Security for Safety: Clear structures in the automation network

Andreas Willert, Head of Industrial Security at Pilz Austria

(Check against delivery)

The Machinery Regulation (EU) 2023/1230 clearly stipulates that safety can only function reliably if safety-related functions are protected against manipulation. Modern machinery is digitally networked, configured via software and adjusted during operation. Any unauthorised change – whether deliberate or accidental – can render protective measures ineffective.

That's why Security is no longer just an additional consideration, but a basic requirement for functioning safety. The aim is to ensure the integrity of all safety-related components so that safety functions are triggered exactly when they are needed.

How standards and architectural principles ensure robust safety
The IEC 62443 series of standards and the emerging EN 50742 provide a clear framework for this. Both call for a systematic safety architecture that evaluates risks, builds protective measures in a structured manner and has clear system segmentation.

At the heart of the system is the “Zones and Conduits” principle: systems are divided into zones and the transitions between them are controlled. This approach enables Defence-in-Depth, in other words a multi-layered safety strategy in which several layers of protection complement each other and make manipulation much more difficult.

In accordance with IEC 62443, Pilz advocates a strict separation of safety and standard automation. Safety functions run on separate hardware and are isolated both organisationally and technically. This means they remain unaffected by updates, bugs or attacks in the standard section. The attack surface is reduced, as is the maintenance work.

A key success factor here is the degree of isolation: the greater the separation between the safety functions and the production and machine network, the better protected they are. At the same time, the need for additional security measures is reduced.

It is therefore a well-tried approach to transfer the devices that perform safety functions into a separate network segment. It is crucial to configure this segment correctly using access policies and additional authentication mechanisms. As safety systems are very stable compared with standard automation and are rarely modified, this strict segmentation can be implemented effectively from both an efficiency and a security perspective. It is important, however, that the measures defined are consistently maintained throughout the machine’s entire lifecycle.

The availability of diagnostic data plays a particularly important role, especially in the case of larger machinery or complex plants. In the event of a fault, you want to be able to quickly establish why the safety function has been triggered: was an emergency stop operated – and if so, which one? Has a light curtain been interrupted – and at which point? Or is there possibly a short circuit in the wiring? Such information helps to significantly reduce downtimes and get the plant back up and running again quickly. Diagnostic data is not just about “what’s broken”, but above all about “what exactly happened”.

In a cleanly segmented architecture, it is nevertheless possible to forward safety diagnostic data to a standard PLC – provided that access to the actual safety functions within their protected zone remains strictly prohibited.

For simple applications, safety relays from the PNOZ range offer an appropriate solution, while for more complex machinery, a tailor-made implementation using myPNOZ is recommended. These products do not have any network capabilities and are therefore not vulnerable to remote attacks. This significantly reduces both the development work and the requirements for security measures during operation. Pilz also offers a comprehensive training and service programme – ranging from the basics of Industrial Security through to CESA certification. The content explains how to design safe architectures, assess risks and improve measures in a sustainable manner. The result is competence exactly where it is needed: among those who plan, design and are responsible for systems.

What this approach actually achieves
Separating safety from standard automation brings many benefits – throughout the entire lifecycle of a machine:

• Greater safety: safety functions are protected against unauthorised changes – regardless of what happens in the standard section.
• Less effort: updates, certifications and adjustments don't have to be duplicated.
• Less operational complexity: operators do not need an in-depth knowledge of Security; the architecture automatically ensures Safety.
• Greater flexibility: independent safety systems such as PNOZmulti 2 or myPNOZ can be integrated across a range of manufacturers.
• Lower costs: less support, fewer licences, fewer interventions – and therefore the total cost of ownership is low.

Pilz combines robust technology, clear structures and targeted training to form a “Security for Safety” strategy that meets the requirements of the standards and makes everyday life genuinely easier: it's safe, understandable and effective long-term.