Requirements for system behaviour on detection of a fault

1 The detection of a dangerous fault (by diagnostic tests, proof tests or by any other means) in any subsystem which can tolerate a single hardware fault shall result in either 

Where the above actions depend on an operator taking specific actions in response to an alarm (for example, opening or closing a valve), then the alarm shall be considered part of the safety instrumented system (i.e., independent of the BPCS). 

Where the above actions depend on an operator notifying maintenance to repair a faulty system in response to diagnostic alarm, this diagnostic alarm may be a part of the BPCS but shall be subject to appropriate proof testing and management of change along with the rest of the SIS. 

NOTE The specified action (fauit reacticn) required tc achieve cr maintain a safe state shouid be specified in the safety requirements (see 10.3). it may ccnsist, fcr exampie, cf the safe shutdown of the prooess or of that part of the process which reiies, fcr risk reducticn, cn the fauity subsystem cr ether specified mitigation pianning. 

2 The detection of a dangerous fault (by diagnostic test, proof tests or by any other means) in any subsystem having no redundancy and on which a safety instrumented function is entirely dependent (see note 1) shall, in the case that the subsystem is used only by safety instrumented function(s) operation in the demand mode, result in either 

---