Safety PLC

What is a Safety PLC?

A Safety PLC is a programmable controller specifically designed and certified to execute safety functions, such as an emergency stop, guard door monitoring or a process shutdown, and to force a safe state by itself whenever an internal or external fault occurs. Where a standard PLC is built for productivity, a safety PLC is built to protect people, machines and installations. It is certified to IEC 61508, usually up to SIL 3 and Performance Level e, and forms the computing core of safety systems in machine building and the process industry.

🧠 How does a Safety PLC differ from a standard PLC?

The difference is not on the outside but in how the controller deals with faults. A standard PLC assumes the hardware works; a safety PLC assumes something will eventually go wrong and must detect it within a fixed time.

Many modern systems combine both worlds: a standard program and a safety program run on the same CPU but are strictly separated. The standard program may read safety data but can never influence it.

🎯 What is a Safety PLC used for?

A safety PLC executes the safety functions that follow from the risk assessment. Typical applications in machine building and the process industry:

🔧 How does a Safety PLC work?

A safety PLC executes a safety function following the chain sense → decide → act:

1. Detect - fail-safe sensors such as a light curtain, an emergency stop button or a pressure transmitter deliver a signal, often over two channels
2. Compare - the controller compares both channels; a discrepancy counts as a fault
3. Decide - the safety logic, possibly including an interlock, determines whether the machine or process must stop
4. Act - safe outputs de-energise actuators such as contactors, valves or the Safe Torque Off input of a drive
5. Self-test - the controller continuously tests memory, processors, clock and outputs; when it finds a fault it moves to the safe state within the specified response time

The safe state is almost always de-energised: output off, motor stopped, valve closed or open towards the safe side. That is why safety circuits follow the normally energised (de-energise to trip) principle: a broken wire also leads to a shutdown.

Two main architectures are common. In machine building you mostly find 1oo2D (two channels with diagnostics) or a single CPU with time- and code-diverse processing. In the process industry, an SIS or emergency shutdown (ESD) system often uses TMR (triple modular redundant) controllers with 2oo3 voting: three processors vote, so a single failed channel causes neither an unsafe state nor a spurious trip. This improves both safety and availability, a form of redundancy that a standard PLC lacks.

📏 Which standards and SIL levels apply to a Safety PLC?

The safety PLC itself is certified against the basic standard IEC 61508. The application it is used in falls under a sector standard:

Each SIL corresponds to a maximum failure probability. For SIL 3, that is an average probability of failure on demand (PFDavg) between 10⁻⁴ and 10⁻³ in low-demand mode, or a probability of dangerous failure per hour (PFHd) between 10⁻⁸ and 10⁻⁷ in high-demand or continuous mode. PL e uses the same PFHd band as SIL 3.

SIL 4 exists in IEC 61508, but programmable safety PLCs are not certified for it. For the rare SIL 4 applications, hardwired systems without software exist, such as HIMA Planar4.

🔗 How does a Safety PLC communicate safely?

Safe I/O is increasingly connected over the network rather than by hardwiring. Safety PLCs therefore use safety protocols that run on top of a standard industrial network:

• PROFIsafe (IEC 61784-3-3) - over PROFINET and PROFIBUS, used by Siemens and Phoenix Contact among others
• CIP Safety (IEC 61784-3-2) - over IP, used by Rockwell Automation and Omron among others
• FSoE (Safety over EtherCAT, IEC 61784-3-12) - over EtherCAT, used by Beckhoff among others

All three follow the black channel principle: the underlying network is treated as untrusted. The safety layer itself detects corrupted, repeated, lost, delayed or masqueraded messages using sequence numbers, CRCs, connection IDs and a watchdog time. This protects against random faults, but not against a deliberate attack: that requires cybersecurity.

🏭 Which Safety PLCs are on the market?

Mind the nuances per product: a GuardLogix 5580, for example, only reaches SIL 3 / PL e in combination with its safety partner; on its own the controller reaches SIL 2 / PL d. The manufacturer’s safety manual is always authoritative.

🧭 How do you program and validate a Safety PLC?

Programming a safety PLC is not a matter of writing logic and downloading it. Under IEC 62061, ISO 13849 or IEC 61511 you follow a lifecycle:

1. Risk assessment - determine the required risk reduction for each hazard, using a HAZOP and LOPA in the process industry or a risk graph in machine building
2. Safety requirements specification - record each safety function with its required SIL or PL, response time and safe state
3. Choose the architecture - select sensors, safety PLC and actuators and calculate the PFHd or PFDavg, for ISO 13849 for example with the free IFA tool SISTEMA
4. Program - use the manufacturer’s certified function blocks and keep the safety program small and simple
5. Verify and validate - test every safety function, including fault simulation such as wire breaks and short circuits, and record the program checksum
6. Manage - every modification goes through change management with impact analysis and retesting; overrides and bypasses are logged

In the EU this is not optional. Under the Machinery Directive and, from 20 January 2027, the Machinery Regulation (EU) 2023/1230, logic units to ensure safety functions are on the list of high-risk products, and the regulation explicitly recognises that software can also be a safety component. For Dutch chemical sites covered by the Brzo (the Dutch implementation of the Seveso III directive), IEC 61511 is the state of the art for designing and managing an SIS.

🔐 How do you protect a Safety PLC against cyberattacks?

The assumption that a safety system is “separate” from everything else proved untenable in 2017. In the TRITON attack on a petrochemical plant in Saudi Arabia, attackers moved from the IT network to the engineering workstation of the Triconex controllers and tried to modify the safety logic. The controllers’ key switch was in the PROGRAM position, which allowed remote programming. Only a bug in the malware tripped the process to its safe state and led to discovery.

Since edition 2 (2016), IEC 61511-1 therefore requires a security risk assessment of the SIS in clause 8.2.4. Practical measures based on IEC 62443:

• Separate zone - place the safety system in its own zone following the zones and conduits model, separated from the process control system through network segmentation
• Key switch in RUN - keep the mode switch in the operating position by default and monitor every change
• Protected engineering workstation - no internet access, strong authentication, and used only during planned changes
• Checksum monitoring - periodically compare the program checksum with the validated version
• Monitoring - detect engineering traffic to the safety PLC outside maintenance windows

❓ Frequently asked questions

What is the difference between a safety PLC and a safety relay?

A safety relay usually monitors one or a few fixed safety functions, such as a single emergency stop circuit, and is not freely programmable. A safety PLC can combine dozens to hundreds of safety functions in software and communicate with safe I/O over a network. Beyond a handful of functions, or with many machine variants, a safety PLC is usually cheaper and more flexible.

Can a safety PLC also perform normal control tasks?

Many safety PLCs, such as the Siemens S7-1500F and Rockwell GuardLogix, run a standard program and a safety program side by side on the same CPU. The safety program is strictly isolated and is certified and validated separately. In the process industry, by contrast, the SIS is often deliberately kept separate from the process control system.

What SIL level does a safety PLC achieve?

Common safety PLCs are certified up to SIL 3 according to IEC 61508 and PL e according to ISO 13849-1. The final SIL, however, applies to the complete safety function, including sensors and actuators, not to the controller alone. A SIL 3 safety PLC therefore does not deliver a SIL 3 function if the sensor only reaches SIL 1.

Is a safety PLC more expensive than a standard PLC?

A safety PLC costs more per unit than a comparable standard PLC, and programming, validation and documentation take extra hours. On the other hand, a single safety PLC often replaces many separate safety relays and a lot of wiring. The total cost therefore depends mainly on the number of safety functions.

What role did a safety PLC play in TRITON?

In the TRITON attack of 2017, a Triconex safety PLC from Schneider Electric was the target: the attackers wanted to modify the safety logic so the system would no longer intervene in a dangerous situation. It was the first publicly known attack aimed specifically at a safety instrumented system. The incident made clear that a safety PLC needs cybersecurity too.

Which programming languages does a safety PLC use?

A safety PLC usually uses a restricted variant of the IEC 61131-3 languages, such as safe ladder logic or a function block diagram with certified function blocks. That restriction makes the program easier to verify and test. Unrestricted languages such as Structured Text are often not permitted, or only to a limited extent, in safety programs.

📌 In summary

A Safety PLC is a certified controller that executes safety functions reliably, detects its own faults and forces a safe state on any failure, typically up to SIL 3 and PL e. With standards such as IEC 61508, IEC 62061, ISO 13849-1 and IEC 61511, safety protocols such as PROFIsafe and CIP Safety and, since TRITON, cybersecurity based on IEC 62443, it forms the last automatic line of defence in machines and process plants.