2oo3 voting logic triplicates one process measurement, accepts the reading agreed by at least two of three channels, and trips the final element only when two of three exceed the high-high threshold, per IEC 61511 SIS practice documented in process-control literature [S1].
A single-sensor threshold (1oo1) trips one transmitter's output to the logic solver, which is the lowest-cost path but has no fault tolerance: any failed-safe or failed-dangerous single channel directly becomes a plant trip or a missed trip [S5].
1oo1 Single-Channel Trip: Where It Is the Right Tool
1oo1 is the cheapest architecture, uses one sensor, one input card, and one trip path, with a PFDavg dominated entirely by that single channel's dangerous-failure rate, which is the reason it caps out at SIL 1 in most safety analyses [S1]. The wiring and proof-test burden are minimal, and the 1oo1 loop is the right call on non-critical interlocks, downstream of a higher-tier SIF, or on skid packages where adding two extra transmitters and three impulse lines cannot be justified economically [S1][S5]. The catch is that any single failure, drift, plug, or wiring break is also a hidden failure, so 1oo1 only fits applications where the consequence of a missed trip is bounded and the nuisance-trip cost of a false trip is acceptable [S1].
2oo3 Architecture: How the Voting Math Actually Behaves
In a 2oo3 logic solver, the trip output energises only when at least 2 of 3 input channels report trip-state, so 1 of 3 stuck-trip does not shut the unit down, while 2 of 3 trip, or 3 of 3 trip, drives the Emergency Shutdown (ESD) final element to its safe state [S1][S5]. With three independent channels, the dangerous-failure probability drops versus a single channel by roughly the square of the per-channel PFD, which is why 2oo3 with proven transmitter diagnostics is the common path to SIL 2 or SIL 3 on a single SIF [S1]. The practical truth table for a 2oo3 pressure transmitter arrangement is: (0,0,0) no trip, (1,0,0) no trip, (1,1,0) trip, (1,1,1) trip, and any single channel under maintenance or powered down is automatically bypassed with a diagnostic flag so the remaining two channels still vote as 1oo2 [S1]. Spurious-trip rate scales roughly with the square of the per-channel safe-failure rate, so 2oo3 sits between 1oo2 (lowest nuisance trips per dangerous failure) and 2oo2 (highest dangerous-fault tolerance, highest nuisance-trip rate) on the classic MooN trade-off curve [S1][S5].
Comparison Matrix: 1oo1, 1oo2, 2oo2, 2oo3, 3oo3
On the four decision criteria that matter at the desk, the architectures rank as follows. A common mistake is to assume 2oo3 automatically delivers SIL 3: it does not, because the achieved SIL also depends on the final element's PFD, common-cause failures between the three channels, and proof-test coverage, all of which must be summed in the SIF equation [S1].
Desynchronisation, Drift, and the Hidden Failure Mode
The failure mode that catches most first-time 2oo3 designs is desynchronisation, not outright sensor failure: three identical pressure transmitters on the same tap can read 0.8 bar / 1.0 bar / 1.2 bar at the same instant because of response-time spread, sampling skew, cable-length delay, or EMI, and that divergence can suppress a real trip if the logic solver averages or median-selects the channels [S2][S4]. The standard mitigation is a pairwise-difference alarm: compute (S1-S2), (S2-S3), (S1-S3) in absolute value, compare each against a preset threshold Δ, apply a persistence filter of typically 0.5–3 s so transient noise does not flag, and only flag desync when the deviation persists for T continuous seconds, then add a deadband of roughly ±Δ so the alarm clears cleanly without chatter [S2][S4]. Lag compensation can be applied when one channel is known to be slower (e.g. longer impulse line), and adaptive thresholds are commonly relaxed during commissioning and tightened automatically once stable operation data is collected [S2][S4].
Sensor Independence, Tapping, and Proof-Test Discipline
For 2oo3 to actually buy the SIL headroom on paper, the three channels must be physically and electrically independent: separate process taps at minimum 1 m apart on the line, separate impulse tubing, separate power feeds, separate I/O cards in the logic solver, and where possible separate transmitter suppliers or at least non-shared firmware revisions, otherwise a common-cause failure defeats the redundancy [S1][S2]. Proof testing on a 2oo3 SIF is more expensive than 1oo1 because all three channels must be exercised per test interval, the bypass must be interlocked so the plant cannot run with two channels bypassed (which would silently degrade 2oo3 to 1oo1 and the SIF to a lower SIL), and the test must include the logic solver's voting function, not just the field transmitter, using a valve or simulated input [S1]. A single channel under maintenance is auto-degraded to 1oo2 by the logic solver, which is acceptable for a defined repair window but must be time-bounded; running in 1oo2 mode for an extended campaign quietly halves the dangerous-failure tolerance of the SIF [S1].
Decision Rule: When to Spec 2oo3 vs 1oo1
Spec 2oo3 when the SIF must reach SIL 2 or SIL 3, when a single spurious trip costs more than the three extra transmitters over the loop lifetime, when the process measurement is critical (high-high pressure, flame-failure, reactor level), and when a documented proof-test and bypass-management program is in place [S1][S2]. Spec 1oo1 when the SIF target is SIL 1 or below, when the hazard consequence of a missed trip is low, when adding two more impulse penetrations on a high-pressure vessel is mechanically unattractive, or when the loop will never get the proof-test discipline 2oo3 demands; in those cases spend the budget on a better single transmitter with high diagnostic coverage instead of duplicating a mediocre one [S1][S5]. For related instrument-side trade-offs, the SIS logic-solver selection and field-measurement accuracy references are worth scanning alongside this decision. A useful adjacent comparison is the heat-detector rating trade-off, which follows the same single-channel-vs-multi-sensor logic pattern at a smaller safety scale.
Track these three signals before committing: (1) your SIL target per the Safety Requirement Specification and the SIF's required PFDavg, which sets whether 2oo3 is justified at all; (2) the transmitter manufacturer's published safe- and dangerous-failure rates, diagnostic coverage, and proof-test interval, since these three numbers feed the SIL verification calculation; (3) the cost of a single spurious trip in dollars per event for the unit, which usually decides 2oo3 vs 1oo1 more honestly than any functional-safety textbook.
Detailed specification references: single girder crane.