Industrial AI Safety & Controls

The machine changed. The standard didn't.

Every critical system that has ever run inside a regulated facility has followed the same rule. A human is in control. There is proof. And when something happens, the people in the room sign the records.

That was true for the assembly line. It was true for the PLC. It is true for AI.

Industrial AI Safety & Controls Glossary

A — C — F — H — I — L — P — S — U

Air Gap

A running machine is a connected system. Energy moves. The machine works. The cycle continues. An air gap is a deliberate break in that connection. A pulled breaker. An opened valve. A disconnected line. The path is open. Energy stops moving. The machine stops. The gap between the two sides is the safety boundary. Nothing crosses that boundary until a human physically restores the connection.

Chain of Custody

Every action taken on a system has a name attached to it, or, when AI takes the action, a record of what it did and who is accountable for it. The tech who opened the panel. The AI that changed the setting. The person who signed off on the work. Chain of custody is the sequence of those actions, in order, from the first to the last. Each handoff is documented before the next begins. Skip one, human or AI, and the chain is broken.

Control Path

Every machine in a facility takes instructions from somewhere. A person turns a dial. A controller sends a signal. An actuator moves. The route from decision to action is the control path. It is physical. It runs through wires, switches, controllers, and actuators in a specific order. Nothing moves until every part of the path allows it to.

Failsafe

Every component in a critical system has a resting state. The position it returns to when power is cut, signal is lost, or something breaks. That state is engineered before the system runs. A valve that closes when pressure drops. A brake that engages when current stops. A gate that locks when the signal disappears. Failure has a direction. That direction is always toward the safe state. The engineer decided what safe looks like before the machine ever turned on.

Failsafe Open / Failsafe Closed

When the system loses power, signal, or control, every component has to land somewhere. It closes, or it opens. There is no third option. The direction is not a preference, it is a decision made in advance about which hazard is worse. A valve that shuts contains a chemical feed before it spreads, closed is safe because uncontrolled flow is the hazard. A valve that releases keeps a water supply moving through the failure, open is safe because blocked flow is the hazard. The engineer did not guess which way to fail. They looked at what the system protects, and built the failure to protect it.

Failsafe De-Energize / Failsafe Energize

Power is not neutral. It has to go somewhere, and when it stops going somewhere, something happens. De-energize is the oldest failsafe there is: cut the source, the system goes still, gravity and friction finish the job. It's the default every relay and valve assumes. But some systems are dangerous when they lose power, not when they have it, for those systems, safe means the power never stops arriving, batteries behind generators behind redundant lines, so the one component that cannot afford to go dark never does.

Failsafe Human

When the system loses power, signal, control, or trusted autonomy, someone has to be standing there who can act on the source directly. Not the signal. Not the controller. Not a screen. The breaker. The valve. The switch itself. Human is the safe state. No software sits between the person and the machine: a hand goes straight to the thing itself. Human is the safe state.

Failsafe AI

Some moments don't wait for a person to arrive, a pressure spike closing in milliseconds, a window gone before a hand could reach the panel. Failsafe AI is the state a system enters when the decision has to happen faster than any human can reach it. It acts within the limits a human already set, for exactly as long as it takes a human to arrive. When the person arrives, they inherit the full account and decide whether it was right, and whether the boundary needs to move. Failsafe AI doesn't replace Failsafe Human. It's the bridge to it, holding the door for the person who's still the one who walks through.

HMI (Human Machine Interface)

The HMI is how the human sees what the machine is doing and gives it instructions. It shows the current state of the system: temperatures, pressures, flow rates, alarm conditions, in real time. The operator gives an instruction and the PLC acts on it. The screen is not the control. It is the window into the control. The machine is still physical. The PLC is still physical. The HMI is where the human looks before they decide what to do next.

Human in the Loop

Every automated system has a cycle. A sensor reads a value. A controller makes a decision. An actuator takes an action. The cycle repeats. Human in the Loop places a person inside that cycle at a defined point. Before an action is taken, the person sees what the system is about to do and decides whether it moves forward. The system waits for that decision.

Human in Control

A human in control decides what the system does. The distinction is physical. The person can direct the system, interrupt the system, or disconnect the system entirely at any moment. That authority lives in their hands. It is verified by their identity. It is recorded when they exercise it. The system moves because a specific person decided it should.

Immutable Record

Every action taken in a regulated facility produces a record. That record captures what happened, when it happened, and who authorized it. Immutable means the record cannot be changed after it is written. A signature stays signed. A timestamp stays fixed. A recorded value stays recorded. The record reads the same tomorrow as it did the moment it was created. That is what makes it defensible.

Lockout/Tagout (LOTO)

Machines store energy. Charge in capacitors. Pressure in hydraulic lines. Tension in springs. Gravity in suspended parts. Turning a machine off does not release that energy. It only stops the cycle. Before anyone touches the machine, a safety padlock goes on the physical energy isolation point. Not the off switch. The breaker. The valve. The source. The person doing the work holds the only key. The machine stays off until that person decides otherwise.

PLC (Programmable Logic Controller) 

Every machine on a facility floor takes instructions from something. That something is usually a PLC. A PLC is a small industrial computer built to control machines. It has no screen. No keyboard. No mouse. It reads signals from sensors: temperature, pressure, position, flow. It follows programmed rules and sends instructions to motors, valves, and actuators. A PLC is built to survive the environment it lives in. Dust. Vibration. Heat. Electrical interference. It runs continuously for years. When AI acts on the physical world, it acts through a PLC.

Proof of Control

Knowing you are in control is not enough. In a regulated facility you have to prove it. Proof of control is documented evidence that a specific human had authority over a specific system at a specific moment. Not a department. Not a role. A person. Their name is on the record. Their identity verified the action. The timestamp is fixed. Control that cannot be proven is not control.

SCADA (Supervisory Control and Data Acquisition)

A facility can have dozens or hundreds of PLCs. Each one controls its own part of the process. SCADA is the system that watches all of them at once. It collects data from every PLC and gives the operator a view of the entire operation in one place. A pressure spike. A temperature deviation. A valve that failed to open. In large facilities the equipment being monitored can span miles. SCADA makes it possible for one operator to see the system as a whole. The PLC controls the machine. SCADA watches the PLC.

SIS (Safety Instrumented System)

Every facility has a control system that runs normal operations. The SIS is not that system. It runs alongside it, independent, watching for conditions the normal control system is not designed to handle. A reactor pressure climbing too high. A gas concentration reaching a dangerous threshold. A temperature rising beyond safe limits. When those conditions are detected, the SIS does not wait. It acts. Valves close. Feeds cut. Systems shut down. The SIS is designed to put the process into a safe state even when the normal control system cannot.

Ultimate Authority

Every automated system operates inside defined limits. Verified inputs. Known conditions. Approved actions. Inside those limits the system runs. Outside them, it stops acting alone. A sensor stops agreeing with the process. A condition appears that was not expected. A decision reaches beyond what the system was designed to handle. The process pauses. The decision escalates. In a regulated system, important actions do not continue until someone with authority approves them.