SOLUTION SERIES.DSIB

Functional Safety Assessment across the safety lifecycle

An evidence-based investigation and judgement of the functional safety achieved by one or more safety instrumented systems and/or other protection layers.

Non-Negotiable

Functional safety must be assessed by competent personnel with the required independence before hazards are introduced to the process—and IEC 61511 carries the obligation into operation and relevant modification.

Contents Jump to a section

Definition

An FSA Tests Whether Lifecycle Evidence Supports The Functional Safety Claimed.

IEC 61511-1:2016 defines Functional Safety Assessment as an evidence-based investigation and judgement of the functional safety achieved by one or more SIS and/or other protection layers. Clauses 5.2.6.1.1–5.2.6.1.10 directly govern the assessment procedure, team, planning, information, independence, findings and lifecycle timing.

The FSA reviews the work completed up to the selected stage, including earlier conclusions and actions. Verification, validation, audit, testing, interviews and inspection may all provide evidence; none alone replaces the assessment judgement.

Verification

Confirmation that the outputs of a lifecycle phase satisfy its stated inputs, requirements and engineering performance criteria, using reports, checklists, reviews, analysis or recorded tests.

Confirming through the SIL verification report that the integrity and functional requirements stated in the Process SRS are achieved, and checking that the target design has been transferred into the Design SRS.

Validation

Confirmation that the installed and commissioned SIFs and SIS meet the Safety Requirements Specification in all respects.

Executing traceable tests for trips, timing, modes, resets, bypasses, diagnostics and final actions.

Functional Safety Audit

A systematic and independent examination of whether functional-safety procedures comply with planned arrangements and are implemented effectively.

Sampling whether competence, document control, verification and change procedures are being followed.

Functional Safety Assessment

An evidence-based investigation that judges whether functional safety and safety integrity have been achieved for the agreed SIS/SIF scope.

A competent independent team reviews evidence, interviews disciplines and issues findings and an overall conclusion.

Assessment Basis

A design can be correct and still receive an FSA finding because the record of how it was developed is incomplete, inconsistent between disciplines, or held in documents without a controlled number, revision or date. IEC 61511 requires one or more FSAs before hazards are introduced, periodic assessment during operation and maintenance, and assessment of relevant modifications before work begins. Stage 3 is the mandatory pre-hazard assessment; when it is the only pre-startup FSA, its scope must also address the Stage 1 and Stage 2 work already completed, making the assessment broader and typically longer.

Gate-Pass?

IEC 61511 does not define FSA as a generic pass/fail gate. An owner, contract or project governance system may use its conclusion as an input to authorisation.

Why Assess Early?

Contractual assurance, independent challenge, engineering quality management and early correction can justify FSA1 or FSA2 before the final pre-startup judgement.

Potential Outcomes And Final Report Coverage

Each assessor applies a defined procedure, stage-specific checklist and reporting method. Terminology varies; a practical reporting structure may distinguish the following requirement-level outcomes.

Positive / Pass

The requirement is satisfied directly or through an accepted, justified alternative.

Partial Compliance

The basis is substantially present, but completion, clarification or improvement is recommended.

Action Required

A material gap or negative finding requires documented resolution at the defined lifecycle stage.

Not Applicable

The requirement does not apply to the agreed project, lifecycle stage or assessment boundary.

Final report coverage. Purpose, assessment stage and boundary; team competence and independence; applicable requirements and evidence reviewed; compliance arguments and finding status; recommendations, action ownership and timing; overall conclusion, limitations, closeout evidence and the strategy for further assessments.

Lifecycle

Collect Evidence Through 5 Lifecycle Stages

IEC 61511 identifies five useful stages for FSA activity from hazard analysis through design, pre-startup readiness, operation and change. Select a stage to see its timing and purpose; open the supporting rows for evidence, interactions, typical challenges and DSIB involvement.

FSA 01

After H&RA, protection-layer allocation and SRS development

Confirm that the project has a robust technical and management foundation before detailed SIS design proceeds.

Stage 1 examines whether hazards, required risk reduction, allocated protection layers and SIF requirements form a complete and traceable design basis. The Process SRS is the principal transfer point from analysis into design.

Evidence for FSA

Functional Safety Management Plan and lifecycle plan; competence, verification and audit arrangements; HAZOP/H&RA and LOPA or SIL target-selection study; recommendation closeout; SIF register and conceptual configuration; Process SRS; interdisciplinary work split; project quality, change, configuration and document-control procedures.

Interactions

The HAZOP/LOPA team defines the hazardous event, initiating causes, risk reduction and protection-layer assumptions. Process engineering converts these into safe state, trip points, response time, output action and operating-mode requirements. I&C challenges implementability and prepares the route into detailed design. The owner supplies risk criteria, proof-test, repair, bypass, operating and maintenance decisions. The FSM lead reconciles the interfaces and prevents unresolved assumptions from being passed downstream as design facts.

Typical Challenges

The SIF need, boundary or successful action is unclear, or HAZOP/LOPA actions remain open.
Schedule pressure advances detailed design while SIF definitions, process safety time, demand assumptions or response to detected faults are unresolved.
Owner SIL-selection criteria and the project target-selection study point to different outcomes after design has progressed.
H&RA, allocation records, P&IDs and Process SRS do not carry one consistent SIF definition.
Without an active Functional Safety Management Plan and FSM leadership, systematic errors and avoidable findings accumulate across disciplines.

How DSIB Involves

DSIB can strengthen the lifecycle basis or assess it independently. The two scopes are contracted separately and the required assessor independence is maintained.

Readiness ConsultancyFunctional Safety Management Plan preparation and leadership, clause-based H&RA/SRS review, SRS work split, verification procedures and checklists, competence development, recommendation closeout and resolution of missing SIF requirements.

Independent AssessmentStage 1 plan, evidence review, discipline interviews, compliance judgement, recommendations and documented action register.

FSA 02

After the SIS has been designed

Confirm traceability from the SRS into hardware, application program, SIL verification and planned testing.

Stage 2 reviews detailed SIS design and engineering, including systematic capability, random hardware integrity and application-program development. Published FSA2 guidance treats project evidence through FAT as part of this stage; the assessment plan states the actual design and test evidence available at the selected timing.

Evidence for FSA

Controlled Process SRS issued for review and Design SRS at final issue; P&IDs and cause-and-effect; SIF architecture and conceptual configurations; configuration and SIF-element change log; application-program requirements and logic; SIL verification; device identification, datasheets, certificates, safety manuals, reliability data and prior-use justification; loop, wiring and interface drawings; design-verification records; FAT plan, procedures, results and punch closeout; SAT and validation plans.

Interactions

Process engineering protects the functional intent. I&C and the SIS integrator implement voting, diagnostics, bypasses, alarms, resets, logic and interfaces. Mechanical, piping and electrical teams confirm final-element and ancillary-device arrangements. Procurement and vendors provide equipment-specific failure data, certificates, safety manuals and package boundaries. The owner confirms proof-test intervals, repair time, bypass arrangements, testing infrastructure, construction constraints and spurious-trip targets. Document control keeps the combined design basis reviewable.

Typical Challenges

Changes to a SIF element do not propagate through the SRS, parametric SIL verification, configuration records, drawings and vendor constraints.
Late owner preferences on proof testing, bypasses, repair time, testing infrastructure, construction or spurious-trip targets alter an advanced design.
SIS-specific verification is treated as another discipline’s task; conceptual configurations then conflict with loop, wiring or cause-and-effect documents.
Amplifiers, barriers, MCC contactors, relays and package PLCs disappear from the SIF boundary, or different logic-solver failure-data boundaries are used.
Revamp projects retain uncertain existing final elements or panels, including equipment without suitable certification, safety manuals or reliability evidence.
Vendor packages and interfaces arrive with incomplete reliability diagrams or unrecorded SIF transfers caused by communication limitations.
Late package procurement delays SIL verification, Design SRS finalisation and FAT-ready evidence.

How DSIB Involves

DSIB can prepare the design evidence for review or perform the independent Stage 2 judgement.

Readiness ConsultancyPre-FSA2 review, SIF/tag reconciliation, Process and Design SRS checks, SIL verification, configuration/change control, compliance and reliability-data review, vendor evidence requests, interface workshops, FAT evidence planning and controlled readiness package.

Independent AssessmentAssessment of the agreed hardware, application-program and FAT boundary, with a transparent checklist, discipline interviews, findings and closeout requirements.

FSA 03

After installation, pre-commissioning and final validation

Confirm that the installed SIS meets the SRS and that operations and maintenance can accept the system.

Stage 3 follows installation, pre-commissioning and final validation, after the necessary operating and maintenance procedures have been developed. IEC 61511 requires the relevant assessment before hazards are present.

Evidence for FSA

Updated SRS and as-built design; installation, inspection and pre-commissioning records; FAT punch-list closeout; SAT/SIT and validation plans and results; calibration and functional-test records; approved configuration; proof-test, operating, maintenance, bypass and emergency procedures; training and handover dossier; safety-critical equipment records; status of prior FSA actions and relevant PSSR checklist outputs.

Interactions

Construction and commissioning teams establish what was installed and tested. The SIS integrator and package vendors supply configuration, interface and test evidence. Process, I&C, mechanical and electrical disciplines resolve deviations. Owner operations, maintenance and safety teams confirm procedures, staffing, competence, spares, testability and handover readiness. Stage 3 should be coordinated with the PSSR; PSSR outputs and checklist closure can provide supporting evidence without replacing the FSA.

Typical Challenges

Pre-commissioning or commissioning records are treated as validation without demonstrating every applicable SRS requirement.
FAT changes, site modifications, temporary configurations and punch items are not traced into the as-built basis.
Package-vendor and site tests do not demonstrate integrated SIF action across every interface.
Proof-test and bypass procedures do not reflect the installed arrangement or safety-manual limits.
Operations and maintenance training, asset records, performance-data collection and action closeout are incomplete at handover.

How DSIB Involves

The focus shifts from design intent to installed evidence and operating readiness.

Readiness ConsultancyOrganisation of the full validation programme, SRS-to-test traceability, vendor and site-team integration, as-built dossier review, procedure and checklist preparation, training, FAT/SAT punch reconciliation, PSSR readiness and prior-action closeout.

Independent AssessmentPre-startup Stage 3 judgement on installation, validation, procedures, competence, handover and further FSA planning.

FSA 04

After gaining operating and maintenance experience

Confirm that operating evidence still supports the design assumptions and required safety integrity.

Stage 4 uses installed performance and the owner’s automation asset integrity arrangements to judge whether functional safety is being maintained in operation.

Evidence for FSA

Demand, trip, failure and repair records; proof-test schedules, methods, coverage and as-found/as-left results; calibration, inspection and work orders; bypass and deferral logs; alarm, incident and performance analysis; operating-limit and KPI reports; configuration, competence and safety-critical equipment records; audits, H&RA reviews and management-of-change records.

Interactions

Operations records demands, bypasses and operating context. Maintenance records testing, failures, repair and restoration. Automation and reliability teams analyse repeated failures, overdue work, test effectiveness and useful life. Process safety compares actual demand and performance with the original risk model. Management of change protects the approved configuration, procedures and SIL-verification assumptions.

Typical Challenges

Proof tests record completion but not the as-found condition, achieved coverage or detected dangerous failures.
Demand rate, repair time, bypass duration and spurious trips are not compared with SIL-verification assumptions.
Repeated failures, operating-limit excursions and overdue tasks are managed as work orders rather than functional-safety performance signals.
Equipment revisions, useful-life limits, temporary changes and configuration updates are not linked back to the SIF record.
Performance data exists in separate systems but is not translated into periodic review, trends, corrective action and retained evidence.

How DSIB Involves

DSIB connects operational data, procedures and lifecycle assumptions.

Readiness ConsultancySet-up of data-collection and reporting arrangements; review of proof-test methods, procedures and results; performance interpretation; bypass and failure-data quality checks; training; and support to management of change as a functional-safety reviewer.

Independent AssessmentPeriodic Stage 4 judgement against the SRS, actual performance, maintenance evidence and functional safety management arrangements.

FSA 05

After modification and before SIS decommissioning

Confirm that change has been analysed, authorised, implemented, verified and revalidated.

Stage 5 revisits the affected parts of Stages 1, 2 and 3. For larger changes, assessment activities can be staged before site work, during design and after revalidation.

Evidence for FSA

Approved change request and impact analysis; updated H&RA, allocation and SRS; revised hardware and application-program design; SIL verification; test, installation and validation records; configuration and authorisation records; updated procedures and training; decommissioning plan and retained-protection arrangements.

Interactions

The owner’s MOC authority defines and authorises the change. Process safety identifies affected hazards and protection layers. Engineering and the SIS integrator revise the design and software. Operations and maintenance control temporary states, testability and procedures. Decommissioning teams preserve any function still required while equipment is removed.

Typical Challenges

The impact analysis treats the changed tag but not the full SIF, shared equipment or other protection layers.
Temporary bypasses and transition hazards during site work are not included in the change plan.
Application-program revisions are tested without updating the SRS, SIL verification or proof-test procedure.
Safety-critical equipment records, operating limits, maintenance tasks and training are not updated before handover.
Revalidation is narrowed without a documented risk basis or retained evidence.

How DSIB Involves

DSIB scales the work to the size and risk of the modification.

Readiness ConsultancyMOC and impact-analysis review as the functional-safety reviewer, affected-document map, verification and revalidation planning, temporary-state controls, asset-record updates, training and closeout support.

Independent AssessmentStage 5 judgement over the affected lifecycle phases, including implementation, revalidation and continued functional safety.

FAT

End of Design Stage

FAT is not limited to logic—and it is too late to begin lifecycle alignment.

IEC 61511-1 Clause 13 places FAT after design and before installation and commissioning. Its objective is to test SIS devices against the SRS. Testing the defined logic-solver hardware, software and application-program version is central, but the planned boundary may also include panels, I/O, power, interfaces and field elements.

ISA-TR84.00.03-2019, Automation Asset Integrity of Safety Instrumented Systems (SIS), distinguishes hardware FAT (HWFAT), application-program FAT (APFAT) and integrated FAT (IFAT). Project practice varies: some FSA2 scopes exclude FAT, while others review its procedures and results. The principle is that the assessment plan must state the boundary clearly and the FSA conclusion must not imply review of evidence that was outside that boundary.

HWFAT · Panels, I/O, power & wiringAPFAT · Logic, trips, resets & bypassesIFAT · BPCS/SIS and package interfacesFault and degraded modesVersion and change controlTest records, deviations & closeout

Tools

Seamless Lifecycle Data, Integrated Engineering And Traceable Project Controls.

DSIB does not mandate use of a specific tool either in engineering design, QA/QC or engineering management processes. An integrated lifecycle platform or a controlled set of equivalent tools can be used, provided that inputs, changes, checks and outputs remain traceable.

Integrated Lifecycle Platform

exSILentia® Or An Equivalent Environment

An integrated platform supports the controlled flow of information and engineering outputs from hazard-analysis inputs and SIL target selection through the Process SRS, SIL verification and Design SRS, reducing independent re-entry between lifecycle activities. Its equipment-reliability handbook provides a broad dataset covering sensors, logic solvers, interfaces and final elements. Values assigned to individual SIF elements remain traceable, can be compared with purchased vendor packages and allow the SIL-calculation basis to be supplied promptly as assessment evidence.

Project Controls

Registers, Matrices And Controlled Documents

Project-control arrangements vary between engineering organisations. Some requirements may be covered through general engineering practice or Safety-Critical Element Integrity Verification procedures. Within an FSM programme, dedicated documentation can include a SIF register, conceptual-configuration sheets, SRS responsibility matrix, IEC 61508 compliance register, certificate and safety-manual index, interface and RFI register, change logs, document/evidence index and action tracker. These records make design status, cross-discipline communication and assessment readiness visible between formal deliverables.

DSIB Solution Model

Readiness And Independent Assessment Serve Different Purposes.

Readiness Consultancy builds the controlled lifecycle evidence and engineering process before assessment. Independent FSA reviews that evidence and issues the judgement. DSIB does not combine the two roles within the same scope where independence would be compromised.

Solution 01

Readiness Consultancy

DSIB works with the project or operating organisation before the formal assessment. The scope can be a focused evidence review or an extended FSM and lifecycle-integration assignment.

See The Whole Scope

Functional Safety Management Plan preparation and day-to-day FSM leadership
Stage-specific readiness plan, evidence index and internal pre-assessment
Engineering verification steps, procedures and discipline checklists
Interdisciplinary SRS work split, design interfaces and consistency checks
Collection and review of compliance, certification and reliability data
Validation strategy, procedures, checklists and SRS-to-test traceability
Review of RFIs, action registers, configuration changes and MOC logs
Training, assessor package, technical responses and closeout coordination

Solution 02

Independent Functional Safety Assessment

DSIB appoints a competent assessment team with the independence required by IEC 61511 and issues the documented judgement for the agreed stage and boundary.

See The Whole Scope

Assessment plan, checklist, scope, participants and information request
Evidence review, interviews and technical clarification
Requirement-by-requirement compliance arguments
Finding classification, recommendations and action ownership
Overall conclusion and strategy for further FSAs
Closeout review against submitted resolution evidence

For an Independent FSA, DSIB issues the assessment plan and information request in advance. Transparency of scope and evidence requirements does not alter the independence of the judgement.

CASE / FSA1+2

Case Study

Preparing An EPC Engineering Team For An Independent FSA On A Major Refinery Revamp.

Process facility at night — Representative, non-identifying image · Supplied for unrestricted use

DSIB principals served within the functional-safety management structure of a Türkiye-based engineering contractor on a long-duration EPC project, taking responsibility for readiness through the external FSA1–2. The assessment itself was performed by EXIDA. The project, owner, EPC parties, site and technical identifiers remain anonymous.

Engineering processes were aligned to the IEC 61511 lifecycle and to the evidence needed to demonstrate compliance. Process, risk, I&C and design teams were trained in the selected tools and in the expected detail of their outputs.

In parallel, the project Functional Safety Management Plan, internal procedures and engineering work splits were established and led through the FSM role.

Scope Of Involvement

01Lifecycle Alignment

Project planning, procedures, work splits, competence and internal pre-assessments.

02Engineering Integration

HAZOP/LOPA feedback, Process SRS, Design SRS, SIL verification and design checks.

03External Interfaces

Owner inputs, vendor evidence, existing systems, package boundaries and RFIs.

04Assessment Coordination

Readiness package, clarification, revision control, response and final-report support.

Result5Minor Action Items After A Broad FSA1–2 Review

1Supporting evidence for generic data used at one step in the logic-solver calculations.

1Site-application evidence for one SIF.

2Parametric revisions to SIL verification for two SIFs.

1Completion of missing wiring diagrams.

The five items were resolvable through evidence and controlled engineering updates. They did not create a material cost item, major rework or project delay. More importantly, the organisation retained a sustainable and robust functional safety management practice rather than a one-time assessment file.

Why it succeededEarly lifecycle involvement, visible FSM ownership, trained discipline leads, seamless SIF information flow, transparent owner/vendor interfaces and internal pre-assessments before the external review.

What it demonstratesAssessment readiness is an engineering-management outcome. When started before FAT, most corrections remain design decisions and desktop reworks rather than construction changes.

ConfidentialityThis case is silent on all project, client, contractor, site, document, tag, design-value and correspondence identifiers. The description is limited to the verified scope, working methods and anonymised outcome categories.

FSA stages in the lifecycle

DSIB service models per stage

Controlled evidence base

Assessment, not inspection alone

The assessment follows what the lifecycle has produced.

FSA is a judgement based on evidence. It considers whether the safety lifecycle work completed before the assessment stage supports the functional safety and safety integrity claimed for each SIF.

IEC 61511 separates Functional Safety Assessment from verification, validation and functional safety audit. Verification confirms that requirements for a lifecycle phase have been fulfilled. Validation confirms that the installed SIS meets the SRS. Audit examines whether the functional safety management system is in place, current and followed. Evidence from these activities supports the FSA judgement.

Assessment basis The FSA team reviews lifecycle work not already covered by previous assessments, considers previous conclusions and recommendations, and records the results together with recommendations from the assessment.

IEC 61511 safety lifecycle and typical FSA timing The exact number, size and scope depend on the project and operating context.

Five assessment points

Each stage examines a different body of lifecycle evidence.

The counterparties change with the stage. During analysis and design, the work is centred on the owner, EPC contractor, engineering disciplines, SIS integrator and suppliers. During validation and operation, commissioning, operations, maintenance and asset integrity functions become central. Modification and decommissioning add management of change and impact analysis.

Strongest point for requirement correction

After the H&RA has been carried out, required protection layers identified and the SRS developed.

Stage 1 examines whether hazards, hazardous events, required risk reduction, allocated protection layers and SIF requirements form a complete and consistent input to design. The SRS is the transfer point from analysis into SIS design.

Typical evidenceH&RA / HAZOP, LOPA or SIL determination, protection layer allocation, recommendations and closeout, SIF list, conceptual configuration, SRS, functional safety plan, competence records.

Central interfacesOwner risk criteria and operating knowledge; process safety, process, I&C, mechanical and project engineering decisions; information needed from existing facilities and suppliers.

Assessment focusClear SIF identity, safe state, initiating causes, required SIL/RRF, process safety time, demand assumptions, independence and consistency with process information.

Stage 1 readiness questions

Are SIF names and boundaries unique and traceable across H&RA, SIL determination, SRS and P&IDs?
Are unresolved H&RA recommendations identified with owners, due dates and their effect on the SIS?
Does each SIF requirement define the input, logic, output action and safe state without leaving design intent to inference?
Are required owner decisions and missing process information visible before detailed design starts?

DSIB preparation serviceReadiness review of H&RA, allocation and SRS; responsibility matrix; evidence index; workshops for unresolved SIF requirements.

DSIB independent FSAStage 1 assessment with declared scope, competence and independence; documented judgement, recommendations and action register.

Design and engineering evidence

After the SIS has been designed.

Stage 2 considers whether the SIS hardware and application program requirements are traceable to the SRS and whether the design meets the functional and safety integrity requirements. The boundary of the assessment is stated: hardware, application programming and FAT may be included together or assessed in defined parts.

Typical evidenceSRS and design SRS, P&IDs, cause and effect, architecture, logic and wiring diagrams, SIL verification, device data, certifications, safety manuals, datasheets, FAT plan and previous FSA closeout.

Central interfacesEPC and engineering contractor disciplines, owner, SIS integrator, packaged equipment suppliers, existing systems, procurement, construction and document control.

Assessment focusSIF architecture and voting, device boundaries, systematic capability, failure data, proof-test assumptions, response time, interfaces, bypasses, diagnostics and cross-document consistency.

The interdisciplinary document set

These documents are produced by different disciplines but are assessed as one design basis. H&RA and SIL determination define the need. The SRS carries requirements into design. P&IDs and cause-and-effect documents show process and functional relationships. SIL verification tests the proposed architecture and assumptions. Datasheets, safety manuals and certificates support device selection. Architecture, logic, loop and wiring drawings show implementation. FAT, SAT and validation plans define how requirements will be demonstrated.

What repeatedly makes Stage 2 demanding

Interfaces with existing SIS, BPCS, package logic, relays, barriers and final elements are not represented consistently.
Vendor make, model, failure data, certificates and safety manuals arrive after architecture or SIL verification decisions.
Tag names, voting, SIL/RRF, mission time, proof-test interval and response-time assumptions differ between documents.
Design information is split across future phases, existing facilities and third-party packages without a controlled interface record.

DSIB preparation serviceClause-based pre-control, document and tag reconciliation, open-interface register, SIL verification review, evidence package and team interviews.

DSIB independent FSAStage 2 assessment for the agreed hardware, application program and FAT boundary, with transparent checklist expectations provided in advance.

Before hazards are present

After installation, pre-commissioning and final validation have been completed and O&M procedures developed.

Stage 3 considers whether the installed SIS conforms to the SRS and design, whether differences have been identified and resolved, and whether validation, procedures, training and handover information support safe operation.

Typical evidenceInstallation and commissioning records, FAT/SAT/SIT results, validation plan and results, calibration records, as-built documents, proof-test procedures, operating and maintenance procedures, training and previous actions.

Central interfacesOwner, EPC, construction and commissioning teams, SIS integrator, operations, maintenance, process safety and document control.

Assessment focusTraceability to the SRS, resolution of discrepancies, complete input-to-output validation, readiness of procedures and personnel, as-built configuration and further FSA planning.

DSIB preparation serviceStage 3 evidence register, validation traceability review, procedure and training readiness, open-punch and FSA action closeout review.

DSIB independent FSAPre-startup assessment of installed and validated SIS evidence, O&M readiness and the status of prior assessment recommendations.

Operating experience and asset integrity

After gaining experience in operation and maintenance.

Stage 4 tests whether operating and maintenance practice remains consistent with the design assumptions and whether the required safety integrity is maintained. The evidence comes from the installed performance of the SIS and the management system used to inspect, maintain, test, operate and modify it.

Typical evidenceDemands, trips, failures and repairs; proof-test schedules and results; as-found/as-left data; bypass and deferral records; maintenance, inspection and calibration records; audits, metrics and incident investigations.

Central interfacesOwner operations, maintenance, asset integrity, process safety, automation, reliability, inspection, training and management of change.

Assessment focusProof-test effectiveness and interval, detected degradation, repeated failures, demand rate, repair time, equipment useful life, bypass control, configuration, competence and validity of design assumptions.

DSIB preparation serviceAutomation asset integrity gap review, data quality check, proof-test and bypass record review, performance analysis and readiness package.

DSIB independent FSAPeriodic operations-phase assessment against the SRS, lifecycle assumptions, maintenance evidence and functional safety management requirements.

Modification and decommissioning

After modification and prior to decommissioning of a SIS.

Stage 5 considers the impact analysis, control, authorization and implementation of the change. The assessment returns to the affected requirements from Stages 1, 2 and 3 and confirms that the modification work follows IEC 61511 lifecycle requirements.

Typical evidenceApproved change request, impact analysis, updated H&RA and SRS, revised design and application program, verification and validation, configuration records, procedures, training and authorization.

Central interfacesOwner MOC authority, operations, maintenance, process safety, project engineering, SIS integrator, contractors and decommissioning teams.

Assessment focusEffect of change on hazards, required risk reduction, other protection layers, existing SIFs, operating practice and information needed to keep required functions available during decommissioning.

DSIB preparation serviceMOC and impact-analysis review, affected-document map, verification and validation readiness, action closeout and authorization package.

DSIB independent FSAAssessment of the modified or decommissioned SIS scope, including the affected lifecycle phases and continued functional safety.

Audit readiness

Readiness is built into normal engineering work.

A successful assessment starts with clear responsibility for the evidence required by each lifecycle activity.

The preparation work does not create a separate design record for an assessor. It makes existing lifecycle documents complete, controlled and traceable, and it identifies missing decisions before they affect later work.

01 · PLAN

Scope and responsibility

Define assessment boundary, participants, competence, independence, information, resources and revalidation arrangements.

02 · INDEX

Evidence register

Map each requirement to a controlled document, record, calculation, interview or previous assessment response.

03 · ALIGN

Interdisciplinary consistency

Reconcile SIF identity, tags, voting, values, assumptions, actions and revision status across the document set.

04 · RESOLVE

Open interfaces

Obtain owner, vendor, integrator and existing-facility information; record assumptions and their effect on design.

05 · PRESENT

Assessment evidence

Provide the requested information in a reviewable form, with accountable discipline leads available for clarification.

FAT

is not the starting point for readiness

Calling for assessment only after FAT moves correction into the costliest part of the project.

By then, unresolved SRS requirements may already be embedded in procured devices, I/O allocation, wiring, application programming, panels, interfaces, test procedures and construction work. Findings that could have been closed by analysis or a design decision can become supplier changes, site work, repeated testing or schedule exposure.

FSM leadership

The FSM lead coordinates lifecycle decisions across the engineering team.

The lead does not replace discipline responsibility. The role establishes the safety lifecycle plan, assigns competent people, identifies required inputs and outputs, maintains interfaces between disciplines, and makes verification and assessment evidence visible to project management.

Plan the lifecycle against the project schedule

Place H&RA, SRS, SIL verification, design reviews, procurement information, application programming, FAT, validation, training and FSA at workable decision points.

Assign roles and competence

Define accountable discipline leads, owner inputs, supplier interfaces, verification roles and the required assessor independence. Keep competence and training records.

Control the SIF information

Maintain one traceable SIF identity and consistent safe state, SIL/RRF, input, logic, output action, voting, response time and test assumptions across documents.

Manage decisions and change

Track recommendations, RFIs, assumptions and changes. Identify their effect on the SRS, SIL verification, design, application program, testing and O&M information.

Use interim documents deliberately

Issue controlled process SRS, design SRS, conceptual configurations, compliance matrices, action registers and interface records at the point where they can guide downstream work.

Prepare people as well as documents

Use focused IEC 61511 training and document workshops so process, I&C, mechanical, operations and project personnel understand what evidence they own and why it is needed.

Difficulty patterns

Most assessment effort is spent at interfaces.

The following patterns were evident in the reviewed engineering and assessment records. They are reported here as general project conditions. No real finding, tag, document number, party or facility detail is reproduced.

Definition is incomplete

A SIF need may be identified without a complete input, logic, output action, safe state, process safety time or boundary. Detailed designers then receive an interpretation task.

Documents do not agree

HAZOP/LOPA, SRS, P&IDs, cause and effect, SIL verification, logic and wiring documents may use different tags, voting, SIL/RRF or test assumptions.

Existing systems cross the SIF boundary

Package PLCs, existing logic solvers, relays, barriers, MCCs and legacy final elements require evidence that may be outside the EPC design package.

Vendor information arrives late

Make, model, failure data, systematic capability, safety manuals and proof-test information may be unavailable when architecture and SIL verification decisions are made.

Owner decisions remain open

Proof-test intervals, repair time, spurious trip targets, bypass philosophy, operating modes and response to detected faults require operating-company input.

Evidence is difficult to retrieve

Uncontrolled names, revisions, compressed packages, superseded drawings and missing interface records increase assessment time and weaken traceability.

Enabling tools

Tools support control and traceability. Engineering judgement remains with competent people.

IEC 61511 requires design, development and production tools, or their outputs, to be addressed so they do not have a negative effect on the SIS. Tool quality, verification and controlled use therefore form part of the evidence.

Integrated lifecycle engineering

exSILentia®

The integrated modules can carry information through SIL target selection, SIL verification, process and design SRS work, IEC 61511 compliance documentation and proof-test procedure development. Used with controlled inputs and independent verification, this reduces repeated data entry and makes assumptions easier to compare across lifecycle outputs.

Project controls

Registers, matrices and controlled documents

A SIF register, SRS responsibility matrix, interface register, certificate and safety-manual index, document register, action tracker and cross-document tag check often provide as much value as specialist software.

Possible outcomes

The report records a judgement and the evidence behind it.

A report can identify requirements as satisfied, partly satisfied with action recommended, not satisfied with action required, or not applicable to the agreed scope. The overall recommendation can support acceptance, qualified acceptance or rejection. Actions are recorded, assigned, tracked and closed with approval.

PASS

Requirement satisfied

The evidence directly meets the requirement or provides a justified alternative.

OPEN

Action recommended

An incomplete item or non-compliance requires documented resolution and later review.

FAIL

Action required

The item requires immediate action and resolution before the relevant hazard is present.

01Purpose, lifecycle stage, agreed scope, SIS/SIF boundary and exclusions.

02Assessment team, roles, competence, independence and participants.

03Applicable standards, procedures, assessment plan and information reviewed.

04Compliance arguments, evidence references and requirement status.

05Significant issues, recommendations, action ownership and closeout requirements.

06Overall judgement, report status, limitations and strategy for further FSAs.

DSIB service model

Preparation and assessment are separate engagements with a common technical basis.

DSIB can be engaged before the formal assessment to prepare the team and documentation, or engaged as the independent assessor. The scope, deliverables, counterparties and required independence are set for the relevant lifecycle stage.

Service A

Assessment preparation

DSIB works with the project or operating team to identify the required evidence, review its maturity and resolve inconsistencies before the independent assessment.

Stage-specific readiness plan and evidence index
Document, SIF and interface consistency review
FSM responsibility and lifecycle timing review
Training, workshops and assessment interviews
Open action and missing-information register

Service B

Independent Functional Safety Assessment

DSIB appoints a competent assessment team with the required independence, reviews the evidence and issues the assessment report and recommendations.

Declared assessment plan, scope and exclusions
Evidence review and discipline interviews
Compliance arguments and finding classification
Overall judgement and action register
Closeout review and further FSA strategy

If DSIB performs the assessment, the team is still told openly what information will be requested, how the scope is defined and how to prepare the evidence. This deliberate and fair approach improves the assessment process without changing the independence of the judgement.

OWNER

Plant owners

Independent evidence on lifecycle performance, design assumptions, O&M readiness, automation asset integrity and the effect of modifications.

EPC

EPC contractors

Earlier identification of owner, vendor and construction interfaces; controlled evidence for stage gates; reduced exposure to late rework and repeated testing.

ENGINEERING

Engineering contractors

Clear allocation of SRS content, consistent interdisciplinary outputs, reviewable SIL verification assumptions and an auditable design record.

An anonymized FSA1–2 case

A complete engineering package inside a Türkiye-based EPC scope

A Turkish engineering firm executed the engineering package in full and prepared it for FSA1–2. The external assessment was performed by EXIDA. The assessment closed with only minor findings and produced no significant cost item, rework or project delay.

Preparation started before the formal review. The FSM lead established the lifecycle plan and work split, coordinated process, risk, I&C and project functions, and used interim process SRS and design SRS records to move requirements into detailed design. A pre-control checklist, SIF conceptual configurations, SIL verification, device compliance records, certificates, safety manuals and a controlled assessment package were developed as the design matured. Focused IEC 61511 training and document workshops gave discipline leads a common basis for their inputs.

The difficult work concerned interfaces: late information from existing facilities and suppliers, more than one logic solver within a safety function, relay and barrier boundaries, tag and voting differences between documents, proof-test and response-time assumptions, and the distinction between current and future project scope. These issues were managed through documented questions, technical clarification, cross-document review and accountable closeout.

The lasting result was an internal functional safety management practice that extended beyond the assessment. Lifecycle responsibilities became part of discipline work, SIF information was treated as a controlled interdisciplinary record, and the client received a design package that could be followed from hazard analysis to implementation. This created confidence in both the engineering result and the organisation that produced it.

Management changeLifecycle planning, competence and verification became visible project responsibilities.

Engineering changeSRS, SIL verification and design interfaces were controlled as one body of evidence.

Client effectThe assessment provided independent confidence without material rework or delay.

Information security

An anonymized service description

This page omits the project, client, contractors, site, document numbers, tags, design values, assessment findings, correspondence and proprietary evidence. The case is presented only to explain the assessment scope, preparation demands and service value.

Assessment evidence should remain in controlled project systems and be shared according to agreed access, confidentiality, retention and document-control arrangements.