What is Safety?
Safety, in industry, is the combination of technical, organisational and human measures that prevents plants, machines and processes from unintentionally harming people, the environment or the installation itself. The term covers functional safety, machine safety, process safety and occupational safety, each with its own standards and legislation such as IEC 61508, ISO 13849-1, IEC 61511 and the Dutch Arbowet. In industrial automation, safety is a design principle from the very first sketch, not a feature that is bolted on afterwards.
In OT environments, safety protects not only personnel but also production continuity, local residents and corporate reputation.
🧠 What types of safety exist in industry?
Safety is an umbrella term. In practice four disciplines work side by side, each with its own perspective:
| Domain | What is it about? | Key frameworks | Typical instruments |
|---|---|---|---|
| Functional safety | Control systems that intervene reliably when a hazard or fault occurs | IEC 61508, IEC 61511, IEC 62061, ISO 13849 | SIL, PL, Safety PLC |
| Machine safety | Hazards from moving parts, stored energy and operation | Machinery Directive, Machinery Regulation, ISO 12100 | Risk assessment, CE Marking, Interlock |
| Process safety | Fire, explosion and release of hazardous substances | Seveso III Directive, IEC 61511, ATEX | HAZOP, LOPA, SIS, BOW-TIE |
| Occupational safety | Health and safety of workers on the shop floor | Arbowet, Working Conditions Decree | RI&E, VCA, permits to work |
What the four domains share is a focus on unintended events such as wear, design errors, operator mistakes or process deviations. Deliberate misuse belongs to Security.
⚙️ What is functional safety?
Functional Safety is the part of overall safety that depends on a safety function working correctly: a sensor detects a hazard, a logic solver decides and an actuator brings the installation to a safe state. The parent standard is IEC 61508 (edition 2 from 2010; edition 3 is in preparation). Sector standards are derived from it: IEC 61511 for the process industry and IEC 62061 for machinery. For machines there is also ISO 13849-1 (fourth edition, 2023), which works with Performance Levels.
The required reliability is expressed as a SIL (Safety Integrity Level) or a PL (Performance Level). For functions that are demanded continuously or frequently, the probability of a dangerous failure per hour (PFHd) is what counts:
| Performance Level | Probability of dangerous failure per hour (PFHd) | Comparable SIL | Example |
|---|---|---|---|
| PL a | 10⁻⁵ to 10⁻⁴ | none | Slight, quickly reversible injury |
| PL b | 3×10⁻⁶ to 10⁻⁵ | SIL 1 | Simple guarding |
| PL c | 10⁻⁶ to 3×10⁻⁶ | SIL 1 | Door interlock with limited risk |
| PL d | 10⁻⁷ to 10⁻⁶ | SIL 2 | Monitored access to a danger zone with risk of serious injury |
| PL e | 10⁻⁸ to 10⁻⁷ | SIL 3 | Presses and zones with frequent exposure to serious injury |
| none | 10⁻⁹ to 10⁻⁸ | SIL 4 | Rare; mainly railway signalling, not in IEC 62061 |
For process plants, where a safety function is demanded only rarely, IEC 61511 uses the average probability of failure on demand (PFDavg): SIL 1 then stands for a risk reduction factor of 10 to 100, SIL 3 for a factor of 1,000 to 10,000.
🏭 How does machine safety work?
Anyone placing a machine on the EU market must demonstrate that it meets the essential health and safety requirements of the Machinery Directive 2006/42/EC and affix the CE marking. From 20 January 2027 the Machinery Regulation (EU) 2023/1230 replaces the directive. Among other things, the regulation adds requirements for protection against corruption of software and data (cybersecurity), for self-learning control systems and for digital instructions for use.
The method follows ISO 12100 (2010 edition, revision under way):
- Determine the limits of the machine — intended use, reasonably foreseeable misuse, life-cycle phases
- Identify hazards — mechanical, electrical, thermal, noise, ergonomic
- Estimate and evaluate the risk — severity, exposure, probability and possibility of avoidance
- Reduce the risk in three steps — inherently safe design first, then technical safeguards, and only then information for use
Step 4 is where the components come in: an emergency stop (according to NEN-EN-ISO 13850), interlocks and guard locking (ISO 14119), light curtains (IEC 61496), safety distances (ISO 13855), safety relays and the Safety PLC. Electrical equipment is covered by IEC 60204-1.
🧪 What is process safety?
Process safety focuses on major accidents: fire, explosion and toxic releases in chemicals, refining and storage. The analysis starts with a HAZOP (according to IEC 61882), in which a team uses guide words such as no, more, less and reverse to work through deviations from the design intent. A LOPA then determines whether the independent protection layers together provide enough risk reduction; each layer must deliver at least a factor of 10. If a gap remains, a SIS (Safety Instrumented System) is designed with a required SIL. The SIS is kept separate from the basic process control in the DCS, so that a single failure cannot disable both the control and the protection.
In the Netherlands, companies holding large quantities of hazardous substances fall under the European Seveso III Directive (2012/18/EU). Until 2024 the Dutch implementation was the Major Accidents Risks Decree (Brzo 2015). Since the Environment and Planning Act (Omgevingswet) took effect on 1 January 2024, the rules have been incorporated into the Environmental Activities Decree and related decrees, and these sites are now called Seveso establishments. Supervision lies with the Netherlands Labour Authority, the environmental services and the safety regions.
👷 What governs occupational safety in the Netherlands?
The Arbowet (Working Conditions Act) requires every employer to record the risks to employees in an RI&E (risk inventory and evaluation) together with an action plan. The Working Conditions Decree elaborates specific topics such as work equipment, hazardous substances and explosive atmospheres (ATEX). For contractors working at high-risk sites, VCA (the SHE Checklist Contractors, managed by the Stichting Samenwerken Voor Veiligheid) is the standard certification; many clients in the process and energy sectors require it.
Occupational safety ties directly into the technology: permits to work, lockout/tagout (LOTO) procedures during maintenance and the operation of robots and cobots all need arrangements that match the safety functions of the machine.
🔐 What is the difference between safety and security?
| Characteristic | Safety | Security |
|---|---|---|
| Cause | Unintentional hazards: failures, errors, accidents | Deliberate attacks: sabotage, malware, espionage |
| Protects | People, environment and the installation | Availability, integrity and confidentiality of systems and data |
| Standards | ISO 13849, IEC 62061, IEC 61508, IEC 61511 | IEC 62443, ISO 27001 |
| Evaluation | SIL, PL, PFHd | risk assessment, SL (Security Level) |
| Changes | As few as possible after validation, via MOC | Regular patching and updating |
The two disciplines are closely linked: a system that appears functionally safe can still become hazardous through an attack. That became clear in 2017 with TRITON, malware that attempted to reprogram the Triconex safety systems from Schneider Electric at a Saudi petrochemical plant. A bug in the attack code caused the SIS controllers to trip the plant to a safe shutdown, which led to the attack being discovered.
For that reason, IEC 61511 has required a security risk assessment of the SIS in clause 8.2.4 since its second edition (2016). The technical report IEC TR 63069 (2019) describes how IEC 61508 and IEC 62443 are applied together, on the principle that security protects the safety functions and must never block a safe shutdown. The Machinery Regulation and the Cyber Resilience Act also link product safety to cybersecurity.
🔧 Which standards and components matter most?
| Standard | Description |
|---|---|
| ISO 12100 | Principles of risk assessment and risk reduction for machinery |
| ISO 13849-1 | Safety-related parts of control systems with PL (Performance Level) |
| IEC 61508 | Basic standard for functional safety (basis for SIL) |
| IEC 61511 | Functional safety in the process industry (SIS) |
| IEC 62061 | Functional safety of machinery control systems (SIL 1–3) |
| ISO 14119 | Interlocking devices associated with guards |
| IEC 60204-1 | Electrical equipment of machines |
| IEC 61439 | Low-voltage switchgear and controlgear assemblies |
Commonly used components:
- Safety PLC — certified logic for safety functions, with internal diagnostics and redundancy
- Safety relays — hardware-based monitoring and interruption of emergency stop and door circuits
- Emergency stop — manual intervention to stop a machine immediately in case of danger
- Interlock — restricts access or actions based on machine position or state
- Light curtains and safety mats — detection of people in the danger zone
- Encoders and sensors with fault detection — safe speed and position monitoring
- Safe communication — PROFIsafe and CIP Safety (based on CIP) carry safety data over ordinary networks using the black-channel principle; errors are detected in the safety layer itself
- Fail-safe design — on power loss, wire break or short circuit the system falls back to the safe state
✅ How do you ensure safety in practice?
Safety is a life cycle. A proven approach:
- Assess risks up front — RI&E, HAZOP, FMEA or ISO 12100, depending on the domain
- Specify the safety requirements — a Safety Requirements Specification with the required SIL or PL per function
- Design with certified components — and substantiate the calculation, for example with SISTEMA for ISO 13849
- Validate and test — during FAT and SAT, and afterwards with periodic proof tests
- Control changes — every modification through MOC, including software and firmware updates
- Connect safety with security — segment the SIS through network segmentation, restrict access and assess according to IEC 62443
Technology alone is not enough. Safety culture determines whether procedures are actually followed. Hudson’s well-known model distinguishes five rungs: pathological, reactive, calculative, proactive and generative. In the Netherlands this has been worked out in the Safety Culture Ladder (formerly the Veiligheidsladder), originally developed by ProRail and now managed by NEN, which clients in rail, infrastructure and energy often require. Training, reporting near misses and visible leadership are the main levers.
❓ Frequently asked questions
What is the difference between safety and functional safety?
Safety is the broad discipline that protects people, the environment and the installation from unintended harm, including machine, process and occupational safety. Functional safety is the part of safety that depends on a correctly working control system, such as a SIS or safety PLC that intervenes when a hazard occurs. Functional safety is expressed as a SIL or PL.
When do you use ISO 13849 and when IEC 62061?
Both standards cover safety-related control systems of machinery and are harmonised under the Machinery Directive. ISO 13849-1 works with Performance Levels (PL a–e) and suits electrical, pneumatic and hydraulic technologies. IEC 62061 works with SIL 1–3 and is often chosen for complex, programmable electronic control systems; since the 2021 edition it also covers non-electrical technologies.
What is a SIS?
A SIS (Safety Instrumented System) is an independent protection system in the process industry that automatically brings an installation to a safe state when a process variable reaches dangerous values. A SIS consists of sensors, a logic solver and final elements such as shut-off valves. Its design and maintenance are governed by IEC 61511.
Is an RI&E mandatory in the Netherlands?
Yes, the Dutch Working Conditions Act (Arbowet) requires every employer with staff to draw up an RI&E, including an action plan. With more than 25 employees, or when a non-recognised sector tool is used, a certified expert must review the RI&E. The RI&E is the foundation of occupational safety within a company.
Can a cyberattack disable a safety system?
Yes, the TRITON attack in 2017 showed that attackers can deliberately reprogram a SIS, with potentially physical consequences. That is why IEC 61511 requires a security risk assessment of the SIS and IEC TR 63069 recommends engineering safety and security together. Segmentation, key switches for program mode and monitoring reduce this risk.
What does the Machinery Regulation change for safety?
The Machinery Regulation (EU) 2023/1230 applies from 20 January 2027 and replaces the Machinery Directive. It adds essential requirements for protection against corruption of software and data, for self-learning control systems and for digital documentation. Manufacturers will have to demonstrate safety and cybersecurity together for the CE marking.
📌 In summary
Safety is not a stand-alone system, but an integral part of design, maintenance, culture and security in OT. Functional, machine, process and occupational safety together protect people, processes and production from the consequences of errors and failures, and they only remain effective if deliberate attacks are taken into account as well.