Connected functional safety for autonomous systems

ASAP is our Advanced Safety Acceleration Program, developed inside Amazon Robotics to document, trace, and manage every aspect of the safety lifecycle for an autonomous system. It was created by functional safety engineers who lived the problem firsthand: the spreadsheet morass and traceability bottleneck of designing, certifying, and deploying autonomous systems at scale. In April 2025, Fennec externalized the program from Amazon to bring it to the broader market. Read the origin story. Today, our program includes the ASAP Platform and ASAP Testing.

ASAP is designed for anyone building an autonomous system: mobile robots, drones, vehicles, factory machinery, smart hardware like battery management systems, and software agents making consequential decisions. If your product senses, decides, or acts on its own, functional safety applies to it, whether you're at concept stage, deep in product development, or integrating systems into environments where machines and people work together. In place of disconnected documents and manual administration, ASAP gives you one connected system that carries intelligent machines from design to defensible compliance. Learn more about ASAP.

The platform is standards agnostic by design. It is built around IEC 61508, the parent functional safety standard nearly every sector standard derives from, so its tracking and evidence mechanisms support whatever standard your program answers to. Customers use it today for ISO 12100, ISO 13849-1 (PL supported natively alongside SIL), ANSI/RIA R15.08-1 (builders) and R15.08-2 (integrators), and UL 3100. For AI-driven systems it aligns with ISO/IEC TR 5469, and we're tracking and accommodating the forthcoming ISO/IEC TS 22440.

Both, in one connected safety case. Hardware: upload your Bill of Materials and ASAP calculates reliability metrics (SFF, Diagnostic Coverage, PFH) using the integrated Siemens SN 29500 dataset, replacing hand-built FMEDA spreadsheets. Software: manage software and firmware safety requirements, track releases against them, and maintain IEC 61508-3 compliance, with everything traceably linked so the safety case knows exactly what each change requires you to re-verify.

Adopting ASAP is not a rip-and-replace decision, and it doesn't strand the safety work you've already done. Integration happens at three levels.

Your existing safety data comes with you: Fennec provides migration services that move requirements, hazard analyses, and FMEAs out of spreadsheets and static documents into the platform's traceable structure, so years of prior engineering become the foundation of your safety case rather than a filing cabinet next to it. Your requirements ecosystem stays in sync, with bidirectional API integrations across Jama Connect, IBM DOORS Next, Polarion, Jira, and Confluence, so safety and systems engineering work from one live set of requirements instead of reconciling exports. And safety evidence connects to where engineering actually happens: CI/CD (GitHub, Azure DevOps), simulation (NVIDIA Isaac Sim, MATLAB/Simulink, Gazebo, Unity), and field telemetry (ROS 2, AWS IoT Core), with a REST/GraphQL API for everything proprietary.

This matters because safety evidence is only as strong as its weakest handoff. Every manual transfer between tools is where traceability breaks and assessor questions begin; integration keeps the chain intact from requirement to code to test to field data.

In service of the safety case, never in place of it. AI in ASAP works strictly in an advisory capacity, automating documentation and repetitive analysis across the lifecycle, while any change to your safety case, system state, or configuration requires explicit human approval.

The architecture is built for enterprise scrutiny. Every AI recommendation is generated through a structured intent-and-reasoning engine and permanently logged, recording the user's intent, the AI's suggested path, and the human approval that followed, so AI-assisted work is end-to-end auditable, exactly the way the rest of your safety evidence is. Deployment flexes to your security posture: standard secure enterprise endpoints, or full bring-your-own-model isolation where AI actions route entirely through your own cloud infrastructure inside your VPC boundary. Access runs through enterprise SSO with role-based control, customer data is fully siloed, and for organizations that want no AI at all, ASAP runs in a fully non-AI mode with every AI dependency disabled.

Yes. The ASAP Platform is qualified as a T2 offline support tool in accordance with IEC 61508-3 and ISO 13849 by TÜV Rheinland. Under IEC 61508, justifying confidence in every software tool that touches your safety evidence is normally your burden, on every project: documenting what the tool does, proving it does it, and defending that argument to your assessor. Qualification means a certification body has already performed that assessment. You reference it in your safety plan instead of building a tool qualification argument from scratch, and assessors can rely on the platform's verified mechanisms instead of auditing your toolchain.

The practical effect is trust that compounds. Evidence built in a qualified tool arrives at assessment pre-trusted, without the manual-spreadsheet error surface that drives follow-up questions, which is how a full certification package built in ASAP has been reviewed and accepted in hours rather than weeks. What T2 qualification means for users.

We see this constantly, and it's worth saying plainly: the problem is almost never the engineering. Experienced functional safety teams do rigorous work in spreadsheets every day. The problem is that the rigor isn't legible. Leadership can't see it, auditors can't efficiently trust it, and the traceability that lives in your senior engineer's head walks out the door when they do. A spreadsheet safety program is only as defensible as the person defending it.

ASAP doesn't replace your safety expertise; it's what makes that expertise visible, durable, and provable. Your engineers' hazard analyses, requirements, and verification evidence live in one connected, traceable safety case, in a framework already qualified by official assessors, which gives internal evidence external weight. When leadership asks "are we compliant, and can you prove it?", the answer is a live, auditable system rather than a walkthrough of fourteen linked workbooks. And your experts stop spending their judgment on administration: the cross-referencing, version reconciliation, and report assembly that consume senior safety engineers become platform functions, so their time goes to the analysis only they can do.

The same evidence stands ready beyond the internal case: third-party certification, customer audits, and insurers, whenever your program calls for them. Compliance by design, not compliance by scramble. Book a Discovery Call