Functional Safety

What is Functional Safety?

Functional Safety is the part of the overall safety of a plant or machine that depends on automatic protective functions working correctly, detecting a dangerous deviation and bringing the system into a safe state on their own. It is not about strong structures or good insulation, but about active functions: a sensor measures, a logic solver decides and an actuator acts. The basic standard is IEC 61508, which defines functional safety for electrical, electronic and programmable electronic (E/E/PE) systems. Sector standards such as IEC 61511 for the process industry and IEC 62061 and ISO 13849 for machinery translate that foundation into practice.

A safety function is only valuable if it works at the moment things go wrong. Functional safety makes that reliability measurable and demonstrable.

🧠 What is and is not functional safety?

The distinction lies in whether safety depends on a function that has to work. Two examples from an electric motor make this clear:

• Functional safety - a temperature sensor in the windings that switches the motor off before it overheats. If the sensor or the circuit fails, the protection is gone.
• Not functional safety - extra heat-resistant insulation on the windings. It protects passively and does not need to detect or switch anything.

The same applies in the process industry. A mechanical pressure relief valve or a bursting disc is a valuable protection layer, but falls outside the E/E/PE scope of IEC 61508 and IEC 61511. A pressure measurement that shuts off the feed through a SIS is a safety function in the sense of those standards. In a LOPA, both count as independent protection layers.

Functional safety is also different from fail-safe design. Fail-safe is a design principle: on loss of power or a broken wire, a system drops into a safe position. Functional safety is the broader framework that also covers failure probabilities, diagnostics, testing, competence and change management.

🧱 What are the building blocks of a safety function?

Every safety function follows the same chain: sense, decide, act. If one link fails, the whole function fails.

In the process industry a safety function is called a SIF (Safety Instrumented Function); all SIFs together form the SIS. In machinery, IEC 62061 speaks of an SCS (safety-related control system) and ISO 13849 of SRP/CS (safety-related parts of control systems). To achieve the required reliability, designers use redundancy (for example two sensors in 1oo2 voting), diagnostics that detect faults automatically, and periodic proof tests for faults that diagnostics cannot see.

📏 Which standards apply to functional safety?

IEC 61508 is the generic umbrella standard. Edition 1 was published in 1998 and 2000, edition 2 from 2010 is still current, and edition 3 is expected around 2027. Manufacturers of components such as safety PLCs and transmitters certify their products against IEC 61508. Users then apply those components according to a sector standard:

For machinery, the choice between IEC 62061 and ISO 13849 mostly depends on the technology and the builder’s habits. Both are harmonised under the Machinery Directive and therefore give a presumption of conformity.

📊 How do you determine how reliable a safety function must be?

First you identify the hazards: with a HAZOP in the process industry, or with a risk assessment to ISO 12100 for machinery. You then determine how much risk reduction is still needed after the other protection layers. That translates into a SIL (Safety Integrity Level) or a Performance Level (PL):

A SIL 2 function in low demand may therefore fail on average less than once in a hundred demands: a risk reduction factor of 100 to 1,000. Most process safeguards operate in low demand (demanded at most once a year), most machine functions in high demand or continuous mode. A SIL is only achieved when three things hold: the calculated failure probability, sufficient hardware fault tolerance and the systematic capability of every component. A standard PLC usually lacks that evidence, so in practice you choose a safety PLC certified to IEC 61508.

🔄 Why does functional safety cover the whole lifecycle?

Most accidents involving control systems are not caused by an exotic hardware fault, but by mistakes in specification and management. In its publication Out of control (first edition 1995, revised in 2003), the British regulator HSE analysed 34 control system incidents. The primary causes by lifecycle phase:

That is why IEC 61508 defines a safety lifecycle of 16 phases: from concept and hazard analysis through the safety requirements specification, realisation and validation to operation, modification and decommissioning. IEC 61511 follows the same logic for process plants. Around it, the standards require functional safety management: demonstrable competence of everyone involved, documented verification and an independent functional safety assessment (FSA). IEC 61511 has five FSA stages; the third, after installation and validation, must be completed before the hazard is present in the plant. Changes go through management of change, because a seemingly small modification can disable a safety function.

🏭 Practical examples

• Emergency stop on a production line - a safety relay or safety PLC uses Safe Torque Off to make the drives torque-free, a stop category 0 to IEC 60204-1.
• Tank overfill protection - an independent level switch closes the filling line. The Buncefield disaster (United Kingdom, 11 December 2005) showed what happens when such a switch is not properly managed: around 250,000 litres of petrol overflowed and exploded.
• Burner management - flame monitoring closes the gas valves when the flame goes out, so that no explosive mixture builds up.
• Door locking with an interlock - a robot cell stops or stays locked as long as the movement is dangerous.
• Turbine overspeed protection - a safety PLC with a SIL 2 function closes the steam supply on overspeed, independently of the DCS.

🔐 How are functional safety and cybersecurity related?

A safety function that can be switched off remotely no longer delivers any risk reduction. That became reality in 2017 with TRITON: malware tried to reprogram the Triconex safety controllers of a petrochemical plant in Saudi Arabia. Since then, the link between safety and security has become a fixed part of the standards:

• IEC 61508 edition 2 requires the hazard analysis to consider malicious actions and refers to IEC 62443 for countermeasures.
• IEC 61511 edition 2016 requires a security risk assessment of the SIS in clause 8.2.4.
• IEC TR 63069 (2019) describes how IEC 61508 and IEC 62443 are applied together.
• The Machinery Regulation (EU) 2023/1230 requires, from 20 January 2027, in Annex III that safety-relevant hardware and software withstand intentional corruption.

Cyber-Informed Engineering goes one step further: for every protection layer it asks whether the same attacker can reach it too, and values non-digital layers such as a mechanical relief valve as the last line of defence.

🧭 How do you approach functional safety in the Netherlands?

There is no separate law that prescribes functional safety. The obligation follows from the duty of care in the Dutch Working Conditions Act (Arbowet), from the Machinery Directive (and from 2027 the Machinery Regulation) for machines with CE marking, and for Seveso establishments from the Environment and Planning Act (Omgevingswet), which absorbed the Brzo 2015 on 1 January 2024. Regulators regard IEC 61511 as the state of the art for instrumented safeguards; see Seveso and Cybersecurity. Since 15 August 2026 the Cybersecurity Act also applies to many chemical and energy companies.

A practical approach:

1. Identify the hazards - HAZOP for process plants, ISO 12100 for machinery.
2. Determine the required risk reduction - with LOPA, a risk graph or the PL graph from ISO 13849-1.
3. Specify the requirements - per function the safe state, response time, SIL or PL and proof test interval.
4. Design and verify - select certified components and calculate the failure probability.
5. Validate and assess - test the complete function and have an independent FSA carried out.
6. Manage the operating phase - carry out proof tests, record demands and failures, limit bypasses and secure the system according to IEC 62443.

❓ Frequently asked questions

What is the difference between functional safety and safety?

Safety is the overall safety of a plant, including its construction, procedures and personal protective equipment. Functional safety is the part of it that depends on automatic safeguards that must act at the right moment. A guard rail is safety, an emergency stop circuit is functional safety.

Is functional safety a legal requirement?

Functional safety is not laid down as such in Dutch or EU law. The Working Conditions Act, the Machinery Directive and, for Seveso establishments, the Environment and Planning Act do require risks to be controlled according to the state of the art. Standards such as IEC 61511, IEC 62061 and ISO 13849 are the recognised way to demonstrate that.

What is the difference between SIL and PL?

SIL (Safety Integrity Level) comes from IEC 61508, IEC 61511 and IEC 62061 and has levels 1 to 4. PL (Performance Level) comes from ISO 13849-1 and runs from a to e. Both express the reliability of a safety function; PL d roughly corresponds to SIL 2 and PL e to SIL 3.

Can a standard PLC perform a safety function?

A standard PLC is not developed and certified to IEC 61508 and therefore cannot in practice support a SIL or PL claim. IEC 61511 does offer a prior-use route based on documented operating experience, but for a programmable logic solver it is rarely feasible, so you use a safety PLC or a certified safety relay. In the process industry, a protection layer in the basic process control system may claim a risk reduction of at most 10.

Who is allowed to do functional safety work?

IEC 61508 and IEC 61511 require everyone working on the safety lifecycle to be demonstrably competent. There is no statutory qualification, but companies record competence through training, experience and often personal certificates from certification bodies. The functional safety assessment is carried out by an experienced person who is independent of the design team.

What does cybersecurity have to do with functional safety?

A safety system that is reachable over the network can be disabled by an attacker, as the TRITON malware attempted in 2017. That is why IEC 61511 has required a security risk assessment of the SIS since 2016. Functional safety and OT security therefore have to be designed and managed together.

📌 In summary

Functional Safety ensures that automatic safeguards act with demonstrable reliability whenever a plant or machine threatens to enter a hazardous state. With IEC 61508 as its foundation, sector standards such as IEC 61511, IEC 62061 and ISO 13849, SIL and PL requirements and a full lifecycle from hazard analysis to change management, functional safety is indispensable in chemicals, oil and gas, energy, food and machine building. Since TRITON, cybersecurity has become an inseparable part of it.