Functional Safety Assessment and Audit

Functional safety assessment is an important review activity required by IEC 61511 and IEC 61508. It must be carried out at least once before start-up of a new or modified automated safety instrumented system.

The activity must be led by a senior, competent person who is not involved with the step or steps being assessed.

The end expectation of a functional safety assessment is a judgement on the functional safety conformance and safety integrity achieved by every safety instrumented function within the system(s) being assessed.

Ideally, duty holders plan functional safety assessment at the outset of a new project or modification. Every organisation involved in delivering functional safety equipment or services must be aware of its responsibilities.

Functional safety audit is intentionally separated from functional safety assessment in the IEC functional safety standards. An audit of procedures and records determines whether an appropriate functional safety management system is in place, and whether it is being followed.

Somewhat like a quality or gap audit, a functional safety audit cannot be conducted until functional safety procedures are in place. The auditor looks for sufficient evidence that the procedures are being followed.

An audit alongside a functional safety assessment is an entirely valid approach for an existing installation.

The timing depends largely on the type of project or installation being assessed, and on the standard being applied.

Projects working to IEC 61511 have five recommended stages, FSA 1 to FSA 5, described in the questions below.

• The duty holder or hazard owner’s technical resources and project management, who should lead the FSA activity.
• At least one senior, functional safety competent, independent person who is not involved with the stage or stages being assessed.
• Sub-contractors providing risk assessment or engineering services.
• Suppliers of key equipment for the safety instrumented system or safety-related electrical control system.
• Any certifying bodies required to approve an application or system.

Stage 1 FSA takes place when the hazard and risk assessment is complete and the SIL targets have been selected.

It is possible to wait until the safety requirements are complete before starting stage 1, but only if they follow immediately after SIL target allocation or SIL determination. Do not wait for the requirements to fully stabilise before starting functional safety assessment.

Stage 2 FSA is best completed alongside factory acceptance testing, although it is advisable to start once the instrumentation and logic solver have been selected.

Logic solver software review should begin when the software detailed design specification is available.

Stage 3 FSA must be complete before the safety instrumented system enters service. In practice, this means the FSA 1 and FSA 2 actions must be closed out.

Key documents for this stage include the installation, commissioning and validation planning, and witnessed records showing that validation testing of each SIS and SIF is complete.

Since IEC 61511 edition 2 was published, functional safety assessment of existing safety instrumented systems after a period in operation and maintenance has been a requirement. This is FSA stage 4.

It must be led by someone independent of the operations and maintenance team.

FSA stage 5 is an assessment of any modification to safety instrumented system (SIS) or safety instrumented function (SIF) hardware or software.

Except for fully like-for-like hardware changes, an FSA 5 may repeat elements of FSA 1, 2 and 3 for a limited part of the system. All changes to software must undergo FSA 5.