 assumes the flammable vapor stays inside its containers and closed systems in normal running, so the NEC lets in equipment that makes no arc and runs cool — exactly what a solid-state prox with sealed electronics and no contacts does.
Division 2 describes the area, not the device: flammable vapor is handled there, but in normal operation it stays confined and reaches the air only when something fails. Because the atmosphere is normally absent, the NEC admits equipment that in normal operation makes no arc, spark or hot surface. A 3-wire solid-state prox has no contacts to make or break; its output is a transistor switching a PLC input of 10-15 mA, with typical datasheet output ratings of 100-200 mA.
Heat is nowhere near the problem either. Even a full 1.5 W dissipated in a metal body warms it a few tens of degrees, while toluene and xylene, the solvents in most paints, auto-ignite near 480 C [900 F] on their safety data sheets. Aerosol propellants such as propane and butane sit in the same gas group with similar ignition temperatures. The intact sensor is lawful equipment in this area, and the same reasoning carries the wider panel, as the Division 2 junction box article and the NEMA 4 HMI article explain.
The permission attaches to the device as built, operating normally. Both halves of that — intact construction and normal operation — disappear when a steel can hits the sensor at line speed.
What happens when a can strike smashes the sensor?
The smashed sensor loses the permission the moment its housing breaks: live terminals meet the can body, the short can arc at 24 V, and the same spilled can has just released the solvent vapor the arc now sits in.
Look at the timing first. Division 2's premise is that vapor stays confined during normal running. A can tipping over is the abnormal event that sprays solvent and propellant across the sensing spot, and the same event has just crushed the sensor beside the spill. The area leaves its normal state at the exact moment the circuit stops being a normal, non-arcing one.
Inside the crushed housing the circuit board cracks and leads sever, and the 24 V supply shorts through the can body and the steel rail your cans roll on. A break spark or a short arc in a flammable atmosphere is the classic ignition path, the same physics that bans fault-arc earthing underground. The fuse decides how long the arc feeds: a time-delay Class J fuse carries 5 times its rating for at least 10 s (UL 248-8), so a 2 A group fuse can hold a fault for seconds.
Pull the struck sensor from service and replace it before the line restarts. Nothing on its datasheet covers a crushed housing.
How much energy can a smashed 24 V loop release?
In the worked example below, a 100 m sensor loop fused at 2 A stores about 0.2 mJ in its cable inductance alone, and paint-solvent vapor ignites from roughly 0.2 to 0.5 mJ — the fault sits inside the ignition band before the supply adds its own arc.
The example uses stated assumptions: a 24 V DC supply, one group fuse at 2 A, 100 m of shielded instrumentation cable at the 1 µH/m inductance that intrinsic-safety loop calculations use for typical cable, and solvent vapor in gas group IIA, where minimum ignition energy runs about 0.2-0.5 mJ (the ignition data behind the IEC gas groups). Replace the cable length, fuse current and barrier data with your own values before ordering anything.
The crushed housing shorts the loop. Until the fuse clears, roughly 2 A flows, and the cable's magnetic field holds:
E = ½ × L × I² = ½ × (100 m × 1 µH/m) × (2 A)² = ½ × 100 µH × 4 A² = 200 µJ = 0.2 mJ
That is the stored cable energy alone. The arc at the break and the supply feeding it add more while the fuse runs its curve, and the band you are trying to stay out of starts at about 0.2 mJ.
An intrinsically safe barrier closes that gap. Put the same 100 m loop behind a barrier whose short-circuit current is 25 mA — an example entity value; your barrier datasheet prints the real one — and the cable stores:
E = ½ × 100 µH × (0.025 A)² = ½ × 100 µH × 0.000625 A² ≈ 31 nJ
That is about 6,400 times below 0.2 mJ, nearly four orders of magnitude of margin, which is the whole point of intrinsic safety. Run your own ½ L I² with your length and your fuse current: an answer anywhere near a tenth of a millijoule has no business facing released solvent vapor.
Which sensor keeps the area covered after a strike?
Three fixes work: guard the standard prox so a strike cannot reach it, move the loop behind an intrinsically safe barrier that caps fault energy near 31 nJ, or fit a sensor certified for Class I Division 2 with a temperature class such as T4 (135 C).
| Option | How it stays safe | What to watch |
|---|---|---|
| Standard prox behind a guard | Non-arcing Division 2 equipment stays intact, and the steel takes the strike | A strike that reaches it scraps the sensor; replace before restart |
| Intrinsically safe loop | A certified barrier in the safe area caps fault energy, about 31 nJ in the example, even at a dead short | Barrier and sensor entity parameters must cover the cable's inductance and capacitance |
| Certified Division 2 sensor | Bought with the area class, gas group and temperature class marked, wired per its control drawing | The certification covers internal faults; a crushed housing still scraps the sensor |
Mount the guarded prox in a steel well or behind a slot so the face sits below the guard surface; the can then passes over steel, and the sensing distance barely changes. An intrinsically safe loop normally runs one barrier per channel, mounted on the non-hazardous side. The Class I Division 2 selection article and the control cabinet without purge piece cover the enclosure side of the same decision.
An explosion-proof housing is a Division 1 technique, built around flame-arresting joints, and it is a heavy answer to a spark question. We build washdown and outdoor stainless enclosures, not that class of housing. The loop decisions above still decide the sensor.
What goes into the panel design and the order?
Specify the loop fuse at 0.2 A per sensor, a steel guard plate at least 3 mm thick over any prox a can can reach, an IS barrier whose entity parameters cover the sensor's, and a written rule that any struck sensor is replaced before the line restarts.
- Fuse each prox at about 0.2 A. A 3-wire 24 V sensor draws 10-15 mA quiescent and up to 100-200 mA driving a PLC input, so one fuse carries one sensor with margin; a 2 A group fuse feeds several sensors through a single fault.
- Mount every sensor a can can reach in a steel well or behind a 3 mm [1/8 in] stainless guard plate; any 304 or 316L sheet works, and you pick the grade for the washdown chemistry.
- For intrinsically safe loops, match the barrier's entity parameters to the sensor's, and total the cable at about 1 µH/m and 200 pF/m against the barrier's permitted inductance and capacitance before you fix the run length.
- Buy the approval with the sensor: the datasheet shows the Division 2 basis, non-arcing construction or intrinsic safety, and in US workplaces electrical equipment must be approved under OSHA 29 CFR 1910.303(a), as the listing and approval guide explains.
- Order the panel that houses the barriers and PLC as ordinary washdown equipment — stainless wall-mount and HMI enclosures — cut for the barriers and wells, delivered in 10 business days from your approval of the drawing.
- Put the restart rule in writing: a struck sensor is replaced and its loop re-fused before the conveyor runs again.
The decision by line: cans rolling freely with strikes seen or likely — move the loop to intrinsically safe barriers or certified sensors now. Strikes possible but sensors in wells behind guards — the standard prox stays, fused small, with replacement on strike as standing policy. Either way the NEMA 4 or IP67 marking keeps its own job, which is keeping washdown water out of the electronics.
Questions
Does the fuse rating change the ignition risk of a smashed prox?
Yes, strongly. The fault arc runs at whatever the fuse lets through: a 0.2 A fuse on one sensor lets far less into a smashed prox than a 2 A group fuse feeding several, and a time-delay Class J fuse carries 5 times its rating for at least 10 s on its UL 248-8 curve. Fuse each prox separately at about 0.2 A and prefer a fast-acting style, so the arc at a crushed housing feeds for the shortest time.
Can the same standard prox ever go into a Class I Division 1 area?
A standard IP67 prox has no path into Division 1. That classification assumes ignition-capable vapor is present during normal operation, so the non-arcing-in-normal-operation argument that carries Division 2 ends at that boundary. Division 1 takes certified equipment: an intrinsically safe loop whose barrier caps fault energy near the 31 nJ of this article's example, or flame-proof or encapsulated construction, with the approval printed on the datasheet.
How long a cable can an intrinsically safe prox loop run?
The barrier datasheet decides. A barrier lists the maximum external inductance and capacitance the loop may add; typical shielded instrumentation cable contributes about 1 µH/m and 200 pF/m, so a 100 m run adds roughly 100 µH and 20 nF. When those sit under the barrier's printed limits with margin, the run is fine; when they do not, shorten the cable or move the barrier to a position nearer the field.
What marking should a certified Class I Division 2 sensor carry?
Look for the area class, gas group and temperature class on the housing or datasheet, for example Class I Division 2, Group D, T4. The IEC temperature-class scale caps T4 at 135 C surface, far below the roughly 480 C auto-ignition of common paint solvents. Intrinsically safe sensors add entity parameters — maximum permitted voltage, current, power, external capacitance and inductance — and those must match the barrier you install.
Does a smashed certified sensor still need replacing before restart?
Yes. Every approval covers the sensor as built, and a crushed housing is damage outside it. The intrinsically safe loop still holds fault energy near the 31 nJ of the example, but the dead sensor reads falsely, its exposed leads can short neighboring channels, and the line restarts only with a known-good device. Fit the spare, re-fuse the loop, and log the strike.
