An apparatus for industrial process control comprising one or more input modules, one or more processing modules and one or more analogue output modules, an analogue output module of said one or more analogue output modules comprising: an output drive circuit; a pair of parallel cutoff switches (62, 63); an availability management unit receiving a first signal indicating a commanded current and determining a signal to control the output drive circuit to generate a first driven current; and a safety management unit receiving a second signal indicating the commanded current and a signal indicating the first driven current; and the safety management unit comprising means to determine an expected first driven current and a difference between the first driven current and the expected first driven current and driving the pair of parallel cutoff switches (62, 63) to disable the first driven current in the event that the difference between the first driven current and the expected first driven current is greater than a predetermined threshold and in which in operation the safety management unit is arranged to alternately drive the cutoff switches such that a first one of said pair of parallel cutoff switches is switched off; a second one of said pair of parallel cutoff switches remains on; and the safety management unit determines whether the current in the said first one of said pair of parallel cutoff switches is below a predetermined minimum current threshold; or said first one of said pair of parallel cutoff switches is switched on; said second one of said pair of parallel cutoff switches is switched off; the safety management unit determines whether the current in the said second one of said pair of parallel cutoff switches is below the predetermined minimum current threshold; and in the event that any one of the pair of parallel cutoff switches allows current above said predetermined threshold when switched off the safety management unit will set the analogue output channel state to failsafe. an output drive circuit; a pair of parallel cutoff switches (62, 63); an availability management unit receiving a first signal indicating a commanded current and determining a signal to control the output drive circuit to generate a first driven current; and a safety management unit receiving a second signal indicating the commanded current and a signal indicating the first driven current; and the safety management unit comprising means to determine an expected first driven current and a difference between the first driven current and the expected first driven current and driving the pair of parallel cutoff switches (62, 63) to disable the first driven current in the event that the difference between the first driven current and the expected first driven current is greater than a predetermined threshold and in which in operation the safety management unit is arranged to alternately drive the cutoff switches such that a first one of said pair of parallel cutoff switches is switched off; a second one of said pair of parallel cutoff switches remains on; and the safety management unit determines whether the current in the said first one of said pair of parallel cutoff switches is below a predetermined minimum current threshold; or said first one of said pair of parallel cutoff switches is switched on; said second one of said pair of parallel cutoff switches is switched off; the safety management unit determines whether the current in the said second one of said pair of parallel cutoff switches is below the predetermined minimum current threshold; and in the event that any one of the pair of parallel cutoff switches allows current above said predetermined threshold when switched off the safety management unit will set the analogue output channel state to failsafe.