Method for automatically validating safety functions of a safety system (10, 20) which is modularly constructed with subsystem modules (1, 2, 3, 4), is intended to fulfill specific safety functions and is constructed from at least two subsystem modules (1, 2, 3, 4), which subsystem modules (1, 2, 3, 4) are each in turn intended to fulfill safety functions, with a checking device being connected to the safety system (10, 20), comprising the steps: a) storing of safety-relevant nominal characteristic values, in particular of residual fault probabilities, failure rates and/or total reaction times, in machine-readable form in a memory of a checking device, of a system which forms a safety system (10, 20) which comprises at least two subsystem modules (1, 2, 3, 4) and is constructed modularly from the at least two subsystem modules (1, 2, 3, 4), b) storing of local, module-specific safety-relevant actual characteristic values in each of the individual subsystem modules (1, 2, 3, 4), which is used for the modular construction of the safety system (10, 20) of the system, in machine-readable form in the respective subsystem module (1, 2, 3, 4), c) transmitting the local, module-specific safety-relevant actual characteristic values from the individual subsystem modules (1, 2, 3, 4), which currently construct the safety system (10, 20) of the system in modular form, to the checking device, in particular by reading out the local, module-specific safety-relevant actual characteristic values by the checking device or by the subsystem modules (1, 2, 3, 4) transmitting the local, module-specific safety-relevant actual characteristic values on their own to the checking device, in particular after this has been connected to the safety system (10, 20); characterized by the following steps: d) processing, by the checking device, the transmitted, in particular read out by the checking device, local, module-specific safety-relevant actual characteristic values, to safety-relevant actual characteristic values of the safety system (10, 20), which result when the individual subsystem modules (1, 2, 3, 4) interact and when the safety system (10, 20) is constructed spanning the individual subsystem modules (1, 2, 3, 4), e) comparing, by the verification device, the resulting safety-relevant actual characteristic values of the safety system (10, 20) with the nominal characteristic values of the system stored in the memory of the checking device and f) generating a reaction signal as a function of the comparison result, with the generated reaction signal being used to automatically release current safety functions of the safety system (10, 20) by the checking device if a threshold value is not reached with regard to at least one difference value resulting from the comparison and/or to automatically refuse to release current safety functions of the safety system (10, 20) by the checking device if the threshold value is exceeded with regard to at least one difference value resulting from the comparison. a) storing of safety-relevant nominal characteristic values, in particular of residual fault probabilities, failure rates and/or total reaction times, in machine-readable form in a memory of a checking device, of a system which forms a safety system (10, 20) which comprises at least two subsystem modules (1, 2, 3, 4) and is constructed modularly from the at least two subsystem modules (1, 2, 3, 4), b) storing of local, module-specific safety-relevant actual characteristic values in each of the individual subsystem modules (1, 2, 3, 4), which is used for the modular construction of the safety system (10, 20) of the system, in machine-readable form in the respective subsystem module (1, 2, 3, 4), c) transmitting the local, module-specific safety-relevant actual characteristic values from the individual subsystem modules (1, 2, 3, 4), which currently construct the safety system (10, 20) of the system in modular form, to the checking device, in particular by reading out the local, module-specific safety-relevant actual characteristic values by the checking device or by the subsystem modules (1, 2, 3, 4) transmitting the local, module-specific safety-relevant actual characteristic values on their own to the checking device, in particular after this has been connected to the safety system (10, 20); characterized by the following steps: d) processing, by the checking device, the transmitted, in particular read out by the checking device, local, module-specific safety-relevant actual characteristic values, to safety-relevant actual characteristic values of the safety system (10, 20), which result when the individual subsystem modules (1, 2, 3, 4) interact and when the safety system (10, 20) is constructed spanning the individual subsystem modules (1, 2, 3, 4), e) comparing, by the verification device, the resulting safety-relevant actual characteristic values of the safety system (10, 20) with the nominal characteristic values of the system stored in the memory of the checking device and f) generating a reaction signal as a function of the comparison result, with the generated reaction signal being used to automatically release current safety functions of the safety system (10, 20) by the checking device if a threshold value is not reached with regard to at least one difference value resulting from the comparison and/or to automatically refuse to release current safety functions of the safety system (10, 20) by the checking device if the threshold value is exceeded with regard to at least one difference value resulting from the comparison.