SAFETY CONTROLLER WITH CYBER-SECURE MAINTENANCE OVERRIDE

A safety controller includes an interface circuit coupled to IO devices coupled to field devices coupled to processing equipment, a primary controller including a primary processor and a secondary controller including a secondary processor each for implementing control loops that automatically take actions by sending control signals to the actuators, and a bus coupling the interface circuit and a mode-switching multi-key switch. The multi-key switch includes a force (FRC) enable key-switch having a FRC enable On position for entering a maintenance override mode and an OFF position, and a FRC reset key-switch having a FRC reset position for removal of maintenance overrides. Following entry of a first maintenance override and the FRC enable key-switch is then returned to the OFF position, there are no changes to the first maintenance override while new maintenance overrides cannot be added until the FRC enable key-switch is set to the FRC On position again.