A safety temperature limiter is a device for monitoring temperature that automatically triggers a protective shutdown of the system when a set limit value is exceeded. It is available in various versions, can be adapted to specific requirements and environments, and helps to comply with legal standards. It is commonly found in thermal plants such as heat transfer oil plants, boilers, and furnaces.
Normally, a temperature controller controls the process temperature. If it rises to an impermissible level due to a technical fault or incorrect operation, the safety temperature limiter intervenes. In combination with an electric thermometer, it monitors the temperature and switches the plant to a safe operating status before the critical temperature is reached. This condition is usually achieved by switching off the heating.
The image shows a temperature controller (1) which, together with a temperature probe (2) and a heater (3), maintains the temperature in a furnace at 650 °C. When heating is required, the controller closes the contact shown and heating is activated. The safety temperature limiter (4) measures the temperature with another temperature probe (5). For example, it only closes the shown contact at temperatures below 700 °C and only then enables heating. If the safety temperature limiter detects a temperature of more than 700 °C, it opens its contact (as shown in the figure) and heating is switched off.
The controller and safety temperature limiter do not switch the voltage supply directly (contrary to the simplified figure) due to the high currents to be switched. Instead, the controller controls a thyristor power switch and the safety temperature limiter controls a mechanical relay – these actuators then switch the voltage supply accordingly.
The analog input of the safety temperature limiter can be set to different sensors and signals. That way, a signal such as 4 to 20 mA can be evaluated. All process variables that are made available via a current signal can be monitored for minimum or maximum values (pressure, humidity, flow, etc.).
Safety temperature limiters are equipped with a manual reset mechanism – for a good reason: once the switch-off temperature has been reached, the system should not automatically restart, but requires careful testing and approval by authorized personnel. This ensures that the cause of the excess temperature has been identified and eliminated before the plant restarts. This manual reset is mandatory for safety-related applications, which is the case in many heating plants, steam generators, or industrial processes.
Safety temperature limiters have a redundant design: the signal from a sensor is processed in 2 channels in the safety temperature limiter and compared with the limit temperature in each channel. Each channel has a relay that is only activated when the evaluated process variable is within the valid range. The electrical circuits are connected in series so that heating is only switched on when both contacts are activated. A diagnostic channel checks both evaluated signals for plausibility. Even in the event of an internal hardware error, the plant will not be released, so safe operation remains possible in this case as well. The redundant structure gives the safety temperature limiters enhanced security, which is mandatory for high security requirements.
In contrast, temperature limiters do not have a redundant structure and are only used for lower safety requirements.
Depending on the sensor technology, safety temperature limiters can monitor a wide temperature range. Resistance thermometers with Pt100 and Pt1000 sensors are often used for temperatures up to 600 °C. Thermocouples are used for higher temperatures. The type B thermocouple can be used to monitor the highest temperatures – typically up to 1500 °C.
Temperature monitoring up to 650 °C can be implemented relatively inexpensively using electromechanical components. Safety temperature limiters and temperature limiters filled with gas or liquid are available, including variants with SIL 2 certification and suitability for Ex areas.
The switching point accuracy of the safety temperature limiters is subject to tolerance and the switching point continues to be influenced by the ambient temperature. If the switching point must be precisely set in an application, this type of safety temperature limiter is not suitable.
The temperature often needs to be measured in an area where an explosive atmosphere can form. In this case, safety temperature limiters with ATEX approval are used, which only feed very low electrical power in the temperature probe. This prevents the temperature probe from heating up to an excessively high temperature and becoming a source of ignition.
Depending on the application, operating location, and industry, different directives apply to the use of safety temperature limiters. Compliant selection, installation, and testing in accordance with these standards is mandatory and is often partially verified by testing or acceptance procedures carried out by experts (e.g. TÜV, DEKRA).
This standard applies to electrical or non-electrical temperature control devices used to regulate the temperature in heat-generating plants. It describes the features that temperature control devices and temperature limiters in these plants must have. The standard is mandatory in many European countries.
The DIN EN 61508 series "Functional safety of electrical/electronic/programmable electronic systems" is intended as a basic safety standard. Regardless of the application, it deals with the functional safety of systems. It is the central standard for functional safety of control systems. The standard defines the requirements for safety systems in plant safety.
In this context, the Safety Integration Level (SIL) plays an important role, which is defined by DIN EN 61508 as the "average probability of dangerous failures" (PFDavg). The overall classification system consists of 4 levels (SIL 1 to SIL 4). In a system with SIL 4, the probability of failure (i.e. the PFDavg value) is extremely low. In a system with SIL 1, the probability of failure is significantly higher. If an SIL classification is required for process plants, it is usually SIL 2 – rarely SIL 3.
The SIL classification is always based on an "average probability of dangerous failures". An example here is a safety device designed to switch off in the event of excess temperatures. This type of system normally consists of multiple components such as a temperature probe, a safety temperature limiter, and an actuator for which the manufacturers must certify the respective failure probabilities. The plant project engineer has to calculate the overall probability of failure from these individual probabilities and ensure that it is lower than 10-2 (per requirement) for SIL 2 for example.
Safety temperature limiters should only be installed by authorized specialist companies. The temperature probe is installed in close proximity to the heat source (e.g. in the boiler or in the heat exchanger) – ideally at the place where the highest temperature to be expected occurs. The probe is inserted into a suitable thermowell or directly into the medium.
The electrical connection must be carried out according to the manufacturer's specifications and applicable regulations. This generally occurs by means of a potential-free normally open contact that is only closed when the temperature is below the limit value. When the limit temperature is exceeded, the contact is open and heating control is interrupted.
To ensure proper operation, it is mandatory that a functional test is performed after mounting. Triggering is generally carried out using a test button on the safety temperature limiter, alternatively by heating the plant.
The safety temperature limiter must be regularly maintained to ensure operational safety. This comprises visual inspections, an annual functional test, and, if necessary, replacement in the event of aging, damage, or malfunction. The tests must be documented.
The choice of the right safety temperature limiter largely depends on the requirements of the specific application. The most important criteria include:
In the case of plants for heating, the switch-off temperature is always above the normal operating temperature, but below the admissible maximum plant temperature. If the temperatures (e.g. operating temperature and switch-off point) are too close together, electronic safety temperature limiters are required due to the switching point tolerances, which switch precisely at the set temperature.
The thermostats designed as safety temperature limiters can be limited to a maximum temperature of 600 °C. Higher temperatures preclude these systems.
In the case of plants with fast temperature rises, the safety temperature limiter also has to determine the temperature as rapidly as possible – otherwise, the plants will only be switched off when the temperature is too high. In this case, temperature probes which respond quickly are required. For example, this is achieved by using temperature probes with a low mass and by avoiding additional thermowells.
Safety temperature limiters usually control a power contactor and only switch extremely small amounts of electrical power. However, they also switch the overall power for heating in very small plants (e.g. 10 A at AC 230 V). In this case, it must be ensured that the maximum current is not exceeded.
Electronic safety temperature limiters contain a fuse cut-out that is connected along the same path as the normally open contact. If an impermissibly high current is conducted via the contact and the fuse cut-out, the fuse is destroyed and the safety temperature limiter can no longer switch on the heating via its contact. This structure prevents the contact from being destroyed by overcurrent and therefore closing permanently, for example. If the fuse cut-out is destroyed, the heating remains switched off – but the safety temperature limiter is then unusable and has to be replaced.
Safety temperature limiters are often integrated by plant manufacturers on their own initiative to protect the plant against damage. However, they are also mandatory in many cases and must have certain approvals and certifications. Compliance with DIN EN 14597 is key for heat-generating plants in Europe.
In potentially explosive areas, such as in the chemical industry or gas installations, ATEX approval is also mandatory.
UL or CSA certification may also be required for export to the USA or Canada.
Additional important approval marks are CE, VDE, TÜV, or EAC – they certify compliance with national and international standards as well as the safety-related suitability of the safety temperature limiter for the respective application.