Functional Safety Assessment (FSA)
Activity
Topic overview
Quick facts
- Definition of Functional Safety Assessment in functional safety
- Functional Safety Assessment in depth
- The case for Functional Safety Assessment
- Functional Safety Assessment in practice
- Where teams get Functional Safety Assessment wrong
- Functional Safety Assessment and its standards
- Industries where Functional Safety Assessment applies
- Ask our team about Functional Safety Assessment
- Terms related to Functional Safety Assessment
The functional safety assessment is the standards' answer to the question everyone else on the program is too invested to answer: not whether the process was followed, but whether the resulting system is actually functionally safe.
The assessor examines the evidence, hazard and risk analysis, safety requirements, design and its analyses, verification and validation results, modification records, and forms a judgement, documented in an assessment report with a recommendation on whether the system is fit for its safety duty.
It differs from a functional safety audit, which checks process conformance; the FSA is entitled to conclude that a program followed its process perfectly and still built something unsafe.
Staging matters.
allows FSA at defined points in the lifecycle rather than only at the end, and mature automotive practice makes this concrete by staging the assessment across the program, commonly labeled FSA-1 at the concept phase (is the sound, are the safety goals and plan adequate), FSA-2 during product development (do the architecture, analyses, and hardware metrics hold up), and FSA-3 before release (is the full evidence set complete and consistent, supporting the final judgement).
The labels are industry convention rather than standard text, but the logic is universal: findings raised at FSA-1 cost a document revision, the same findings discovered at the final assessment cost redesign.
Independence requirements scale with the integrity level and consequence: lower SILs may accept an independent person, higher SILs an independent department, and the highest levels an independent organization, with prescribing analogous independence for its confirmation measures by .
The independence is structural, not personal: the assessor must not report to the delivery organization whose work is being judged, and must be free to write an adverse report without career consequence.
The case for Functional Safety Assessment
The FSA is the gate between engineering and market: certification bodies, rail authorities, and sophisticated customers rely on the assessment judgement, so an adverse or qualified FSA report stops a launch regardless of how finished the product looks.
The staging decision is one of the highest-leverage schedule choices a product leader makes, because a program that buys assessment early buys cheap findings, while a program that saves the assessment budget for the end converts every latent problem into late redesign discovered at the moment of maximum schedule pressure.
Functional Safety Assessment in practice
FSA activity flow
The functional safety plan names the assessor, the required independence level, and the assessment stages with their scope. The assessor works to an assessment plan: sampling strategy across the lifecycle, documents to review, tests to witness, people to interview.
At each stage the assessor raises findings the program must resolve or formally accept with rationale, and the engagement culminates in an assessment report stating the judgement, including any conditions or open points.
What the assessor probes hardest: whether the integrity targets were derived defensibly, whether the analyses reflect the design as built rather than as drawn, whether verification evidence actually covers the safety requirements, and whether the configuration under assessment matches what will ship.
Where teams get Functional Safety Assessment wrong
Functional Safety Assessment and its standards
IEC 61508 sets the requirements that Functional Safety Assessment work has to satisfy: the umbrella functional safety standard defining the safety lifecycle, sil levels, and requirements for electrical, electronic, and programmable systems.
Assessors evaluate Functional Safety Assessment against ISO 26262, automotive functional safety standard defining asil levels and the automotive safety lifecycle.
Independence level vs SIL (IEC 61508)
| SIL | Minimum FSA independence |
|---|---|
| SIL 1 | Independent person |
| SIL 2 | Independent department |
| SIL 3 | Independent department (organization preferred) |
| SIL 4 | Independent organization |
Industries where Functional Safety Assessment applies
In industrial machinery, Functional Safety Assessment comes up in nearly every certification conversation: fixed and mobile machinery, packaging lines, and manufacturing equipment.
Functional Safety Assessment shapes how autonomous systems teams argue safety - autonomous mobile equipment, off-highway autonomy, and driverless platforms.
Ask our team about Functional Safety Assessment
Ben TwomblyFounder & CEOLeads CSA's functional-safety, certification, and engineering programs for safety-critical products and organizations. His assessor-side background informs practical programs that connect standards, engineering work, and credible evidence.
Tom CyrPrincipal Safety Engineer, IFSPSupports industrial and rail functional-safety programs with safety analysis, requirements, lifecycle planning, and certification-readiness guidance.Terms related to Functional Safety Assessment
How each connects to Functional Safety Assessment:
Functional Safety Audit appears in the same lifecycle work as Functional Safety Assessment and is usually produced or reviewed alongside it.
ISA is the natural next concept after Functional Safety Assessment; assessors expect teams to connect the two.
Programs that deal with Functional Safety Assessment almost always involve Functional Safety Plan in the same phase.
Both Functional Safety Assessment and Functional Safety sit under IEC 61508, so evidence for one usually references the other.
IEC 61508 connects the two: Functional Safety Assessment and SIL are assessed against the same lifecycle.
ISO 26262 connects the two: Functional Safety Assessment and HARA are assessed against the same lifecycle.
IEC 61508 connects the two: Functional Safety Assessment and Safety Function are assessed against the same lifecycle.
Both Functional Safety Assessment and Safe Torque Off sit under IEC 61508, so evidence for one usually references the other.
Both Functional Safety Assessment and FMEA sit under IEC 61508, so evidence for one usually references the other.
IEC 61508 connects the two: Functional Safety Assessment and FMEDA are assessed against the same lifecycle.