Cause and Effect Matrix
Template (Excel)

A cause and effect matrix (also called a C&E matrix, trip matrix, or safety cause effect diagram) is the document that defines, for each Safety Instrumented Function (SIF), which initiator (cause) drives which final element action (effect). It is presented as a matrix with initiators on the rows and final elements on the columns. Each intersection records the action (close, open, trip, start, stop, vent, inject), the voting arrangement (1oo1, 1oo2, 2oo2, 2oo3), the SIL classification per IEC 61511, the time delay, and any bypass provisions. It is the primary specification for Safety Instrumented System (SIS) logic.

Required columns: document and P&ID reference, initiator tag and service description, initiator type, trip setpoint, voting arrangement, SIF identifier, SIL classification, time delay, bypass and override provision, logic solver cabinet reference, final element tag and service description, final element action, fail-safe state, cause category (process upset, equipment failure, fire and gas, manual ESD), effect category (unit trip, equipment trip, local isolation, depressurisation, alarm only), HAZOP and LOPA cross-reference, notes. See the IEC 61511 SIL standard reference.

Pathnovo, an engineering document intelligence platform, extracts trip initiators and final element actions from the P&IDs, cross-references the HAZOP register and LOPA worksheets for SIF assignments, and assembles a draft C&E matrix with voting, SIL classification, and time delay populated from the SIL determination worksheet. The platform also runs the cross-document verification check against the live P&IDs to flag initiators or final elements that exist on one document but not the other. See the C&E vs P&ID verification workflow.

HAZOP identifies process hazards and recommends safeguards. LOPA quantifies the risk reduction required from each Independent Protection Layer (IPL) and assigns the SIL target for each Safety Instrumented Function (SIF). The C&E matrix is the engineering realisation of those SIFs: it defines the specific initiators, voting, final elements, and timing that deliver the SIL target. The HAZOP Action Reference and LOPA Reference columns trace each row back to the hazard study. See the HAZOP register template and the LOPA standard reference.

Voting arrangement is set by the SIL target and the spurious trip tolerance. 1oo1 (one initiator out of one trips) is used for SIL 1 with low spurious trip cost. 1oo2 (one out of two trips, redundant sensors) is the typical SIL 2 arrangement, providing fail-safe but with higher spurious trip rate. 2oo2 (both must agree to trip) reduces spurious trips at the cost of availability and is rare in safety service. 2oo3 (two out of three) is the typical SIL 3 arrangement, giving both high safety integrity and low spurious trip rate. The C&E matrix Voting column drives the SIS hardware specification.

Cross-document verification ensures every initiator and final element on the C&E matrix exists on the live P&ID revision, and every safety-critical instrument on the P&ID is represented on the C&E matrix. Manual verification is error-prone: a typical revamp project carries 200 to 500 SIF cells across multiple C&E sheets. Pathnovo, an engineering document intelligence platform, runs the verification automatically, producing a verification report listing missing initiators, missing final elements, mismatched tag numbering, and revision drift. See the C&E vs P&ID verification workflow.

On a revamp project, the existing C&E matrix is the baseline. Each row is reviewed against the revamp scope and flagged as 'retained', 'modified', 'new', or 'removed'. Retained rows preserve existing SIF logic; modified rows update voting, setpoint, or final element; new rows add SIFs introduced by the revamp; removed rows are demolished. The revamp C&E is then re-verified against the marked-up P&IDs. Particularly important on Indian PSU and GCC refinery revamps where partial demolition introduces high risk of orphaned SIF logic in the SIS.