Cause-and-Effect Matrix Specifications for Safety Critical Systems at CERN

One of the most critical phases in the development of a Safety Instrumented System (SIS) is the functional specification of the Safety Instrumented Functions (SIFs). This step is carried out by a multidisciplinary team of process, controls and safety experts. This functional specification must be simple, unambiguous and compact to allow capturing the requirements from the risk analysis, and facilitating the design, implementation and verification of the SIFs. The Cause and Effect Matrix (CEM) formalism provides a visual representation of Boolean expressions. This makes it adequate to specify stateless logic, such as the safety interlock logic of a SIS. At CERN, a methodology based on the CEM has been applied to the development of a SIS for a magnet test bench facility. This paper shows the applicability of this methodology in a real magnet test bench and presents its impact in the different phases of the IEC 61511 safety lifecycle.