Functional Safety and Regulatory Compliance

Introduction

Industrial automation increases productivity, repeatability and process visibility, but it also introduces hazards arising from moving machinery, stored energy, pressure, temperature, electricity, chemicals and software-controlled operation. Functional safety addresses hazards by ensuring that control systems perform safety-related functions correctly when required. It is not the same as general reliability, cybersecurity, or production control. A highly reliable production controller may still be unsafe if it responds incorrectly to a hazardous condition.

Functional safety is therefore a lifecycle discipline. It begins with identifying hazards and assessing risk, continues through specification and design of protective functions, and includes validation, operation, maintenance, modification and decommissioning. This chapter develops the principles needed to distinguish basic control from safety control and to apply emergency stops, guards, safety PLCs and safety instrumented functions in accordance with major international standards.

Learning Objectives

After studying this chapter, you should be able to:

• perform a structured hazard and risk analysis;
• distinguish basic process control from safety-related control;
• explain the purpose and limitations of emergency stops and guards;
• describe the architecture and operation of safety PLC systems;
• relate safety instrumented functions to safety integrity levels;
• interpret the roles of IEC 61508, IEC 61511, ISO 13849 and relevant electrical standards;
• evaluate a safety design through verification, validation and lifecycle documentation.

1. Fundamental Concepts

1.1 Safety, functional safety and risk

Safety is freedom from unacceptable risk. In engineering, absolute freedom from risk is rarely achievable; the objective is to reduce risk to a tolerable level using inherently safe design, safeguarding and information for use.

Functional safety is the part of overall safety that depends on systems or devices operating correctly in response to inputs. Examples include a guard switch causing a machine to stop, a high-pressure transmitter initiating shutdown, or an emergency-stop circuit removing hazardous motion.

A safety function has three essential elements:

1. Input or sensing: detection of a dangerous condition or safety demand.
2. Logic: evaluation of the condition and decision to act.
3. Final element: removal of energy or transition to a safe state.

A failure in any element can prevent the safety function from working. Consequently, a safety system must address systematic failures, random hardware failures, common-cause failures, diagnostic coverage and human factors.

1.2 Hazard, harm and risk

A hazard is a potential source of harm. Harm is physical injury or damage to health. Risk combines the likelihood of harm with its severity. A common conceptual expression is:

Severity describes the consequence, while probability includes both exposure to the hazard and the likelihood that the hazardous event leads to harm. This expression is a risk concept rather than a complete probability model; it should not be interpreted as permitting arbitrary numerical multiplication of incomparable rating scales.

Risk assessment should identify the task, operating mode, people exposed, hazardous energy, foreseeable misuse and possible failure modes. It should consider normal production, setup, cleaning, maintenance, fault recovery and reasonably foreseeable bypassing or defeat of safeguards.

1.3 Risk reduction hierarchy

Risk reduction normally follows this order:

1. Inherently safe design: eliminate the hazard or reduce energy at the source.
2. Engineering safeguards: guards, interlocks, light curtains, pressure relief and safety control systems.
3. Information for use: procedures, training, warnings and personal protective equipment.

Administrative instructions and personal protective equipment are important, but they should not replace feasible engineering controls. A warning label cannot compensate for an accessible unguarded crushing point when a physical guard can be installed.

2. Hazard and Risk Analysis

2.1 The assessment process

A practical assessment consists of the following activities:

• define the machine boundaries, intended use and foreseeable misuse;
• identify hazards in every lifecycle phase;
• estimate risk before safeguards;
• select risk-reduction measures;
• specify safety functions;
• estimate residual risk;
• validate the safeguards and document assumptions.

The assessment is iterative. A new guard may introduce a trapping hazard, obstruct maintenance, or create unexpected restart behavior. Each modification therefore requires reassessment.

2.2 Risk estimation variables

For machinery, risk-ranking methods commonly consider:

• severity of injury;
• frequency and duration of exposure;
• possibility of avoiding or limiting harm;
• probability of occurrence of the hazardous event.

These parameters are used in methods associated with machinery safety standards, but the selected method must match the applicable standard and organization’s risk criteria. A risk graph is a decision aid, not a substitute for engineering judgment or evidence.

2.3 Example of a risk assessment

Consider a conveyor transfer point where an operator can reach a nip point during clearing of material. The hazard is entanglement or crushing. The assessment identifies frequent access during production and occasional access during cleaning. A fixed guard prevents routine access, while an interlocked access door permits authorized clearing. Opening the door must stop hazardous motion, prevent unexpected restart and detect failures in the interlock circuit.

The resulting safety function might be stated as:

When the access door is opened, hazardous conveyor motion shall be stopped and shall not restart until the door is closed and a deliberate reset is performed outside the danger zone.

This statement is measurable and testable. It is superior to the vague requirement “the door should be safe.”

3. Basic Control and Safety Control

A basic process control system (BPCS) regulates production. It may use a conventional PLC, distributed control system or drive controller to maintain speed, temperature, level or sequence. Its priorities are availability, quality and productivity.

A safety-related control system reduces risk. It must achieve a defined safe state even when faults occur and must prevent a single fault from defeating the safety function where required by the target performance level or safety integrity level.

The systems may communicate, but ordinary data communication must not be assumed to provide a safety function. A standard PLC output commanding a contactor is not automatically safety-rated merely because it is used for an emergency stop.

4. Emergency Stops, Guards and Safe States

4.1 Emergency-stop function

An emergency stop is a complementary protective measure intended to avert or reduce danger to people or damage to machinery. It is not a replacement for guards, inherently safe design or normal operational controls. Emergency-stop devices are generally manually actuated and require intentional reset. Resetting the device must not itself restart the machine.

An emergency-stop design should address:

• accessible actuator location;
• clear identification and unambiguous operation;
• positive opening or equivalent fault-tolerant contacts where applicable;
• stopping category and stopping time;
• prevention of unexpected restart;
• reset visibility and control;
• inspection and periodic testing.

The safe state is application-dependent. Removing motor power may be appropriate for an ordinary conveyor, but it may create a greater hazard for a suspended load, a hot process or a machine requiring controlled deceleration. Safety design must therefore define what “safe” means rather than equating safety with immediate power removal.

4.2 Guards and interlocks

A fixed guard physically prevents access and normally requires a tool for removal. A movable guard permits access but is monitored by an interlocking device. A guard-locking device may be required when access must remain prevented until hazardous motion has stopped.

Important principles include:

• the guard should be difficult to defeat using reasonably foreseeable methods;
• opening the guard should initiate the specified safety function;
• closing the guard should not cause automatic restart unless a carefully justified standard permits it;
• the location of the reset should allow the operator to see that no person remains in the hazard zone;
• stored energy must be controlled independently of the guard signal.

4.3 Two-hand controls and presence sensing

Two-hand controls require simultaneous operation of two actuators and are useful for protecting an operator during a limited machine cycle. They do not protect other people who can enter the hazard zone, and they must be designed to prevent easy defeat.

Light curtains, laser scanners, pressure mats and safety-rated vision systems detect presence or access. Their effectiveness depends on resolution, response time, minimum separation distance, environmental conditions and correct integration with the machine stop function.

5. Safety PLCs and Safety-Related Architecture

A safety PLC is designed, assessed and documented for safety-related control applications. It typically includes redundant processing, internal diagnostics, monitored input and output circuits, fault reaction, configuration controls and a defined safety integrity capability. A standard PLC with duplicated software is not necessarily equivalent.

A typical architecture is:

Figure: Generic safety-related control architecture.

Safety outputs often use dual channels and feedback from contactors or valves. The feedback loop can detect welded contacts, failure to de-energize or disagreement between channels. However, redundancy alone does not guarantee safety; common power supplies, common environmental stresses, identical design errors and incorrect wiring can defeat redundant channels.

5.1 De-energize-to-trip and fault reaction

Many safety circuits are designed so that loss of power, broken wiring or detected internal faults causes a trip. This is called a de-energize-to-trip principle. It is useful but not universal. Some processes require energized action, such as opening a cooling valve to prevent overheating. The designer must analyze loss of power, loss of signal, short circuits and dangerous energized failures.

5.2 Reset and restart

Reset is an authorization to restore readiness, not an automatic start command. A robust sequence is: remove the initiating hazard, verify the area, actuate reset from a safe location, and issue a separate start command. Control software should distinguish between a persistent safety demand, a reset edge and a start request.

6. Safety Instrumented Functions and Integrity Levels

6.1 SIF structure

In process industries, a safety instrumented function (SIF) is a specific protective action implemented by a safety instrumented system (SIS). A SIF includes sensor(s), logic solver and final element(s). Example: if reactor pressure exceeds a specified limit, close the feed valve and stop the pump.

A SIF specification should state:

• initiating condition and trip set point;
• safe state and process response;
• process safety time;
• required response time;
• proof-test interval;
• bypass and override rules;
• required SIL or other performance target;
• independence from the basic process control system.

6.2 Safety Integrity Level

IEC 61508 and IEC 61511 define Safety Integrity Levels (SIL 1 to SIL 4). SIL is a property of a safety function in a defined context, not a general grade assigned to an entire plant or a component in isolation. SIL 4 represents the highest integrity range and is uncommon in ordinary industrial control.

For low-demand mode, the average probability of failure on demand (PFDavg) is commonly expressed by ranges:

The ranges apply to the complete safety function and the relevant operating mode. They are not a license to calculate SIL from a single device’s failure rate.

For a simple illustrative, low-demand, one-channel architecture with constant dangerous undetected failure rate λ_DU, proof-test interval T₁, perfect proof testing, no repair delay and negligible diagnostics, an approximate relationship is:

Here λ_DU has units of failures per hour and T₁ has units of hours, so PFDavg is dimensionless. The approximation follows a linearly increasing unavailability between proof tests. It is not valid without modification for redundancy, online diagnostics, partial testing, repair time, common-cause failures or multiple failure modes.

Illustrative calculation. Suppose λ_DU = 2 × 10⁻⁶ failures/hour and T₁ = 8,760 hours (one year). Then:

This value lies in the SIL 2 range numerically, but no SIL claim can be made from this calculation alone because the complete sensor–logic–final-element architecture and systematic capability must also be assessed.

6.3 Performance Level

ISO 13849-1 uses Performance Levels (PL a to PL e) for safety-related parts of control systems in machinery. The achieved PL depends on architecture/category, mean time to dangerous failure, diagnostic coverage and common-cause measures. PL and SIL are related risk-reduction concepts but are not interchangeable labels. Conversion requires the applicable standard’s method and evidence.

7. Standards and Regulatory Compliance

7.1 IEC 61508

IEC 61508 is a generic functional-safety standard for electrical, electronic and programmable electronic systems. It establishes a safety lifecycle covering concept, hazard and risk analysis, allocation of safety requirements, design, realization, validation, operation, maintenance, modification and decommissioning. It also addresses hardware random failures, systematic capability, software, independence and competence.

7.2 IEC 61511

IEC 61511 applies functional safety to the process industry sector. It guides users, engineering organizations and suppliers in specifying, designing, operating and maintaining SISs. It emphasizes the safety lifecycle, SIF allocation, independence from the BPCS, proof testing, management of functional safety and control of bypasses and modifications.

7.3 ISO 13849

ISO 13849 addresses safety-related parts of control systems for machinery. It is particularly relevant to guards, emergency stops, presence sensing and machine motion. Designers use risk assessment to determine a required PL and then verify that the architecture and component data achieve it.

7.4 Electrical and machinery standards

Other standards may apply depending on jurisdiction and equipment. IEC 60204-1 addresses electrical equipment of machines; IEC 60947-5-5 addresses electrical emergency-stop devices with mechanical latching; IEC 62061 addresses functional safety of machinery control systems; and IEC 61800-5-2 addresses functional safety for adjustable-speed power drive systems. National legislation, adopted standards, certification requirements and electrical installation rules must also be consulted. Compliance cannot be established by citing a standard without checking its current edition, scope and legal status.

8. Verification, Validation and Lifecycle Management

Verification asks whether the design has been built according to its specification. Examples include reviewing logic, checking wiring, calculating stopping distance and confirming diagnostic behavior.

Validation asks whether the completed machine or process actually achieves the intended risk reduction under realistic operating conditions. Tests should include normal operation, faults, power loss, sensor disconnection, short circuits where relevant, reset behavior, restart prevention, bypass conditions and all operating modes.

A professional safety file normally contains:

• risk assessment and machinery boundaries;
• safety requirements specification;
• design drawings and cause-and-effect matrices;
• component certificates and assumptions;
• software version and change records;
• verification calculations;
• validation procedures and results;
• proof-test procedures;
• training, operating and maintenance instructions;
• management-of-change records.

Periodic proof testing is essential because some dangerous failures remain hidden during normal operation. Test intervals should be justified by the integrity analysis and process risk. A test that merely checks the PLC diagnostic light may not test the field sensor, wiring, valve movement or actual energy isolation.

9. Applied Case: Packaging Cell with a Robot and Conveyor

Background

The following is an illustrative case. A packaging cell contains a robot, an infeed conveyor and an operator access door. The robot can move rapidly, and the operator enters the cell to remove misaligned cartons.

Problem

The original design used a standard PLC to stop the robot when the door switch opened. The door could be closed while a start command remained active, causing an unexpected restart. The risk assessment also found that the standard PLC did not monitor welded contactors and that the robot drive’s coast-to-stop time was longer than the access time.

Analysis

The hazards were unexpected motion, access during stopping, and stored pneumatic energy in a gripper. The required safety functions were:

1. opening the door prevents robot and conveyor motion;
2. the door cannot be opened until hazardous motion has stopped;
3. reset does not initiate motion;
4. pneumatic energy is exhausted or held in a safe state when required;
5. an emergency stop is available at the operator station and cell boundary.

Approach and solution

A safety-rated door-locking switch was installed. A safety PLC monitored two independent door channels, emergency-stop channels and feedback contacts from redundant motor contactors. The robot controller’s safe torque off function was integrated where appropriate. A timer was not used as the sole proof of safe stopping; the design used the robot’s safety-rated stopping status and validated stopping time. The reset button was positioned so that the operator could observe the cell, and a separate start command was required.

The pneumatic gripper was analyzed separately. Where release of a load could create a hazard, a dump valve alone was not accepted as sufficient; mechanical retention and controlled exhaust were considered.

Outcome

Validation demonstrated that opening the door removed torque, prevented restart, detected a welded contactor, and maintained the safe state after power restoration. Proof-test instructions were added for the door lock, contactors, emergency stops, robot safety inputs and pneumatic isolation.

Learning points

• A standard PLC sequence is not automatically a safety function.
• Safe stopping must consider actual stopping time and stored energy.
• Reset and restart are separate actions.
• The final element is as important as the sensor and logic solver.
• Safety performance depends on lifecycle evidence, not only on hardware selection.

10. Challenges, Ethics and Contemporary Practice

Safety engineering involves ethical duties because design decisions can expose workers and the public to serious harm. Production targets, maintenance convenience or cost reduction must not justify undocumented reduction in protection. Engineers should communicate residual risk honestly and escalate unresolved hazards.

Common challenges include obsolete equipment, undocumented modifications, nuisance trips, bypassed interlocks, inadequate competence, poor proof testing and unclear responsibility between machine builders and users. A safety function that is routinely bypassed is evidence of a design or operational problem, not merely operator misconduct.

Cybersecurity is increasingly relevant. Unauthorized changes to safety logic, network disruption or manipulated sensor data can affect functional safety. Cybersecurity controls should support, not replace, independent safety measures. A network firewall cannot substitute for a properly designed emergency-stop circuit.

Artificial intelligence may assist anomaly detection, maintenance planning and hazard identification, but a probabilistic AI model should not be assumed to provide a safety function unless its behavior, failure modes, validation evidence and applicable standards support that use. Safety decisions require traceability and controlled change management.

Best-Practice Design Checklist

• Start with hazard elimination before adding control logic.
• Define each safety function in measurable terms.
• Select the applicable standard and current legal requirements.
• Separate basic control assumptions from safety requirements.
• Specify sensors, logic solver, final elements and response time.
• Analyze common-cause and systematic failures.
• Design deliberate reset and restart prevention.
• Validate every operating mode and credible fault.
• Establish proof testing, training and management of change.
• Preserve an auditable safety file throughout the lifecycle.

Chapter Summary

Functional safety reduces risk through control systems that respond correctly to hazardous conditions and failures. Effective practice begins with hazard identification and risk assessment, followed by inherently safe design and engineered safeguards. Emergency stops, guards, interlocks, safety PLCs and safety instrumented functions must be specified as complete safety functions involving inputs, logic and final elements. Basic production control cannot automatically be treated as safety control.

IEC 61508 provides a generic functional-safety framework; IEC 61511 applies it to process-industry SISs; ISO 13849 addresses machinery safety-related control parts; and standards such as IEC 60204-1, IEC 60947-5-5, IEC 62061 and IEC 61800-5-2 address related equipment and applications. SIL and PL are integrity concepts requiring complete-system evidence. Verification, validation, proof testing, competence and management of change are essential because safety is a lifecycle responsibility rather than a one-time installation task.

Key Terms

Functional safety: Safety dependent on correct operation of electrical, electronic or programmable systems.

Hazard: Potential source of harm.

Harm: Injury or damage to health.

Risk: Combination of consequence severity and likelihood of harm.

Safety function: Function intended to achieve or maintain a safe state.

Basic process control system: Control system primarily serving production and quality.

Safety PLC: PLC designed and assessed for safety-related control functions.

Emergency stop: Manually initiated complementary protective function for reducing danger.

Guard: Physical barrier preventing or limiting access to a hazard.

Interlock: Arrangement that prevents or stops operation when a protective condition is absent.

Safe state: Condition in which the specified hazard is controlled.

Safety instrumented function: Specific protective action performed by a safety instrumented system.

Safety instrumented system: System implementing one or more SIFs.

SIL: Safety Integrity Level, ranked from SIL 1 to SIL 4.

PL: Performance Level under ISO 13849.

PFDavg: Average probability that a safety function fails to operate on demand.

Proof test: Periodic test intended to reveal hidden dangerous failures.

Verification: Confirmation that specified design requirements have been met.

Validation: Confirmation that the completed system achieves its intended safety performance.

Common-cause failure: Failure affecting multiple channels because of a shared cause.

Review Questions

Short Answer Questions

1. Define functional safety and distinguish it from general equipment reliability.
2. What are the three basic elements of a safety function?
3. Why must reset and restart be separate actions?
4. State the main purpose of a proof test.
5. Explain why a standard PLC is not automatically a safety PLC.

Long Answer Questions

1. Describe a complete hazard and risk assessment process for an automated machine.
2. Compare basic process control systems with safety-related control systems.
3. Explain the design principles of emergency stops, guards and guard interlocks.
4. Discuss the roles and scopes of IEC 61508, IEC 61511 and ISO 13849.
5. Explain verification, validation and management of change in the safety lifecycle.

Analytical / Application Questions

1. A machine door switch is connected to a standard PLC input, and closing the door immediately restarts the motor. Identify the hazards and propose a safer architecture and restart sequence.
2. A low-demand SIF has λ_DU = 2 × 10⁻⁶ failures/hour and a one-year proof-test interval. Using the stated approximation, calculate PFDavg and explain why the result alone does not establish SIL.
3. For a robot cell with a long coast-to-stop time, evaluate whether an emergency stop alone is sufficient. Propose additional safeguards and validation tests.

Multiple Choice Questions with Answers

Question 1

Which statement best describes functional safety?

A. The ability of a machine to maximize production output

B. Safety that depends on systems operating correctly in response to inputs

C. Protection provided only by personal protective equipment

D. The elimination of every possible hazard

Correct Answer: B. Safety that depends on systems operating correctly in response to inputs

Question 2

Which measure has the highest priority in the risk-reduction hierarchy?

A. Warning labels

B. Operator training

C. Inherently safe design

D. Personal protective equipment

Correct Answer: C. Inherently safe design

Question 3

What is the primary purpose of an emergency-stop function?

A. To replace all machine guarding

B. To increase production speed

C. To avert or reduce danger in an emergency

D. To provide routine cycle control

Correct Answer: C. To avert or reduce danger in an emergency

Question 4

What should normally happen when a safety guard is reset?

A. The machine automatically starts

B. The machine becomes ready but requires a separate start command

C. All safety diagnostics are disabled

D. The guard is permanently bypassed

Correct Answer: B. The machine becomes ready but requires a separate start command

Question 5

Which three elements form a typical safety function?

A. Sensor, logic and final element

B. Motor, gearbox and bearing

C. HMI, printer and database

D. Training, warning and insurance

Correct Answer: A. Sensor, logic and final element

Question 6

IEC 61511 is primarily associated with which application?

A. Process-industry safety instrumented systems

B. Consumer audio equipment

C. Building decoration

D. Financial auditing

Correct Answer: A. Process-industry safety instrumented systems

Question 7

A SIF has λ_DU = 2 × 10⁻⁶ failures/hour and a proof-test interval of 8,760 hours. Using PFDavg ≈ λ_DU × T₁ ÷ 2, what is the approximate PFDavg?

A. 0.00000876

B. 0.000876

C. 0.00876

D. 8.76

Correct Answer: C. 0.00876

Question 8

What does validation determine?

A. Whether the design document has a title

B. Whether the completed system achieves its intended safety performance

C. Whether production targets were increased

D. Whether a component is inexpensive

Correct Answer: B. Whether the completed system achieves its intended safety performance

Question 9

Which statement about SIL is correct?

A. It is assigned to every component independently of its application

B. It is a property of a defined safety function in context

C. SIL 1 is the highest possible integrity level

D. It is identical to a machine’s production availability rating

Correct Answer: B. It is a property of a defined safety function in context

Question 10

What is a common-cause failure?

A. A failure affecting multiple channels through a shared cause

B. A failure that occurs only during commissioning

C. A failure caused exclusively by an operator pressing reset

D. A failure that improves diagnostic coverage

Correct Answer: A. A failure affecting multiple channels through a shared cause