2oo3 Architecture: The Design Decision Behind Majority Voting

Last updated September 2026

Three transmitters measure the same pressure, and the SIS trips when two of them reach the trip condition. That is 2oo3 voting, two out of three.

Every SIF has two overarching requirements: the risk reduction factor (RRF) assigned to it at SIL allocation, and the maximum allowable spurious trip rate (STR) the facility requires and the safety requirements specification (SRS) has to state (10.3.2).

A design typically starts at 1oo1 and adds channels only when one of those two requirements comes up short. Each step up improves one requirement at the expense of the other, so the progression stops in a different place for different SIFs. The 2oo3 architecture is often where the design ends up, because of the balance it provides.

How 2oo3 Works

2oo3 is the M out of N (MooN) notation for an arrangement of N independent channels connected so that M of them are sufficient to perform the SIF. Here, any two of three channels can trip.

One failed channel does not change what the SIS does, whether it failed safe or dangerous. A transmitter that fails dangerous and sticks at a normal reading still leaves two healthy channels to trip on a real demand. A transmitter that fails safe casts a false trip vote, but one vote is not enough, and the two healthy channels still hold the plant on a normal day.

That arrangement tolerates one failure, and a hardware fault tolerance (HFT) of 1 is the minimum IEC 61511-1 allows at SIL 3 (Table 6). Getting to an HFT of 1 without doubling the STR is part of why 2oo3 is common.

What a Detected Failure Does to the Vote

The SRS has to state what the SIS does when a device reports a detected failure, and here that choice decides what the vote becomes:

Notify only. The failed channel drops out of the vote, so the vote essentially becomes a 2oo2. HFT goes to zero, and the SIF needs compensating measures until repair.
Vote to trip. The failed channel is forced to a trip vote, so the vote essentially becomes a 1oo2. HFT stays at 1, and one more detected failure of either kind trips the plant.
Trip. The detected fault trips the entire SIF, whatever the architecture.

With no diagnostics there is no policy to apply, which is the case the worked example below uses. Note that diagnostic management and its impact on the average probability of failure on demand (PFDavg) and the STR is notoriously confusing.

How 2oo3 Balances PFDavg Against Spurious Trips

No table and no rule of thumb replaces the engineering thought process. The FuSa engineer works the numbers for that SIF and finds the right balance.

The RRF target comes out of SIL allocation with a derivation behind it. The spurious trip target is often a blanket corporate number stated per SIF or per SIS, even when the thing that actually trips the plant is a shared final element.

Starting from 1oo1, the options move the two numbers in opposite directions:

1oo2 lowers PFDavg and roughly doubles the STR, so it could clear the RRF target and miss the STR target.
2oo2 lowers the STR and roughly doubles PFDavg, so it could clear the STR target and miss the RRF target.
2oo3 is the one of the four that can clear both targets at once, on SIFs where 1oo2 and 2oo2 each miss one.

1oo3 and 3oo4 extend the same trade further, 1oo3 toward risk reduction and 3oo4 toward spurious immunity, at a hardware count most process SIFs do not justify.

It is also perfectly acceptable for a SIF to have no STR target, as long as the SRS says so. That fits where the safe state is cheap to reach and cheap to recover from, such as a batch unit that aborts the batch and restarts with the next one, or a service with a spare train that picks up the load. With no STR target, the RRF target alone drives the architecture.

A Worked Example of Four Architectures With the Same Numbers

The Assumptions

One instrument type is used in every case:

Total failure rate of 1.0E-6 per hour, 70% of it safe
Certificate beta factor (β) of 5%
Proof test interval (TI) of 1 year
Mean time to restore (MTTR) of 8 hours
Proof test coverage (Cpt) of 90%
SIS lifetime (LT) of 15 years

The SIF being served has an RRF target of 2000 from SIL allocation and a maximum allowable STR of one trip per 500 years from its SRS. The results cover the instruments only. A complete SIF adds a logic solver and a final element, and those typically dominate both PFDavg and the STR.

The instruments are modeled with no diagnostics, so every failure is undetected. That makes the dangerous undetected failure rate (λ_DU) 3.0E-7 per hour and the safe undetected failure rate (λ_SU) 7.0E-7 per hour. A dangerous failure waits for the proof test, and a safe failure casts a trip vote immediately.

MTTR still appears on the spurious side because one instrument giving a false vote is visible through the vote itself. The longer that instrument stays failed, the more likely a second one fails safe and trips the plant.

The Equations

PFDavg, with proof test coverage in every term:

1oo1

\mathrm{PFD}_{\mathrm{avg}} = \frac{1}{2}\,C_{pt}\,\lambda_{DU}\,TI + \frac{1}{2}\,(1 – C_{pt})\,\lambda_{DU}\,LT

2oo2

\mathrm{PFD}_{\mathrm{avg}} = C_{pt}\,\lambda_{DU}\,TI + (1 – C_{pt})\,\lambda_{DU}\,LT

1oo2

\begin{aligned} \mathrm{PFD}_{\mathrm{avg}} ={}& \frac{1}{3}\bigl((1-\beta)\,C_{pt}\,\lambda_{DU}\,TI\bigr)^2 + \frac{1}{3}\bigl((1-\beta)(1-C_{pt})\,\lambda_{DU}\,LT\bigr)^2 \\ &+ (1-\beta)^2\,C_{pt}\,(1-C_{pt})\,\lambda_{DU}^2\left(\frac{1}{2}\,TI \cdot LT + \frac{1}{6}\,TI^2\right) \\ &+ \frac{1}{2}\,\beta\,C_{pt}\,\lambda_{DU}\,TI + \frac{1}{2}\,\beta\,(1-C_{pt})\,\lambda_{DU}\,LT \end{aligned}

2oo3

\begin{aligned} \mathrm{PFD}_{\mathrm{avg}} ={}& \bigl((1-\beta)\,C_{pt}\,\lambda_{DU}\,TI\bigr)^2 + \bigl((1-\beta)(1-C_{pt})\,\lambda_{DU}\,LT\bigr)^2 \\ &+ (1-\beta)^2\,C_{pt}\,(1-C_{pt})\,\lambda_{DU}^2\left(\frac{3}{2}\,TI \cdot LT + \frac{1}{2}\,TI^2\right) \\ &+ \frac{1}{2}\,\beta\,C_{pt}\,\lambda_{DU}\,TI + \frac{1}{2}\,\beta\,(1-C_{pt})\,\lambda_{DU}\,LT \end{aligned}

The squared terms are two channels down at once, and the mixed terms are the combinations of a channel the proof test would have caught and a channel it would not. The diagnostic, proof-test-bypass, initial-failure and support-system terms are all zero under the assumptions above and are left out. We at SIL Safe consider these the middle level of complexity: definitely more complex than the simple forms, but not as complex as they can be.

The 2oo3 equation also leaves out four third-order terms, the cases where all three channels are down together. They subtract 0.03% from the answer at these inputs, which is why most practitioners drop them and only a full verification tool includes them.

Spurious trip rate:

1oo1

\mathrm{STR} = \lambda_{SU}

1oo2

\mathrm{STR} = 2 \times \lambda_{SU}

2oo2

\mathrm{STR} = 2 \times \lambda_{SU}^{2} \times \mathrm{MTTR} + \beta \times \lambda_{SU}

2oo3

\mathrm{STR} = 6 \times \lambda_{SU}^{2} \times \mathrm{MTTR} + \beta \times \lambda_{SU}

β in these equations is the architecture-adjusted value, not the number on the SIL certificate. A certificate reports β for 1oo2. IEC 61508-6 Annex D Table D.5 scales it by architecture, and the factor for 2oo3 is 1.5, so a certificate β of 5% becomes 7.5%. We at SIL Safe always render our equations without the Annex D factor and apply it to the β value before working the numbers.

2oo2 has no β on the PFDavg side. Any single dangerous failure defeats the vote, so it makes no difference whether that failure was common cause or independent, and λ_DU already includes common cause. The spurious side is the reverse: a 2oo2 trips only when both channels fail safe, so common cause is what drives it, and the β term is most of the answer.

Cpt does not appear on the spurious side. It describes how much of λ_DU a proof test reveals, and spurious trips come from λ_SU.

What the Numbers Show

With the mean time to fail spurious (MTTFsp) shown alongside the STR:

Architecture	PFDavg	RRF	SIL on PFDavg	STR (/yr)	MTTFsp
1oo1	3.15E-3	317	SIL 2	6.13E-3	163 years
1oo2	1.68E-4	5,940	SIL 3	1.23E-2	82 years
2oo2	6.31E-3	159	SIL 2	3.07E-4	3,261 years
2oo3	2.67E-4	3,748	SIL 3	4.60E-4	2,173 years

Against the two targets this SIF was given:

1oo1 — fails RRF, fails spurious
1oo2 — passes RRF, fails spurious
2oo2 — fails RRF, passes spurious
2oo3 — passes both

Calculated MTTFsp runs optimistic against field experience, because loss of utilities, plugged and frozen impulse lines, drift, and maintenance error trip plants without ever appearing in a λ_SU calculation.

Common Cause Moves the 2oo3 Column More Than Anything Else

β (certificate, 1oo2)	β with 1.5 factor	Common cause share of PFDavg	Common cause share of STR	RRF
2%	3%	74%	99.89%	7,816
5%	7.5%	89%	99.96%	3,748
10%	15%	95%	99.98%	2,005

Common cause is most of the PFDavg at the low end of the band and nearly all of it at the high end. It is effectively all of the STR throughout, because an independent spurious trip needs a second safe failure inside the 8-hour MTTR. 2oo3 clears the RRF target of 2000 at β = 2% and β = 5%. At β = 10% it lands on 2,005 against that target, which is no margin at all.

Note that the β used here comes purely from the SIL certificate, scaled by the Table D.5 factor. We are not using the β scoring process of IEC 61508-6 Annex D, which is beyond the scope of this discussion.

Disadvantages of 2oo3

Three instruments cost roughly three times one, and so do their support systems: process connections, impulse lines, wiring, I/O, and installation.

Proof testing scales with channel count, so every interval means three tests instead of one for the life of the SIS. That adds operating and maintenance cost, and possibly longer downtime.

It is easy to underestimate the real β of three identical instruments on the same service, for two reasons. The first is an error trap: the certificate β is a 1oo2 value, and forgetting the IEC 61508-6 Annex D factor understates the 2oo3 common cause contribution by a third. The second is scope: the certificate number covers the instrument, and the three channels also share process connections, impulse lines, wiring, I/O and installation. Taking the instrument number without thinking about those shared support systems can grossly underestimate β.

2oo3 on Logic Solvers and Final Elements

2oo3 is an instrument decision almost every time. Where a safety PLC votes internally, the vendor built and certified that arrangement, so it is not a decision the user makes. Relay logic is the exception, where three relay channels are wired to vote. No one buys three safety PLCs and puts them in 2oo3.

On Most Final Elements 2oo3 Is Not Applicable

On a final element, MooN counts how many elements have to operate for the safe state, not how many channels have to agree. For isolation, de-energization, and torque removal through safe torque off (STO), one element does the job: close one valve and the flow stops, open one contactor and the motor stops.

When one element is enough, redundancy means a second element in series, and the notation is 1oo2 or 1oo3. The first element to act has already reached the safe state and nothing the others do can undo it, so there is no vote and 2oo3 cannot exist.

An architecture like 2oo3 applies only when the safe state is a rate rather than an on-or-off condition. Relief, blowdown, quench and inhibitor injection add across parallel paths, so three paths each sized at 50% of the required rate are a real 2oo3 with an HFT of 1.

2oo3 Solenoids in the Top Hat

The top hat, the actuator and accessories package mounted on the valve, holds the solenoids that dump air to trip, and that is where 2oo3 actually appears on a final element. Three solenoids in a 2oo3 voting manifold need two to de-energize before the actuator loses air. Manifolds with the vote built in on both the energize and de-energize paths are off-the-shelf products.

A high integrity pressure protection system (HIPPS), the SIS that isolates a pressure source where conventional relief is impractical, is the classic example of a mixed build: 2oo3 transmitters, 1oo2 series valves, and 2oo3 solenoids in each top hat, with HFT assigned per subsystem (11.4.2).

Nothing about the valve body changes. Its λ_DU, its Cpt and its spurious behavior are what they were.

Life-cycle Placement

Architecture selection follows the hazard and risk assessment (H&RA) and SIL allocation. It works from an SRS complete enough to state both the target failure measure and the maximum allowable spurious trip rate.

Architecture selection is an SIS design activity. SIL verification follows it to confirm the chosen arrangement clears both targets, or to send it back.

Validation and then operation and maintenance inherit the proof-test load and the degraded-mode rules the architecture created.

Common Mistakes

One tap, three transmitters. Three transmitters share one process tap or one manifold far more often than anyone admits. The vote then runs on a single point of failure that plugs, freezes, or drifts as one unit, while the verification still shows three channels and a β of 5%.
One procedure, one technician. Proof tests typically run all three channels back to back with one procedure and one technician. That is normal practice, but it adds a systematic common cause, and the mistake is a β assessment that doesn’t account for it.
Three instruments, one valve. Facilities put three instruments on a SIF and leave a single valve in place, where the final element already contributes the majority of both the SIF PFDavg and the STR. This is where the balance the FuSa engineer strikes is critical.
No fault response policy. Specifications call for 2oo3 without a diagnostic fault response policy, and the SIS often reverts to 2oo2 on the first detected failure, dropping HFT to zero with no compensating measures in place.

Frequently Asked Questions

Does SIL Safe recommend that all SIFs be 2oo3 for consistency?

Generally, no, unless there’s a very strong reason. Many SIFs would be overkill that way, with three instruments and three proof tests where one or two would clear both targets. If your company truly finds it easier to run everything homogenized, so be it; that’s a business decision, and safety doesn’t require it.

I heard 2oo3 is only needed for SIL 3 or above. Is that true? What’s the story?

Partly. Whoever told you is probably thinking of the hardware fault tolerance rule: SIL 3 requires an HFT of 1 (IEC 61511-1, Table 6), so the minimum architecture there is 1oo2 or 2oo3. That’s an HFT requirement, and nothing in it forces 2oo3 over 1oo2. It’s often 2oo3 that gets a SIF to both the RRF of SIL 3 and the spurious trip rate the facility needs, so the claim isn’t totally right and isn’t totally wrong.

My understanding is that a 2oo3 SIF for a SIL 1 is overkill. Is that right?

On hardware fault tolerance, yes: SIL 1 needs an HFT of 0, so a single instrument meets the rule. On failure rates it’s very likely overkill too with modern instruments, though maybe not with older ones. Corporate policy may still require it, and that’s fine.

How common is 2oo3 worldwide?

Nobody has counted. We aren’t aware of any published census, so we won’t put a percentage on it. Our feeling at SIL Safe is that it’s a lot.

Do some plants really have no spurious trip rate target? If so, how does that make sense?

Yes, and “not applicable” is a valid value. The requirement is only that the SRS states it. It makes sense where the safe state is cheap to reach and cheap to recover from, and the honest version records that decision rather than leaving the field blank.

My team is setting an acceptable spurious trip rate and my manager says that is ridiculous, that the only acceptable number is never. How do we respond to that?

Zero isn’t achievable. Instruments fail safe, and every safe failure is a trip vote. A trip isn’t free either: every spurious trip forces a restart, and startup is one of the most dangerous modes a plant runs in. That’s why the number gets a target instead of being left to operations. A reasonable target is one spurious trip in 15 years, and put that way it may feel better to your manager.

I see spurious trip rate, mean time to fail spurious, and mean time to trip spuriously used in different places. Are they all the same thing?

Yes, near enough. Mean time to fail spurious (MTTFsp) and mean time to trip spuriously (MTTTsp) are the same quantity, and the spurious trip rate is its reciprocal. The probability of failing safely (PFS) is the one nearby term that means something different, because it’s a probability rather than a rate or a time.

Search site