The invention relates to a safety controller and to a method for loading a new operating program onto such a safety controller. The safety controller has an input module for automatically reading process signals, a failsafe signal processing module for automatically processing the process signals, and a failsafe output module which produces control signals as a function of the signal processing module. The signal processing module comprises at least one programmable processor and at least one read only memory. A current operating program for the processor is stored in a non-volatile form in the read only memory. A download device for transferring a new operating program is provided in the safety controller, with the download device enabling or inhibiting the transfer of a new operating program in a failsafe manner as a function of enabling information.