Safety, Human Factors, Cybersecurity and Governance

Introduction

Manufacturing automation improves productivity, repeatability, quality and worker safety, but it also changes the nature of industrial risk. A manually operated machine may expose an operator to mechanical hazards; an automated cell can add unexpected motion, stored energy, software faults, network attacks, poor interfaces and organizational failures. Safety therefore cannot be treated as a guard installed around a machine. It is a lifecycle discipline involving design, installation, commissioning, operation, maintenance, cybersecurity, management and continuous learning.

This chapter examines how engineers and managers integrate machinery safety, functional safety, safeguarding, ergonomics, lockout/tagout, industrial cybersecurity and governance. The central principle is that safe automation is socio-technical: dependable hardware and software are necessary, but safe outcomes also depend on human abilities, procedures, training, leadership, accountability and ethical choices.

Learning Objectives

By the end of this chapter, students should be able to:

1. Identify hazards and perform a structured machinery risk assessment.
2. Explain the hierarchy of risk reduction and the meaning of functional safety.
3. Select and evaluate guards, presence-sensing devices, interlocks and emergency stops.
4. Apply ergonomic principles and lockout/tagout practices.
5. Describe industrial cybersecurity threats, defense-in-depth and access control.
6. Explain data governance, privacy, accountability and ethical human–automation interaction.
7. Interpret the relationship between standards, legal duties and organizational procedures.
8. Analyze an integrated safety and cybersecurity case in an automated manufacturing cell.

1. Safety as a Lifecycle and Systems Problem

A manufacturing system consists of machines, people, materials, energy sources, control systems, software, networks and management processes. An incident may result from the interaction of several individually reasonable decisions. For example, a robot may be correctly programmed, but a maintenance worker may enter the cell because a gate switch was bypassed, a restart warning was inaudible, and the work permit was incomplete.

Safety engineering distinguishes between a hazard, a source with the potential to cause harm, and risk, the combination of the likelihood and severity of that harm. A hazard exists even when no incident has occurred. Risk assessment is the disciplined process of identifying hazards, estimating risk, selecting controls and verifying that controls work.

Important hazard categories include:

• mechanical: crushing, shearing, entanglement, impact and ejection;
• electrical: shock, arc flash, unexpected energization and static discharge;
• thermal: hot surfaces, molten material and cryogenic substances;
• pneumatic and hydraulic: stored pressure and uncontrolled actuator movement;
• chemical: toxic, corrosive, flammable or sensitizing materials;
• ergonomic: excessive force, repetition, awkward posture and poor reach;
• noise, vibration, radiation and environmental hazards; and
• digital and organizational hazards: malicious commands, loss of control, alarm overload, inadequate staffing and poorly governed data.

A useful lifecycle includes concept, design, procurement, installation, commissioning, production, change management, maintenance and decommissioning. Safety decisions made during design are usually more effective and less expensive than corrective measures added after installation.

2. Machinery Risk Assessment

A risk assessment should be traceable and performed by a competent, multidisciplinary team. Operators and maintainers contribute knowledge that may not be visible to designers. A typical process is:

1. Define the machine, intended use, reasonably foreseeable misuse and all lifecycle phases.
2. Identify hazards and hazardous situations.
3. Estimate risk before controls.
4. Reduce risk using the hierarchy of controls.
5. Verify the controls and estimate residual risk.
6. Document assumptions, responsibilities, training and review dates.

Risk estimation is not an exact prediction. A common qualitative model considers severity, exposure and the possibility of avoiding harm. Some organizations use numerical indices, but a score must never create false precision or justify an unacceptable hazard merely because the arithmetic produces a low number.

For a simple semi-quantitative screening method, a risk priority value may be written as:

where R is a screening score, S is severity, E is frequency or duration of exposure, and P is the probability that a hazardous event leads to harm. The scales must be defined by the organization, and the result is suitable only for prioritization—not as a substitute for engineering judgment or legally required assessment. A high-severity hazard may require elimination even when exposure is infrequent.

Risk reduction follows a preferred order:

1. Inherently safe design: remove the hazard or reduce energy, speed, force or reach.
2. Engineering safeguards: guards, barriers, interlocks, safe control functions and presence sensing.
3. Administrative controls: procedures, permits, training, supervision, signs and scheduling.
4. Personal protective equipment: eye, hearing, hand, foot, respiratory and other protection.

PPE is important but is the least reliable layer because it depends strongly on human selection, fit and consistent use.

Standards and Conformity

Standards provide recognized methods, terminology and performance requirements; they do not automatically replace national law. Depending on the jurisdiction and machine, relevant references may include ISO 12100 for machinery risk assessment and risk reduction, ISO 13849-1 for safety-related control systems, IEC 62061 for functional safety of machinery control systems, IEC 60204-1 for electrical equipment of machines, ISO 14120 for guards, ISO 14119 for interlocking devices, ISO 13850 for emergency stop principles, ISO 13855 for positioning safeguards, and IEC 62443 for industrial automation and control-system cybersecurity. In the United States, OSHA requirements and recognized consensus standards may apply; elsewhere, local occupational safety, machinery, electrical and data-protection laws govern.

A competent engineer must check the current edition, scope and applicable jurisdiction. Certification marks or a supplier declaration do not eliminate the employer’s duty to ensure safe integration and operation.

3. Safeguarding and Functional Safety

Physical and Presence-Based Safeguards

A fixed guard prevents access by requiring a tool for removal. An adjustable guard accommodates changing workpieces but requires careful design. An interlocked guard detects opening and initiates a defined safe response. A trapped-key system can enforce a sequence such as isolating power before access. Light curtains, laser scanners, pressure-sensitive mats and two-hand controls detect people or prevent hazardous initiation.

Safeguards must address reach-through, bypassing, visibility, reset behavior, stopping distance, environmental conditions and foreseeable defeat. A guard that is easy to defeat, difficult to maintain or constantly causes nuisance trips may encourage unsafe workarounds.

An emergency stop is a complementary protective measure. It is intended to stop hazardous motion quickly when a dangerous situation is observed, but it does not replace risk assessment, guarding or energy isolation. Emergency-stop reset must not by itself restart the machine; a separate, intentional start action is normally required.

Functional Safety

Functional safety concerns the ability of safety-related control systems to perform specified safety functions under defined conditions. Examples include stopping a robot when a gate opens, preventing restart after a light curtain interruption, limiting speed during teaching, or monitoring a drive for overspeed.

A safety function should be specified in operational terms:

• initiating event, such as gate opening;
• required safe state, such as removal of torque from a drive;
• response time and stopping performance;
• operating and environmental conditions;
• diagnostic behavior and fault response; and
• reset and restart requirements.

Performance Level (PL) under ISO 13849-1 and Safety Integrity Level (SIL) under IEC 62061 are related but not interchangeable labels. The required level depends on the risk assessment, while the achieved level depends on architecture, component reliability, diagnostic coverage, common-cause failure control and systematic design quality. A high-rated component does not make an entire safety function high-performing if wiring, logic, actuators or integration are inadequate.

Verification should include inspection, functional testing, fault insertion where appropriate, validation of stopping time, confirmation of reset logic and review of changes. Test intervals must reflect manufacturer instructions, risk and applicable requirements.

4. Human Factors and Ergonomics

Human factors studies how people interact with tools, machines, information and organizations. Ergonomics applies this knowledge to fit work to human capabilities and limitations. It includes physical, cognitive and organizational dimensions.

Physical ergonomics considers posture, reach, force, repetition, vibration, lighting and workstation height. Cognitive ergonomics considers perception, workload, attention, memory, alarm interpretation and decision-making. Organizational ergonomics considers shift patterns, staffing, communication, training and participation.

A human-centered automation design should:

• make the normal and abnormal states visible;
• use consistent controls, symbols and terminology;
• distinguish warnings from commands;
• prioritize alarms by consequence and urgency;
• avoid excessive simultaneous alarms;
• provide feedback after an action;
• support recovery rather than punish predictable mistakes;
• make safe actions easier than unsafe bypasses; and
• involve operators and maintainers in trials.

Automation bias occurs when people over-trust an automated recommendation. The opposite problem, automation disuse, occurs when unreliable or confusing automation is ignored. Designers should specify the human role: whether the person monitors, authorizes, supervises, diagnoses or directly controls the process. Responsibility must not be transferred ambiguously to “the system.”

Artificial intelligence introduces additional concerns. A vision model may misclassify reflective surfaces, unusual products or damaged parts. A predictive-maintenance model may generate a useful warning but cannot be treated as a safety-rated protective function unless it has been designed, validated and certified for that purpose. AI outputs should have confidence limits, human escalation rules, audit records and a defined response to missing or abnormal data.

5. Lockout/Tagout and Control of Hazardous Energy

Lockout/tagout (LOTO) protects people during servicing, maintenance, cleaning, unjamming and setup. The objective is not merely to press an emergency stop; it is to isolate hazardous energy and prevent unexpected release or reaccumulation.

A robust procedure normally includes:

1. Prepare: identify all energy sources and authorized personnel.
2. Notify affected employees.
3. Shut down using the normal controls.
4. Isolate electrical, hydraulic, pneumatic, mechanical, thermal, chemical and other sources.
5. Apply personal locks and tags to isolation points.
6. Dissipate or restrain stored energy, including capacitors, gravity, pressure, springs, flywheels and hot fluids.
7. Verify zero-energy state using appropriate test instruments and a try-start attempt.
8. Perform the work.
9. Inspect, replace guards and account for people and tools.
10. Remove locks under the approved procedure, notify personnel and restore energy in a controlled manner.

Verification is the decisive step. A disconnected main switch may not isolate a second supply, and a de-energized motor may not eliminate gravity or pressure hazards. Electrical testing must be performed by qualified personnel using suitable instruments and safe practices.

Group LOTO requires personal accountability: each worker applies and removes an individually identifiable lock, or an equivalent controlled system is used. Shift changes, contractors and remote operation require explicit handover arrangements. Safety PLC logic, software inhibit commands and passwords are not substitutes for physical energy isolation when people enter a hazardous zone.

6. Industrial Cybersecurity

Operational technology (OT) directly monitors or controls physical processes. Its priorities often emphasize safety, availability, deterministic behavior and integrity before confidentiality, although all three cybersecurity objectives remain relevant. An attack can alter a robot program, disable alarms, delay maintenance, expose production data or create unsafe physical conditions.

Threats include weak passwords, unsupported operating systems, removable media, phishing, insecure remote access, vendor accounts, malware, ransomware, misconfigured firewalls, insider misuse and supply-chain compromise. Safety and cybersecurity are connected but distinct: a safety system may tolerate random component failures yet be vulnerable to a malicious command, while a cybersecurity control may preserve network confidentiality without preventing a mechanical injury.

Defense in depth uses multiple independent or partially independent layers:

• asset inventory and network diagrams;
• separation of enterprise IT, industrial DMZ and control zones;
• least-privilege accounts and multifactor authentication where feasible;
• allowlisting and secure configuration;
• patch and vulnerability management based on operational risk;
• backups tested for restoration;
• monitoring, logging and anomaly detection;
• removable-media control;
• supplier and remote-access governance;
• incident-response and recovery exercises; and
• independent safety mechanisms that fail to a safe state.

IEC 62443 provides a widely used framework for industrial automation cybersecurity, including system zones and conduits, secure product development and organizational processes. The NIST Cybersecurity Framework is another useful risk-management reference. Neither framework removes the need to understand the actual process and consequences of compromise.

Access Control

Access should be authorized by role and limited to the minimum necessary privilege. A practical model separates operators, maintenance technicians, controls engineers, safety personnel, system administrators and vendors. Shared accounts reduce accountability and should be avoided. Privileged actions—such as changing safety logic, robot limits or recipes—should require stronger authentication, change approval and audit logging.

Remote access should be disabled by default where practical, enabled for a defined purpose and time, monitored, and terminated after use. Vendor access must not become a permanent hidden pathway. Backups should include known-good machine programs, safety configurations and documentation, while restoration must be tested offline or in a controlled environment.

7. Data Governance, Privacy and Accountability

Automated factories generate machine states, production records, quality images, maintenance histories, operator logins, location data and sometimes biometric or behavioral information. Data governance defines who may collect, use, change, share, retain and delete data.

Core principles include purpose limitation, data minimization, accuracy, retention control, security, transparency and accountability. Production data may be commercially sensitive; worker data may be personal data subject to privacy law. A camera used for defect detection should not automatically be repurposed for worker surveillance without lawful justification, notice, proportionality and appropriate controls.

Governance should establish:

• data ownership and stewardship;
• classification of confidentiality and criticality;
• approved purposes and retention periods;
• access and disclosure rules;
• provenance and time synchronization;
• correction and deletion procedures where applicable;
• audit trails for material changes; and
• incident notification and response responsibilities.

Accountability requires named owners. “The algorithm decided” is not an acceptable allocation of responsibility. Organizations should document design decisions, assumptions, approvals, test evidence, exceptions and changes. A change-control board may review modifications to PLC code, robot paths, safety parameters, network architecture and AI models.

Ethical human–automation interaction requires respect for dignity, safety, autonomy and fair treatment. Performance monitoring should be proportionate and transparent. Workers should have a channel to challenge unsafe automation, report errors without retaliation and obtain human review when automated decisions affect discipline, access or employment.

8. Integrated Governance Framework

Safety, cybersecurity and data governance should be coordinated rather than managed as isolated compliance programs. A useful governance cycle is:

1. establish scope, legal duties and responsible owners;
2. inventory assets, tasks, data flows and dependencies;
3. assess safety, security, privacy and ethical risks together;
4. select controls using risk reduction and defense-in-depth principles;
5. implement and verify controls;
6. train personnel and communicate responsibilities;
7. monitor performance and investigate deviations;
8. review changes, incidents and near misses; and
9. improve the system throughout its lifecycle.

Useful indicators include overdue safety tests, guard bypasses, near misses, unauthorized access attempts, unpatched critical assets, backup restoration success, alarm rates, ergonomic discomfort reports and corrective-action closure. Metrics should encourage learning rather than concealment. A low incident count may reflect under-reporting rather than excellent performance.

9. Applied Case: Automated Palletizing Cell

Background

The following is an illustrative case. A packaging plant operates a robot palletizing cell with a conveyor, automatic pallet dispenser, pneumatic grippers, safety gates, a light curtain and a supervisory Ethernet connection. Operators load cartons and remove completed pallets. Maintenance technicians enter the cell to clear jams and adjust tooling.

Problem

A jam occurs when cartons arrive misaligned. Operators frequently open a gate and press the reset button. The robot stops, but pneumatic pressure remains, and a restart is possible after the gate is closed. A shared vendor account permits remote program changes. The plant has no current network diagram, and the light curtain has never undergone a documented stopping-distance test.

Analysis

The risk assessment identifies crushing between the gripper and conveyor, unexpected robot motion, stored pneumatic energy, manual handling strain and unauthorized program modification. The existing gate switch provides some protection, but the reset arrangement and residual pressure create unsafe exposure. The shared account weakens accountability, while remote changes could alter motion limits or defeat interlocks. The absence of test evidence means that the claimed protective function has not been validated.

Approach and Solution

The plant forms a team including an operator, maintenance technician, controls engineer, safety professional and cybersecurity specialist. It defines intended use and jam-clearing tasks, including foreseeable shortcuts. The team then:

• installs a fixed barrier and redesigns access to reduce routine entry;
• uses a coded interlock with monitored locking where access during hazardous motion is possible;
• validates the stop function and measures stopping time against the light-curtain position;
• adds a controlled, reduced-speed setup mode for authorized maintenance;
• isolates and vents pneumatic energy under LOTO before physical entry;
• separates normal reset from start and requires a clear-zone check;
• assigns individual accounts and removes the shared vendor credential;
• places remote access behind approval, multifactor authentication, time limits and logging;
• segments the cell network and restricts permitted communications;
• stores signed, version-controlled backups of PLC, robot and safety configurations;
• provides ergonomic aids for pallet handling and jam prevention; and
• trains staff, performs practical drills and schedules periodic validation.

Outcome

After implementation, routine jams are cleared from outside the cell more often, unauthorized changes become traceable, and maintenance entry follows verified isolation. The plant discovers during testing that a pneumatic accumulator can sustain gripper force after electrical isolation; this finding leads to an additional isolation and bleed-down point. The case demonstrates why safety, cybersecurity and human factors must be assessed together.

Learning Points

The emergency stop was not equivalent to LOTO. A safety input was not proven merely because it existed. Cybersecurity controls supported accountability but did not replace physical safeguards. Finally, involving operators exposed practical behaviors that the original design assessment had missed.

10. Challenges and Limitations

Risk assessment is limited by incomplete information, changing tasks and disagreement about likelihood. Numerical scoring can disguise uncertainty. Standards may overlap, use different terminology or require specialist interpretation. Legacy equipment may not support modern authentication, segmentation or safe diagnostics. Patching can interrupt production and introduce compatibility risks. Excessive alarms, authentication steps or nuisance trips may cause unsafe workarounds.

Organizations should therefore prioritize critical assets, use compensating controls for legacy systems, document residual risk and avoid claiming absolute security or safety. Independent review is valuable for high-consequence systems. Near misses, maintenance observations and worker feedback should update the assessment rather than remain informal knowledge.

Contemporary Developments and Best Practices

Current practice increasingly combines digital twins, remote support, condition monitoring, zero-trust principles and machine-readable asset inventories. These technologies can improve visibility but also expand attack surfaces and create dependence on data quality. Digital twins must not be assumed to represent the physical machine perfectly. Remote diagnostics should be read-only when possible, and safety-critical changes should require local authorization.

Best practice is characterized by:

• risk reduction beginning at design;
• clear separation between safety, control and business functions;
• validated protective functions and documented test intervals;
• energy isolation that addresses every source;
• human-centered interfaces and worker participation;
• unique identities, least privilege and controlled remote access;
• governed data with proportional privacy practices;
• traceable changes and accountable decisions; and
• continuous improvement based on evidence.

Chapter Summary

Safe manufacturing automation requires lifecycle risk management rather than isolated devices or procedures. Machinery risk assessment identifies hazards, estimates risk and applies the hierarchy of controls, beginning with inherently safe design. Safeguards and functional safety systems must be properly specified, integrated, validated and maintained. Ergonomics addresses physical, cognitive and organizational conditions, while human-centered design reduces automation bias, alarm overload and unsafe workarounds.

LOTO protects workers by isolating and verifying all hazardous energy; software commands and emergency stops are not substitutes for physical isolation. Industrial cybersecurity protects the availability, integrity and confidentiality of operational technology through defense in depth, segmentation, least privilege, monitoring, recovery and controlled remote access. Data governance establishes purpose, ownership, retention, privacy and accountability. Ethical automation preserves human dignity, transparency and meaningful responsibility. Effective governance integrates these disciplines through asset inventories, risk assessment, change control, training, verification, incident learning and continuous improvement.

Key Terms

Hazard: A source or situation with the potential to cause harm.

Risk: The combination of likelihood and severity of harm.

Risk assessment: The systematic identification, estimation and evaluation of risk.

Safeguard: A measure that prevents access to a hazard or reduces exposure.

Functional safety: The part of overall safety that depends on safety-related control functions operating correctly.

Performance Level: A reliability and fault-tolerance classification for safety-related control systems under ISO 13849-1.

Safety Integrity Level: A discrete level describing the reliability of a safety function under applicable IEC functional-safety standards.

Interlock: A device or logic arrangement that prevents or stops hazardous operation when a condition is unsafe.

Emergency stop: A manually initiated complementary protective function for rapidly stopping hazardous motion.

Ergonomics: The discipline of fitting tasks, tools and environments to human capabilities.

Automation bias: Excessive trust in an automated recommendation or decision.

Lockout/tagout: A controlled method for isolating and securing hazardous energy.

Zero-energy state: A verified condition in which hazardous energy has been isolated, dissipated or restrained.

Operational technology: Hardware and software that monitors or controls physical processes.

Defense in depth: The use of multiple protective layers so that failure of one layer does not cause compromise.

Least privilege: Restricting access to only the permissions necessary for an assigned role.

Data governance: Policies and responsibilities controlling data quality, access, use, retention and protection.

Accountability: The assignment of identifiable responsibility for decisions and outcomes.

Change control: A formal process for reviewing, approving, testing and documenting modifications.

Residual risk: Risk remaining after protective measures have been applied.

Review Questions

Short Answer Questions

1. Distinguish a hazard from risk.
2. State the preferred order of the hierarchy of controls.
3. Why is an emergency stop not a substitute for LOTO?
4. Define functional safety and give one example of a safety function.
5. What is meant by least privilege in industrial cybersecurity?

Long Answer Questions

1. Explain the complete machinery risk-assessment process for an automated production cell.
2. Compare fixed guards, interlocked guards, light curtains and laser scanners, including their limitations.
3. Discuss how ergonomic design can reduce both human error and unsafe automation workarounds.
4. Explain how defense in depth and network segmentation protect an industrial control system.
5. Develop a governance framework integrating safety, cybersecurity, privacy and change control.

Analytical / Application Questions

1. A robot cell stops when its gate opens, but stored hydraulic pressure can still move the gripper. Analyze the hazard and propose a validated safeguarding and LOTO strategy.
2. A supplier requests permanent remote access to a CNC controller. Evaluate the safety, cybersecurity, accountability and privacy implications, then recommend controls.
3. An AI vision system rejects products and records operator identifiers. Design a process for validating the system, governing its data and assigning responsibility for incorrect decisions.

Multiple Choice Questions with Answers

Question 1

Which measure has the highest preferred position in the hierarchy of risk reduction?

A. Personal protective equipment

B. Warning signs

C. Inherently safe design

D. Additional operator training

Correct Answer: C. Inherently safe design

Question 2

What is the primary purpose of lockout/tagout?

A. To improve production speed

B. To isolate and control hazardous energy

C. To authenticate remote users

D. To record machine temperature

Correct Answer: B. To isolate and control hazardous energy

Question 3

Which statement about an emergency stop is correct?

A. It replaces all physical guards

B. It guarantees zero stored energy

C. It is a complementary protective measure

D. It automatically authorizes restart

Correct Answer: C. It is a complementary protective measure

Question 4

Functional safety primarily concerns the ability of a system to:

A. Reduce product cost

B. Perform specified safety functions correctly

C. Encrypt all production data

D. Increase network bandwidth

Correct Answer: B. Perform specified safety functions correctly

Question 5

Which practice best supports cybersecurity accountability?

A. Using one shared administrator account

B. Disabling all audit logs

C. Assigning unique user identities

D. Allowing permanent vendor access

Correct Answer: C. Assigning unique user identities

Question 6

Which action is an example of defense in depth?

A. Relying on one password for every system

B. Combining segmentation, least privilege, monitoring and backups

C. Replacing all guards with warning labels

D. Allowing unrestricted removable media

Correct Answer: B. Combining segmentation, least privilege, monitoring and backups

Question 7

Why should operators and maintainers participate in risk assessment?

A. They can reveal practical tasks and foreseeable workarounds

B. They eliminate the need for engineering analysis

C. They can certify any machine automatically

D. They are legally responsible for all design decisions

Correct Answer: A. They can reveal practical tasks and foreseeable workarounds

Question 8

Which statement best describes data minimization?

A. Collecting every available worker attribute

B. Keeping data indefinitely

C. Collecting only data necessary for a defined purpose

D. Sharing data with all suppliers

Correct Answer: C. Collecting only data necessary for a defined purpose

Question 9

During LOTO, why is verification essential?

A. Isolation labels are always inaccurate

B. Unexpected sources or stored energy may remain

C. Verification increases machine speed

D. It replaces the need for personal locks

Correct Answer: B. Unexpected sources or stored energy may remain

Question 10

A safety-rated component is installed in a poorly designed control architecture. What is the most accurate conclusion?

A. The entire safety function is automatically high-performing

B. The component guarantees cybersecurity

C. Overall performance depends on the complete safety function and its integration

D. Validation is unnecessary

Correct Answer: C. Overall performance depends on the complete safety function and its integration