Safety-Critical Equipment Explained: 4 Control States Before Maintenance

Maintenance decisions become dangerous when an asset is described as “available” even though its protective function has not been demonstrated. On Headline Podcast, conversations about leadership and operational risk repeatedly return to the same question: what evidence allows a leader to keep people exposed to a hazard?

Safety-critical equipment is equipment whose failure, loss of function, or incorrect use could contribute to fatality, serious injury, major environmental harm, or a high-consequence process event. Its control state describes whether the protective function is available, degraded, unavailable, or unverified before work continues.

What does safety-critical equipment mean?

Safety-critical equipment is defined by the consequence of losing its function, not by its purchase price, size, or location. A shutdown system, pressure relief device, gas detector, machine guard, emergency shower, isolation point, or lifting brake may become safety-critical when people depend on it to prevent or limit serious harm.

The label should therefore connect an asset to a credible hazard and a protective function. A pump can be ordinary in one service and safety-critical in another if its failure changes containment, ignition, exposure, or emergency response. The OSHA Process Safety Management standard illustrates this logic by requiring covered facilities to manage process equipment, procedures, and safeguards whose failure can affect process safety.

Maintenance teams also need a clear boundary between equipment that is merely important to production and equipment that protects people. That distinction changes the approval route, test evidence, impairment controls, and authority to defer the work.

Four control states to record before maintenance

Available and verified

The equipment can perform its defined protective function, and current evidence supports that conclusion. Verification may include inspection, functional testing, calibration, proof testing, or a documented field check, depending on the asset and hazard.

Available but degraded

The equipment still provides some protection, but its reliability, capacity, response time, or operating margin is reduced. A degraded state needs a named risk owner, a time limit, compensating controls, and a decision about whether the work remains acceptable.

Unavailable or isolated

The protective function cannot be relied upon because the equipment is out of service, bypassed, locked out, removed, or intentionally isolated. The work authorization must identify the exposure created by that loss and establish controls before people enter the affected area.

Unknown or unverified

The organization cannot show whether the equipment will perform as intended. Missing records, overdue tests, conflicting tags, changed conditions, or an unclear owner can place an asset in this state. Unknown is not the same as available, so maintenance should not treat the gap as a clerical issue.

How can leaders differentiate the states in practice?

A useful review asks four connected questions. What hazard does the equipment control? What exact function is required? What evidence confirms current performance? What decision follows if that evidence is weak?

The OSHA lockout and tagout standard shows why energy isolation must be tied to a defined procedure, authorized roles, and verification rather than a label alone. For broader management-system discipline, the UK Health and Safety Executive’s HSG65 guidance connects planning, control, assurance, and review, which is useful when an organization needs to govern impaired equipment across shifts.

When should a control state change?

The state should change whenever evidence, condition, or exposure changes. A failed proof test, a temporary bypass, a new process condition, a maintenance delay, or a disagreement between the permit and the field can move equipment from verified to degraded or unknown. The change should be visible to the people who plan, authorize, execute, and supervise the work.

That visibility is more valuable than a long asset list. A short register that shows the protective function, current state, owner, expiry, compensating control, and next decision gives leaders a better basis for escalation than an inventory that only records whether the item exists.