Cause and Effect Matrix

Cause Ref,Cause Description,Tag,Trip Setting,Units,Delay s,MTR-101 Stop,XV-101 Close,FCV-101 Close,Beacon On,Horn On,Sequence Hold,Master Trip,Reset Type,Test Ref
C-001,Emergency stop pressed,ESTOP-01,,,0,X,X,X,X,X,X,X,Manual,FAT-SF-001
C-002,Guard door opened,GS-101,,,0,X,X,,X,,X,,Manual,FAT-SF-002
C-003,Feed tank level high high,LT-101,95,%,2,X,X,,X,X,X,,Manual,FAT-IL-001
C-004,Feed tank level low low,LT-101,5,%,5,X,,,X,,X,,Auto,FAT-IL-002
C-005,Reactor temperature high high,TT-101,180,degC,0,X,X,X,X,X,X,X,Manual,FAT-IL-003
C-006,Feed flow low,FT-101,5,m3/h,10,,,,X,,X,,Auto,FAT-IL-004
C-007,Feed pump fault,MTR-101,,,0,X,,,X,,X,,Manual,FAT-IL-005
C-008,Valve failed to open,XV-101,,,10,X,,,X,,X,,Manual,FAT-IL-006
C-009,Remote I/O comms loss,,,,3,X,X,X,X,X,X,,Manual,FAT-IL-007
C-010,Control power failure,,,,0,X,X,X,,,X,X,Manual,FAT-IL-008

# Cause and Effect Matrix, notes and rules
## {{PROJECT_NAME}}

| | |
|---|---|
| **Document title** | Cause and Effect Matrix, notes and rules (C&E) |
| **Document number** | {{DOC_NO}} |
| **Revision** | {{REV}} |
| **Date** | {{DATE}} |
| **Project** | {{PROJECT_NAME}} |
| **Client** | {{CLIENT}} |
| **Prepared by** | {{AUTHOR}}, {{COMPANY}} |

### Revision history

| Rev | Date | Description | Author | Approved |
|---|---|---|---|---|
| 0 | {{DATE}} | First issue | {{AUTHOR}} | |
| | | | | |

### Approval

| Role | Name | Signature | Date |
|---|---|---|---|
| Author | {{AUTHOR}} | | |
| Reviewer (engineering) | | | |
| Approver ({{COMPANY}}) | | | |
| Approver ({{CLIENT}}) | | | |

---

## How to read the matrix

Each row is a cause. Each column after the delay is an effect. An X means that cause produces
that effect. A blank means it does not, and a blank is a statement, not an omission.

## Rules that apply to the whole matrix

**Fail safe.** Every effect listed is the de-energised state unless the row says otherwise. A
loss of control power produces every effect in the C-010 row, and that row is not optional.

**Delays.** A delay is a deliberate filter against a noisy signal or a transient. A zero delay
on a safety cause is correct and must not be "tuned out" during commissioning because it is
nuisance tripping. Nuisance tripping on a safety input is a fault to be found, not a delay to
be added.

**Reset type.** Auto means the effect clears when the cause clears. Manual means an operator
must act. Every safety related cause is manual reset, per ISO 13849-1: a machine that restarts
by itself when a guard is closed is a machine that restarts with someone inside it.

**Master trip.** Where a cause is marked for master trip, all other effects are implied. It is
still listed explicitly, because implied behaviour is untestable behaviour.

## Bypass and override

| Ref | What may be bypassed | Who may authorise | Conditions | Recorded |
|---|---|---|---|---|
| BP-001 | [Signal] | [Role, level 3] | [e.g. maintenance mode only, key switch] | Yes, audit trail |

No safety instrumented function may be bypassed from the operator interface. If a bypass is
required for maintenance, it is key switched, it is alarmed while active, and it is logged.

## Testing

Each X is one test. The test proves the effect happens, and it also proves the blanks: while
testing C-006, confirm the pump does *not* stop. Testing only the marks proves half the matrix.

| Test ref | Cause | Method | Expected | Result | Tester | Date |
|---|---|---|---|---|---|---|
| FAT-IL-001 | C-003 | [Simulate LT-101 above 95%] | [Effects per row] | | | |