Functional Safety Management and Safety Culture
Functional safety management and safety culture
This domain tests whether you can run the safety lifecycle as a managed process rather than a documentation exercise. Expect questions on the functional safety management (FSM) plan, competency, verification and assessment independence, configuration management, and the behaviours that make reporting and challenge normal.
Core rules
- The FSM plan defines who does what, when, and with what competence for every lifecycle phase, including suppliers and integrators.
- Verification is planned and independent of the originator; functional safety assessment is an independent judgement of functional safety achievement, with independence graded by SIL and risk.
- Competence records must match the task: SIL 2 logic configuration, HAZOP leadership, and proof-test execution need different evidence.
- Configuration management covers software, hardware, tools, and documents; change control links every modification to impact analysis.
- Safety culture is observable: leadership commitment, a just culture that separates error from wilful violation, near-miss reporting, and authority to stop work.
Worked example
A SIL 2 burner management system is modified to add a new fuel gas train. The team updates the SRS, but no FSM plan exists and the original logic developer verifies her own change. The modification fails assessment: the FSM plan must define the modification procedure, a competent independent verifier, impact analysis on the SIL verification, and configuration control of the new logic. The technical change may be sound; the management evidence is not.
Traps
- Treating the FSM plan as a one-off document rather than a live plan.
- Claiming verification independence when the same person specifies and checks.
- Assuming a SIL certificate proves the operating site's management system.
- Recording training attendance as competence.