'Safe-by-design' — the four-question test

Yesterday's post defined "safe-by-design" and noted that it's industry vernacular — not a defined term in any safety standard. Today is the practical test: four questions that separate serious safety engineering from marketing copy.

Question 1: Can you name your SIL or PL target?

Every safety architecture built to IEC 61508 or ISO 13849 starts with a quantified target derived from hazard analysis and risk assessment. SIL 2 for a collaborative robot application. PL d for a machinery safety function. The target defines the hardware fault tolerance, the diagnostic coverage, the software development rigor, and the assessment independence. "Working toward certification" is not a target. A number is.

Question 2: Can you describe your redundancy architecture?

IEC 61508-2 defines architectural constraints that link SIL capability to hardware fault tolerance. A SIL 2 system with high diagnostic coverage can use a single-channel architecture. A SIL 3 system typically requires dual-channel with diversity. The architecture determines how the system handles random hardware failures. "We have dual processors" is a component fact. "Dual-channel with diverse software on hardware-logic and microcontroller, cross-monitored with independent watchdogs" is an architecture.

Question 3: Can you show how software updates get re-certified?

This is the question that will matter most after January 2027. Under EU Machinery Regulation 2023/1230, the manufacturer retains lifecycle obligations for software modifications that affect safety functions. A model update that changes inference behavior may invalidate the original conformity assessment. "We'll handle that later" means it isn't designed in. A real answer describes the impact analysis process, the regression test suite, and the re-assessment trigger criteria.

Question 4: Can you demonstrate fallback behavior under sensor failure?

What does the robot do when the LiDAR returns garbage data? When the camera feed drops? When the force-torque sensor saturates? The IEC 61508 concept of a defined safe state requires that the system's response to detectable failures is specified, tested, and documented. If the answer is "it stops and alerts the operator" — that may be the right answer for the application. If there is no answer — the safety claim is aspirational, not engineered.

These four questions aren't a standard. They're a filter derived from real engineering requirements in IEC 61508, ISO 13849, and EU 2023/1230. A vendor who can answer all four clearly is doing the work. A vendor who deflects on all four is doing the marketing.

@misc{melchior2026safe,
  author       = {Melchior, Mati},
  title        = {{'Safe-by-design' — the four-question test}},
  howpublished = {Physical AI Safety},
  year         = {2026},
  month        = aug,
  date         = {2026-08-27},
  url          = {https://physical-ai-safety.com/blog/safe-by-design-four-question-test}
}