Software Stack and Cybersecurity

Software Safety, Traceability, and Cybersecurity Routing

Source: rag/reference_models/Software_Safety_and_Intrinsic_Safety_Standards.md

Scope Boundary

This page is a routing and implementation-boundary guide. Key limits:

Quick Answers

Fast Routing Table

Question Start With Also Add
Machinery safety PLC software IEC 62061 or ISO 13849-1 ISO 12100, IEC 60204-1, NFPA 79
Process / chemical shutdown software IEC 61511 IEC 61508-2/-3/-6
Generic safety-related software lifecycle IEC 61508-3 IEC 61508-2/-6
PLC programming language / code structure IEC 61131-3 A safety lifecycle standard if any safety claim is made
Secure PLC software development IEC 62443-4-1 IEC 62443-4-2, IEC 62443-3-3
Redundancy, voting, sensor count IEC 61508-2/-6, IEC 61511, IEC 62061, ISO 13849-1 Device safety manuals
Cable routing and shielding IEC 60204-1, NFPA 79, NEC, UL 508A EMC and environmental requirements
Intrinsically safe loops IEC 60079-11, IEC 60079-14, IEC 60079-25 US hazardous-location code path if applicable

PLC Language Standard vs Safety Claim Standard

Use IEC 61131-3 for language and software-structure questions such as:

The current edition is IEC 61131-3:2025, published May 2025. Older installed bases and current vendor platforms may implement earlier editions. Verify the edition in use against the applicable vendor platform documentation.

Key point: if the code reduces risk, the language standard is only one part of the answer. Pair it with:

Normal PLC vs Safety PLC vs SIS

Topic Normal PLC logic Safety PLC logic SIS logic
Main purpose Machine control Risk reduction on machinery Process hazard reduction
Typical standards IEC 61131-3:2025 ISO 13849-1:2023, IEC 62061:2021+AMD1:2024, ISO 13850:2015, IEC 60204-1 IEC 61511-1:2016+AMD1:2017
Typical function Sequence motors, valves, conveyors E-stop, guard door, safety interlock High pressure trip, burner management, reactor shutdown
Hardware expectation Standard PLC I/O Safety-rated I/O / safety relay / safety PLC SIS logic solver, dedicated field devices
Redundancy Usually not required Used when risk target demands it Common when SIL target demands it
Coding expectation Functional correctness Safety lifecycle, validation, controlled reset, fault response Safety lifecycle, SRS, validation, proof testing
Traceability Helpful Expected Expected
Logging Ops/alarm history Safety events and changes Trips, bypasses, proof tests, demand/fault history

What Traceability and Logging Mean in Practice

For safety-related logic, traceability usually means:

Typical logged events are:

What usually does not need logging:

Safety Route Decision

flowchart TD
    A[Control logic question] --> B{Does the code reduce risk?}
    B -->|No| C[IEC 61131-3 for language and structure]
    B -->|Yes| D{Application domain?}
    D -->|Machinery| E[ISO 13849-1 or IEC 62061]
    D -->|Process| F[IEC 61511]
    E --> G[IEC 60204-1 and NFPA 79 for electrical implementation]
    F --> H[IEC 61508-2/-3/-6 for lifecycle and architecture depth]
    B --> I{Networked or remotely maintained?}
    I -->|Yes| J[IEC 62443-4-1 / 4-2 / 3-3]

Worked E-Stop Pattern

An emergency stop is usually not implemented as ordinary PLC logic alone. A typical machinery architecture is:

Simplified safety-ladder intent:

Rung 1: ESTOP_HEALTHY := SI_ESTOP_CH1 AND SI_ESTOP_CH2
Rung 2: CHANNEL_FAULT := (SI_ESTOP_CH1 XOR SI_ESTOP_CH2) for longer than discrepancy time
Rung 3: FEEDBACK_OK   := SI_K1_FB AND SI_K2_FB
Rung 4: RESET_VALID   := RisingEdge(SI_RESET_PB) AND ESTOP_HEALTHY AND NOT CHANNEL_FAULT AND FEEDBACK_OK
Rung 5: SAFETY_ENABLE := ESTOP_HEALTHY AND NOT CHANNEL_FAULT AND FEEDBACK_OK AND RESET_VALID
Rung 6: SO_K1 := SAFETY_ENABLE; SO_K2 := SAFETY_ENABLE
Rung 7: export ESTOP_ACTIVE, SAFETY_OK, RESET_REQUIRED, FEEDBACK_FAULT, CHANNEL_FAULT

I/O List

Safety inputs:

Safety outputs: SO_K1, SO_K2 — safety outputs to contactors K1 and K2

Standard PLC / HMI read-only status tags (exported from safety PLC): ESTOP_ACTIVE, SAFETY_OK, RESET_REQUIRED, FEEDBACK_FAULT, CHANNEL_FAULT

Architecture

flowchart LR
  subgraph Field["Field Devices"]
    EST1["E-stop CH1 (NC)"]
    EST2["E-stop CH2 (NC)"]
    RST["Reset PB (NO)"]
    K1FB["K1 Feedback (NC)"]
    K2FB["K2 Feedback (NC)"]
  end

  subgraph S["Safety PLC"]
    SI["Safety Inputs"]
    LOGIC["Safety Logic\ndual-channel check\ndiscrepancy check\nmanual reset\nfeedback monitor"]
    SO["Safety Outputs"]
  end

  subgraph P["Power Circuit"]
    K1["Contactor K1"]
    K2["Contactor K2"]
    M["Motor"]
  end

  subgraph C["Standard PLC / HMI"]
    PLC["Standard PLC"]
    HMI["HMI / Event Log"]
  end

  EST1 --> SI
  EST2 --> SI
  RST --> SI
  K1FB --> SI
  K2FB --> SI
  SI --> LOGIC
  LOGIC --> SO
  SO --> K1
  SO --> K2
  K1 --> K2 --> M
  LOGIC -. "status only" .-> PLC
  PLC -. "display / log" .-> HMI

State Machine

stateDiagram-v2
  [*] --> SafeStopped

  SafeStopped --> ReadyForReset : CH1 healthy, CH2 healthy, feedback OK
  ReadyForReset --> SafetyEnabled : Manual reset accepted
  SafetyEnabled --> Running : Standard PLC run command
  Running --> SafeStopped : E-stop pressed
  SafetyEnabled --> SafeStopped : E-stop pressed
  Running --> Faulted : Channel fault or feedback fault
  SafetyEnabled --> Faulted : Channel fault or feedback fault
  Faulted --> ReadyForReset : Fault cleared, channels healthy
  Faulted --> SafeStopped : E-stop still active

Sequence of Operation

Normal start:

  1. E-stop released; both NC channels closed; FEEDBACK_OK true.
  2. Operator presses Reset; RESET_VALID true for one scan.
  3. SAFETY_ENABLE sets; SO_K1 and SO_K2 energize; SAFETY_OK exported.
  4. Standard PLC may now start motor.

E-stop pressed:

  1. Both NC channels open; ESTOP_HEALTHY drops immediately.
  2. SAFETY_ENABLE clears; SO_K1 and SO_K2 de-energize; contactors open.
  3. Exported: ESTOP_ACTIVE = true, SAFETY_OK = false, RESET_REQUIRED = true.

After E-stop release:

  1. Channels may return healthy — safety outputs remain off, no auto-restart.
  2. Manual reset required. If feedback or channels are wrong, reset is rejected.

Welded contactor fault:

  1. Contactor fails to open; feedback doesn’t indicate de-energized state.
  2. FEEDBACK_FAULT = true; reset blocked and fault logged.

What must be documented

Logging

Log: E-stop pressed/cleared — reset attempted/accepted/rejected — CHANNEL_FAULT, FEEDBACK_FAULT, module fault — downloads, edits, mode changes — bypass/force/inhibit attempts — security events when networked (IEC 62443-3-3, IEC 62443-4-1, IEC 62443-4-2)

Do not log: every rung state on every scan — every bit transition forever — normal non-safety sequence details

Vendor-Specific Patterns

Rockwell GuardLogix

Note: Instruction names and operands are vendor-specific. Verify against the applicable Studio 5000 Logix Designer documentation for the installed platform version.

Typical safety tags:

  • EStop_A, EStop_B — E-stop dual-channel inputs
  • PB_Reset, PB_FaultReset — reset pushbuttons
  • K1_FB, K2_FB — contactor feedback inputs
  • SafeIn_CombinedStatus, SafeOut_CombinedStatus — Guard I/O health status
  • ESTOP_E1 — ESTOP instruction backing tag
  • CROUT_M1 — CROUT instruction backing tag

Rung structure (pseudocode):

Rung 1: ESTOP(ESTOP_E1, ResetType:=1, ChannelA:=EStop_A, ChannelB:=EStop_B,
               CircuitReset:=PB_Reset, FaultReset:=PB_FaultReset)

Rung 2: OSF(PB_Reset, PB_Reset_OSF)

Rung 3: CROUT(CROUT_M1, Actuate:=ESTOP_E1.O1, Feedback1:=K1_FB, Feedback2:=K2_FB,
              InputStatus:=SafeIn_CombinedStatus, OutputStatus:=SafeOut_CombinedStatus,
              Reset:=PB_Reset_OSF)

Rung 4: SO_K1 := CROUT_M1.O1
         SO_K2 := CROUT_M1.O2

What to log: ESTOP_E1.FP, ESTOP_E1.II, ESTOP_E1.CRHO — CROUT_M1.FP, CROUT_M1.FaultCode — safety signature/download/change events

Official references:

  • ESTOP and CROUT instructions: Studio 5000 Logix Designer safety instructions reference
  • GuardLogix 5580 and Compact GuardLogix 5380 safety reference manual
Siemens S7-1500F / ET200SP

Note: Instruction names and operands are vendor-specific. Verify against the applicable TIA Portal F-library and S7-1500F safety programming manual for the installed firmware and hardware version.

Typical safety tags:

  • fdiEstopGlobal — F-DI dual-channel evaluated E-stop signal
  • DataToSafety.Acknowledge — standard-to-safety acknowledge crossing
  • fdiK1Fb, fdiK2Fb — contactor feedback inputs
  • qSafetyK1, qSafetyK2 — safety outputs to contactors
  • qSafetyK1_VS, qSafetyK2_VS — F-DO value status bits

F-program network structure (pseudocode):

Network 1 — GlobalEstop : ESTOP1
  E_STOP := fdiEstopGlobal; ACK_NEC := TRUE; ACK := DataToSafety.Acknowledge

Network 2 — FbK1 : FDBACK
  ON := GlobalEstop.Q; FEEDBACK := fdiK1Fb; QBAD_FIO := qSafetyK1_VS
  ACK_NEC := TRUE; ACK := DataToSafety.Acknowledge; FDB_TIME := T#500ms; Q := qSafetyK1

Network 3 — FbK2 : FDBACK
  ON := GlobalEstop.Q; FEEDBACK := fdiK2Fb; QBAD_FIO := qSafetyK2_VS
  ACK_NEC := TRUE; ACK := DataToSafety.Acknowledge; FDB_TIME := T#500ms; Q := qSafetyK2

Network 4 — AckGlobal : ACK_GL
  ACK_GLOB := DataToSafety.Acknowledge

What to log: GlobalEstop.ACK_REQ/DIAG — FbK1/FbK2.ERROR/ACK_REQ/DIAG — F-I/O passivation/reintegration — safety compile/download/signature/mode change

Official references:

  • ESTOP1, FDBACK, ACK_GL: S7-1500F safety programming manual (Siemens Industry Online Support)
  • Feedback monitoring application: support article 21331098
  • Safety programming guideline: support article 109750255

Cybersecurity and Hazardous-Area Routing

Cybersecurity

Use IEC 62443-4-1 when the question is secure development for PLC or controller software products. Add IEC 62443-4-2 and IEC 62443-3-3 when the question moves into component and system security requirements.

This family complements functional safety. It does not replace IEC 61508, IEC 61511, IEC 62061, or ISO 13849.

Intrinsic Safety

For sensors, barriers, and I/O in classified locations, start with:

These detailed rules are not confirmed in the local corpus. Verify against the published standards and the applicable US code or listing path where relevant.

Trust Boundary — Engineering Judgment Required

This site is a personal-use paraphrase and navigation reference for industrial automation standards. It is not a substitute for authoritative standards documents, professional engineering judgment, or legal review. All content is sourced from a local RAG corpus and has not been independently verified against current published editions.

Items marked TO VERIFY have limited or unconfirmed local coverage. Items marked NOT IN CORPUS are not covered in the local repository. Do not rely on this site for compliance determinations, safety-critical design decisions, or legal interpretation.