| Voting | HFT (safety) | Safety (PFDavg) | Spurious trips | Online testing / repair | Typical use |
|---|---|---|---|---|---|
| 1oo1 | 0 | Baseline | Baseline (any safe failure trips) | Function lost while the device is tested | SIL 1, some SIL 2 with good devices and tests |
| 1oo2 | 1 | Much better; common cause dominates | About twice 1oo1 | One channel can be tested, function stays | Final elements (two valves in series), SIL 2–3 sensors where spurious trips are acceptable |
| 2oo2 | 0 | About twice as bad as 1oo1 | Very low | Not suitable for safety where both must work | Availability-driven functions, not usually for SIL claims |
| 2oo3 | 1 | Close to 1oo2 (slightly worse) | Very low | One channel can be bypassed (becomes 1oo2 or 2oo2 as configured) | Transmitters on critical trips |
| 1oo3 | 2 | Best | About three times 1oo1 | Two channels remain during a test | High SIL sensors with low spurious trip cost |
Rules of thumb
- Sensors: 2oo3 is the default for important trips because it combines fault tolerance with a low spurious trip rate and allows online testing.
- Final elements: 1oo2 (two valves in series, or valve plus motor trip) for SIL 2–3; separate solenoids and air supplies keep β down.
- Logic solvers: internal redundancy in the certified product rather than voting between products.
- Always check the degraded mode: what voting applies while one channel is bypassed or failed, and for how long.
In First Out AI
Voting is a drop-down on each group (up to four channels; Free covers 1oo1, 1oo2 and 2oo3). The result shows HFT, the HFT required by IEC 61511 for the target and the spurious trip rate, so architectures can be compared quickly; duplicate the function and change one group to compare side by side.
Written for First Out AI as engineering guidance. It supports engineering work and does not replace it; check every value against your standards, certificates and company rules with a competent functional safety engineer.