Cause & Effect (C&E) Matrix — Final Self-Verification Checklist

Header & Document Control

• Document number/title follow project numbering; “Cause & Effect Matrix” clearly stated with unit/area.
• Project, facility, unit, service and revision purpose (IFR/IFA/IFC/IFD) are complete and consistent.
• Prepared/Checked/Approved names, disciplines, dates filled; signatures if required by contract.
• Applicable standards/specs listed (IEC 61511/61508, ISA-84, ISA-5.1/18.2, NFPA 72 for F&G, client specs).
• Reference documents (P&IDs, Safeguarding/Control Narrative, IPF/LOPA register, Area Classification, I/O List, Index) with numbers & revisions.
• Unit systems (pressure/temperature/time) and time base for SOE/time stamps defined and consistent.
• Confidentiality/classification footer matches project policy; logos/ownership correct.

Scope & Boundaries

• Systems covered are clearly stated (BPCS, SIS/PSD/ESD, F&G, Package PLCs, MMS/AS protection) and boundaries defined.
• Nodes/units/areas and shutdown levels (e.g., Unit, Train, Plant) identified; cross-unit dependencies noted.
• Operating modes covered (startup, normal, shutdown, maintenance, emergency, test) and mode-dependent logic identified.
• Safe state definitions for equipment (valves closed/open, motors tripped, blowdown initiated) are declared up front.
• Explicit list of exclusions/assumptions documented (what the C&E does not address).

Causes (Inputs) Definition

• Each cause lists tag, description, service, location, instrument type, and system ownership (BPCS vs SIS vs F&G).
• Trip/alarm setpoints with units, calibration range, hysteresis, filtering/damping, and time delays (on/off) are specified and traceable to narrative/LOPA.
• Voting/selection defined for redundant sensors (e.g., 1oo2, 2oo3, median select) and per-cause logic clearly stated in the table or notes.
• Signal types and fail behavior captured (4–20 mA/HART, dry contact, digital bus; fail high/low/open circuit trip behavior).
• Diagnostic/maintenance states addressed (sensor fault, line break, bad PV) with action (trip, alarm only, degrade to lower vote).
• Initiators from F&G include device type, location class, fire/gas zoning, and voting per zone as per NFPA 72/client spec.
• Manual pushbuttons/ESD stations identified with hardwired/SIS input type and latching/reset rules defined.

Logic, Voting & Reset Behavior

• Trip logic for each function captured (permissives/inhibits, interlocks, mode conditions) and consistent with narrative/SRS.
• Voting schemes and degradation rules defined (e.g., 2oo3 → 1oo2 on fault) including common-cause considerations & diagnostics.
• Latching vs non-latching trips identified; reset conditions and authority (local panel, CCR, key switch) stated; bumpless reset ensured.
• Time delays for actuation and reset documented; energize-to-trip/de-energize-to-trip philosophy consistent across functions.
• Suppression/shelving rules for causes during startup/maintenance documented with automatic re-enable where required.

Effects (Outputs/Actions)

• Each effect identifies final element(s) with tag(s), device type (SDV/BDV/Motor Trip/Blowdown), fail position, and action (Close/Open/Trip/Start/Stop).
• Shutdown level and scope of effect stated (equipment/unit/train/plant); cascaded effects consistent with hierarchy.
• Actuation details: solenoid type/certification, ESD relay, PST/partial-stroke rules, air/hydraulic dependencies, stroke/response time.
• Depressurization/blowdown logic (BDV open, isolations closed) coherent; flare/relief interactions considered if applicable.
• Re-start/untrip permissives, warm-up and sequencing captured; manual intervention notes provided if required.

Matrix Integrity & Cross-References

• Every cause has at least one effect or documented rationale for “no action”; no orphan effects exist without a cause.
• Tag numbers and descriptions match Instrument Index and P&IDs; symbols/abbreviations follow ISA-5.1/client legend.
• C&E aligns with Safeguarding/Control Narrative, IPF/SIF list, and LOPA risk reduction claims; inconsistencies resolved or noted.
• Inter-system links (BPCS↔SIS↔F&G↔packages) identified with signal direction, hardwired vs soft link, and fail behavior on comms loss.
• Shutdown keys/logic diagrams reference numbers included; matrix version synchronized with those drawings.

Alarms, Annunciation & HMI

• Alarm priorities per EEMUA 191/ISA-18.2 assigned; colors, sounds, and texts standardized and concise (verb-object with action).
• First-out trip identification, SOE granularity and time sync (NTP/PTP) requirements specified; timestamps to required resolution.
• Alarm shelving/suppression rules consistent with operating modes; bypass/override annunciation mandatory and latched until cleared.
• Operator guidance embedded (expected actions & time criticality); faceplates/mimics show trip status, votes, inhibits, PST status.

Overrides, Bypass & Inhibit Management

• Bypass/override points identified (sensor, logic, output); authority levels and physical key switch locations noted.
• Time-bound bypass policy defined (auto expiry where applicable) with audit trail/logging and MOC linkage.
• Bypass annunciation is prominent (HMI banner & alarm); risk compensating measures stated during bypass.
• PST strategy documented (method, frequency, acceptable stroke %, failure actions, inhibit handling during PST).

Testing, Proof & Validation

• FAT/SAT procedures reference included; each matrix cause/effect has a corresponding test step with acceptance criteria.
• SIF proof test intervals/coverage captured; reset & restoration steps defined; overrides cleared at test end.
• Trip timings (detection to final action) meet requirements; stroke/trip time records required for valves/motors.
• Failure mode tests included (sensor fault, power loss, comms loss) with expected actions (trip, degrade, alarm).

Interfaces & Utilities

• ICSS interfaces defined (hardwired vs serial/ethernet): signal list, protocol, heartbeat/diagnostics, fail-on-loss behavior.
• External packages (compressor antisurge, turbine control, MMS) interlocks mapped with ownership & test method agreed.
• Power/UPS/air/hydraulic dependencies of final elements noted; loss-of-utility responses included in matrix where needed.

Data Quality & Traceability

• Each setpoint, vote, and effect traceable to source (HAZOP/LOPA node, SRS requirement, narrative clause) with reference IDs in notes.
• Version control maintained; change log updated with rationale/impacts; cross-docs updated (P&ID, logic, shutdown keys).
• Consistency check against Instrument Index, I/O list, loop drawings; no tag or service mismatches remain.

Notes, Attachments, & Final Polish

• Assumptions/constraints captured (startup overrides, maintenance permissives, temporary inhibits) with removal plan.
• Attachments referenced: safeguarding/control narrative, shutdown keys, logic diagrams, package interlock diagrams, F&G zoning drawings.
• Formatting clear: consistent symbols, no blank critical fields; matrix legend and abbreviations table included.
• Grammar/spelling/units reviewed; page numbers/revision history correct; confidential client names handled per policy.
• Final sanity scan: each cause/effect traceable to a source within 60 seconds; testability verified.