Redundancy is the usual answer when one channel cannot reach the target. The gain is real but smaller than intuition suggests, because redundant channels share causes of failure: the same design, the same process connection, the same maintenance crew, the same calibration error.
Voting notation
MooN means the function acts when M of N channels demand it. 1oo2 trips if either of two channels trips; 2oo3 needs two of three. For safety, what matters is how many channels must work: a 1oo2 group still works with one channel failed (hardware fault tolerance 1); a 2oo3 group also tolerates one failure; a 2oo2 group tolerates none for safety but is better against spurious trips.
The β-factor model
A fraction β of each channel's dangerous undetected failures is assumed to hit all channels at once (βD for detected failures). The independent remainder (1 − β) behaves as the binomial combination of channels.
Simplified, perfect proof test, ignoring repair terms:
| Voting | Independent part | Common cause part |
|---|---|---|
| 1oo1 | λDU·T1/2 | – |
| 1oo2 | ((1−β)·λDU·T1)² / 3 | β·λDU·T1/2 |
| 2oo3 | ((1−β)·λDU·T1)² | β·λDU·T1/2 |
| 1oo3 | ((1−β)·λDU·T1)³ / 4 | β·λDU·T1/2 |
Worked example
Two shutdown valves in series (1oo2), each λDU = 2 × 10⁻⁶ per hour, tested yearly.
| β | Independent part | Common cause part | PFDavg |
|---|---|---|---|
| 10 % | 8.3 × 10⁻⁵ | 8.8 × 10⁻⁴ | ≈ 9.6 × 10⁻⁴ |
| 2 % | 9.8 × 10⁻⁵ | 1.8 × 10⁻⁴ | ≈ 2.7 × 10⁻⁴ |
| 0 % (never justified) | 1.0 × 10⁻⁴ | 0 | ≈ 1.0 × 10⁻⁴ |
With a typical β the common cause term is about ten times the independent term. The single valve gave 8.8 × 10⁻³, so redundancy bought a factor of about 9, not 90.
The same transmitters as 2oo3 with β = 10 % give about 1.1 × 10⁻³: worse than 1oo2 for safety, because two of the three must work, but far better against spurious trips.
Choosing β
β is a judgement, normally supported by a checklist that scores separation, diversity, complexity, analysis, procedures, competence and environment. Typical values used for field devices are a few percent to about 10 %; for logic solvers they are usually stated by the manufacturer. A value of zero for redundant channels is a red flag in any review.
Ways to lower it in the design: separate process tappings and impulse lines, different technologies (diversity), separate air supplies and solenoids for valves, staggered testing by different people, and a proof test that looks for common causes.
In First Out AI
Set the voting and β on each group. The automatic checks flag a redundant group with β = 0, and the AI points to it when you ask where the mistake is.
Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.