I85PREP
⌘ K
FSOE Written Test study materials
FSOE Written Test study resources

FSOE Written Test practice questions

One question at a time. Build your FSOE Written Test understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Functional Safety Management and Safety Culture

Under IEC 61508, which organisational body holds ultimate accountability for establishing and maintaining the functional safety management system across the safety lifecycle?

  1. The operating organisation's management Correct answer.
  2. The third-party certification body
  3. The safety instrumented function designer
  4. The independent assessment team

Explanation

IEC 61508 places responsibility for the functional safety management system on the management of the organisation carrying out the lifecycle activities. Management must define the policy, allocate competent resources, and ensure the system is maintained. Assessment and certification bodies provide independent scrutiny but do not own the duty.

Question 2Functional Safety Management and Safety Culture

A safety culture programme is being planned for a plant operating safety instrumented systems. Which characteristic most directly indicates a positive functional safety culture?

  1. Instrument technicians complete training only when a new system is installed
  2. All safety documentation is stored in a single controlled archive
  3. Staff freely report near misses and unsafe conditions without fear of blame Correct answer.
  4. Safety meetings are held once per year with full management attendance

Explanation

A positive safety culture depends on open reporting, where people raise concerns and near misses without fear of punitive response, allowing learning before harm occurs. Documentation control, meeting frequency, and initial training are useful administrative practices but do not by themselves demonstrate the trust and learning behaviour that characterise culture.

Question 3Functional Safety Management and Safety Culture

When defining the competence requirements for personnel performing safety lifecycle activities, which approach best satisfies IEC 61508 expectations?

  1. Rely on years of service as the sole measure of competence
  2. Assign competence assessment to the individual's line manager without criteria
  3. Require every person to hold the same general engineering degree
  4. Define required knowledge, training, experience, and qualifications for each role, then evidence them Correct answer.

Explanation

Competence under IEC 61508 is defined against the specific activities to be performed, covering knowledge, training, experience, and qualifications, with records showing the requirement was met. A single uniform qualification or tenure alone does not demonstrate competence for specialised lifecycle tasks.

Question 4Functional Safety Management and Safety Culture

What is the primary purpose of the functional safety assessment (FSA) required by IEC 61508?

  1. To independently judge whether the functional safety requirements have been achieved Correct answer.
  2. To assign responsibility for accidents to individuals
  3. To certify the product for sale in all markets
  4. To replace the verification activities performed by the design team

Explanation

Functional safety assessment is an independent examination that judges whether the functional safety achieved by the system meets the specified requirements. It complements, rather than replaces, verification and does not assign blame or grant commercial market approval.

Question 5Functional Safety Management and Safety Culture

Which activity best demonstrates management commitment to functional safety rather than merely documenting it?

  1. Providing named resources and time for safety lifecycle tasks and reviewing their progress Correct answer.
  2. Displaying safety posters in the control room
  3. Publishing a safety policy signed by the chief executive
  4. Including safety in the annual report to shareholders

Explanation

Commitment is evidenced by allocating real resources, protecting time for lifecycle work, and actively reviewing progress and resolving issues. Policies, posters, and reports are visible artefacts but can exist without any change in how work is prioritised or resourced.

Question 6Functional Safety Management and Safety Culture

A modification is proposed to a safety instrumented function already in operation. Which action should the functional safety management system require before the change is implemented?

  1. Verbal agreement between the shift supervisor and the designer
  2. A documented impact assessment and management of change authorisation Correct answer.
  3. Immediate implementation followed by retrospective documentation
  4. Deferral of all assessment until the next scheduled plant shutdown

Explanation

Management of change requires that modifications be assessed for their impact on the safety function, documented, and formally authorised before implementation. Informal agreement or after-the-fact documentation removes the control that prevents unanalysed risk. Deferring assessment until shutdown leaves the change uncontrolled in the interim.

Question 7Functional Safety Management and Safety Culture

During an audit of the functional safety management system, which record most directly evidences that competence was maintained over time?

  1. A schedule of future safety meetings
  2. A matrix showing role requirements mapped to individual training and experience records Correct answer.
  3. A copy of the company organisation chart
  4. A list of all employees with their hire dates

Explanation

A competence matrix links each role's defined requirements to the training, experience, and qualifications held by the individual, providing auditable evidence that competence was assessed and maintained. Hire dates, organisation charts, and meeting schedules do not show that people meet the requirements of their safety roles.

Question 8Functional Safety Management and Safety Culture

An organisation finds that incident investigations repeatedly identify the same root cause but corrective actions are not tracked to closure. Which safety culture weakness does this most directly indicate?

  1. Inadequate hardware fault tolerance in the safety function
  2. Weak learning and feedback loop from incidents into corrective action Correct answer.
  3. Insufficient independent assessment resources
  4. Excessive documentation of operating procedures

Explanation

Repeated findings without closure show that the organisation collects information but does not convert it into verified change, which is a failure of the learning element of safety culture. Independent assessment, hardware architecture, and procedure volume are separate concerns that do not explain the failure to close actions.

Question 9Functional Safety Management and Safety Culture

A project team plans to use a contractor to perform safety requirements specification. What should the functional safety management system require regarding the contractor?

  1. Evidence that the contractor's personnel meet the defined competence requirements for the task Correct answer.
  2. Confirmation that the contractor works entirely off site
  3. Assurance that the contractor holds the lowest-price bid
  4. Transfer of all functional safety accountability to the contractor

Explanation

Contractors performing safety lifecycle activities must be subject to the same competence and quality requirements as internal staff, with evidence provided. Accountability for functional safety cannot be transferred away by outsourcing, and commercial or location factors do not substitute for competence.

Question 10Functional Safety Management and Safety Culture

Which set of indicators would best provide leading information about the health of a functional safety management system?

  1. Overdue proof tests, open safety actions, and competence gaps against the matrix Correct answer.
  2. Annual insurance premiums and audit fees
  3. Lost-time injury rate and total recordable incident rate
  4. Number of safety posters distributed and staff attendance at inductions

Explanation

Leading indicators reflect the performance of safety processes before harm occurs, such as proof test completion, closure of safety actions, and competence against defined requirements. Injury statistics are lagging outcomes, and activity counts or costs do not measure the effectiveness of the management system.

Question 11Functional Safety Management and Safety Culture

In IEC 61508, what distinguishes functional safety assessment from functional safety audit?

  1. Assessment is performed by the design team; audit is performed by an external body
  2. Assessment occurs once; audit is optional under the standard
  3. Assessment judges achievement of functional safety; audit examines the procedures and processes used Correct answer.
  4. Assessment applies only to software; audit applies only to hardware

Explanation

Functional safety assessment is a judgement on whether the functional safety requirements have been achieved, while functional safety audit examines whether the specified procedures and processes are being followed. Both are required activities with distinct scopes, and neither is limited to software or a single occurrence.

Question 12Functional Safety Management and Safety Culture

A technician reports that a safety instrumented function was bypassed during maintenance without authorisation. Management response will strongly influence future reporting. Which response best supports a positive safety culture?

  1. Suspend the maintenance team pending a full inquiry
  2. Thank the reporter, investigate the bypass openly, and correct the procedure that allowed it Correct answer.
  3. Record the report but take no action to avoid conflict
  4. Discipline the reporter for not raising the issue sooner

Explanation

Positive safety culture reinforces reporting by treating the reporter constructively and addressing the underlying system weakness that permitted the unauthorised bypass. Punitive responses discourage future reporting, and inaction signals that concerns are not valued.

Question 13Functional Safety Management and Safety Culture

Which arrangement best preserves the independence required for functional safety assessment in a small organisation with limited personnel?

  1. Engage an external assessor or a suitably separated internal function not involved in the design Correct answer.
  2. Ask the designer to self-certify the safety function
  3. Rely on the equipment supplier's marketing declaration
  4. Use the project manager who approved the design as the assessor

Explanation

Independence is about freedom from the pressures and interests of those who designed or manage the work, so a small organisation may need an external assessor or a clearly separated internal function. Self-certification by the designer or the approving manager compromises the objectivity the assessment requires.

Question 14Functional Safety Management and Safety Culture

An organisation outsources operation of a safety instrumented system to a service provider. Which statement correctly reflects accountability under IEC 61508?

  1. Accountability rests with the equipment manufacturer
  2. Accountability is shared equally so no single party is responsible
  3. Accountability transfers entirely to the service provider once the contract is signed
  4. The operating organisation retains accountability and must ensure the provider meets the functional safety management requirements Correct answer.

Explanation

Outsourcing activities does not transfer the duty of care; the operating organisation remains accountable and must verify that contracted parties work within the functional safety management system. Contracts cannot displace the responsibility, and shared accountability without a clear owner undermines control.

Question 15Functional Safety Management and Safety Culture

Which practice most effectively embeds functional safety culture at the working level rather than only at management level?

  1. Including operators and maintainers in hazard reviews and proof test planning Correct answer.
  2. Delegating all safety decisions to the independent assessor
  3. Restricting safety discussions to the engineering department
  4. Communicating safety performance only through annual reports

Explanation

Involving the people who operate and maintain the equipment in hazard reviews and proof test planning builds ownership and uses their practical knowledge of failure modes. Confining safety to one department or to annual reporting leaves the workforce disengaged, and the assessor cannot make operational decisions.

Question 16Functional Safety Management and Safety Culture

A safety case review reveals that a key assumption about operator response time was never validated. Which management system element should have prevented this gap?

  1. A documented verification and review process with defined acceptance criteria and independent check Correct answer.
  2. More frequent safety meetings
  3. A larger training budget for operators
  4. A revised organisation chart

Explanation

Assumptions underlying a safety function must be verified against defined acceptance criteria and checked independently before the safety case is accepted. Training budgets, meeting frequency, and structure changes do not substitute for the technical verification that validates the assumption.

Question 17Functional Safety Management and Safety Culture

A plant's safety culture survey shows high management confidence but low staff confidence that concerns are acted upon. What is the most appropriate interpretation and response?

  1. A reason to discontinue the survey to avoid morale problems
  2. A perception gap indicating weak upward communication; investigate and close the loop on reported concerns Correct answer.
  3. Evidence that the management system is fully effective
  4. Proof that staff are insufficiently trained in safety procedures

Explanation

Divergence between management and staff perceptions points to a breakdown in upward communication and feedback, which is a recognised cultural weakness. The appropriate response is to investigate why staff believe concerns go unaddressed and to demonstrate that reports lead to visible action, not to train staff or suppress the finding.

Question 18Functional Safety Management and Safety Culture

When determining the level of independence required for functional safety assessment, which factor should most influence the decision?

  1. The consequence of failure and the complexity and novelty of the system Correct answer.
  2. The number of pages in the safety manual
  3. The availability of meeting rooms for the assessment team
  4. The seniority of the person who commissioned the assessment

Explanation

IEC 61508 scales independence to the risk of the application and to the complexity, novelty, and maturity of the technology, so higher-consequence or novel systems require greater separation of the assessor. Logistical, hierarchical, and documentation-volume factors do not affect the required independence.

Question 19Functional Safety Management and Safety Culture

An organisation's functional safety management system is mature, but a merger introduces staff from a company with different safety practices. Which action best protects the safety culture during integration?

  1. Delay all safety training until the merger is complete
  2. Harmonise procedures through a documented gap assessment and joint competence verification before merging roles Correct answer.
  3. Allow each team to keep its own practices indefinitely
  4. Adopt the larger company's procedures unchanged to minimise disruption

Explanation

Merging safety cultures requires a structured comparison of practices and verification that people are competent for the roles they will hold, so that differences are resolved deliberately rather than by default. Imposing one set unchanged or allowing permanent divergence creates inconsistent practice, and postponing training leaves gaps during the highest-risk transition.

Question 20Functional Safety Management and Safety Culture

A functional safety audit finds that proof tests are being performed but results are not compared against acceptance criteria. Which conclusion is most defensible?

  1. The process is followed in form but the verification loop is broken, so degradation may go undetected Correct answer.
  2. The acceptance criteria should be removed to simplify the process
  3. The proof tests are adequate because they are being performed on schedule
  4. The audit finding is minor because documentation exists

Explanation

A proof test only provides assurance if its results are evaluated against defined criteria, closing the loop so that detected degradation triggers action. Performing the test without comparison gives an appearance of compliance while allowing undetected deterioration, so the finding is significant rather than minor.

Question 21Hazard and Risk Analysis, Risk Reduction

In the functional safety lifecycle, what is the primary purpose of the hazard and risk analysis phase for a machine safety function?

  1. To document the maintenance schedule for the machine
  2. To determine the required performance level (PLr) from the estimated severity, frequency, and possibility of avoidance of the hazardous situation Correct answer.
  3. To verify the achieved PL of the safety-related control system after installation
  4. To select the specific safety relay and light curtain model to be purchased

Explanation

Hazard and risk analysis establishes the risk of each hazardous situation and derives the required risk reduction, expressed as the required performance level (PLr) under ISO 13849-1 or as SIL under IEC 62061. It precedes design and does not verify achieved performance or select products.

Question 22Hazard and Risk Analysis, Risk Reduction

Which risk graph parameter in ISO 13849-1 reflects how quickly a person can react to move away from the hazard?

  1. T (time to stop the machine)
  2. P (possibility of avoidance) Correct answer.
  3. S (severity of injury)
  4. F (frequency and duration of exposure)

Explanation

The parameter P in the ISO 13849-1 risk graph captures the possibility of avoiding the hazard or limiting the harm, for example by moving away quickly. S captures severity, F captures frequency and duration of exposure, and T is not a risk graph parameter.

Question 23Hazard and Risk Analysis, Risk Reduction

A risk assessment team estimates that a hazardous situation can cause irreversible injury, occurs frequently, and offers little chance of avoidance. Using the ISO 13849-1 risk graph, which PLr is typically derived?

  1. PL e Correct answer.
  2. PL b
  3. PL d
  4. PL a

Explanation

Combining severe and irreversible injury (S2), frequent or continuous exposure (F2), and low possibility of avoidance (P2) yields the highest required performance level, PL e. This reflects the need for the greatest risk reduction.

Question 24Hazard and Risk Analysis, Risk Reduction

What does the required performance level (PLr) represent in the risk reduction process?

  1. The performance level the safety function must achieve to bring residual risk to a tolerable level Correct answer.
  2. The performance level of the machine's non-safety-related control functions
  3. The average performance level of all safety functions on the machine
  4. The performance level already achieved by an existing machine before modification

Explanation

PLr is the target performance level derived from the risk assessment that a safety function must reach so that residual risk is tolerable. It is a requirement, not a measurement of the current design.

Question 25Hazard and Risk Analysis, Risk Reduction

A safety function is designed such that a single fault is detected and the safety function is still maintained. Which ISO 13849-1 architectural category does this describe?

  1. Category 3 Correct answer.
  2. Category 2
  3. Category B
  4. Category 1

Explanation

Category 3 requires that a single fault in any part does not lead to the loss of the safety function, and that faults are detected where reasonably practicable. This is achieved through redundancy combined with diagnostic coverage.

Question 26Hazard and Risk Analysis, Risk Reduction

In an ISO 13849-1 Category 4 architecture, what is the required behavior with respect to fault accumulation?

  1. Faults must be detected, and accumulation of undetected faults shall not lead to loss of the safety function Correct answer.
  2. A single fault must be detected before the next demand on the safety function
  3. Accumulation of undetected faults is permitted as long as the PL is reached
  4. Only the first fault in each channel needs to be detected

Explanation

Category 4 requires high diagnostic coverage so that faults are detected, and it must be ensured that accumulation of undetected faults does not lead to loss of the safety function. This is the most demanding architecture in the standard.

Question 27Hazard and Risk Analysis, Risk Reduction

Which measure is a form of inherently safe design rather than a safeguarding or information measure in the risk reduction hierarchy?

  1. Providing personal protective equipment to operators
  2. Posting a warning sign at the machine entrance
  3. Installing a fixed guard with interlocking
  4. Reducing the force and speed of a press so that injury cannot occur Correct answer.

Explanation

Inherently safe design eliminates or reduces the hazard at its source, for example by limiting force, speed, or energy so harm cannot occur. Guards, warnings, and PPE are protective or information measures applied after inherent design.

Question 28Hazard and Risk Analysis, Risk Reduction

What is the correct order of the three-step method for risk reduction described in ISO 12100?

  1. Inherently safe design, then information for use, then safeguarding
  2. Inherently safe design, then safeguarding and complementary protective measures, then information for use Correct answer.
  3. Safeguarding, then information for use, then inherently safe design
  4. Information for use, then safeguarding, then inherently safe design

Explanation

ISO 12100 defines the three-step method as inherently safe design first, then safeguarding and complementary protective measures, then information for use. Each step is applied in order, and earlier steps should not be skipped in favor of later ones.

Question 29Hazard and Risk Analysis, Risk Reduction

When estimating risk for a task, why should the risk assessment consider both the probability of occurrence of harm and the severity of that harm?

  1. Because ISO 12100 requires severity to be ignored when exposure is continuous
  2. Because severity alone determines the required PLr regardless of exposure
  3. Because risk is a function of the severity of harm and the probability of its occurrence Correct answer.
  4. Because probability alone determines whether a guard is needed

Explanation

Risk is generally expressed as a combination of the severity of the possible harm and the probability of its occurrence, which includes exposure, occurrence of the hazardous event, and possibility of avoidance. Reducing either factor reduces risk.

Question 30Hazard and Risk Analysis, Risk Reduction

A risk assessment identifies a hazard from unexpected start-up during maintenance. Which combination best represents complementary protective measures for this hazard?

  1. A larger warning label on the control cabinet
  2. Lockout/tagout with energy isolation and a restart interlock Correct answer.
  3. Removing the maintenance procedure from the manual
  4. Faster machine cycle to reduce maintenance time

Explanation

Complementary protective measures such as lockout/tagout, energy isolation, and restart interlocks address hazards that remain after safeguarding, including unexpected start-up during maintenance. They supplement guards rather than replace them.

Question 31Hazard and Risk Analysis, Risk Reduction

How does IEC 62061 differ from ISO 13849-1 in the way it expresses the required risk reduction?

  1. IEC 62061 uses risk graphs identical to ISO 13849-1 with no SIL concept
  2. IEC 62061 uses PL, while ISO 13849-1 uses SIL
  3. IEC 62061 uses SIL assigned to safety functions, while ISO 13849-1 uses PL Correct answer.
  4. Both standards use only category numbers to express risk reduction

Explanation

IEC 62061 is a sector standard for machinery that uses safety integrity levels (SIL) for safety-related electrical control systems, while ISO 13849-1 uses performance levels (PL). Both derive requirements from a risk assessment but use different metrics.

Question 32Hazard and Risk Analysis, Risk Reduction

A designer must reduce risk for a hazard that cannot be eliminated by design. According to the hierarchy, which action should be taken before relying on a warning in the manual?

  1. Train operators to work more carefully
  2. Add the hazard to the maintenance checklist
  3. Provide a safeguarding measure such as a guard or protective device Correct answer.
  4. Increase the warning font size in the manual

Explanation

The hierarchy requires safeguarding and complementary protective measures before information for use. A guard or protective device physically reduces exposure, whereas warnings and training rely on human behavior.

Question 33Hazard and Risk Analysis, Risk Reduction

What is meant by residual risk in the context of machine safety?

  1. The risk remaining after protective measures have been implemented Correct answer.
  2. The risk associated only with electrical hazards
  3. The risk that is transferred to the maintenance team by contract
  4. The risk present before any protective measures are applied

Explanation

Residual risk is the risk that remains after all protective measures in the hierarchy have been applied. The designer must determine whether residual risk is tolerable and communicate it through information for use.

Question 34Hazard and Risk Analysis, Risk Reduction

During risk estimation, a team finds that exposure to a hazard is rare but the potential consequence is fatal. How should this influence the risk reduction decision?

  1. Severity should be ignored when exposure occurs less than once per shift
  2. High severity can still require significant risk reduction even when exposure is infrequent Correct answer.
  3. Low exposure frequency always makes the risk negligible regardless of severity
  4. The risk should be accepted because fatalities are statistically rare

Explanation

Risk combines severity and probability; a fatal consequence can keep risk high even with infrequent exposure, so substantial risk reduction may still be required. Exposure frequency reduces probability but does not eliminate the severity contribution.

Question 35Hazard and Risk Analysis, Risk Reduction

Which statement correctly describes the relationship between diagnostic coverage (DC) and the achieved performance level in ISO 13849-1?

  1. Diagnostic coverage only affects Category B designs
  2. Lower diagnostic coverage always raises the achieved PL
  3. Diagnostic coverage has no influence on the achieved PL
  4. Higher diagnostic coverage of faults generally supports a higher achieved PL for a given architecture Correct answer.

Explanation

Diagnostic coverage measures the fraction of dangerous faults that are detected, and higher DC improves the average diagnostic coverage and thus the achieved PL for a given category and MTTFd. It works together with architecture and component reliability.

Question 36Hazard and Risk Analysis, Risk Reduction

What role does mean time to dangerous failure (MTTFd) play in determining the performance level of a safety function?

  1. It quantifies the reliability of components against dangerous failures and contributes to the achieved PL Correct answer.
  2. It defines the required severity category in the risk graph
  3. It determines the frequency of operator exposure
  4. It sets the maximum allowable stopping time of the machine

Explanation

MTTFd represents the expected time to a dangerous failure for components and channels and is combined with category and diagnostic coverage to determine the achieved PL. Higher MTTFd indicates greater reliability against dangerous failures.

Question 37Hazard and Risk Analysis, Risk Reduction

A risk assessment for a robot cell identifies a hazard requiring PLr = d. The proposed design achieves PL c. What is the appropriate conclusion?

  1. The design is acceptable because PL c and PL d are close
  2. No action is needed because the risk graph is only advisory
  3. The PLr should be lowered to c to match the design
  4. The design does not meet the required risk reduction and must be modified or additional measures applied Correct answer.

Explanation

The achieved PL must be at least equal to the PLr derived from the risk assessment. If the design achieves PL c against a requirement of PL d, additional risk reduction or design changes are needed before the safety function is acceptable.

Question 38Hazard and Risk Analysis, Risk Reduction

Which of the following best describes a safety function in the context of risk reduction?

  1. A function that only displays machine status to the operator
  2. A function performed exclusively by the maintenance team
  3. A function of the machine whose failure can result in an immediate increase of risk Correct answer.
  4. A function that improves productivity without affecting risk

Explanation

A safety function is a function of the machine whose failure can lead to an immediate increase in risk, such as a guard interlock or emergency stop. Its integrity is what the PL or SIL quantifies.

Question 39Hazard and Risk Analysis, Risk Reduction

In risk estimation, what does the parameter for possibility of avoidance primarily depend on?

  1. The length of the operator manual
  2. The speed of the hazardous movement and the physical ability of a person to react and move away Correct answer.
  3. The number of safety relays in the control panel
  4. The color of the machine housing

Explanation

Possibility of avoidance depends on factors such as the speed of the hazardous motion, the space available, and whether a person can recognize and react to the hazard in time. Fast, unexpected motion with little warning corresponds to low avoidance.

Question 40Hazard and Risk Analysis, Risk Reduction

Why is it important to document the assumptions and boundary conditions used during hazard and risk analysis?

  1. Because boundary conditions are fixed by the machine builder and never change
  2. Because the risk estimate depends on stated assumptions such as use, exposure, and foreseeable misuse, and later changes must be traceable Correct answer.
  3. Because documentation is only needed for legal liability and has no technical value
  4. Because assumptions eliminate the need for verification of the safety function

Explanation

Risk estimates rest on assumptions about intended use, exposure, and foreseeable misuse, and documenting them allows later design changes to be evaluated against the original basis. It also supports traceability and verification.

Question 41Hazard and Risk Analysis, Risk Reduction

A machine has two independent safety channels and the risk assessment shows that a single fault must not cause loss of the safety function. Which design characteristic is most directly required?

  1. Redundancy with fault detection to prevent a single fault from defeating the function Correct answer.
  2. A single channel with the highest available MTTFd
  3. Reliance on operator vigilance to detect failures
  4. Removal of all diagnostics to simplify the design

Explanation

Preventing a single fault from causing loss of the safety function requires redundant channels combined with fault detection, consistent with Category 3 or 4. A single channel, even with high MTTFd, cannot guarantee this.

Question 42Hazard and Risk Analysis, Risk Reduction

Which of the following is an example of foreseeable misuse that a hazard and risk analysis should consider?

  1. A machine operating within its rated load
  2. A guard remaining closed during normal operation
  3. An operator disabling an interlock to speed up production Correct answer.
  4. A technician following the documented lockout procedure

Explanation

Foreseeable misuse includes reasonably predictable human behavior such as bypassing interlocks to increase throughput, and the analysis must consider it when estimating risk. Compliant and normal operation are not misuse.

Question 43Hazard and Risk Analysis, Risk Reduction

How should the results of a risk assessment feed into the verification step of the functional safety lifecycle?

  1. The documented PLr or SIL requirements become the acceptance criteria against which the achieved safety function is verified Correct answer.
  2. Verification should ignore the risk assessment and rely on manufacturer claims
  3. Verification is only concerned with electrical wiring colors
  4. The risk assessment is repeated only after a failure occurs

Explanation

The risk assessment yields the required PLr or SIL for each safety function, and verification confirms that the realized design meets or exceeds those requirements. This closes the loop between risk reduction requirements and design evidence.

Question 44Hazard and Risk Analysis, Risk Reduction

In the risk graph of ISO 13849-1, what distinguishes the F1 and F2 parameter values?

  1. F1 represents easy avoidance and F2 represents difficult avoidance
  2. F1 represents severe injury and F2 represents slight injury
  3. F1 represents single-channel and F2 represents redundant architecture
  4. F1 represents seldom-to-less-frequent exposure and F2 represents frequent-to-continuous exposure Correct answer.

Explanation

The F parameter describes frequency and duration of exposure, where F1 is seldom to less frequent and F2 is frequent to continuous. Severity is captured by S, avoidance by P, and architecture is not part of the risk graph.

Question 45Safety Requirements Specification and Functional Safety Concept

In the functional safety concept for a machine, what is the primary purpose of the safety requirements specification (SRS)?

  1. To define the required safety functions and their safety integrity requirements in a verifiable form Correct answer.
  2. To list the names of the operators trained on the machine
  3. To record the maintenance history of the machine after commissioning
  4. To document the commercial price of each safety component purchased

Explanation

The safety requirements specification captures the safety functions to be implemented and the safety integrity requirements each must meet, in a form that can be verified during design and validation. It is the technical basis handed from the functional safety concept to the detailed design.

Question 46Safety Requirements Specification and Functional Safety Concept

Which item belongs in the functional safety concept rather than in the detailed technical safety requirements?

  1. The allocation of safety functions to specific subsystems and the required integrity level Correct answer.
  2. The part number of the light curtain used
  3. The wire gauge selected for the emergency stop circuit
  4. The terminal assignment of each safety relay output

Explanation

The functional safety concept defines what safety functions are needed and how they are allocated to subsystems, together with their integrity requirements. Component part numbers, terminal assignments, and wire gauges are detailed design decisions made later.

Question 47Safety Requirements Specification and Functional Safety Concept

A safety requirement states only that 'the guard door shall be interlocked'. Which characteristic is most clearly missing for it to be an adequate safety requirement?

  1. The color of the interlock housing
  2. The supplier of the hinge mechanism
  3. The safety integrity requirement, such as the required performance level Correct answer.
  4. The maintenance interval for the door

Explanation

A complete safety requirement must state not only the function but also the integrity with which it must be performed, for example a required performance level. Without an integrity target the requirement cannot be verified or designed against.

Question 48Safety Requirements Specification and Functional Safety Concept

What does the required performance level (PLr) express in a safety requirement for a machine control function?

  1. The risk-reduction contribution the safety function must achieve Correct answer.
  2. The expected production throughput of the machine
  3. The number of operators who may use the machine
  4. The maximum ambient temperature the system tolerates

Explanation

The required performance level is derived from risk assessment and expresses how much risk reduction the safety function must contribute. It becomes the integrity target against which the achieved performance level of the implemented system is compared.

Question 49Safety Requirements Specification and Functional Safety Concept

A risk assessment assigns a required performance level of PL d to a safety function. What must the verification of the implemented system demonstrate?

  1. That the achieved performance level is exactly PL e
  2. That the achieved performance level of the safety-related parts is at least PL d Correct answer.
  3. That the operator has signed the risk assessment
  4. That the machine cycle time is reduced by half

Explanation

Verification compares the achieved performance level of the safety-related control system against the required level. Meeting or exceeding PLr satisfies the requirement; falling short means the design must be revised.

Question 50Safety Requirements Specification and Functional Safety Concept

Which document typically forms the input to the safety requirements specification for a machine?

  1. The annual sales forecast
  2. The spare parts inventory
  3. The factory floor plan
  4. The machine's risk assessment Correct answer.

Explanation

The risk assessment identifies hazards and the risk reduction needed, and therefore drives which safety functions and integrity levels must be specified. The SRS is developed from those identified requirements.