Functional Safety Glossary

#

1oo1 / 1oo2 / 2oo2 (MooN concept)

The MooN notation ("M out of N") describes the architecture of redundant safety systems: M of N channels must function for the safety function to be carried out. For example, 1oo2 uses two channels where one is sufficient, which increases safety, whereas 2oo2 requires both channels and favours availability. The chosen architecture strongly influences the achievable SIL.

↑ Back to top

A

ASIL (Automotive Safety Integrity Level)

The Automotive Safety Integrity Level (ASIL) is the risk classification used for functional safety in the automotive sector under ISO 26262. It is derived from the severity, exposure and controllability of a potential hazard and ranges from ASIL A (lowest requirements) to ASIL D (highest); non-safety-relevant functions are rated "QM" (Quality Management).

↑ Back to top

B

Black Channel Principle

With the black-channel principle, the transmission network itself is not treated as safety-related. Instead, additional measures in the safety protocol – such as checksums, running counters and timeouts – protect the data so that transmission errors are reliably detected. This allows standard networks like EtherCAT or PROFINET to be used for safety communication.

↑ Back to top

C

CIP Safety

CIP Safety is the safety extension of the Common Industrial Protocol (CIP), used primarily over EtherNet/IP and DeviceNet. It transmits safety-related data up to SIL 3 over standard networks using the black-channel principle, and is maintained by ODVA.

Compliant Item

A compliant item is a building block – such as hardware, firmware or software – that demonstrably meets the requirements of IEC 61508 and comes with the corresponding evidence. Pre-certified items of this kind can be reused across safety products, reducing certification effort. In the Neuron toolkit, all elements are pre-certified as compliant items to IEC 61508.

CORA (Test Library)

CORA is the test library within the Neuron toolkit for safety-related CPU and memory tests according to IEC 61508. At its core is a test manager that administers all configured tests and calls the individual test functions automatically; for memory tests, individual memory blocks can be registered and checked systematically. This makes the hardware diagnostics required by the standard efficient to implement.

↑ Back to top

D

Diagnostic Coverage (DC)

Diagnostic Coverage (DC) indicates the proportion of dangerous failures that are detected and controlled by automatic diagnostics. A high DC value means many potentially dangerous faults are caught in time. DC is an important parameter for the achievable SIL or Performance Level.

DIN EN / EN / IEC (Standard Prefixes)

The same standard carries different prefixes depending on the region in which it applies: IEC denotes the international version, EN the European adoption and DIN EN the German edition. In practice the technical content is identical, so "DIN EN 61800-5-2" and "IEC 61800-5-2" refer to the same standard.

↑ Back to top

E

Edge Device / Industrial PC (IPC)

Industrial PCs and edge devices are robust standard computing platforms that handle automation tasks directly at the plant. Traditionally they were used only for non-safety tasks, while safety functions required a separate safety PLC. With software-based safety, safe and non-safe applications can run on the same standard hardware.

Single-Channel / Dual-Channel

Single-channel systems process a safety function along one processing path, whereas dual-channel systems use two independent paths whose results are cross-checked. Dual-channel processing detects faults that a single channel would miss and is therefore a prerequisite for high safety levels – typically SIL 2 single-channel and SIL 3 dual-channel.

EUC (Equipment Under Control)

The Equipment Under Control (EUC) is the machine, plant or device whose operation is monitored or safeguarded by a safety function. The hazards it presents are the starting point for the risk analysis under IEC 61508. The term helps to clearly separate what is being protected from what provides the protective function.

↑ Back to top

F

FMEA (Failure Mode and Effects Analysis)

FMEA (Failure Mode and Effects Analysis) is a systematic method for identifying and evaluating potential failure modes of a product or process, together with their causes and effects, at an early stage. Its aim is to prioritise risks and derive countermeasures before harm occurs. In functional safety it supports the demonstration that faults are controlled.

FSMP (Functional Safety Management Plan)

The Functional Safety Management Plan defines how functional safety is organised within a project: who is responsible for what, which activities are carried out when, and how evidence is documented. It is a prerequisite for avoiding systematic errors in the development process. Without documented safety management, no credible certification is possible.

FSoE (Fail Safe over EtherCAT / Safety over EtherCAT)

FSoE (Fail Safe over EtherCAT, also "Safety over EtherCAT") is a TÜV-certified safety protocol that transmits safety-related data over a standard EtherCAT network, up to SIL 3 per IEC 61508. The safety payload travels inside a protected container while the network itself is treated as a non-safe "black channel". This removes the need for separate safety wiring.

↑ Back to top

H

HAL (Hardware Abstraction Layer)

The Hardware Abstraction Layer (HAL) is an intermediate software layer that decouples the firmware from the specifics of the underlying hardware. This makes it possible to port the same safety firmware to different hardware architectures with comparatively little effort. In the Neuron toolkit, the HAL provides the flexible link between firmware and the respective hardware.

HFT (Hardware Fault Tolerance)

Hardware Fault Tolerance (HFT) states how many dangerous hardware faults a system can tolerate before the safety function is lost. HFT 0 means a single fault can already compromise the safety function, HFT 1 requires two independent faults and HFT 2 requires three. HFT is one of the factors limiting the SIL a system can achieve.

HIS (Hardware Independent Safety)

HIS is Neuron Automation's software-based safety solution. It delivers functional safety up to SIL 3 / PL e on standard industrial hardware such as IPCs, edge and embedded platforms, without dedicated certified safety hardware. This is achieved through a dual-diverse software architecture in which two independent channels are generated from a single IEC 61131-3 model and cyclically cross-check one another, allowing safe and non-safe applications to run on the same hardware.

↑ Back to top

I

IEC 61131-3

IEC 61131-3 is the standard for the programming languages of programmable logic controllers (PLCs). It defines the common languages across vendors – Function Block Diagram (FBD), Ladder Diagram (LD), Sequential Function Chart (SFC) and Structured Text (ST) – so that control programs and libraries remain reusable across different platforms.

IEC 61508

IEC 61508 is the foundational international standard for the functional safety of electrical, electronic and programmable electronic systems. It applies across industries and is the "parent" standard from which many sector-specific standards are derived. Among other things, it defines the SIL levels and the safety lifecycle.

IEC 61511

IEC 61511 is the functional-safety standard for the process industry (e.g. chemicals, oil and gas). It governs safety instrumented systems at plant level and addresses designers, integrators and operators. Components are typically certified to IEC 61508, while the plant itself is implemented to IEC 61511.

IEC 61784-3

IEC 61784-3 is the international standard for safety-related communication over fieldbuses (functional safety communication profiles). It describes how safety protocols such as FSoE, PROFIsafe and CIP Safety handle transmission errors, and provides the normative basis for the black-channel approach.

IEC 61800-5-2 (DIN EN 61800-5-2)

IEC 61800-5-2 is a product standard for adjustable-speed electrical power drive systems (PDS) that sets out their functional safety requirements within the framework of IEC 61508 — it defines how the drive itself must be realized as a safety subsystem, not the risk assessment of the overall machine. It covers safety functions up to SIL 3 or PL e (ISO 13849), complementing IEC 61800-5-1, which separately covers the electrical, thermal, and energy-related safety of drives.

The standard, together with related industry practice (including fieldbus safety profiles), defines the following safety functions in three groups:

Stop functions:

• STO (Safe Torque Off) – safely removes power that generates torque
• SS1 / SS1-t / SS1-r (Safe Stop 1) – safely monitored, controlled stop followed by STO
• SS2 / SS2-t / SS2-r (Safe Stop 2) – safely monitored stop, drive remains powered afterwards (transition into SOS)

Monitoring functions:

• SOS (Safe Operating Stop) – safely monitors standstill while the drive remains powered and position-controlled
• SLS (Safely-Limited Speed) – safely limits speed
• SSR (Safe Speed Range) – monitors a speed range with upper and lower limits
• SSM (Safe Speed Monitor) – safe output signal indicating whether a speed limit is exceeded or not reached
• SDI (Safe Direction) – monitors the permitted direction of motion
• SLP (Safely-Limited Position) – safely limits position
• SLI (Safely-Limited Increment) – safely limits the distance travelled after a start command (e.g. in jog mode)
• SLT (Safely-Limited Torque) – safely limits maximum torque
• STR (Safe Torque Range) – monitors a torque range with upper and lower limits
• SLA (Safely-Limited Acceleration) – safely limits maximum acceleration
• SAR (Safe Acceleration Range) – monitors an acceleration range with upper and lower limits
• SCA (Safe Cam) – safe output signal indicating whether the axis is within a defined position window

Output function:

• SBC (Safe Brake Control) – safe control of an external brake

Not covered by the standard are the application-specific hazard and risk analysis, the allocation of required safety functions and their SIL, and the driven equipment itself — responsibility for these remains with the machine builder or plant designer. The European edition is designated DIN EN 61800-5-2 or EN 61800-5-2 and is technically identical to the international IEC version.

IEC 62061

IEC 62061 is a machinery-safety standard that, unlike ISO 13849, uses the SIL as its metric. It targets electrical, electronic and programmable control systems for machinery and is the machinery-sector implementation of IEC 61508. The 2021 edition was substantially revised and now refers to a subsystem's maximum SIL rather than "SILCL".

IEC 62881

IEC 62881 standardises the cause-and-effect matrix – a simple tabular format for documenting interlocks and control logic in a consistent way. It supports communication between different engineering disciplines across the plant lifecycle. Translating these matrices into program code is outside the scope of the standard.

ISO 13849

ISO 13849 is a key machinery-safety standard covering the design of safety-related parts of control systems. It uses the Performance Level (PL a–e) as its metric and accounts for both component reliability and control-system architecture. It is commonly applied together with the Machinery Directive/Regulation.

ISO 26262

ISO 26262 is the standard for the functional safety of road vehicles and a sector-specific adaptation of IEC 61508. It introduces the ASIL as its risk metric and covers the entire development lifecycle of automotive systems. It applies to electrical and electronic systems in vehicles.

↑ Back to top

M

MTTFd (Mean Time To dangerous Failure)

MTTFd (Mean Time To dangerous Failure) is a key parameter in ISO 13849 describing the reliability of individual channels of a safety-related control. It feeds into the determination of the Performance Level. A higher MTTFd indicates more reliable components.

↑ Back to top

N

Neuron RTS (Runtime Systems Max / Micro / Nano / safe)

The Neuron RTS family are runtime systems ("soft PLCs") that execute control programs on the target hardware. RTS Max is the full-featured, hardware-independent runtime, usually combined with a real-time operating system, while RTS micro and RTS Nano are leaner variants for embedded microcontrollers. RTS safe is the safety-certified variant for running safety applications.

↑ Back to top

P

PFH (average frequency of a dangerous failure per hour)

PFH is the average frequency of a dangerous failure per hour and applies to safety functions operating in high-demand or continuous mode. It is a key metric used to demonstrate a given SIL. A lower PFH value indicates a higher level of safety.

PL (Performance Level)

The Performance Level (PL) is the machinery-safety counterpart to SIL, defined in ISO 13849. It rates the ability of safety-related control parts to perform a safety function reliably under expected conditions, on a five-step scale (PL a to PL e). PL e represents the highest reliability.

PROFIsafe

PROFIsafe is the safety protocol for the PROFIBUS and PROFINET fieldbuses. It transmits safety-related data up to SIL 3 over the existing standard network, which acts as a "black channel". It is widely used in machinery and plant automation.

↑ Back to top

R

RTOS (Real-Time Operating System)

A real-time operating system (RTOS) guarantees that tasks are executed within firmly defined time limits – not merely quickly, but predictably. This determinism is a prerequisite for a safety function to respond reliably within the required reaction time, which is why runtime systems such as Neuron RTS Max are typically combined with an RTOS.

↑ Back to top

S

Safe Motion Library (SML)

The Safe Motion Library (SML) is Neuron's pre-certified library for safe drive functions, compliant with IEC/EN 61800-5-2. It supports a configurable test manager (CORA) and covers the following safety functions:
Motion Functions:

• STO (Safe Torque Off)
• SS1 Type C (Safe Stop 1)
• SS2 Type C (Safe Stop 2)
• SOS (Safe Operating Stop)
• SLS (Safely Limited Speed)
• SLI (Safely Limited Increment)
• SLT (Safely Limited Torque)
• SLA (Safely Limited Acceleration)
• SDI (Safe Direction)
• SBC (Safe Brake Control)

Safe Motion Monitor Functions:

• SSM (Safe Speed Monitor)
• SCA (Safe Cam)

Safety Case

A safety case is a structured, documented argument that a system is acceptably safe for its intended use. It brings together claims, evidence and reasoning and serves as the basis for assessment and approval. For certification, the safety case must be traceable and substantiated.

Safety Lifecycle

The safety lifecycle is the end-to-end process defined in IEC 61508 for developing safety-related systems – from the initial risk analysis through concept, realisation and operation to decommissioning. Each phase has defined activities and evidence. This ensures that safety is addressed systematically across the entire lifetime of the system.

Safety Toolchain

A safety toolchain is the chain of tools used to develop, program, verify and document safety functions. When the toolchain itself is pre-certified, users can rely on the tools not to introduce dangerous errors into the safety application. The pre-certified toolchain in the Neuron toolkit supports safety functions up to SIL 3, PL e and ASIL C.

SBC (Safe Brake Control)

Safe Brake Control is the safety-related control of an external electromechanical brake (e.g. a motor holding brake). It ensures the brake is applied reliably and at the correct moment — for example in combination with STO, to prevent a vertical axis from dropping. SBC is one of the safety functions defined in IEC 61800-5-2.

SCA (Safe Cam)

Safe Cam provides a safe output signal indicating whether an axis is currently within a predefined position window. The function is based on safe position monitoring and is often used, for example, to release a guard door lock only once an axis is within a safe range.

SDI (Safe Direction)

Safe Direction monitors that a drive moves only in the permitted direction. If motion occurs in a non-permitted direction, the function triggers a safe reaction – often used in combination with SLS during setup mode.

SFF (Safe Failure Fraction)

The Safe Failure Fraction (SFF) is the proportion of failures that are either safe or detected by diagnostics, relative to all failures. Together with hardware fault tolerance, it determines the maximum achievable SIL via the architectural constraints. A higher SFF tends to permit a higher SIL.

SIC (Safety Integrated Core, SIC100)

The Safety Integrated Core (SIC100) is the pre-certified firmware core for safety devices rated SIL 3 or PL e. It provides the base functionality on which the rest of the safety firmware builds, and integrates both with the toolkit's SIC hardware architectures and with existing or customised hardware designs.

SIL (Safety Integrity Level)

The Safety Integrity Level (SIL) is a measure of how reliably a safety function reduces the associated risk. IEC 61508 defines four levels (SIL 1 to SIL 4), with SIL 4 representing the highest risk reduction and the most demanding requirements. The higher the target SIL, the more dependable the safety-related system must be.

SLA (Safely-Limited Acceleration)

Safely-Limited Acceleration safely limits the maximum acceleration of a drive. If the set limit is exceeded, the function triggers a safe reaction. The corresponding range-monitoring function is Safe Acceleration Range (SAR).

SLI (Safely-Limited Increment)

Safely-Limited Increment safely limits the distance a drive is permitted to travel following a start command – for example in jog mode. If the permitted distance is exceeded, the function triggers a safe stop.

SLS (Safely-Limited Speed)

Safely-Limited Speed monitors that a drive's speed does not exceed a defined limit, without automatically stopping the drive. If the limit is exceeded, the system triggers a safe reaction (e.g. STO or SS1). SLS is commonly used to allow safe access to a machine at reduced speed, such as during setup mode.

SLT (Safely-Limited Torque)

Safely-Limited Torque safely limits the maximum torque or force of a drive. Since direct torque measurement is uncommon on standard drives, monitoring is usually performed indirectly via motor current. The function is particularly relevant for collaborative robotics, where limited forces are critical for personnel safety.

SOS (Safe Operating Stop)

With Safe Operating Stop, the drive remains powered and position-controlled instead of having its power removed. Position is safely monitored, and any unintended movement triggers a safety reaction. Unlike STO, a drive can resume motion directly from SOS without needing to be re-referenced.

SRS (Safety Requirements Specification)

The Safety Requirements Specification (SRS) sets out all requirements for the safety functions and their required safety integrity (e.g. SIL). It forms the binding basis for the design, implementation and verification of the safety-related system. A clear, complete SRS is essential to avoid misunderstandings and systematic errors.

SS1 (Safe Stop 1)

Safe Stop 1 is a controlled, safely monitored stopping process: the drive is braked in a controlled manner before STO is activated at the end, removing power. There are two variants — SS1-t (time-based, without speed monitoring) and SS1-r (ramp-based, with safe monitoring of the braking process).

SS2 (Safe Stop 2)

Safe Stop 2 is similar to SS1, but the drive remains powered and controlled afterwards instead of having power removed — it transitions into the SOS state. This allows faster restart, since re-referencing (sometimes required after STO/SS1) is not necessary.

SSM (Safe Speed Monitor)

Safe Speed Monitor provides a safe output signal indicating whether a defined speed limit is exceeded or not reached. Unlike SLS, SSM itself does not trigger a stop reaction — it merely provides the information to a higher-level safety controller, which then determines the appropriate response.

STO (Safe Torque Off)

Safe Torque Off (STO) is the basic safety function of a drive: it safely removes the power that generates torque, so the motor can no longer produce torque. The drive coasts to a stop rather than being actively braked, and an unexpected restart is prevented. STO is defined in IEC 61800-5-2 (DIN EN 61800-5-2).

↑ Back to top

V

VGB R170C

VGB R170C is a guideline issued by the energy industry association VGB PowerTech (today vgbe energy) covering operation-oriented, function-related documentation of power plant instrumentation and control. It defines how I&C functions are documented in a consistent and traceable way, and is a common documentation requirement in power generation.

↑ Back to top