A Functional Safety Assessment is an independent review of whether functional safety activities have been planned, performed and evidenced appropriately for a project or operating facility. It is not simply a design calculation review and it is not the same as routine verification. An FSA looks across the lifecycle to determine whether the processes, decisions and deliverables provide confidence that the Safety Instrumented Functions will achieve and maintain their intended safety performance.
For process-industry applications, Functional Safety Assessments are commonly aligned with IEC 61511. The assessment should be proportionate to the complexity and risk of the project and should be carried out by people with sufficient competence and independence from the work being assessed.
What is the purpose of an FSA?
The purpose is to provide objective assurance that the functional safety lifecycle has been followed and that important safety decisions are supported by adequate evidence. An FSA does not replace engineering design, HAZOP, LOPA or verification. Instead, it checks that these activities form a coherent and controlled lifecycle.
The assessor may review whether hazards have been identified, SIL targets are justified, requirements are complete, verification has been performed, testing is adequate, outstanding actions are controlled and the organisation is ready to move to the next lifecycle stage.
FSA versus verification
Verification checks whether the output of a lifecycle phase satisfies the input requirements for that phase. For example, SIL verification demonstrates that a proposed SIF design can meet its required integrity.
An FSA has a broader assurance role. It asks whether the overall functional safety activities and management arrangements are sufficient and whether the lifecycle can progress safely.
FSA versus validation
Safety validation confirms that the installed and commissioned SIF performs in accordance with the Safety Requirements Specification. It is an end-to-end technical test of the implemented function.
An FSA may review the validation plan and results, but it does not substitute for the validation testing itself.
When are Functional Safety Assessments performed?
Assessments are commonly performed at key lifecycle transition points. The exact stages and required independence should follow the project or company functional safety management procedure. Typical points include after hazard and risk assessment, before detailed SIS design is accepted, before introduction of hazards during commissioning, before start-up and after significant modifications.
Operating facilities may also use assessments to review ongoing lifecycle management, proof testing, bypass control, demand performance and management of change.
Reviewing hazard and risk assessment
The assessor looks for a clear link between identified hazardous scenarios and the SIFs that have been allocated to control them. Inputs may include HAZOP, LOPA and other risk studies.
The FSA is not normally intended to repeat the whole HAZOP, but it should confirm that the scenario basis supporting the functional safety requirements is controlled and that significant actions affecting SIF definition have been addressed.
Reviewing SIL determination
The assessment should confirm that each SIF has an appropriate target and that the decision is traceable to an approved risk method. For LOPA-based determinations, the assessor may examine initiating event frequencies, credited IPLs, modifiers and the resulting required Risk Reduction Factor.
Our guide to SIL assessment and classification explains the technical basis of this step.
Reviewing the SRS
The SRS should be sufficiently complete and controlled to support design and validation. The assessor may check whether SIF purpose, trip setpoints, voting, safe state, response time, SIL target, reset logic, bypass requirements and proof-test assumptions are documented.
Unresolved placeholders or conflicting requirements can indicate that design is progressing before the safety basis is mature.
Reviewing SIS design and verification
The FSA may review architecture, separation, common-cause considerations, device suitability, application programming controls and SIL verification evidence. It should be clear that the design meets both functional and integrity requirements.
Where verification depends on specific proof-test intervals or diagnostic assumptions, those requirements need to be carried into operating documentation.
Reviewing competence and functional safety management
Functional safety depends on people and processes as well as hardware. The assessment may review defined roles, competence, verification responsibilities, document control, change management and independence arrangements.
Competence should match the tasks being performed. A complex SIL verification, for example, requires different capability from routine instrument maintenance.
Reviewing commissioning and validation readiness
Before introduction of hazardous materials, the assessor may check that installation inspections, loop checks, cause-and-effect testing, proof-test procedures and validation plans are sufficiently complete.
Temporary overrides and commissioning bypasses should be identified and controlled so that the plant does not enter operation with hidden impairment of safety functions.
Reviewing operations and maintenance arrangements
Before start-up, there should be practical arrangements for proof testing, fault response, bypass approval, override monitoring and demand reporting. The maintenance system should contain the intervals assumed in the verification.
Our article on SIF proof testing and bypass management covers these operational controls in more detail.
Managing FSA findings
Assessment findings should be clear, risk-based and traceable. Not every comment needs to prevent lifecycle progression, but critical gaps should be resolved before the associated risk is introduced.
Actions should identify what evidence is needed for closure rather than merely state that a document needs updating.
Independence of the assessor
The required degree of independence generally increases with complexity and risk. The assessor should be sufficiently separate from the work to provide objective challenge and should not simply approve their own design decisions.
Organisations should define independence requirements in their functional safety management plan.
FSA and brownfield modifications
Brownfield projects can be challenging because new functions interact with existing SIS architecture, old documentation and operating practices. An FSA can help confirm that modifications have been incorporated into the lifecycle rather than treated as isolated logic changes.
Changes to setpoints, proof-test intervals, voting or final elements should be assessed through Management of Change and reflected in the relevant SRS and verification records.
Functional safety assessment support
Pro Engineers supports Functional Safety Assessments, SIL classification, SRS development, SIL verification and related lifecycle reviews. Our approach is to focus on traceability: the hazard basis, required function, design evidence and operating controls should all tell the same story.
To discuss an FSA for a project milestone, start-up or brownfield modification, contact Pro Engineers.