Safety, Reliability, Cybersecurity and Governance

Introduction and Context

Mechatronic and industrial-automation systems combine mechanical equipment, electrical power, sensors, programmable logic controllers (PLCs), robots, industrial networks, software and human operators. Their integration creates substantial benefits—higher productivity, repeatability, quality and flexibility—but also creates coupled hazards. A software fault can cause a machine movement; a failed sensor can defeat a protective function; a cyberattack can alter a process; and poor governance can allow unsafe changes to remain undocumented.

Safety, reliability, cybersecurity and governance must therefore be treated as one engineering concern. Safety asks whether a system can cause unacceptable harm. Reliability asks whether it performs its intended function for the required time. Cybersecurity asks whether intentional or accidental digital actions can compromise confidentiality, integrity or availability. Governance establishes who is accountable for decisions, evidence, change control and compliance.

A safe automation system is not simply one with many alarms. It is a system whose hazards have been identified, whose risks have been reduced according to accepted principles, whose protective functions have been validated, and whose operation remains controlled throughout its life cycle.

Learning Objectives

After studying this chapter, the student should be able to:

1. Identify hazards and estimate risk using structured methods.
2. Perform and interpret failure mode and effects analysis (FMEA).
3. Construct basic fault trees and calculate simple reliability measures.
4. Explain functional safety and the relationship among IEC 61508, ISO 13849 and sector standards.
5. Distinguish safety functions, control functions and cybersecurity controls.
6. Apply industrial cybersecurity principles associated with the IEC 62443 series.
7. Integrate privacy, ethics, compliance, governance and lifecycle management into automation projects.
8. Evaluate a practical automation case and justify risk-reduction decisions.

1. Risk, Hazard and the Safety Life Cycle

A hazard is a potential source of harm. Examples include unexpected robot motion, crushing between a moving table and a fixed frame, electric shock, hot surfaces, stored pneumatic energy, toxic chemicals and loss of control caused by malicious software. Risk combines the severity of possible harm with the likelihood that harm occurs.

A useful conceptual model is:

This expression is a risk-ranking model rather than a universal physical law. Severity describes the consequence, while probability includes exposure, frequency and the chance that hazardous conditions lead to harm. Organizations normally implement this idea through a risk matrix or a numerical scoring method. Scores must not be interpreted as precise probabilities unless supported by appropriate data.

Risk assessment generally follows these steps:

1. Define the machine, process, boundaries and intended use.
2. Identify hazards during normal, abnormal, maintenance and foreseeable misuse conditions.
3. Estimate and evaluate risk.
4. Select risk-reduction measures.
5. Verify and validate the measures.
6. Document residual risk, operating limits and required training.

The hierarchy of risk reduction is important. First, eliminate the hazard through inherently safe design. Second, use engineering safeguards such as guards, interlocks, light curtains and safety-rated control systems. Third, provide information, procedures, signs and personal protective equipment. Administrative controls and PPE are important, but they should not substitute for feasible design improvements.

Risk assessment is iterative. A new guard may create a trapping point; a software update may change machine behavior; and a network connection may introduce a new attack path. Consequently, assessment must be repeated after significant design, process or software changes.

Important Terminology

• Hazard: potential source of harm.
• Harm: physical injury or damage to health.
• Risk: combination of severity and probability of harm.
• Residual risk: risk remaining after protective measures are applied.
• Safety function: function intended to achieve or maintain a safe state.
• Fail-safe: design in which a failure tends toward a safe condition.
• Safe state: condition in which hazardous energy or motion is acceptably controlled.
• Validation: confirmation, using objective evidence, that specified requirements are fulfilled.

2. Failure Mode and Effects Analysis

FMEA is a bottom-up method. The analysis begins with component or subsystem failure modes and traces their local and system-level effects. A typical worksheet contains the item, intended function, failure mode, cause, local effect, end effect, existing controls, severity, occurrence, detectability and recommended action.

Examples of failure modes include a proximity sensor stuck in the ON state, a relay contact welded closed, a broken encoder cable, loss of network communication, corrupted PLC logic or a pneumatic valve stuck open.

Traditional FMEA often assigns ratings from 1 to 10 for severity, occurrence and detectability. A risk priority number is then calculated as:

Here, S is severity, O is occurrence and D is detectability. The ratings are ordinal judgments, not necessarily ratio-scale measurements. Therefore, an RPN of 200 should not be interpreted as twice the risk of an RPN of 100. High-severity items require attention even when their RPN is modest. Modern practice also uses action-priority schemes and explicit treatment of critical characteristics rather than relying on RPN alone.

Worked Example: Sensor FMEA

Suppose a guard-door sensor has the following ratings: severity S = 9, occurrence O = 3 and detectability D = 4. Then:

The result indicates that the item deserves review, but it does not by itself establish acceptability. Because the failure can permit access to hazardous motion, appropriate actions may include dual-channel sensing, discrepancy monitoring, periodic proof testing and validation of the safety response.

FMEA is especially useful for identifying single-point failures, common-cause failures, inadequate diagnostics and maintenance tasks. Its limitations include dependence on the team’s experience, difficulty representing complex interactions and the possibility that human or software failures are treated superficially. FMEA should therefore be combined with fault-tree analysis, task analysis and cybersecurity threat assessment where appropriate.

3. Fault-Tree Analysis

Fault-tree analysis (FTA) is a top-down, deductive method. It begins with a defined top event, such as “operator exposed to hazardous robot motion,” and decomposes that event into contributing failures using logical gates.

An OR gate means that any input can produce the output. An AND gate means that all specified inputs must occur, subject to the stated assumptions. For independent events A and B:

The AND expression applies only when the events are statistically independent. For rare, independent events, P(A OR B) ≈ P(A) + P(B). If events share a cause—such as loss of a common power supply—the independence assumption is invalid and the tree must include the common-cause event.

Worked Example: Protective Shutdown

Assume hazardous motion occurs when either a safety relay fails to de-energize, or both of two independent position sensors fail to detect an open guard. Let the relay failure probability during a defined mission be P_R = 0.001, and each sensor failure probability be P_S = 0.01. The sensor failures are assumed independent, and the relay failure is independent of the sensors.

The probability of both sensor failures is:

The top-event probability is:

Thus, under the stated assumptions, P_T ≈ 1.10 × 10^-3. The result is conditional on the mission interval, failure definitions and independence assumptions. Real safety analysis must also consider common-cause failures, systematic software faults, testing intervals and human interaction.

FTA identifies minimal cut sets: the smallest combinations of events sufficient to cause the top event. It is valuable for safety cases and quantitative reasoning, but its quality depends on a clearly defined top event and complete system knowledge.

4. Reliability Engineering

Reliability is the probability that an item performs its required function under stated conditions for a stated time. It is not identical to safety: a highly reliable machine may repeatedly perform an unsafe function, while a safe system may intentionally stop frequently.

For a constant failure rate λ and an exponential lifetime distribution, reliability is:

Here, t is time and λ is the constant failure rate in inverse time units. The model assumes statistically independent failures and a constant hazard rate, which is most appropriate for the useful-life region of a bathtub curve—not for infant mortality or wear-out.

The mean time to failure under this model is:

For a repairable item with failure rate λ and repair rate μ, steady-state availability is often approximated by:

where MTBF = 1/λ is mean time between failures and MTTR = 1/μ is mean time to repair. These relationships assume stable rates and a suitable steady-state model. They do not capture planned maintenance, spares shortages, logistics delays or software restoration effort unless those are included in the model.

For independent components in series, every component must function:

For independent, active parallel components, the system functions if at least one functions:

Redundancy improves reliability only if failures are sufficiently independent and the switching, diagnostics and common resources are reliable. Redundant channels connected to the same power supply, exposed to the same environmental stress or containing identical software defects may fail together.

5. Functional Safety and Machine Safety

Functional safety is the part of overall safety that depends on systems or equipment operating correctly in response to inputs. A safety instrumented function may detect a dangerous condition, execute logic and bring equipment to a safe state. Examples include emergency stopping, guard-door interlocking, overspeed shutdown and prevention of unexpected restart.

IEC 61508 is a generic functional-safety framework for electrical, electronic and programmable electronic safety-related systems. It establishes a safety life cycle, hazard and risk analysis, allocation of safety requirements, hardware and software development controls, verification, validation, competence management and modification procedures. It uses Safety Integrity Levels (SIL 1 to SIL 4), with higher levels requiring greater risk reduction and more rigorous measures. SIL is assigned to a safety function, not casually to an entire machine or product.

ISO 13849-1 is directed specifically toward safety-related parts of control systems used in machinery. It uses Performance Levels (PL a to PL e), considering architecture, diagnostic coverage, common-cause failure and component reliability. PL and SIL are related risk-reduction concepts but are not interchangeable labels. The applicable standard and calculation method must be selected according to the equipment and regulatory context.

A safety function should be specified in measurable terms. For example: “When the guard is opened, hazardous motor torque shall be removed within 200 ms; restart shall require guard closure and a deliberate reset outside the hazard zone.” The specification should define input devices, logic, output devices, reaction time, reset behavior, fault response, proof testing and validation criteria.

Common machine-safety principles include:

• guarding and separation from hazards;
• emergency-stop functions where required;
• prevention of unexpected start-up;
• energy isolation and lockout/tagout;
• monitored interlocks and safe speed or torque functions;
• fail-safe circuit design;
• diagnostic coverage and fault reaction;
• clear operator interfaces and safe manual modes.

Emergency stop is not a substitute for guarding or risk elimination. It is a protective measure intended to stop hazardous motion quickly when a dangerous situation is recognized.

6. Industrial Cybersecurity and IEC 62443

Industrial control systems differ from ordinary information systems. Availability, deterministic timing, physical safety and long equipment lifetimes are often more important than rapid software change. Cybersecurity must therefore protect the confidentiality, integrity and availability of information while preserving safe operation.

IEC 62443 provides a family of standards for industrial automation and control-system security. It addresses asset owners, service providers, component suppliers and system integrators. Important concepts include zones, conduits, security levels, secure development and defense in depth.

A zone is a group of assets with common security requirements. A conduit is a controlled communication path between zones. A practical architecture may separate enterprise IT, a demilitarized zone, supervisory systems, control networks and safety systems. Segmentation limits lateral movement and makes monitoring more meaningful.

Security controls include:

• asset inventories and network diagrams;
• unique identities and least privilege;
• multi-factor authentication for remote access where feasible;
• secure configuration and removal of default credentials;
• firewalls, allow-listing and controlled conduits;
• application and firmware integrity checks;
• vulnerability and patch management;
• tested backups and recovery procedures;
• logging, time synchronization and anomaly detection;
• incident-response and business-continuity plans;
• supplier security requirements and secure disposal.

Safety and cybersecurity are connected but distinct. A cyberattack may change a set point, suppress an alarm or inhibit a shutdown. Conversely, an overly aggressive security control may interrupt a safety-critical communication path. Safety functions should be designed to reach a safe state even when ordinary communications fail, and cybersecurity risk assessment should be integrated with hazard analysis.

Artificial intelligence can support anomaly detection, predictive maintenance and log analysis. However, AI outputs should not be treated as inherently trustworthy. Training-data bias, false positives, adversarial inputs and unexplained decisions can create operational or safety risks. AI should normally assist qualified personnel rather than silently override validated safety functions.

7. Privacy, Ethics and Governance

Automation systems increasingly collect video, badge records, biometric information, operator performance data and machine-generated production records. These data may identify individuals or reveal commercially sensitive processes. Privacy principles include purpose limitation, data minimization, access control, retention limits, transparency and secure disposal. Applicable laws depend on jurisdiction and sector; engineering teams must consult organizational legal and compliance specialists rather than assuming that one regulation applies universally.

Ethical engineering requires more than legal compliance. Engineers have duties to protect life, communicate residual risk honestly, avoid misleading safety claims, preserve professional independence and report dangerous conditions. Productivity targets must not encourage bypassing interlocks or suppressing near-miss reporting.

Effective governance assigns responsibility across the life cycle:

Management of change is particularly important. A change to a sensor, PLC program, network switch, robot tool or production recipe may alter both safety and cybersecurity risk. No change should be considered “minor” solely because it is software-based.

8. Integrated Life-Cycle Assurance

A disciplined project begins with concept-level hazard and threat identification. During design, safety requirements, cybersecurity requirements and reliability targets are allocated to components and interfaces. During implementation, configuration control and competence assurance prevent unauthorized or poorly understood changes. During commissioning, protective functions are tested under normal, faulted and foreseeable misuse conditions. During operation, inspections, proof tests, patching, backups and incident exercises preserve the original safety case.

A useful assurance argument contains:

1. a claim, such as “the cell prevents access to hazardous motion during automatic operation”;
2. subclaims concerning guards, interlocks, logic, stopping performance and reset control;
3. evidence from analysis, inspection, testing and training records;
4. explicit assumptions and residual risks.

The distinction between verification and validation is essential. Verification asks whether the design was built according to its specified requirements. Validation asks whether the resulting system is suitable and safe for its intended use in its real operating context.

9. Illustrative Case: Robotic Palletizing Cell

Background

A manufacturing plant installs a robotic palletizing cell. Boxes enter on a conveyor, a robot transfers them to pallets, and an operator periodically replenishes pallets. The cell includes a perimeter fence, access gates, a PLC, a safety controller, light curtains, an emergency-stop circuit and an industrial Ethernet connection to the plant network.

Problem

During commissioning, the risk assessment identifies three concerns. First, a gate switch can fail in the closed indication while the gate is open. Second, the safety controller and robot controller share a poorly documented network path. Third, operators sometimes reset faults from outside the intended reset location, creating uncertainty about whether anyone is inside the cell.

Analysis

An FMEA identifies the gate-switch failure as high severity. A fault tree shows that hazardous motion can occur if the gate signal is falsely closed and the stopping command fails or is bypassed. A cybersecurity review identifies unauthorized remote access and compromised engineering workstations as plausible threats. A task analysis shows that pallet replenishment creates frequent exposure opportunities.

The team also discovers that the light curtain and gate switch use a common 24 V power supply. Treating their failures as independent would overstate the benefit of redundancy. This is a common-cause issue requiring redesign or justified analysis.

Approach and Solution

The team adopts dual-channel, monitored gate interlocking; separates safety power where justified; validates stopping time; relocates reset controls so the operator can observe the hazard zone; and prevents automatic restart after gate closure. The robot’s safety-rated stop interface is tested independently of ordinary network traffic.

For cybersecurity, the cell is placed in a controlled zone. Remote engineering access requires approval, individual accounts, multi-factor authentication and time-limited access. The PLC and robot configurations are backed up, firmware changes are controlled, and network conduits restrict unnecessary traffic. Logs are reviewed and an incident-response procedure is rehearsed.

Outcome

Validation demonstrates that opening the gate removes hazardous motion within the specified time, faults are detected, and reset cannot occur without appropriate observation. The cybersecurity review confirms that ordinary plant-network compromise does not directly provide unrestricted programming access. Operators receive training on residual risks, energy isolation and reporting of abnormal behavior.

Learning Points

The case illustrates that safety analysis, reliability analysis and cybersecurity analysis cannot be isolated. Redundant sensors may share common causes; a network may be outside the safety loop but still influence risk; and human reset behavior can defeat technically sound controls. Evidence, not equipment labels, establishes whether the system satisfies its requirements.

10. Challenges, Limitations and Best Practices

Risk matrices can create false precision, FMEA ratings can be subjective, and reliability models can fail when data are sparse or assumptions are unrealistic. Standards provide frameworks, not automatic safety. Certification of a component does not certify the complete application, and a secure product can be deployed insecurely.

Best practice is to:

• define boundaries and assumptions explicitly;
• use multidisciplinary teams involving operators and maintainers;
• analyze normal operation, maintenance and foreseeable misuse;
• address common-cause and systematic failures;
• separate safety functions from ordinary control where required;
• maintain traceability from hazard to requirement to test evidence;
• use defense in depth for networks and access;
• test recovery, not only prevention;
• control changes throughout the life cycle;
• review incidents and near misses without blame;
• reassess risk when production, software, personnel or connectivity changes.

Chapter Summary

Safe and trustworthy automation requires integrated treatment of hazards, failures, cyber threats and organizational responsibility. Risk assessment identifies hazards and guides the hierarchy of controls. FMEA proceeds from component failures to effects, while fault-tree analysis proceeds from an unwanted top event to combinations of causes. Reliability models such as exponential reliability and series/parallel equations are useful only under stated assumptions.

IEC 61508 provides a generic functional-safety life cycle; ISO 13849 addresses machinery control systems using Performance Levels; and IEC 62443 structures industrial cybersecurity through roles, zones, conduits, secure development and defense in depth. Safety functions must be specified, verified and validated, and cybersecurity controls must not undermine safe operation. Privacy, ethics, competence, documentation and management of change are essential governance responsibilities. The central professional principle is that safety and security are demonstrated through evidence across the complete life cycle, not claimed from individual components or labels.

Key Terms

Hazard: A potential source of harm.

Risk: Combination of the severity and probability of harm.

Residual risk: Risk remaining after protective measures.

FMEA: Bottom-up analysis of failure modes, causes and effects.

Fault-tree analysis: Top-down deductive analysis of an unwanted top event.

Failure rate: Frequency of failure under defined conditions, commonly denoted λ.

Reliability: Probability of performing a required function for a stated time.

Availability: Probability that a repairable item is operational when required.

Safety function: Function intended to achieve or maintain a safe state.

Functional safety: Safety dependent on correct operation of electrical, electronic or programmable systems.

SIL: Safety Integrity Level used in IEC 61508 and related frameworks.

Performance Level: Machinery-control reliability and diagnostic classification in ISO 13849.

Common-cause failure: Failure of multiple channels due to a shared cause.

Validation: Confirmation that the system is suitable for its intended use.

Zone: Group of industrial assets with common security requirements.

Conduit: Controlled communication path between security zones.

Defense in depth: Multiple complementary layers of protection.

Management of change: Controlled process for assessing and approving modifications.

Residual risk: Risk remaining after controls have been implemented.

Safety case: Structured argument supported by evidence that safety requirements are met.

Review Questions

5 Short Answer Questions

1. Distinguish a hazard from a risk.
2. What is the principal difference between FMEA and fault-tree analysis?
3. State the assumptions behind the exponential reliability model.
4. Why are SIL and Performance Level not interchangeable labels?
5. Define a zone and a conduit in industrial cybersecurity.

5 Long Answer Questions

1. Explain the hierarchy of risk reduction and discuss why PPE should not replace inherently safe design.
2. Describe how a safety function should be specified, verified and validated.
3. Explain the relationship between reliability, availability and maintainability in an automation system.
4. Discuss how common-cause failures can reduce the benefit of redundant safety channels.
5. Explain how governance, privacy and ethics influence the life-cycle management of an industrial automation system.

3 Analytical / Application Questions

1. Construct an FMEA for a conveyor emergency-stop function, including at least four failure modes, their effects and proposed controls.
2. A protective system has two independent sensor channels, each with mission failure probability 0.02, and an independent logic-unit failure probability of 0.001. Calculate the probability that both sensors fail and the approximate top-event probability when the top event is logic failure OR both sensor failures. State your assumptions.
3. Design a preliminary safety and cybersecurity architecture for a robotic cell connected to a factory network. Justify your zones, conduits, safety functions, access controls and validation evidence.

Multiple Choice Questions with Answers

Question 1

Which method proceeds from component failure modes toward system effects?

A. Fault-tree analysis

B. FMEA

C. Monte Carlo simulation

D. Penetration testing

Correct Answer: B. FMEA

Question 2

For independent events A and B, which expression gives the probability that both occur?

A. P(A) + P(B)

B. P(A) − P(B)

C. P(A)P(B)

D. 1 − P(A)P(B)

Correct Answer: C. P(A)P(B)

Question 3

Under the constant-failure-rate exponential model, reliability is represented by:

A. R(t) = 1 − e^−λt

B. R(t) = e^−λt

C. R(t) = λt

D. R(t) = t/λ

Correct Answer: B. R(t) = e^−λt

Question 4

What is the primary purpose of a safety function?

A. Increase production speed under all conditions

B. Collect marketing information

C. Achieve or maintain a safe state

D. Replace all operator training

Correct Answer: C. Achieve or maintain a safe state

Question 5

Which standard provides a generic functional-safety framework for electrical, electronic and programmable electronic systems?

A. IEC 61508

B. IEC 62443 only

C. ISO 9001

D. ISO 14001

Correct Answer: A. IEC 61508

Question 6

In IEC 62443 terminology, what is a conduit?

A. A physical machine guard

B. A controlled communication path between zones

C. A type of emergency stop

D. A reliability distribution

Correct Answer: B. A controlled communication path between zones

Question 7

Why can identical redundant channels fail together?

A. Because redundancy always reduces reliability

B. Because common-cause failures may affect both channels

C. Because parallel systems cannot be tested

D. Because only software can fail

Correct Answer: B. Because common-cause failures may affect both channels

Question 8

What does validation primarily ask?

A. Was the design built according to specified requirements?

B. Is the completed system suitable and safe for its intended use?

C. Was the purchase order approved?

D. Was the component manufactured cheaply?

Correct Answer: B. Is the completed system suitable and safe for its intended use?

Question 9

An FMEA uses ratings S = 8, O = 2 and D = 5. What is the RPN?

A. 15

B. 40

C. 80

D. 100

Correct Answer: C. 80

Question 10

Which action best represents defense in depth?

A. Using one password for every device

B. Relying only on operator vigilance

C. Combining segmentation, access control, monitoring and recovery

D. Disconnecting all safety documentation

Correct Answer: C. Combining segmentation, access control, monitoring and recovery