Functional safety · Free awareness · About 25 minutes
Keep functional-safety handover questions open
Use a fictional heated-vessel case to separate a candidate protective action from the evidence needed to justify its requirements and outcome.
BN-AW-FS-01 · Version 1.0.0 · Public source links checked 2026-10-04
What you will practise
- Separate a candidate trigger-and-action statement from justified requirements.
- Ask for process-outcome, response-time, integrity and validation evidence without inventing values.
- Record a design change and preserve the earlier evidence reference in a handover.
Begin with the scenario and the proposed action
A note saying 'safety controller fitted' tells you something about equipment. It does not tell you which hazardous scenario the project intends to address, which condition should be detected or which protective action should follow. Before treating the note as a finished requirement, ask those questions.
HSE describes functional safety in terms of safety-related systems working correctly. Its process-industry guidance links hazard and risk assessment, required functions and integrity, design, validation, operation and change management across a safety lifecycle. This lesson borrows that broad organising context, not a detailed design method. [S1]
Your role in the exercise is to prepare a clear handover. You have no process model, risk study or authority to choose a safety integrity level. You can still distinguish a useful candidate statement from an unsupported conclusion.
An action is not the same as a demonstrated outcome
In the fictional dossier, the proposed action is to isolate heating after a high-high temperature condition. It is reasonable to record that proposal accurately. The dossier also says that stored heat or an ongoing reaction may continue to raise temperature. Therefore the word 'shutdown' alone cannot establish that the vessel reaches a safe outcome.
That conclusion comes from the fictional facts, not from a calculation you are being asked to perform. A useful request asks the process reviewer for evidence of the vessel's behaviour after isolation and whether other measures are needed. It does not tell the reviewer what cooling system to choose or assert that isolation will fail.
Keep three phrases distinct: 'candidate action described', 'outcome evidence received' and 'responsible review completed'. Each is a different state of work. A clear file can show progress through them without collapsing them into 'approved'.
Ask for justified requirements rather than borrowed numbers
The fictional designer has inserted a response time and SIL copied from another vessel. The case provides no analysis linking that vessel to this one. Those numbers are proposed values with an unresolved basis. Ask for the assessment that justifies them; do not substitute a different value from memory.
HSE's overview places specification of the required function and integrity before design and implementation, followed by installation and validation. This supports keeping requirements evidence distinct from a statement that a particular device is certified. [S1]
For this exercise, group your requests by question: what hazardous event is being addressed; what outcome is required; how quickly the complete function must act; what risk reduction is allocated; and how the eventual implementation will be checked against the approved requirements. These are organising questions for a reviewer, not a complete safety requirements specification.
A handover should show what a test did and did not cover
The dossier contains a bench note showing a relay changed state. That is useful evidence of the recorded bench event. It does not describe the complete installed chain, process response or comparison with approved requirements. State the test scope before relying on its conclusion.
A meaningful evidence request names the gap: which configuration was tested, what criteria were used, which outcomes were observed and who reviews the result? Do not relabel a limited bench check as complete validation just because it occurred near the end of the project.
If the implementation changes, preserve the previous test reference and ask how the responsible team assesses the change's effect on requirements and evidence. A change need not imply failure; it does mean the old record should not silently be treated as though it describes the new configuration.
Fictional dossier: vessel V-7
You are organising questions before a proposed temperature function is handed over. The process, identifiers, values and documents below are invented. No operating advice is implied.
- Hazard note H-3 revision 1
- Unwanted heating may lead to a temperature rise, loss of containment and exposure. Stored heat or an ongoing reaction may continue after the heater is isolated.
- Draft function DF-2
- 'On a high-high vessel-temperature condition, isolate the heating supply.' The trigger threshold and required safe outcome are not yet justified.
- Requirements draft R-0
- Says 'SIL 2, response within 2 seconds — same as the previous vessel'. No risk-allocation or process-response evidence is attached.
- Bench note B-6
- Records that a controller output relay changed state during a bench stimulus. It does not describe installed sensor/final-element response, the vessel's process response or comparison with approved requirements.
- Draft handover
- 'Controller tested. Shutdown is safe. Start-up ready.'
Use only fictional facts and role names. Do not enter personal details or confidential project information. Practice text is held only in this page's memory and is not uploaded or saved to an account. Clearing or refreshing removes it; your browser may restore the open page when you go back. Download a local copy if you want to keep your practice.
Activity 1: write a bounded candidate statement
Allow about 3 minutes.
Rewrite the draft handover in two sentences: accurately state the proposed trigger/action, then state why the dossier does not establish a safe outcome or start-up readiness. Do not choose a threshold or another protective action.
Practice response: __________________________________________
Compare with a worked example and review points
The candidate function proposes isolation of the heating supply on a high-high vessel-temperature condition. The required threshold, safe outcome and process response after isolation remain unresolved, so this dossier does not establish start-up readiness.
- Describe the proposed action without calling it approved.
- Include the case fact about continued heating or reaction.
- Avoid inventing process values or an operational instruction.
This is a public worked example. Your text has not been marked or assessed.
Activity 2: prepare three evidence requests
Allow about 4 minutes.
Write one request about the process outcome, one about the copied response time/SIL, and one about the bench note's scope. Give each request a responsible review route. Use role names only.
Practice response: __________________________________________
Compare with a worked example and review points
Process reviewer: provide the assessed vessel response after heating isolation and the required safe outcome. Functional-safety lead: provide the hazard/risk allocation and process-response basis for the integrity and timing requirements instead of relying on copied values. Validation lead: identify the complete configuration, approved criteria and evidence needed beyond the relay bench event. Keep each question open until the responsible review.
- Different questions may need different reviewers.
- Ask for a justified basis rather than a substitute SIL or time.
- A recorded relay event is evidence of that event; do not discard it or overstate its scope.
This is a public worked example. Your text has not been marked or assessed.
Activity 3: preserve the change trail
Allow about 3 minutes.
New fictional information: after the bench check, the designer replaces the output relay with a different final-element arrangement. Write the updated handover and the next question. You have no test evidence for the new arrangement.
Practice response: __________________________________________
Compare with a worked example and review points
Bench note B-6 describes the earlier arrangement. The designer reports a subsequent change to the final-element arrangement; retain the earlier record and request the current configuration plus the responsible team's impact review and any resulting validation evidence. The existing bench note does not establish the new arrangement's behaviour or start-up readiness.
- Keep the earlier evidence associated with the earlier configuration.
- Ask for assessment of the change rather than assuming it is harmless or unsafe.
- Leave the real operating decision with the responsible project process.
This is a public worked example. Your text has not been marked or assessed.
Check your reasoning
Choose an answer to reveal formative feedback. Answers are public by design. These checks do not award a grade or certificate.
Your evidence-request worksheet
Spend about 3 minutes writing one evidence request for V-7. Use fictional facts and role names only. Practice fields are held only in this page's memory and are not uploaded or saved to an account. Clearing or refreshing removes them; your browser may restore the open page when you go back.
Name the dossier record and revision or configuration it describes.
____________________________________________________________
Describe a proposal or observed event accurately.
____________________________________________________________
Ask for a basis; do not choose a SIL, threshold or response time.
____________________________________________________________
Which fictional role supplies and which reviews the evidence?
____________________________________________________________
Name the next review and what the current record does not establish.
____________________________________________________________
If your browser blocks a generated download, save the blank worksheet file or use Print lesson & worksheet. The blank file is also available without JavaScript.