PDF Recent Developments On Industrial Control Systems Resilience Emil Pricop Ebook Full Chapter

Recent Developments on Industrial
Control Systems Resilience Emil Pricop

Visit to download the full and correct content document:
https://textbookfull.com/product/recent-developments-on-industrial-control-systems-re
silience-emil-pricop/
More products digital (pdf, epub, mobi) instant
download maybe you interests ...
Intelligent Information and Database Systems: Recent

Developments Maciej Huk
https://textbookfull.com/product/intelligent-information-and-
database-systems-recent-developments-maciej-huk/
Recent Results on Nonlinear Delay Control Systems: In

honor of Miroslav Krstic 1st Edition Michael Malisoff
https://textbookfull.com/product/recent-results-on-nonlinear-
delay-control-systems-in-honor-of-miroslav-krstic-1st-edition-
michael-malisoff/
Resilience of Critical Infrastructure Systems-Emerging

Developments and Future Challenges 1st Edition Zhishen
Wu (Editor)
https://textbookfull.com/product/resilience-of-critical-
infrastructure-systems-emerging-developments-and-future-
challenges-1st-edition-zhishen-wu-editor/
Systems Engineering in Research and Industrial Practice

Foundations Developments and Challenges Josip
Stjepandi■
https://textbookfull.com/product/systems-engineering-in-research-
and-industrial-practice-foundations-developments-and-challenges-
josip-stjepandic/
Industrial Control Systems Security and Resiliency
Practice and Theory Craig Rieger
https://textbookfull.com/product/industrial-control-systems-
security-and-resiliency-practice-and-theory-craig-rieger/
Recent Developments in Acoustics Select Proceedings of

the 46th National Symposium on Acoustics Mahavir Singh
https://textbookfull.com/product/recent-developments-in-
acoustics-select-proceedings-of-the-46th-national-symposium-on-
acoustics-mahavir-singh/
Industrial Automation and Control Systems Security

Principles Second Edition Ronald L. Krutz
https://textbookfull.com/product/industrial-automation-and-
control-systems-security-principles-second-edition-ronald-l-
krutz/
Recent Trends in Control and Sensor Systems in

Emergency Management 1st Edition Roman Szewczyk
https://textbookfull.com/product/recent-trends-in-control-and-
sensor-systems-in-emergency-management-1st-edition-roman-
szewczyk/
Recent Developments in Integrable Systems and Related

Topics of Mathematical Physics Kezenoi Am Russia 2016
Victor M. Buchstaber
https://textbookfull.com/product/recent-developments-in-
integrable-systems-and-related-topics-of-mathematical-physics-
kezenoi-am-russia-2016-victor-m-buchstaber/
Studies in Systems, Decision and Control 255
Emil Pricop
Jaouhar Fattahi
Nitul Dutta
Mariam Ibrahim Editors
Recent
Developments
on Industrial
Control Systems
Resilience
Studies in Systems, Decision and Control
Volume 255
Series Editor
Janusz Kacprzyk, Systems Research Institute, Polish Academy of Sciences,
Warsaw, Poland
The series “Studies in Systems, Decision and Control” (SSDC) covers both new
developments and advances, as well as the state of the art, in the various areas of
broadly perceived systems, decision making and control–quickly, up to date and
with a high quality. The intent is to cover the theory, applications, and perspectives
on the state of the art and future developments relevant to systems, decision
making, control, complex processes and related areas, as embedded in the fields of
engineering, computer science, physics, economics, social and life sciences, as well
as the paradigms and methodologies behind them. The series contains monographs,
textbooks, lecture notes and edited volumes in systems, decision making and
control spanning the areas of Cyber-Physical Systems, Autonomous Systems,
Sensor Networks, Control Systems, Energy Systems, Automotive Systems,
Biological Systems, Vehicular Networking and Connected Vehicles, Aerospace
Systems, Automation, Manufacturing, Smart Grids, Nonlinear Systems, Power
Systems, Robotics, Social Systems, Economic Systems and other. Of particular
value to both the contributors and the readership are the short publication timeframe
and the world-wide distribution and exposure which enable both a wide and rapid
dissemination of research output.
** Indexing: The books of this series are submitted to ISI, SCOPUS, DBLP,
Ulrichs, MathSciNet, Current Mathematical Publications, Mathematical Reviews,
Zentralblatt Math: MetaPress and Springerlink.
More information about this series at http://www.springer.com/series/13304

Emil Pricop Jaouhar Fattahi Nitul Dutta
• • •
Mariam Ibrahim
Editors
Recent Developments
on Industrial Control Systems
Resilience
123
Editors
Emil Pricop Jaouhar Fattahi
Control Engineering, Computers Department of Computer Science
and Electronics Department and Software Engineering
Petroleum-Gas University of Ploiesti Laval University
Ploiesti, Romania Quebec City, QC, Canada
Nitul Dutta Mariam Ibrahim

Computer Engineering Department Department of Mechatronics Engineering,
Marwadi University School of Applied Technical Sciences
Rajkot, Gujarat, India German Jordanian University
Amman, Jordan
ISSN 2198-4182 ISSN 2198-4190 (electronic)

Studies in Systems, Decision and Control
ISBN 978-3-030-31327-2 ISBN 978-3-030-31328-9 (eBook)
https://doi.org/10.1007/978-3-030-31328-9
© Springer Nature Switzerland AG 2020
This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part
of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations,
recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission
or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar
methodology now known or hereafter developed.
The use of general descriptive names, registered names, trademarks, service marks, etc. in this
publication does not imply, even in the absence of a specific statement, that such names are exempt from
the relevant protective laws and regulations and therefore free for general use.
The publisher, the authors and the editors are safe to assume that the advice and information in this
book are believed to be true and accurate at the date of publication. Neither the publisher nor the
authors or the editors give a warranty, expressed or implied, with respect to the material contained
herein or for any errors or omissions that may have been made. The publisher remains neutral with regard
to jurisdictional claims in published maps and institutional affiliations.
This Springer imprint is published by the registered company Springer Nature Switzerland AG
The registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland
Dedicated to our beloved families for
supporting us all along.
Emil Pricop, Jaouhar Fattahi, Nitul Dutta
and Mariam Ibrahim
Preface
Industrial control systems (ICS) have a critical place in the functioning and
development of today’s world. They are key components of every technical
infrastructure around us, ranging from air conditioning in our homes and cars to the
big factories, the energy production and distribution, the water distribution systems,
and even the nuclear plants. The correct operation of the industrial control systems
is essential for the functioning of our society, so they have to be designed to be
resilient. This means that the ICS should be able to recover from various process
faults and failures and to withstand emerging cyberattacks. These objectives can be
achieved only by assuring both safety and security, being it physical or cybernetic.
Also, a special interest is presented by predictive and preventive maintenance
activities.
The main goal of the book is to collect valuable contributions of renowned
researchers in the field of control engineering, Internet of Things, and cybersecurity.
Some chapters are based on presentations and discussions that took place at the
previous editions of the International Workshop on Systems Safety and Security
(IWSSS, https://www.iwsss.org). The workshop, initiated in 2013, become a tradi-
tional annual scientific event in Romania. IWSSS is now a recognized venue for the
exchange of experience and ideas in the field of systems safety, security, and resi-
lience with the scope of stimulating joint work at a regional and international level.
The book comprises research based on theory, subsequent simulation and exper-
imental results, numerous case studies, and practical implementations. Given the
detailed discussion in the said context, the book offers profound insights on increasing
the resilience of industrial control systems. Both fundamental and advanced topics are
discussed, having the theoretical approaches sustained by practical examples.
The structure and chapters of the book are broadly grouped into core topics that
address challenges related to safe operations of control systems, risk analysis and
assessment, usage of attack graphs to evaluate and increase the resiliency of control
systems, preventive maintenance, and malware detection and analysis. The resi-
lience and cybersecurity of sensor networks and the Internet of Things devices,
which are now an integral part of the various industrial control systems, are dis-
cussed in different chapters of the book.
vii
viii Preface
Another notable contribution of this book is the inclusion of necessary and

timely response to malicious attacks or hazardous situations. This topic will cer-
tainly help readers to decide the best approaches to handle such unwanted
situations.
We believe, the contents of the book is essential readings for system engineers,
researchers, and specialists. The topics discussed in the book are challenging and
recent and we anticipate the book to represent a useful reference for all the pro-
fessionals in the field of ICS resilience, safety, and security. Finally, the editors
expect that this book will be a supportive auxiliary to undergraduate and graduate
students, to academia and researchers trying to address security and safety issues
related to the modern implementations of the industrial control systems.
Ploiesti, Romania Dr. Emil Pricop

Quebec City, Canada Dr. Jaouhar Fattahi
Rajkot, India Dr. Nitul Dutta
Amman, Jordan Dr. Mariam Ibrahim
August 2019
Contents
Safety Instrumented Systems Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Alina-Simona Băieșu
Risks Assessment of Critical Industrial Control Systems . . . . . . . . . . . . 21
Gabriel Rădulescu
Machine Learning Based Predictive Maintenance of Infrastructure
Facilities in the Cryolithozone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Andrey V. Timofeev and Viktor M. Denisov
Cybersecurity Threats, Vulnerability and Analysis in Safety Critical
Industrial Control System (ICS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Xinxin Lou and Asmaa Tellabi
Automatic Attack Graph Generation for Industrial Controlled
Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Mariam Ibrahim, Ahmad Alsheikh and Qays Al-Hindawi
Determining Resiliency Using Attack Graphs . . . . . . . . . . . . . . . . . . . . . 117
Mariam Ibrahim and Ahmad Alsheikh
Modern Methods for Analyzing Malware Targeting
Control Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Nitul Dutta, Kajal Tanchak and Krishna Delvadia
Multi-stage Cyber-Attacks Detection in the Industrial
Control Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
Tomáš Bajtoš, Pavol Sokol and Terézia Mézešová
Using Honeypots for ICS Threats Evaluation . . . . . . . . . . . . . . . . . . . . 175
Nitul Dutta, Nilesh Jadav, Nirali Dutiya and Dhara Joshi
ix
x Contents
Intrusion Detection on ICS and SCADA Networks . . . . . . . . . . . . . . . . 197

Marian Gaiceanu, Marilena Stanculescu, Paul Cristian Andrei,
Vasile Solcanu, Theodora Gaiceanu and Horia Andrei
Security Evaluation of Sensor Networks . . . . . . . . . . . . . . . . . . . . . . . . . 263
Horia Andrei, Marian Gaiceanu, Marilena Stanculescu, Ioan Marinescu
and Paul Cristian Andrei
Innovative Hardware-Based Cybersecurity Solutions . . . . . . . . . . . . . . . 283
Octavian Ionescu, Viorel Dumitru, Emil Pricop and Stefan Pircalabu
Legal Issues of Deception Systems in the Industrial
Control Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301
Pavol Sokol, Radoslav Benko and Laura Rózenfeldová
Editors and Contributors
About the Editors
Emil Pricop is currently with the Control Engineering, Computers and Electronics
Department of the Petroleum-Gas University of Ploiesti, Romania. He holds the
position of Senior Lecturer since 2018 and he is teaching Computer Networking,
Software Engineering, and Human–Computer Interaction courses. He received his
Ph.D. in Systems Engineering from Petroleum-Gas University of Ploiesti by
defending in May 2017 the thesis with the title “Research regarding the security of
control systems”. His research interest is cybersecurity, focusing especially on
industrial control systems security. Dr. Emil Pricop is co-editor of the book Recent
Advances in Systems Safety & Security (Springer, 2016) and author or co-author of
two national (Romanian) patents, five book chapters published in books edited by
Springer, and over 30 papers in journals or international conferences. From 2013,
Dr. Pricop is the initiator and chairman of International Workshop on Systems
Safety and Security—IWSSS, a prestigious scientific event organized annually.
Jaouhar Fattahi is currently working with Defence Research and Development

Canada (DRDC) at the Valcartier Research Centre as a defence scientist. He is also
an adjunct professor with Laval University, Quebec City, Canada. He obtained his
Ph.D. on the security of cryptographic protocols from Laval University in October
2015. He completed his postdoctoral fellowship at the Canadian Armed Forces
Research Centre in the field of cybersecurity. He has also been a computer engineer
since 1995. Dr. Jaouhar Fattahi is the author of The Theory of Witness-Functions
for verifying security of cryptographic protocols. He now specializes in reverse
engineering and machine and deep learning applied to security and cybersecurity.
He is an IEEE member.
Nitul Dutta is a professor in the Computer Engineering Department, Faculty of

Engineering (FoE), Marwadi University, Rajkot, Gujarat, since 2014. He has a total
experience of 20 years. He received B.E. degree in Computer Science and
xi
xii Editors and Contributors
Engineering from Jorhat Engineering College, Assam (1995), and M. Tech. degree
in Information Technology from Tezpur University, Assam (2002). He completed
Ph.D. (Engineering) degree in the field of Mobile IPv6 at Jadavpur University
(2013) and published 15 Journal and 30 conference papers. He has completed
two AICTE sponsored research projects of worth Rs. 25 Lakhs (approx.)
(Rs. Twenty-Five Lakhs only). His current research interests are wireless
communication, mobility management in IPv6-based network, cognitive radio
networks, and cybersecurity.
Mariam Ibrahim received her Bachelor’s degree in Electrical and Computer

Engineering from the Hashemite University, Jordan, in 2008, and M.S. in
Mechatronics Engineering from Al-Balqa Applied University, Jordan, in 2011, and
the Ph.D. in Electrical Engineering from Iowa State University, USA, in 2016. She
was a lab supervisor with EE department at the Hashemite University (2008–2011).
She joined the German Jordanian University (2011) as an RA, where she got a
scholarship to pursue her Ph.D. studies; she is currently an assistant professor at
GJU. Her research interests include discrete-event systems, stochastic systems,
power systems, communication networks, healthcare systems, together with their
control and resiliency analysis, and system model-based verification/attack graph
generation using AADL. She is a member of Iowa Section IEEE Control Systems
Society Technical Chapter. She serves as a scientific reviewer in the international
scientific committee of the International Workshop on Systems Safety and
Security—IWSSS since 2017, journal of IET Cyber-Physical Systems: Theory &
Application, 2018, and IEEE Network Magazine, 2018.
Contributors
Qays Al-Hindawi Department of Mechatronics Eng, Faculty of Applied Technical

Sciences, German Jordanian University, Amman, Jordan
Ahmad Alsheikh Department of Mechatronics Eng, Faculty of Applied Technical
Horia Andrei SM-IEEE, Bucharest, Romania;
Doctoral School of Engineering Sciences, University Valahia Targoviste,
Targoviste, Romania
Paul Cristian Andrei Department of Electrical Engineering, University
Politehnica Bucharest, Bucharest, Romania
Alina-Simona Băieşu Automatic Control, Computers and Electronics Department,
Petroleum-Gas University of Ploiesti, Ploiesti, Romania
Tomáš Bajtoš Faculty of Science, Institute of Computer Science, Pavol Jozef
Šafárik University in Košice, Košice, Slovakia
Editors and Contributors xiii
Radoslav Benko Faculty of Law Institute of International Law and European Law,
Pavol Jozef Šafárik University in Košice, Košice, Slovakia
Krishna Delvadia Chhotubhai Gopalbhai Patel Institute of Technology, Bardoli,
Gujarat, India
Viktor M. Denisov “Flagman Geo” Ltd., Saint-Petersburg, Russia
Viorel Dumitru National Institute of Materials Physics, Magurele, Romania
Nirali Dutiya Department of Computer Engineering, Faculty of PG Studies, MEF
Group of Institutions (MEFGI), Rajkot, India
Nitul Dutta Computer Engineering Department, MEF Group of Institutions,
Rajkot, Gujarat, India
Marian Gaiceanu Department of Control Systems and Electrical Engineering,
Dunarea de Jos University of Galati, Galati, Romania
Theodora Gaiceanu Gheorghe Asachi Technical University of Iasi, Iasi, Romania
Mariam Ibrahim Department of Mechatronics Eng, Faculty of Applied Technical
Octavian Ionescu National Institute for Research and Development in
Microtechnologies, IMT Bucharest, Bucharest, Romania
Nilesh Jadav Department of Computer Engineering, Faculty of PG Studies, MEF
Dhara Joshi Department of Computer Engineering, Faculty of PG Studies, MEF
Xinxin Lou Bielefeld University, Bielefeld, Germany
Ioan Marinescu Doctoral School of Engineering Sciences, University Valahia
Targoviste, Targoviste, Romania
Terézia Mézešová Faculty of Science, Institute of Computer Science, Pavol Jozef
Stefan Pircalabu Cyberswarm Inc., San Mateo, CA, USA
Emil Pricop Petroleum-Gas University of Ploiesti, Ploiesti, Romania
Gabriel Rădulescu Control Engineering, Computers and Electronics Department,
Petroleum-Gas University of Ploieşti, Ploieşti, Romania
Laura Rózenfeldová Faculty of Law, Department of Commercial Law and
Business Law, Pavol Jozef Šafárik University in Košice, Košice, Slovakia
Pavol Sokol Faculty of Science, Institute of Computer Science, Pavol Jozef
Vasile Solcanu Dunarea de Jos University of Galati, Galati, Romania
xiv Editors and Contributors
Marilena Stanculescu Department of Electrical Engineering, University

Politehnica Bucharest, Bucharest, Romania
Kajal Tanchak Computer Engineering Department, MEF Group of Institutions,
Rajkot, Gujarat, India
Asmaa Tellabi University Siegen, Siegen, Germany
Andrey V. Timofeev LLP “EqualiZoom”, Astana, Kazakhstan
Safety Instrumented Systems Analysis
Alina-Simona Băies, u
Abstract Operating most industrial processes, especially those in the oil and gas
industry, involves an inherent risk due to the presence of dangerous/flammable sub-
stances. Therefore, using Safety Instrumented Systems (SIS) is mandatory. These
systems are especially designed to protect personnel, equipment and environment
by reducing the likelihood of an unwanted event to appear by reducing the sever-
ity of its impact. This chapter presents a comprehensive Introduction in the field of
Safety Instrumented Systems, then the most important feature of a SIS is presented,
Safety Integrity Level of a Safety Instrumented System and some Practical Aspects
Regarding Safety Instrumented Systems are outlined. The chapter ends with some
considerations regarding IT Enabled Safety Systems.
Keywords Safety instrumented systems · Risk analysis · IT enabled safety systems
1 Introduction
This paragraph outlines general aspects regarding the Safety Instrumented Systems
(SIS) and their goal by presenting examples of such systems used in the industrial
practice.
It also presents the evolution of the current in use standards that regulates the
design, implementation and operation of SIS, focusing on IEC 61508 and IEC
61511 standards. The delimitation between the Control Systems (CS) and Safety
Instrumented Systems (SIS) it is also highlighted by marking the major differences
between the two types of automated systems.
A.-S. Băies, u (B)

Automatic Control, Computers and Electronics Department, Petroleum-Gas University of
Ploiesti, Ploiesti, Romania
e-mail: agutu@upg-ploiesti.ro
© Springer Nature Switzerland AG 2020 1

E. Pricop et al. (eds.), Recent Developments on Industrial Control Systems Resilience,
Studies in Systems, Decision and Control 255,
https://doi.org/10.1007/978-3-030-31328-9_1
2 A.-S. Băies, u
1.1 Safety Instrumented Systems General Aspects
A Safety Instrumented System (SIS) aims to bring the process to a safe state when
the normal operating conditions are violated, for reasons of safety and protection
[1]. Therefore, the role of a SIS is to monitor potential hazardous conditions and to
mitigate the consequences in case of an unwanted dangerous event appearance.
A SIS is a set of sensors, logic solvers and actuators [2].
A SIS does not improve production or efficiency but helps to reduce economic
losses by reducing risks [1].
The structure of a SIS is presented in Fig. 1.
The sensors are used to measure process parameters (temperature, pressure, flow,
etc.) and to use their measures to determine whether an equipment or process is in a
safe or unsafe state. The sensors can be of various types, from simple pneumatic or
electrical switches to intelligent sensors with diagnosis. These sensors are dedicated
to SIS and use communication channels and power supplies, different from those of
control system sensors.
The logic solvers have the role of establishing what decision should be made
based on the information received from sensors. Typically, the logic solver is a Pro-
grammable Logic Controller (PLC) that receives as inputs the signals from sensors,
runs a particular program according to these values in order to prevent possible
dangerous situations and sends output control variables to actuators.
The actuators carry out the actions from the logic solver. Usually the actuators
are two-way valves (opened/closed), pneumatically operated.
All SIS components must be designed so that they can safely isolate the process
in the event of a hazardous situation [3].
In the following, a SIS example is presented to highlight its role, structure and
operation [4].
PROCESS
SENSORS LOGIC SOLVER ACTUATORS
SAFETY INSTRUMENTED SYSTEM (SIS)
Fig. 1 A safety instrumented system (SIS) structure

Safety Instrumented Systems Analysis 3
I/P LC
1
Inlet PSV Forced Dangerous

CV1 outlet vapours
LT H
1 FLAMABLE
LIQUID
Outlet
Fig. 2 A flammable liquid level control system: LC1—level controller, LT1—level transducer,
I/P—electro/pneumatic converter, CV1—control valve, PSV—overPressure Safety Valve, H—liq-
uid level
Figure 2 presents a vessel in which a flammable liquid is stored. A typical control

loop must maintain the level (H) at 50%. An unwanted dangerous event can occur
if the control loop fails for some reason and the vessel becomes full. The vessel has
an overPressure Safety Valve (PSV) which evacuates the liquid out of vessel, but it
will form a dangerous cloud of vapours [5].
Situations that can cause the control loop malfunction are:
– the Control Valve (CV1) cannot be operated;
– the Level Transducer (LT1) is faulty;
– the Level Controller (LC1) is manually operated and the Control Valve (CV1) is
opened.
To prevent a possible damage, in the event of Control System (CS) malfunction,
a Safety Instrumented System (SIS), as in Fig. 3, can be used. The CS equipment are
marked with 1 and the equipment from SIS structure, with 2.
The SIS elements are symbolized using the ANSI/ISA 5.1 Specific Standard [6].
The SIS from Fig. 3 operation can be described as follows: the level transducer
LZT2 has the role of detecting the vessel maximum liquid level (Hmax) and when
this happens, the logic solver, for example a PLC, stops the vessel feeding through
the UZV2 Safety Valve. Basically, the logic solver acts on the electromagnetic valve
UZY2 that stops the air supply of UZV2, the air being ventilated outwards. The
UZV2 will remain closed until all faults are removed. When the liquid level reaches
a normal value, the operator can reset the UZV2 valve state, using HS2 (Human
reSet) and the normal operation can continue.
4 A.-S. Băies, u
HS
2
LOGIC
SOLVER
AS
UZY2 LC
I/P
1
Inlet Forced
PSV
UZV2 CV1 outlet
HH
LZT
Hmax 2
FLAMABLE
LIQUID
LT
1
Outlet
Fig. 3 Liquid level control system and safety instrumented system: LC1—level controller, LT1—
level transducer, LZT2—high level transducer, UZV2 safety valve, I/P—electro/pneumatic con-
verter, CV1—control valve, PSV—overPressure Safety Valve, UZY2—electromagnetic valve,
AS—air supply, HS2—Human reSet, HH—high level alarm (High High), Hmax—high level
1.2 Safety Instrumented System Standards
The Safety Instrumented Systems (SIS) are receiving attention in the industrial sector
due to the increasing environmental pressure in order to reduce the gas emissions
and to get the most environmentally friendly products, but also because of the many
accidents that occurred in different installations, through time.
Until the ‘80s, the industrial process safety issue was left to the decision of the
various companies, who based on their own experience developed set of rules regard-
ing SIS design and use. Subsequently, these sets of rules have been integrated into
international standards and government regulations that require companies to comply
with certain procedures.
IEC 61508 Standard

The IEC 61508 standard was developed by IEC (International Electrotechnical Com-
mission) and covers a wide range of fields of activity and a multitude of SIS-associated
equipment [7].
The standard applies for all steps which a SIS passes through from specification,
design, operation, use, decommissioning and covers all the constituent parts of the
SIS: sensors, logic solvers and actuators.
IEC 61508 standard has 7 parts [4]:

– Part 1, (December, 1998) presents some general specifications;
– Part 2, (May, 2000) presents the requirements for programmable electri-
cal/electronic systems;
– Part 3, (December, 1998) presents requirements for software components;
– Part 4, (December, 1998) presents definitions, abbreviations and terminology to
ensure a certain consistency;
– Part 5, (December, 1998) presents examples for determining the Safety Integrity
Level (SIL);
– Part 6, (April, 2000) provides the appliance guide of Parts 2 and 3;
– Part 7, (March, 2000) presents a brief presentation of the techniques and methods
relevant for Parts 2 and 3.
The most important part of IEC 61508 is the life cycle model of a SIS, shown in
Fig. 4.
IEC 61511 Standard

IEC 61511 includes additional guidance for determining the Safety Integrity Level
(SIL) to be imposed by the design team at the beginning of the SIS design phase and
is structured in 3 parts [8]:
– Part 1, provides definitions, hardware and software requirements;
– Part 2, provides the appliance guide of Part 1;
– Part 3, provides guidance for determining the SIL.
The IEC 61511 standard is dedicated to the end user whose task is to design
and operate the SIS in an industrial plant. The requirements are those imposed by
IEC 61508, but modified to fit to practical situations from an industrial plant. 61511
standard does not cover the design and implementation of equipment used in safety
applications, such PLCs, which remains standardized by IEC 61508.
1.3 Safety Instrumented Systems Versus Control Systems
A fundamental question is whether the Safety Instrumented Systems (SIS) and Con-
trol Systems (CS) systems should be combined or a clear delimitation between these
two should be established.
According ANSI/ISA 84.01 [9], Separation between control systems and safety
instrumented systems reduces the probability that at some point in time either control
and safety functions to be inactive, or some modifications to the control systems will
lead to changes in the functionality of the safety systems. Therefore, it is generally
necessary to separate the control systems from the safety instrumented systems.
Several basic differences between the two types of systems support the idea that
control and safety should be separated. Control operations are active, dynamic, and
performance-oriented. Safety operations are passive.
6 A.-S. Băies, u
1. Concept
2. Establishing the
global scope
3. Hazard and risk

analysis
4. Safety
requirements
5.Safety requirements
allocation
Global planification 9. SIS design 10.SIS design using

6. Operating differenet circuits and
8.Installation
and 7. Validation Hardware Software
and statt-up PLCs
maintenace
12.Instalation and 11.External facilities

start-up for risk reduction
13. Validation 15. SIS changes
14. Operation,
Returning to an
maintenance,
adequate life cycle
reparation
phase
16. Decommissioning
Fig. 4 Safety life cycle model according to IEC 61508 [7]
CSs act actively to maintain or change process conditions, helping to achieve the
best performance of the process. They are often used to force the process to its limits,
in order to obtain the required performance. They were not built to provide safety.
Since control system operation is continuous, it does not incorporate error diag-
nostics routines. A CS either work or not. There are no hidden defects. In these
systems, operating errors are visible.
CSs are usually flexible and allow easy operation in the sense that, for example,
operators can modify certain parameters or exclude certain part of the control system.
This aspect has to be avoided in case of the safety systems.
Safety Instrumented Systems (SIS) are exactly the opposite of Control Systems
(CS). They work only at certain times, their action must be restricted, and they must
be reliable and act instantly when necessary. An example is the overPressure Safety
Valve (PSV) from Figs. 2 and 3, which must be closed as long as the pressure is
below a certain value and opened when the pressure reaches a certain high limit. If
the pressure never touches this limit, the valve should never open. Likewise, it may
happen that this valve if stays closed for a long time, when a problem appears and
must be opened, it cannot be opened. Therefore, these systems can hide defects that
are not directly observed.
Because the SIS components stay for a long time in standby mode, it may not
work if they must be put into operation. As such, these systems should be tested or
should include techniques that provide the possibility of self-testing.
Safety instrumented systems are designed to involve human intervention as low
as possible. The operator interacts with the control system. If it fails, the next step
is to pass it on manually and the operator must act directly on the process. If this
intervention also fails to make the necessary corrections, the last line of defence,
the SIS, should work automatically and independently. The only human interference
allowed is the start-up or maintenance of certain parts of the system.
2 Safety Integrity Level of a Safety Instrumented System
This paragraph describes the main methods for determining the Safety Integrity Level
(SIL), which is the most important feature of a SIS.
The IEC 61508 standard defines four levels of SIL, marked with SIL1, SIL2, SIL3
and SIL4. SIL 4 denotes the highest level of safety integrity and SIL 1, the smallest.
The Safety Integrity Level of a SIS can be expressed in terms of Probability of Failure
on Demand (PFD) for systems/functions that operate with a low demand rate or in
terms of Probability of dangerous failure Per Hour (PFH) for systems/functions that
operate with a high demand rate or continuously.
There are several methods and tools for determining SIL, developed by different
companies and organizations in order to provide support for assessing the process’s
risk and turning it into something palpable that has a certain meaning that is the
required SIL level.
These methods can be grouped into four main categories: quantitative and semi-
quantitative methods (e.g. LOPA—Layer of Protection Analysis), qualitative (e.g.
risk matrix, risk graph) and semi-qualitative methods (e.g. calibrated risk graph).
A system risk is a function of the frequency of an unwanted dangerous event and
the severity of the consequences of that event/hazard. Risk can influence personnel,
production, environment etc. [10].
RISK = FREQUENCY × HAZARD CONSEQUENCE
According to [5], hazard is an inherent feature of a system/process that has the

potential to cause damage to individuals, processes or the environment.
8 A.-S. Băies, u
In the case of chemical processes, hazard is the combination of a hazardous

material, an operating environment with problems and some unplanned events that
can cause accidents.
Depending on how the Risk Reduction Factor (RRF) is expressed, quantitatively
or qualitatively, what is the scope and purpose of the risk analysis a particular type of
method is chosen. Although the method used is a qualitative one, a number always
quantifies the determined SIL (SIL1, SIL2, SIL3 or SIL 4).
The SIL level is a measure of the performance of the safety system and not a direct
measure of process risk. The higher the risk of a process is, the higher the safety level
will be and the number that follows the SIL increases as value.
Usually, the qualitative methods are used in the design phase of the SIS and the
quantitative methods are used more in the SIL verification and validation phases.
2.1 Quantitative Methods
For systems with a low demand ratio, after determining the risk level, the next step
is to determine, using (1), the Risk Reduction Factor (RRF) required to meet the
tolerable risk level. This is achieved by dividing the number of times per year when
a SIF function fail to function to the number of demands per year. The result is the
acceptable number of times when a SIF may not operate at a demand per year, named
the Probability of Failure on Demand (PFD) [8].
The Risk Reduction Factor (RRF), in frequency, is given by [11]:
Fnp
RRF = , (1)
Ft
where F np is the frequency of the risk without protection and F t is the tolerable risk
frequency.
The Probability of Failure on Demand (PFD) is:
1 Ft
PFD = = . (2)
RRF Fnp
Further, SIL is determined using Table 1.

The Probability of Failure on Demand, PFD of a Safety Instrumented System
(SIS) is obtained by summing the PFD for transducers (ZT), logic solvers (PLCs)
and actuators (UZ) [3]:
P F D SS P = P F D Z T + P F D P LC + P F D U Z . (3)
Also, PFD for transducers (PFDZT ) is obtained by summing PFD for sensors and
adapters:
Table 1 Safety integrity level and required values for the instrumented system performance in case
of low demand rate system [7]
Safety integrity level, Probability of failure Availability, 1-PFD Risk reduction factor,
SIL on demand, PFD (%) RRF = 1/PFD
4 10−4 to 10−5 99.99–99.999 104 to 105
3 10−3 to 10−4 99.9–99.99 103 to 104
2 10−2 to 10−3 99–99.9 102 to 103
1 10−1 to 10−2 90–99 101 to 102
Table 2 Safety integrity

Safety integrity Probability of Mean time to
levels (SIL) and required
level, SIL failures per hour, failure, MTTF
values for the safety system
PFH
performance in case of a high
demand rate/continuous 4 10−9 to 10−8 104 to 105
operation systems [7] 3 10−8 to 10−7 103 to 104
2 10−7 to 10−6 102 to 103
1 10−6 to 10−5 101 to 102
P F D Z T = P F D adaptor + P F D sensor , (4)
and the PFD for actuators (PFDUZ ) is obtained by summing the PFD for electromag-
netic valve UZY and the safety valve UZV:
P F DU Z = P F DU ZT + P F DU ZV . (5)
For systems with a high demand ratio or continuous operation, the Safety Integrity
Level (SIL) is determined using the Probability of a hazardous Failure per Hour (PFH)
or the Mean Time To Failure indicator (MTTF), according to Table 2.
The two measures (PFD and PFH) of the SIS performance are related, the depen-
dence between them being expressed through equation [12]:
T T
PFD = · PFH = . (6)
2 2 · MT T F
PFD is the Probability of Failure on Demand, T represents the test or replacement
interval, PFH Probability of a dangerous Failure per Hour and MTTF is the Mean
Time To Failure.
10 A.-S. Băies, u
2.2 Risk Matrix
The risk matrix is one of the most popular method for determining the Safety Integrity
Level (SIL), due to its simplicity. The risk matrix takes into account the frequency
and severity of an unwanted event, based on a classification of the risk parameters.
The frequency of an event to occur can be quantified in terms such Small (S),
Medium (M), High (H) or any other suggestive terms, Table 3.
Consequences and its severity can be quantified based on various risk factors such
personnel, environment, production, equipment, capital, etc.
Table 4 provides an example of the severity of risk values, associated with per-
sonnel, environment and production.
Table 3 Risk frequency values [13]

Level Frequency Qualitative interpretation
3 High (H) An unwanted event may occur more than once in the predicted life
time of the plant
2 Medium (M) An unwanted event can occur once in the predicted life time of the plant
1 Small (S) An unwanted event may appear with a low probability over the
predicted life time of the plant
Table 4 Example of severity values/risk consequences [13]

Level Severity/consequences Personnel Environment Production/equipment
III Catastrophic (C) More Escapes of Losses greater than
fatalities dangerous $1,500,000
substances
outside the plant
perimeter
II Serious (S) Single death Releases of Losses between 100,000
or injuries non-hazardous $ and 1,500,000 $
requiring substances
recovery time outside the
perimeter of the
plant or leakage
of dangerous
substances into
the perimeter of
the plant
I MINor (MIN) Injured that Releases of Losses up to $100,000
requires hazardous
medical substances to a
treatment or restricted area of
first aid the plant
perimeter or
without leakage
Fig. 5 Global risk (risk

matrix)
According to Table 4, the consequences may be MINOR (MIN), SERIOUS (S)

or Catastrophic (C), according to severity level. Categories can be selected either
qualitatively or quantitatively by attaching some economic figures, deaths, etc.
By joining the values of the two properties, the frequency and severity of the risk,
the risk matrix is obtained (Fig. 5).
If the identified risk is high, then changes are recommended. If the identified risk
is medium, it is necessary to add additional safety levels. If the identified risk is low,
no changes or additions of protection levels are required.
Given that, if each risk matrix cell has an associated SIL level, then the process
of determining the SIL level is simple [13].
Figure 6 shows a typical modified risk matrix chart for determining the SIL level.
Severity-minor consequence (I), low frequency (1) leads to unnecessary SIL. This
means that the risk is considered tolerable.
Severity-minor consequence (I), average frequency leads (2) to a low SIL level,
while catastrophic consequence, high frequency leads to a high SIL level. In case of
a SIL 3 or SIL 4 required level, additional studies should be conducted as a single
SIF may not provide sufficient risk reduction [14].
Fig. 6 The modified risk

matrix for determining the
SIL level
12 A.-S. Băies, u
Sometimes, due to the assessments that need to be made, the result may be unre-
alistic. Therefore, it is recommended to use other tools and methods in conjunction
with this method in order to improve the quality of the determination [8].
The risk matrix has two dimensions, the frequency and severity of an event.
Sometimes, in practical applications, there is also added a third dimension that takes
into account additional safety levels, resulting the risk matrix of safety and protection
levels.
2.3 Risk Graph
The method of determining the Safety Integrity Level (SIL) using the risk graph is
based on the methods written in the German publication DIN 19250 [15].
Table 5 lists the risk parameters classification suggested in IEC 61511.
The risk graph method is a qualitative method that takes into account the conse-
quence and frequency of a dangerous event, but also the likelihood that the personnel
could avoid the danger [14].
For the Consequence parameter (C), in relation to personnel’s risk, four categories
of consequences are suggested, ranging from minor injury to multiple deaths. C1 is
the least severe category. In general, the consequences are measured by the degree
of injuries of individuals but also by environmental or financial measures [8].
Occupancy Frequency (F) shows the fraction of time in which the hazardous area
is occupied by personnel. F2 shows a higher risk than F1 because the area is occupied
more frequently. Usually, in accordance with IEC 61511, F1 can be selected if the
hazardous area is occupied less than about 10% of the time.
Table 5 Risk parameters classification according to IEC 61511

Risk parameter Notation Classification
Consequence (C) C1 Minor injuries
C2 Serious injury of one or more persons
C3 Death of one person
C4 Catastrophic effect. Many deaths
Occupation frequency of the affected F1 Rare to frequent (<0.1)
area (F) F2 Frequent to continuous (>0.1)
The probability of avoiding the P1 Possible in certain conditions (>90%)
consequences (P) P2 Almost impossible (<10%)
The probability of occurrence of an A1 Very unlikely to appear (F < 0.01/year)
unwanted event (A) A2 It is unlikely that an unwanted event will
appear (F > 0.01/year)
A3 Relatively large probability that an
unwanted event to appear (F > 0.1/year)
The possibility of personnel to avoiding the danger is incorporated into parameter

P. This parameter shows which methods must be identified by personnel in order
to escape the danger. Additionally, the rate of development of the dangerous event
is taken into account. Two categories are suggested, P1 and P2, P2 indicating the
highest risk. In order to select P1, a list of statements must be validated. Such lists
of statements are suggested in IEC 61511.
The final parameter is the probability of occurrence (A), which is the frequency
of the occurrence of an unwanted event without SIF (Safety Instrumented Function).
Figure 7 is a typical chart of personnel risk. Similar graphs can be obtained for
the risk associated with equipment, production losses or environmental impact.
The path from left to right is determined by the selected risk parameter values.
The selected result, the occupancy frequency and the probability of avoidance leads
to a certain output line, O. The output line leads to three values of the parameter A.
Choosing the parameter A is the last step in determining the SIL level. Choosing a
higher A parameter results in a higher SIL level [14].
If the probable consequence is assessed to be serious injury to one or more persons,
C2 is selected. If the area could be exposed to personnel rarely to more frequent,
F1 is chosen. It is possible that under certain conditions the unwanted events can
be avoided, which means that parameter P1 should be chosen. The combination of
these risk parameters leads to the O2 output line. Considering a high probability that
an unwanted event to occur, A3 is selected. According to Fig. 7, SIL 1 is required.
A3 A2 A1
O1
C1 X - -
P1 O2
1 X -
F1 P2 O3
C2 2 1 X
F2 P1
P2
F1 O4 3 2 1
C3 F2 P1
P2
F1 O5
C4 P1 4 3 2
F2
P2 O6
4' 4 3
Fig. 7 Risk graph: C—consequences (C1—minor injuries, C2—serious injuries, C3—one death,
C4—more deaths); F—frequency (F1—rare to frequent, F2—frequent to continuous); P—proba-
bility of avoidance (P1—sometimes possible, P2—almost impossible); A—appearance probability
(A1—very small, A2—small, A3—relatively high); X—SIS is not necessary, 1, 2, 3, 4—safety
integrity level, SIL, 4 —one SIS is not enough
14 A.-S. Băies, u
3 Practical Aspects Regarding Safety Instrumented

Systems
This paragraph outlines some general aspects regarding SIS implementation by list-
ing the main requirements of the components, the available implementation tech-
nologies and ways to connect them.
The performance of a SIS depends on each element from its structure (sensor,
logic solver or actuator), so a special attention must be given starting from the stage
of choosing the type of each sensor and actuator to be used, to the implementation
of the logic solver phase or to the way that these parts are interconnected.
The field devices that are parts of the Safety Instrumented Systems (SIS) must be
selected and installed to meet the performance requirements expressed through the
Safety Integrity Level (SIL), for each SIF (Safety Instrumented Function).
Any SIS associated field device must be separate and independent of those of the
control system. With few exceptions, sharing equipment with the control system can
cause procedural and maintenance problems.
In order to achieve the necessary independence, the following components should
be separated from the control system [16]:
– the field sensors, safety and electromagnetic valves, pulse lines;
– wires, panels and junction boxes;
– voltage sources.
If the SIS signals are to be sent to the control system for comparison, the signals
between the two systems should be isolated (using optical insulators) to prevent that
one single failure affecting both systems.
The SIS field devices should be fail safe. In most cases, this means that the devices
are normally energized. De-energizing or losing power will initiate the unit/plant
shutdown.
Systems where the shutdown function is activated in the case of alarms are used
to reduce false errors due to power failures.
Only tested technologies should be used in safety applications.
When installing sensors, the following general requirements must be considered
[17]:
– contacts must be normally closed and normally energized;
– sensors must be directly connected to the logic system;
– smart transducers are more commonly used for SIS due to improved diagnostics
facilities and rigorous reliability. When using such transducers, procedures should
be established to ensure that they cannot be left in forced outputs;
– the contacts of the electric circuit should be hermetically sealed for greater relia-
bility;
– the SIS associated field sensors should be differentiated in a certain way by the
sensors of the control system by a single tag, numbering or colour;
– when using redundant sensors, a discrepancy alarm should be provided to indicate
the failure of a single sensor.
In case of flow measurement, although diaphragm transducers are primarily used

in most safety applications, the vortex and magnetic flow transducers can offer some
advantages such ease of installation and improved performance.
In the case of temperature sensors, the main failure mode of thermocouples is
burning; therefore, detection and alarm systems should be used.
In the case of pressure sensors, the main precautions to be taken are when selecting
the range and that the condensate accumulation will not cause calibration problems.
Level transducers with air blowers and nitrogen purge have proven to be reliable,
requiring low maintenance.
When installing actuators, they should be set to maintain their status after a shut-
down function, until manual reset. They should be allowed to return to their normal
state only if the variables that generated the stop have returned to their normal oper-
ating values.
The following aspects should be considered when selecting the actuators:
– closing/opening speed;
– leaks;
– fire resistance;
– suitability/compatibility of the material;
– diagnostic requirements;
– the safety of the valve;
– the need for a position indicator or limiter;
– on-line maintenance capacity.
The bypass valves must be considered for each safety valve that fails in the closed
state. Limiters can be used to initiate an alarm if a bypass valve is opened.
Generally, safety valves should be dedicated to safety applications and separate
from the control valves.
Electromagnetic valves have a low reliability and therefore can be one of the most
critical (weaker) components in the whole system. A common cause of the failure is
burning the coil causing a false stop. It is important to use a tap like to withstand high
temperatures, including heat generated by its own coil, heat generated by furnaces,
exposure to sunlight, etc. Double ball valves or redundant valves can also be used.
24 V powered electromagnetic valves seem to be more reliable due to low energy
consumption and low heat output.
When installing a field equipment, consideration should be given to issues related
to:
– environment (temperature, vibration, shock, corrosion, humidity etc.);
– on-line testing, if necessary;
– maintenance requirements;
– accessibility;
– local indication;
– protection against frost, if required.
Common wiring defects include grounding, noise and induced voltages.
General recommendations to minimize connection issues:
Another random document with
no related content on Scribd:
five years old, nevertheless she was of the greatest assistance to
her mother in nursing women. Both showed the utmost kindness to
the new-born children, washed and brushed them up, said pretty
things to them, and strengthened the mothers with cordials and tonic
draughts. To their care the Israelites were indebted for the graceful
and vigorous forms of their children; and the two women were such
favourites with the people, that they called the one Shiphrah (the
soother or beautifier) and the other Puah (the helper).
When they appeared before the king, and heard what he designed,
Miriam’s young face flushed scarlet, and she said, in anger, “Woe to
the man! God will punish him for his evil deed.”
The executioner would have hurried her out, and killed her for her
audacity, but the mother implored pardon, saying, “O king! forgive
her speech; she is only a little foolish child.”
Pharaoh consented, and assuming a gentler tone, explained that the
female children were to be saved alive, and that the male children
were to be quietly put to death, without the knowledge of the
mothers. And he threatened them, if they did not obey his wishes,
that he would cast them into a furnace of fire. Then he dismissed
them. But the two midwives would not fulfil his desire.
And when Pharaoh found that the men-children were saved alive, he
shut up the two midwives, that the Hebrew women might be without
their succour. But this availed not. And God rewarded the midwives;
for of the elder Moses was born.
Five years passed, and Pharaoh dreamed that, as he sat upon his
throne, an old man stood before him holding a balance. And the old
man put the princes, and nobles, and elders of Egypt, and all its
inhabitants into one scale, and he put into the other a sucking child,
and the babe outweighed all that was in the first scale.[457]
When Pharaoh awoke, he rehearsed his dream in the ears of his
wise men and magicians and soothsayers, and asked them the
interpretation thereof.
Then answered Balaam, who, with his sons Jannes and Jambres,
was at the court, and said, “O king, live for ever! The dream thou
didst see has this signification. A child shall be born among the
Hebrews who shall bring them with a strong hand out of Egypt, and
before whom all thy nations shall be as naught. A great danger
threatens thee and all Egypt.”
Then said Pharaoh in dismay, “What shall we do? All that we have
devised against this people has failed.”
“Let the king suffer me to give my advice,” said Jethro, one of his
councillors. And when Pharaoh consented, he said, “May the king’s
days be multiplied! This is my advice; the people that thou
oppressest is a great people, and God is their shield. All who resist
them are brought to destruction; all who favour them prosper.
Therefore, O king, do thou withdraw thy hand, which is heavy upon
them; lighten their tasks, and extend to them thy favour.”
But this advice pleased not Pharaoh nor his councillors; and his
anger was kindled against Jethro, and he drove him from his court
and from the country. Then Jethro went with his wife and daughter,
and dwelt in the land of Midian.
Then said the king, “Job of Uz, give thy opinion.”
But Job opened not his lips.
Then rose Balaam, son of Beor, and he said, “O my king, all thy
attempts to hurt Israel have failed, and the people increase upon
you. Think not to try fire against them, for that was tried against
Abraham their father, and he was saved unhurt from the midst of the
flames. Try not sword against them, for the knife was raised against
Isaac their father, and he was delivered by the angel of God. Nor will
hard labour injure them, as thou hast proved. Yet there remains
water, that hath not yet been enlisted against them; prove them with
water. Therefore my advice is—cast all their new-born sons into the
river.”[458]
The king hesitated not; he appointed Egyptian women to be nurses
to the Hebrews, and instructed them to drown all the male children
that were born; and he threatened with death those who withstood
his decree. And that he might know what women were expecting to
be delivered, he sent little Egyptian children to the baths, to observe
the Hebrew women, and report on their appearance.
But God looked upon the mothers, and they were delivered in sleep
under the shadow of fruit-trees, and angels attended on them,
washed and dressed the babes, and smeared their little hands with
butter and honey, that they might lick them, and, delighting in the
flavour, abstain from crying, and thus escape discovery. Then the
mothers on waking exclaimed:—“O most Merciful One, into Thy
hands we commit our children!” But the emissaries of Pharaoh
followed the traces of the women, and would have slain the infants,
had not the earth gaped, and received the little babes into a hollow
place within, where they were fed by angel hands with butter and
honey.
The Egyptians brought up oxen and ploughed over the spot, in
hopes of destroying thereby the vanished infants; but, when their
backs were turned, the children sprouted from the soil, like little
flowers, and walked home unperceived. Some say that 10,000
children were cast into the Nile. They were not deserted by the Most
High. The river rejected them upon its banks, and the rocks melted
into butter and honey around them and thus fed them,[459] and oil
distilled to anoint them.
This persecution had continued for three years and four months,
when, on the seventh day of the twelfth month, Adar, the astrologers
and seers stood before the king and said, “This day a child is born
who will free the people of Israel! This, and one thing more, have we
learnt from the stars, Water will be the cause of his death;[460] but
whether he be an Egyptian or an Hebrew child, that we know not.”
“Very well,” said Pharaoh; “then in future all male children, Egyptians
as well as Hebrews, shall be cast indiscriminately into the river.”
And so was it done.[461]
2. THE BIRTH AND CHILDHOOD OF MOSES.
Kohath, son of Levi, had a son named Amram, whose life was so
saintly, that death could not have touched him, had not the decree
gone forth, that every child of Adam was to die.
He married Jochebed, the daughter of Levi, his aunt, and by her he
had a daughter Miriam; and after four years she bore him a son, and
he called his name Aaron.
Now when it was noised abroad that Pharaoh would slay all the sons
of the Hebrews that were born to them, Amram thrust away his wife,
and many others did the same, not that they hated their wives, but
that they would spare them the grief of seeing their children put to
death.[462] After three years, the spirit of prophecy came on Miriam,
as she sat in the house, and she cried, “My parents shall have
another son, who shall deliver Israel out of the hands of the
Egyptians!” Then she said to her father, “What hast thou done? Thou
hast sent thy wife away, out of thine house, because thou couldst not
trust the Lord God, that He would protect the child that might be born
to thee.”
Amram, reproved by these words, sought his banished wife; the
angel Gabriel guided him on his way, and a voice from heaven
encouraged him to proceed. And when he found Jochebed, he led
her to her home again.[463]
One hundred and thirty years old was Jochebed, but she was as
fresh and beauteous as on the day she left her father’s house.[464]
She was with child, and Amram feared lest it should be a boy, and
be slain by Pharaoh.
Then appeared the Eternal One to him in a dream, and bade him be
of good cheer, for He would protect the child, and make him great,
so that all nations should hold him in honour.
When Amram awoke, he told his dream to Jochebed, and they were
filled with fear and great amazement.
After six months she bore a son, without pain. The child entered this
world in the third hour of the morning, of the seventh day of the
month Adar, in the year 2368 after the Creation, and the 130th year
of the sojourn of the Israelites in Egypt. And when he was born, the
house was filled with light, as of the brightest sunshine.
The tender mother’s anxiety for her son was increased when she
noted his beauty,—he was like an angel of God,—and his great
height and noble appearance. The parents called him Tobias (God is
good) to express their thankfulness, but others say he was called
Jokutiel (Hope in God). Amram kissed his daughter, Miriam, on the
brow, and said, “Now I know that thy prophecy is come true.”[465]
Jochebed hid the child three months in her chamber where she
slept. But Pharaoh, filled with anxiety, lest a child should have
escaped him, sent Egyptian women with their nurslings to the
houses of the Hebrews. Now it is the custom of children, when one
cries, another cries also. Therefore the Egyptian women pricked their
babes, when they went into a house, and if the child were concealed
therein, it cried when it heard the Egyptian baby scream. Then it was
brought out and despatched.
Jochebed knew that these women were coming to her house, and
that, if the child were discovered, her husband and herself would be
slain by the executioner of Pharaoh.
Moreover they feared the astrologers and soothsayers, that they
would read in the heavens that a male child was concealed there.
“Better can we deceive them,” said Amram, “if we cast the child into
the water.”
Jochebed took the paper flags and wove a basket, and pitched it
with pitch without, and clay within, that the smell of the pitch might
not offend her dear little one; and then she placed the basket
amongst the rushes, where the Red Sea at that time joined the river
Nile.
Then, weeping and wailing, she went away, and seeing Miriam come
to meet her, she smote her on the head, and said, “Now, daughter,
where is thy prophesying?”
Miriam followed the little ark, as it floated on the wash of the river,
and swam in and out among the reeds; for Miriam was wondering
whether the prophecy would come true, or whether it would fail. This
was on the twenty-first of the month Nisan, on the day, chosen from
the beginning, on which in after times Moses should teach his people
the Song of Praise for their delivery at the Red Sea.[466]
Then the angels surrounded the throne of God and cried, “O Lord of
the whole earth, shall this mortal child fore-ordained to chant, at the
head of Thy chosen people, the great song of delivery from water,
perish this day by water?”
The Almighty answered, “Ye know well that I behold all things. They
that seek their salvation in their own craftiness and evil ways shall
find destruction, but they who trust in Me shall never be confounded.
The history of that child shall be a witness to My almighty power.”
Melol, king of Egypt, had then only one daughter, whom he greatly
loved; Bithia (Thermutis or Therbutis)[467] was her name. She had
been married for some time to Chenephras, prince of a territory near
Memphis, but was childless. This troubled her greatly, for she
desired a son who might succeed her father upon the throne of
Egypt.
At this time God had sent upon Egypt an intolerable heat, and the
people were affected with grievous boils.[468] To cure themselves,
they bathed in the Nile. Bithia also suffered, and bathed, not in the
river, but in baths in the palace; but on this day she went forth by the
Nile bank, though otherwise she never left her father’s palace. On
reaching the bathing-place she observed the ark lodged among the
bulrushes, and sent one of her maids to swim out and bring it to her;
but the other servants said, “O princess, this is one of the Hebrew
children, who are cast out according to the command of thy royal
father. It beseems thee not to oppose his commands and frustrate
his will.”
Scarcely had the maidens uttered these words than they vanished
from the surface of the earth. The angel Gabriel had sunk them all,
with the exception of the one who swam for the ark, into the bosom
of the earth.
But the eagerness of the princess was so great, that she could not
wait till the damsel brought her the basket, and she stretched forth
her arm towards it, and her arm was lengthened sixty ells, so that
she was able to take hold of the ark and draw it to land, and lift the
child out of the water.
No sooner had she touched the babe, than she was healed of the
boils which afflicted her, and the splendour of the face of the child
was like that of the sun.[469] She looked at it with wonder, and
admired its beauty. But her father’s stern law made her fear, and she
thought to return the child to the water, when he began to cry, for the
angel Gabriel had boxed his ears to make him weep, and thus excite
the compassion of the princess. Then Miriam, hid away among the
rushes, and little Aaron, aged three, hearing him cry, wept also.
The heart of the princess was stirred; and compassion, like that of a
mother for her babe, filled her heart. She felt for the infant yearning
love as though it were her own. “Truly,” said Bithia, “the Hebrews are
to be pitied, for it is no easy matter to part with a child, and to deliver
it over to death.”
Then, fearing that there would be no safety for the babe, if it were
brought into the palace, she called to an Egyptian woman who was
walking by the water, and bade her suckle the child. But the infant
would not take the breast from this woman, nor from any other
Egyptian woman that she summoned; and this the Almighty wrought
that the child might be restored to its own mother again.
Then Miriam, the sister, mingled with those who came up, and said
to Bithia, with sobs, “Noble lady! vain are all thine attempts to give
the child the breast from one of a different race. If thou wouldst have
a Hebrew woman, then let me fetch one, and the child will suck at
once.”[470]
This advice pleased Bithia, and she bade Miriam seek her out a
Hebrew mother.
With winged steps Miriam hastened home, and brought her mother,
Jochebed, to the princess. Then the babe readily took nourishment
from her, and ceased crying.
Astonished at this wonder, the king’s daughter said, but unawares,
the truth, for she spake to Jochebed, “Here is thy child; take and
nurse the child for me, and the wage shall be two pieces of silver a
day.”
Jochebed did what she was bidden, but better reward than all the
silver in Pharaoh’s house was the joy of having her son restored to
his mother’s breast.
The self-same day the soothsayers and star-gazers said to Pharaoh,
“The child of whom we spake to thee, that he should free Israel, hath
met his fate in the water.”
Therefore the cruel decree ordering the destruction of all male
infants was withdrawn, and the miraculous deliverance of Moses
became by this means the salvation of the whole generation. In
allusion to this, Moses said afterwards to the people when he would
restrain them (Numbers xi.): “Verily ye number six hundred thousand
men, and ye would all have perished in the river Nile, but I was
delivered from the water, and therefore ye are all alive as at this
day.”
After two years Jochebed weaned him, and brought him to the king’s
daughter. Bithia, charmed with the beauty and intelligence of the
child, took him into the palace, and named him Moses (he who is
drawn out of the water). Lo! a voice from heaven fell, “Daughter of
Pharaoh! because thou hast had compassion on this little child and
hast called him thy son, therefore do I call thee My daughter (Bithia).
The foundling that thou cherishest shall be called by the name thou
gavest him—Moses; and by none other name shall he be known,
wheresoever the fame of him spreads under the whole heaven.”
Now, in order that Moses might really pass for the child of Bithia, the
princess had feigned herself to be pregnant, and then to be confined;
and now Pharaoh regarded him as his true grandchild.
On account of his exceeding beauty, every one that saw him was
filled with admiration, and said, “Truly, this is a king’s son.” And when
he was taken abroad, the people forsook their work, and deserted
their shops, that they might see him. One day, when Moses was
three years old, Bithia led him by the hand into the presence of
Pharaoh, and the queen sat by the king, and all the princes of the
realm stood about him. Then Bithia presented the child to the king,
and said, “Oh, sire! this child of noble mien is not really my son; he
was given to me in wondrous fashion by the divine river Nile;
therefore have I brought him up as my own son, and destined him to
succeed thee on thy throne, since no child of my body has been
granted to me.”
With these words Bithia laid the boy in the king’s arms, and he
pressed him to his heart, and kissed him. Then, to gratify his
daughter, he took from his head the crown royal, and placed it upon
the temples of Moses. But the child eagerly caught at the crown, and
threw it on the ground, and then alighting from Pharaoh’s knee, he in
childish fashion danced round it, and finally trampled it under his
feet.[471]
The king and his nobles were dismayed. They thought that this
action augured evil to the king through the child that was before
them. Then Balaam, the son of Beor, lifted up his voice and said, “My
lord and king! dost thou not remember the interpretation of thy
dream, as thy servant interpreted it to thee? This child is of Hebrew
extraction, and is wiser and more cunning than befits his age. When
he is old he will take thy crown from off thy head, and will tread the
power of Egypt under his feet. Thus have his ancestors ever done.
Abraham defied Nimrod, and rent from him Canaan, a portion of his
kingdom. Isaac prevailed over the king of the Philistines. Jacob took
from his brother his birthright and blessing, and smote the Hivites
and their king Hamor. Joseph, the slave, became chief in this realm,
and gave the best of this land to his father and his brethren. And now
this child will take from thee the kingdom, and will enslave or destroy
thy people. There is no expedient for thee but to slay him, that Egypt
become not his prey.”
But Pharaoh said, “We will take other counsel, Balaam, before we
decide what shall be done with this child.”
Then some advised that he should be burnt with fire, and others that
he should be slain with the sword. But the angel Gabriel, in the form
of an old man, mingled with the councillors, and said, “Let not
innocent blood be shed. The child is too young to know what he is
doing. Prove whether he has any understanding and design, before
you sentence him. O king! let a bowl of live coals and a bowl of
precious stones be brought to the little one. If he takes the stones,
then he has understanding, and discerns between good and evil; but
if he thrusts his hands towards the burning coals, then he is innocent
of purpose and devoid of reason.”[472]
This advice pleased the king, and he gave orders that it should be as
the angel had recommended.
Now when the basins were brought in and offered to Moses, he
thrust out his hand towards the jewels. But Gabriel, who had made
himself invisible, caught his hand and directed it towards the red-hot
coals; and Moses burnt his fingers, and he put them into his mouth,
and burnt his lips and tongue; and therefore it is that Moses said, in
after days, “I am slow of lips and slow of tongue.”[473]
Pharaoh and his council were now convinced of the simplicity of
Moses, and no harm was done him. Then Bithia removed him, and
brought him up in her own part of the palace.
God was with him, and he increased in stature and beauty, and
Pharaoh’s heart was softened towards him. He went arrayed in
purple through the streets, as the son of Bithia, and a chaplet of
diamonds surrounded his brows, and he consorted only with princes.
When he was five years old, he was in size and knowledge as
advanced as a boy of twelve.
Masters were brought for him from all quarters, and he was
instructed in all the wisdom and learning of the Egyptians; and the
people looked upon him with hope as their future sovereign.[474]
3. THE YOUTH AND MARRIAGE OF MOSES.
Moses, as he grew older, distinguished himself from all other young

men of Egypt by the conquest which he acquired over himself and
his youthful passions and impetuous will. Although the life of a court
offered him every kind of gratification, yet he did not allow himself to
be attracted by its pleasures, or to regard as permanent what he
knew to be fleeting. Thus it fell out, that all his friends and
acquaintances wondered at him, and doubted whether he were not a
god appeared on earth. And, in truth, Moses did not live and act as
did others. What he thought, that he said, and what he promised,
that he fulfilled.
Moses had reached the summit of earthly greatness; acknowledged
as grandson to Pharaoh, and heir to the crown. But he trusted not in
the future which was thus offered to him, for he knew from
Jochebed, whom he frequently visited, what was his true people, and
who were his real parents. And the bond which attached him to his
own house and people was in his heart, and could not be broken.
Moses went daily to Goshen to see his relations; and he observed
how the Hebrews were oppressed, and groaned under their burdens.
And he asked wherefore the yoke was pressed so heavily on the
neck of these slaves. He was told of the advice of Balaam against
the people, and of the way in which Pharaoh had sought the
destruction of himself in his infancy. This information filled Moses
with indignation, and alienated his affections from Pharaoh, and filled
him with animosity towards Balaam.[475] But, as he was not in a
position to rescue his brethren, or to punish Balaam, he cried, “Alas!
I had rather die than continue to behold the affliction of my brethren.”
Then he took the necklace from off him, which indicated his princely
position, and sought to ease the burden of the Israelites. He took the
excessive loads from the women and old men, and laid them on the
young and strong; and thus he seemed to be fulfilling Pharaoh’s
intentions in getting the work of building sooner executed, whereas,
by making each labour according to his strength, their sufferings
were lightened. And he said to the Hebrews, “Be of good cheer, relief
is not so far off as you suppose—calm follows storm, blue sky
succeeds black clouds, sunshine comes after rain. The whole world
is full of change, and all is for an object.”
Nevertheless Moses himself desponded; he looked with hatred upon
Balaam, and lost all pleasure in the society of the Egyptians. Balaam
seeing that the young man was against him, and dreading his power,
escaped with his sons Jannes and Jambres to the court of Ethiopia.
The young Moses, however, grew in favour with the king, who laid
upon him the great office of introducing illustrious foreigners to the
royal presence.
But Moses kept ever before his eyes the aim of his life, to relieve his
people from their intolerable burdens. One day he presented himself
before the king and said, “Sire! I have a petition to make of thee.”
Pharaoh answered, “Say on, my son.”
Then said Moses, “O king! every labourer is given one day in seven
for rest, otherwise his work becomes languid and unprofitable. But
the children of Israel are given no day of rest, but they work from the
first day of the week to the last day, without cessation; therefore is
their work inferior, and it is not executed with that heartiness which
might be found, were they given one day in which to recruit their
strength.”
Pharaoh said, “Which day shall be given to them?”
Moses said, “Suffer them to rest on the seventh day.”
The king consented, and the people were given the Sabbath, on
which they ceased from their labours; therefore they rejoiced greatly,
and for a thousand years the last day of the week was called “The
gift of Moses.”[476]
As the command to destroy all the male children had been
withdrawn the day that Moses was cast into the Nile, the people had
multiplied greatly, and again the fears of the Egyptians were
aroused. Therefore the king published a new decree, with the object
of impeding the increase of the bondsmen.
He required the Egyptian task-masters to impose a tale of bricks on
every man, and if at evening the tale of bricks was not made up,
then, in place of the deficient bricks, even though only one brick was
short, they were to take the children of those who had not made up
their tale, and to build them into the wall in place of bricks.[477] Thus
upon one misery another was piled.
In order that this decree might be executed with greater certainty, ten
labourers were placed under one Hebrew overseer, and one
Egyptian task-master controlled the ten overseers. The duty of the
Hebrew overseers was to wake the ten men they were set over,
every morning before dawn, and bring them to their work. If the
Egyptian task-masters observed that one of the labourers was not at
his post, he went to the overseer, and bade him produce the man
immediately.
Now one of these overseers had a wife of the tribe of Dan, whose
name was Salome, daughter of Dibri. She was beautiful and faultless
in her body. The Egyptian task-master had observed her frequently,
and he loved her. Then, one day, he went early to the house of her
husband, and bade him arise, and go and call the ten labourers. So
the overseer rose, nothing doubting, and went forth, and then the
Egyptian entered and concealed himself in the house. But the
overseer, returning, found him, and drew him forth, and asked him
with what intent he had hidden himself there; and Moses drew nigh.
Now Moses was known to the Hebrews as merciful, and ready to
judge righteously their causes; so the man ran to Moses, and told
him that he had found the Egyptian task-master concealed in his
house.
And Moses knew for what intent the man had done thus, and his
anger was kindled, and he raised a spade to smite the man on the
head and kill him.
But whilst the spade was yet in his hand, before it fell, Moses said
within himself, “I am about to take a man’s life; how know I that he
will not repent? How know I that if I suffer him to live, he may beget
children who will do righteously and serve the Lord? Is it well that I
should slay this man?”
Then Moses’s eyes were opened, and he saw the throne of God,
and the angels that surrounded it, and God said to him, “It is well that
thou shouldst slay this Egyptian, and therefore have I called thee
hither. Know that he would never repent, nor would his children do
other than work evil, wert thou to give him his life.”
So Moses called on the name of the Most High and smote; but
before the spade touched the man, as the sound of the name of God
reached his ears, he fell and died.[478]
Then Moses looked on the Hebrews who had crowded round, and
he said to them, “God has declared that ye shall be as the sand of
the sea-shore. Now the sand falls and it is noiseless, and the foot of
man presses it, and it sounds not. Therefore understand that ye are
to be silent as is the sand of the sea-shore, and tell not of what I
have this day done.”
Now when the man of the Hebrews returned home, he drove out his
wife Salome, because he had found the Egyptian concealed in his
house, and he gave her a writing of divorcement, and sent her away.
Then the Hebrews talked among themselves at their work, and some
said he had done well, and others that he had done ill. There were at
their task two young men, brothers, Dathan and Abiram, the sons of
Eliab, of the tribe of Reuben, and they strove together on this
subject, and Dathan in anger lifted his hand, and would have smitten
Abiram. Then Moses came up and stayed him, and cried, “What
wickedness art thou doing, striking thy comrade? It beseems you not
to lay hands on each other.”
Boldly did Dathan answer: “Who made thee, beardless youth, a lord
and ruler over us? We know well that thou art not the son of the
king’s daughter, but of Jochebed. Wilt thou slay me as thou didst the
Egyptian yesterday?”
“Alas!” said Moses, “now I see that the evil words, and evil acts, and
evil thoughts of this people will fight against them, and frustrate the
loving-kindness of the Lord towards them.”
Then Dathan and Abiram went before Pharaoh, and told him that
Moses had slain an Egyptian task-master; and Pharaoh’s anger was
kindled against Moses, and he cried, “Enough of evil hath been
prophesied against thee, and I have not heeded it, and now thou
liftest thy hand against my servants!”
For he had, for long, been slowly turning against Moses, when he
saw that he walked not in the ways of the Egyptians, and that he
loved the king’s enemies, and hated the king’s friends. Then he
consulted his soothsayers and his councillors, and they gave him
advice that he should put Moses to death with the sword. Therefore
the young man, Moses, was brought forth, and he ascended the
scaffold, and the executioner stood over him with his sword, the like
of which was not in the whole world. And when the king gave the
word, the headsman smote. But the Lord turned the neck of Moses
into marble, and the sword bit not into it.
Instantly, before the second blow was dealt, the angel Michael took
from the executioner his sword and his outward semblance, and
gave to the headsman the semblance of Moses, and he smote at the
executioner, and took his head from off his shoulders. But Moses
fled away, and none observed him. And he went to the king of
Ethiopia.[479]
Now the king of Ethiopia, Kikannos (Candacus) by name, was
warring against his enemies; and when he left his capital city, Meroe,
at the head of a mighty army, he left Balaam and his two sons
regents during his absence.
Whilst the king was engaged in war, Balaam and his sons conspired
against the king, and they bewitched the people with their
enchantments, and led them from their allegiance, and persuaded
them to submit to Balaam as their king. And Balaam strengthened
the city on all sides. Sheba, or Meroe, was almost impregnable, as it
was surrounded by the Nile and the Astopus. On two sides Balaam
built walls, and on the third side, between the Nile and the city, he
dug countless canals, into which he let the water run. And on the
fourth side he assembled innumerable serpents. Thus he made the
city wholly impregnable.
When King Kikannos returned from the war, he saw that his capital
was fortified, and he wondered; but when he was refused admission,
he knew that there was treason.
One day he endeavoured to surmount the walls, but was repulsed
with great slaughter; and the next day he threw thirty pontoons
across the river, but when his soldiers reached the other side, they
were engulfed in the canals, of which the water was impelled with
foaming fury by great mill-wheels. On the third day he assaulted the
town on the fourth side, but his men were bitten by the serpents and
died. Then King Kikannos saw that the only hope of reducing the city
was by famine; so he invested it, that no provisions might be brought
into it.
Whilst he sat down before the capital, Moses took refuge in his
camp, and was treated by him with great honour and distinction.
As the siege protracted itself through nine years, Kikannos fell ill and
died.
Then the chief captains of his army assembled, and determined to
elect a king, who might carry on the siege with energy, and reduce
the city with speed, for they were weary of the long investment. So
they elected Moses to be their king, and they threw off their
garments and folded them, and made thereof a throne, and set
Moses thereon, and blew their trumpets, and cried “God save King
Moses!”[480]
And they gave him the widow of Kikannos to wife, and costly gifts of
gold and silver and precious stones were brought to him, but all
these he laid aside in the treasury. This took place 157 years after
Jacob and his sons came down into Egypt, when Moses was aged
twenty-seven years.
On the seventh day after his coronation came the captains and
officers before him, and besought of him counsel, how the city might
be taken. Then said Moses, “Nine years have ye invested it, and it is
not yet in your power. Follow my advice, and in nine days it shall be
yours.”
They said, “Speak, and we will obey.”
Then Moses gave this advice, “Make it known in the camp that all
the soldiers go into the woods, and bring me storks’ nests as many
as they can find.”
So they obeyed, and young storks innumerable were brought to him.
Then he said, “Keep them fasting till I give you word, and he who
gives to a stork food, though it were but a crumb of bread, or a grain
of corn, he shall be slain, and all that he hath shall become the king’s
property, and his house shall be made a dung-heap.”
So the storks were kept fasting. And on the third day the king said,
“Let the birds go.”
Then the storks flew into the air, and they spied the serpents on the
fourth side of the city, and they fell upon them, and the serpents fled,
and they were killed and eaten by the storks or ever they reached
their holes, and not a serpent remained. Then said Moses, “March
into the city and take it.”
And the army entered the city, and not one man fell of the king’s
army, but they slew all that opposed them.
Thus Moses had brought the Ethiopian army into possession of the
capital. The grateful people placed the crown upon his head, and the
queen of Kikannos gave him her hand with readiness. But Balaam
and his sons escaped, riding upon a cloud.
Moses reigned in wisdom and righteousness for forty years, and the
land prospered under his government, and all loved and honoured
him. Nevertheless, some thought that the son of their late king ought
to ascend the throne of his ancestors;—he was an infant when
Moses was crowned, but now that he was a man, a party of the
nobles desired to proclaim his right.
They prevailed upon the queen to speak; and when all the princes
and great men of the kingdom were assembled, she declared the
matter before all. “Men of Ethiopia,” said she, “it is known to you that
for forty years my husband has reigned in Sheba. Well do you know
that he has ruled in equity, and administered righteous judgment. But
know also, that his God is not our God, and that his faith is not our
faith. My son, Mena-Cham (Minakros) is of fitting age to succeed his
father; therefore it is my opinion that Moses should surrender to him
the throne.”
An assembly of the people was called, and as this advice of the
queen pleased them, they besought Moses to resign the crown to
the rightful heir. He consented, without hesitation, and, laden with
gifts and good wishes, he left the country and went into Midian.[481]
Moses was sixty-seven years old when he entered Midian. Reuel or
Jethro,[482] who had been a councillor of Pharaoh, had, as has been
already related, taken up his residence in Midian, where the people
had raised him to be High Priest and Prince over the whole tribe. But
Jethro after a while withdrew from the priesthood, for he believed in
the one True God, and abhorred the idols which the Midianites
worshipped. And when the people found that Jethro despised their
gods, and that he preached against their idolatry, they placed him
under the ban, that none might give him meat or drink, or serve him.
This troubled Jethro greatly, for all his shepherds forsook him, as he
was under the ban. Therefore it was, that his seven daughters were
constrained to lead and water the flocks.[483]
Moses arrived near a well and sat down to rest. Then he saw the
seven daughters of Jethro approach.
The maidens had gone early to the well, for they feared lest the
shepherds, taking advantage of their being placed under ban, should
molest them, and refuse to give their sheep water. They let down
their pitchers in turn, and with much trouble filled the trough. Then
the shepherds came up and drove them away, and led their sheep to
the trough the maidens had filled, and in rude jest they would have
thrown the damsels into the water, but Moses stood up and delivered
them, and rebuked the shepherds, and they were ashamed.
Then Moses let down his pitcher, and the water leaped up and
overflowed, and he filled the trough and gave the flocks of the seven
maidens to drink, and then he watered also the flocks of the
shepherds, lest there should be evil blood between them.
Now when the maidens came home, they related to their father all
that had taken place; and he said, “Where is the man that hath
shown kindness to you?—bring him to me.”
So Zipporah ran—she ran like a bird—and came to the well, and
bade Moses enter under their roof and eat of their table.
When Moses came to Raguel (Jethro), the old man asked him
whence he came, and Moses told him all the truth.
Then thought Jethro, “I am fallen under the displeasure of Midian,
and this man has been driven out of Egypt and out of Ethiopia; he
must be a dangerous man; he will embroil me with the men of this
land, and, if the king of Ethiopia or Pharaoh of Egypt hears that I
have harboured him, it will go ill with me.”
Therefore Raguel took Moses and bound him with chains, and threw
him into a dungeon, where he was given only scanty food; and soon
Jethro, whose thoughts were turned to reconciliation with the
Midianites, forgot him, and sent him no food. But Zipporah loved him,
and was grateful to him for the kindness he had showed her, in
saving her from the hands of the shepherds who would have dipped
her in the watering-trough, and every day she took him food and
drink, and in return was instructed by the prisoner in the law of the
Most High.[484]
Thus passed seven, or, as others say, ten years;[485] and all the while
the gentle and loving Zipporah ministered to his necessities.
The Midianites were reconciled again with Jethro, and restored him
to his former position; and his scruples about the worship of idols
abated, when he found that opposition to the established religion
interfered with his temporal interests.
Then, when all was again prosperous, many great men and princes
came to ask the hand of Zipporah his daughter, who was beautiful as
the morning star, and as the dove in the hole of the rock, and as the
narcissus by the water’s side. But Zipporah loved Moses alone; and
Jethro, unwilling to offend those who solicited her by refusing them,
as he could give his daughter to one only, took his staff, whereon
was written the name of God, the staff which was cut from the Tree
of Life, and which had belonged to Joseph, but which he had taken
with him from the palace of Pharaoh, and he planted it in his garden,
and said, “He who can pluck up this staff, he shall take my daughter
Zipporah.”
Then the strong chiefs of Edom and of Midian came and tried, but
they could not move the staff.
One day Zipporah went before her father, and reminded him of the
man whom he had cast into a dungeon so many years before. Jethro
was amazed, and he said, “I had forgotten him these seven years;
he must be dead; he has had no food.”
But Zipporah said meekly, “With God all things are possible.”
So Jethro went to the prison door and opened it, and Moses was
alive. Then he brought him forth, and cut his hair, and pared his
nails, and gave him a change of raiment, and set him in his garden,
and placed meat before him.
Now Moses, being once more in the fresh air, and under the blue
sky, and with the light of heaven shining upon him, prayed and gave
thanks to God; and seeing the staff, whereon was written the name
of the Most High, he went to it and took it away, and it followed his
hand.
When Jethro returned into the garden, lo! Moses had the staff of the
Tree of Life in his hand; then Jethro cried out, “This is a man called
of God to be a prince and a great man among the Hebrews, and to
be famous throughout the world.” And he gave him Zipporah, his
daughter, to be his wife.[486]
One day, as Moses was tending his flock in a barren place, he saw
that one of the lambs had left the flock and was escaping. The good
shepherd pursued it, but the lamb ran so much the faster, fled
through valley and over hill, till it reached a mountain stream; then it
halted and drank.
Moses now came up to it, and looked at it with troubled
countenance, and said,—
“My dear little friend! Then it was thirst which made thee run so far
and seem to fly from me; and I knew it not! Poor little creature, how
tired thou must be! How canst thou return so far to the flock?”

PDF Recent Developments On Industrial Control Systems Resilience Emil Pricop Ebook Full Chapter

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

PDF Recent Developments On Industrial Control Systems Resilience Emil Pricop Ebook Full Chapter

Uploaded by

Copyright:

Available Formats

Recent Developments on Industrial

Control Systems Resilience Emil Pricop

Intelligent Information and Database Systems: Recent

Recent Results on Nonlinear Delay Control Systems: In

Resilience of Critical Infrastructure Systems-Emerging

Systems Engineering in Research and Industrial Practice

Recent Developments in Acoustics Select Proceedings of

Industrial Automation and Control Systems Security

Recent Trends in Control and Sensor Systems in

Recent Developments in Integrable Systems and Related

More information about this series at http://www.springer.com/series/13304

Nitul Dutta Mariam Ibrahim

ISSN 2198-4182 ISSN 2198-4190 (electronic)

Another notable contribution of this book is the inclusion of necessary and

Ploiesti, Romania Dr. Emil Pricop

Safety Instrumented Systems Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Intrusion Detection on ICS and SCADA Networks . . . . . . . . . . . . . . . . 197

About the Editors

Jaouhar Fattahi is currently working with Defence Research and Development

Nitul Dutta is a professor in the Computer Engineering Department, Faculty of

Mariam Ibrahim received her Bachelor’s degree in Electrical and Computer

Qays Al-Hindawi Department of Mechatronics Eng, Faculty of Applied Technical

Marilena Stanculescu Department of Electrical Engineering, University

Keywords Safety instrumented systems · Risk analysis · IT enabled safety systems

A.-S. Băies, u (B)

© Springer Nature Switzerland AG 2020 1

1.1 Safety Instrumented Systems General Aspects

SENSORS LOGIC SOLVER ACTUATORS

SAFETY INSTRUMENTED SYSTEM (SIS)

Fig. 1 A safety instrumented system (SIS) structure

Inlet PSV Forced Dangerous

Figure 2 presents a vessel in which a flammable liquid is stored. A typical control

1.2 Safety Instrumented System Standards

IEC 61508 Standard

IEC 61508 standard has 7 parts [4]:

IEC 61511 Standard

1.3 Safety Instrumented Systems Versus Control Systems

3. Hazard and risk

Global planification 9. SIS design 10.SIS design using

12.Instalation and 11.External facilities

13. Validation 15. SIS changes

Fig. 4 Safety life cycle model according to IEC 61508 [7]

2 Safety Integrity Level of a Safety Instrumented System

RISK = FREQUENCY × HAZARD CONSEQUENCE

According to [5], hazard is an inherent feature of a system/process that has the

In the case of chemical processes, hazard is the combination of a hazardous

2.1 Quantitative Methods

Further, SIL is determined using Table 1.

Table 2 Safety integrity

P F D Z T = P F D adaptor + P F D sensor , (4)

2.2 Risk Matrix

Table 3 Risk frequency values [13]

Table 4 Example of severity values/risk consequences [13]

Fig. 5 Global risk (risk

According to Table 4, the consequences may be MINOR (MIN), SERIOUS (S)

Fig. 6 The modified risk

2.3 Risk Graph

Table 5 Risk parameters classification according to IEC 61511

The possibility of personnel to avoiding the danger is incorporated into parameter

3 Practical Aspects Regarding Safety Instrumented

In case of flow measurement, although diaphragm transducers are primarily used

Moses, as he grew older, distinguished himself from all other young

You might also like