Safety Function
Concept
Topic overview
Quick facts
Examples include emergency stop, speed monitoring, protective field muting, safely-limited speed, and safe torque off.
Each safety function carries an integrity requirement ( or PL) derived from the risk assessment and must be specified, implemented, verified, and validated as a unit, end to end from the sensor that detects the condition, through the logic that decides, to the actuator that brings the system to a safe state.
A proper safety function specification defines far more than a name: the triggering condition, the safe state, the response time budget across the whole chain, the required integrity level, operating modes in which it is active, behavior on detected faults, and reset conditions.
Response time deserves particular attention because it drives physical layout, for example the safety distance between a light curtain and the hazard is computed directly from the total stop time.
The safety chain framing matters practically: the achieved integrity of a function is that of its weakest link and their combination, not of its best-certified component. A 3 logic solver feeding a single unmonitored contactor yields a low-integrity function. Standards therefore require the loop-level calculation and validation, not just component certificates.
The case for Safety Function
Safety functions are the unit of account for the entire safety program: integrity levels, certification claims, component budgets, and test campaigns all attach to them.
Getting the function list and their specifications right early lets teams buy the correct components once and design realistic stop-time and layout budgets; getting them wrong surfaces late as machines that fail validation, safety distances that do not fit the floor plan, or certification claims that collapse under assessment.
Customers specify safety functions in purchase contracts, so ambiguity here becomes commercial dispute later.
Safety Function in practice
Safety function execution chain
The risk assessment identifies which hazards require control-system risk reduction and assigns each resulting safety function its required PL or .
Controls engineering then writes the safety requirements specification covering trigger, safe state, timing, integrity, modes, and fault behavior; designs the sensor-logic-actuator chain; and computes the achieved integrity across the whole loop. Validation exercises each function against its specification, including fault injection and measured stop times.
Assessors look for a complete function list reconciled against the risk assessment, unambiguous specifications, loop-level integrity calculations rather than component certificates alone, and validation records with measured response times matching the assumptions used for safety distances.
Where teams get Safety Function wrong
Standards related to Safety Function
Safety Function is defined and governed by IEC 61508 - the umbrella functional safety standard defining the safety lifecycle, sil levels, and requirements for electrical, electronic, and programmable systems.
In programs run to ISO 13849-1, Safety Function is one of the things the assessor checks first - defines performance levels (pl) for safety functions implemented in control systems, including pneumatic and hydraulic parts.
Common machinery safety functions
| Function | Typical standard | Typical integrity |
|---|---|---|
| Safe Torque Off (STO) | IEC 61800-5-2 | SIL 2-3 / PL d-e |
| Emergency stop | ISO 13850 | PL c-e per risk |
| Guard interlocking | ISO 14119 | PL c-e per risk |
| Safe speed monitoring (SLS) | IEC 61800-5-2 | SIL 2 / PL d typical |
| Presence detection (ESPE) | IEC 61496 | Type 2-4, PL c-e |
Safety Function by industry
Safety Function shapes how industrial machinery teams argue safety - fixed and mobile machinery, packaging lines, and manufacturing equipment.
Robotics & Automation programs lean on Safety Function because the sector covers industrial robots, cobots, amrs, and automated warehousing systems.
Ask our team about Safety Function
Ben TwomblyFounder & CEOLeads CSA's functional-safety, certification, and engineering programs for safety-critical products and organizations. His assessor-side background informs practical programs that connect standards, engineering work, and credible evidence.
Tom CyrPrincipal Safety Engineer, IFSPSupports industrial and rail functional-safety programs with safety analysis, requirements, lifecycle planning, and certification-readiness guidance.Safety Function: related terms
How each connects to Safety Function:
SIL appears in the same lifecycle work as Safety Function and is usually produced or reviewed alongside it.
Programs that deal with Safety Function almost always involve Safe Torque Off in the same phase.
Functional Safety is governed by IEC 61508 as well, which is why the two show up together in audits.
ISO 13849-1 connects the two: Safety Function and Performance Level are assessed against the same lifecycle.
MTTFd is governed by ISO 13849-1 as well, which is why the two show up together in audits.
FMEA is governed by IEC 61508 as well, which is why the two show up together in audits.
Both Safety Function and FMEDA sit under IEC 61508, so evidence for one usually references the other.
Both Safety Function and Fault Tree Analysis sit under IEC 61508, so evidence for one usually references the other.
Both Safety Function and Verification and Validation sit under IEC 61508, so evidence for one usually references the other.
Safety Management System is governed by IEC 61508 as well, which is why the two show up together in audits.
Both Safety Function and Functional Safety Plan sit under IEC 61508, so evidence for one usually references the other.