The industry’s answer then was a shrug. The answer today, after TRITON, PIPEDREAM, and a dozen state-sponsored near-misses, is: catastrophe . For decades, functional safety engineers operated under a sacred pact: A safety system (SIS) must be fail-safe, deterministic, and isolated. If you pulled the logic solver’s plug, the valves went to their safe position. If a sensor failed, the system defaulted to shutdown. Safety was about physics, random hardware failures, and reliability.
ISA-TR84.00.09 didn’t just predict the collision of safety and security. It gave us the tools to survive it. The only question is whether we’ll use them before the next TRITON finds its target. Next time you see a SIL-rated safety controller, don’t ask, “Is it fail-safe?” Ask, “Is it cyber-safe?” And when you get a blank stare, hand them a copy of ISA-TR84.00.09. It’s short, it’s free for ISA members, and it might just save their plant. isa-tr84.00.09
Cybersecurity wasn’t part of the equation. Why? Because the assumption was that safety networks were air-gapped, proprietary, and obscure. No hacker would bother with a Beckhoff controller or a Triconex when they could go after corporate payroll. The industry’s answer then was a shrug
But lurking in the shadows, often out of print and overlooked, is a technical report that saw the future coming: . If you pulled the logic solver’s plug, the