Section 1.2.1 on the safety and reliability of control systems is familiar to every machine builder: faults and logic errors must not lead to hazardous situations. The Machinery Regulation keeps that and adds three things that change how control systems are designed and documented.
1. Malicious attempts are an external influence
Control systems must withstand, where appropriate to the circumstances and the risks, the intended operating stresses and external influences, "including reasonably foreseeable malicious attempts from third parties leading to a hazardous situation" (1.2.1(a)).
Two limits matter. The attempt must be reasonably foreseeable, and it must lead to a hazardous situation. A stolen usage statistic is not a 1.2.1 problem; a remote command that unfolds a boom near a person is.
In practice this puts threat scenarios into the risk assessment you already do (Annex III, Part B, point 1). For each hazard, ask who could provoke it on purpose, through which interface, and with what effort. Rate those scenarios like any other risk, and reduce them in the usual order: inherently safe design first, then protective measures, then information (1.1.2(b)).
2. Safety limits stay where the risk assessment put them
The limits of safety functions are set in the risk assessment, and no modification of settings or rules, by the machine or by operators, is allowed where it could lead to a hazardous situation (1.2.1(d); see also point (c) of the "particular attention" list).
A user who raises a speed limit through a hidden menu is reasonably foreseeable misuse (1.1.2(c)). So is a third-party tool that rewrites a parameter block. The usual answer is to separate the safety limits from ordinary settings, accept them only from a signed, factory-controlled source, and keep the machine in a safe state if the check fails at start-up.
3. A tracing log for five years
The tracing log of the data generated in relation to an intervention, and of the versions of safety software uploaded after the machine was placed on the market, must be enabled for five years after each upload, exclusively to demonstrate conformity when a competent national authority asks with reasons (1.2.1(f)).
| Design question | A defensible answer |
|---|---|
| Where does the log live? | In the unit that enforces safety, so a compromised gateway cannot rewrite it |
| What is logged? | Software uploads with version and result, parameter changes, refused attempts, service connections |
| How is it protected? | Integrity-protected entries, a reserved area that routine events cannot overwrite |
| How long? | Five years counted from each upload, not from the sale |
| Who may use it? | The text says "exclusively" for conformity. Keep marketing or warranty data separate |
Machines that learn
For control systems with fully or partially self-evolving behaviour designed to operate with some autonomy, three further rules apply: no actions beyond the defined task and movement space, recording of safety-related decision-making data kept for one year, and the possibility to correct the machine at all times. Most machines today have no self-evolving safety logic. If yours does, it may also fall under Annex I, Part A, which always involves a notified body.
Loss and return
Section 1.2.6 belongs to the same picture. The interruption, re-establishment or fluctuation of the power supply or of the communication network connection must not lead to a hazardous situation: no unexpected start, no uncontrolled change of parameters, no blocked stop. A machine must reach a defined safe state when a link drops and must not act on stale commands when it returns.
How to show it
An assessor will look for three things: threat scenarios in the risk assessment with their ratings and measures; requirements that make those measures testable; and test reports that show the machine refuses what it should refuse. A requirement such as "the controller shall discard pump-start commands from the gateway and log each discarded frame" passes or fails. "The system shall be secure" does not.
This article explains Regulation (EU) 2023/1230 in plain words. It is not legal advice.