Redundancy is a general term which means having more than one way of performing a required function, so in a SIS it is two transmitters where one would do the job, or two valves in series. In our sense it is directly related to architecture, and some will use “redundancy” and “architecture” in the same way.
Architecture It is the main design decision a FuSa engineer has for lowering PFDavg, meeting an HFT requirement, or cutting spurious trips, and which of those it does depends on how the redundant devices are voted: 1oo2 lowers PFDavg, 2oo2 lowers the STR, 2oo3 does some of both. Redundancy is not free, either. Every redundant channel shares something with its twin, and that shared piece is where common cause failure (CCF) lives.
Key Points
- Identical redundancy (two of the same device) protects against random hardware failure; diverse redundancy also protects against systematic faults and CCF.
- Redundancy raises the HFT, which is the basis of the architectural constraints gate in SIL verification.
- Redundant channels are never fully independent. The β factor accounts for the share of failures that take both out together, and it dominates PFDavg once β gets past a few percent.
Example
A high-pressure SIF uses two pressure transmitters voted 1oo2 in place of a single one. Either transmitter can trip the function, so PFDavg drops well below the 1oo1 value, at the cost of roughly twice the spurious trip rate plus a CCF term set by the β factor.
Go deeper: 2oo3 Architecture: The Design Decision Behind Majority Voting
See Also: architecture, HFT, CCF
Cited Sources
- IEC 61511-1:2016, Clause 3.2.60