SAFETY CONTROLLER WITH CYBER-SECURE MAINTENANCE OVERRIDE

A safety controller 150 includes an interface circuit 157 coupled to IO devices coupled to field devices coupled to processing equipment, a primary controller 118a including a primary processor 119a and a secondary controller 118b including a secondary processor 119b each for implementing control loops that automatically take actions by sending control signals to the actuators, and a bus 154 coupling the interface circuit 157 and a mode-switching multi-key switch 200. The multi-key switch includes a force (FRC) enable key-switch 202 having a FRC enable On position for entering a maintenance override mode and an OFF position, and a FRC reset key-switch 203 having a FRC reset position for removal of maintenance overrides. Following entry of a first maintenance override and the FRC enable key-switch is then returned to the OFF position, there are no changes to the first maintenance override while new maintenance overrides cannot be added until the FRC enable key-switch is set to the FRC On position again.