1oo2, 2oo3 Voting Architecture.

Voting architecture, MooN notation describes how a safety instrumented function, SIF determines whether to actuate based on multiple sensor or final-element channels. 1oo2, one out of two means one of two channels voting for actuation is sufficient. 2oo2 means both channels must vote for actuation. 2oo3 means two of three channels must vote, used to balance the need to detect a real demand against the risk of spurious trips. Voting architecture is one of the primary design choices in IEC 61511 SIL verification. It affects both the achieved SIL, through PFDavg and the spurious-trip rate.

Upload a drawing View sample results

Part ofGlossary

What 1oo2, 2oo3 Voting Architecture means.

The MooN notation reads as 'M out of N', M channels of N must vote for the SIF to actuate. The choice of voting architecture trades dangerous undetected failure probability against spurious trip frequency. 1oo2 is conservative for dangerous undetected failures, both channels must fail to disable the SIF but doubles the spurious-trip rate compared to 1oo1, either channel failing spuriously trips the SIF. 2oo3 is the workhorse for SIL 3 SIFs because it balances both. Two of three sensors must vote, so a single sensor failure does not trip the SIF, and two sensors must fail to disable the SIF. Higher-order voting, 3oo4, 2oo4 is rare in process industry but appears in nuclear and certain offshore applications.

How does voting architecture affect PFDavg.

1oo1. PFDavg ≈ lambda_du × T, 2. Single point of failure. 1oo2. PFDavg ≈, lambda_du × T^2, 3 plus β × lambda_du × T, 2. Both channels must fail. The common-cause term, β term dominates the long-term PFDavg. 2oo2. PFDavg ≈ 2 ×, lambda_du × T, 2 lambda_du × T. Worse than 1oo1 for dangerous failures, either channel failing disables the SIF. 2oo3. PFDavg ≈, lambda_du × T^2 × 3 plus β × lambda_du × T, 2. Same dangerous-failure performance as 1oo2 but improved spurious-trip resistance, single channel failure does not spuriously trip.

How does voting architecture affect spurious trip rate.

1oo1. STR ≈ lambda_su, single-channel spurious failure rate. 1oo2. STR ≈ 2 × lambda_su, either channel failing trips. 2oo2. STR ≈, lambda_su × T^2, both channels must spuriously fail. 2oo3. STR ≈ 3 ×, lambda_su × T^2, two of three channels must spuriously fail. The 2oo3 architecture combines the spurious-trip resistance of 2oo2 with the dangerous-failure performance of 1oo2. This is why 2oo3 dominates SIL 3 SIF designs.

What about voting on final elements.

Voting also applies to final elements, the actuators that respond to the SIF logic-solver output. A 1oo2 final-element voting means either of two valves closing is sufficient to achieve the safety action. Both valves are arranged in series. A 2oo3 final-element voting requires two of three valves to close. Three valves arranged in series with logic that demands two-of-three closure. Final-element voting is less common than sensor voting because of the cost and complexity of redundant final elements. It is typically applied on SIL 3 SIFs where the final element is the dominant PFDavg contributor.

Worked example, reading a voting arrangement off a drawing.

A separator carries three pressure transmitters on one tapping set, PT-1201A, PT-1201B and PT-1201C, and the cause and effect matrix marks the high high pressure cause as 2oo3. Read that as: the function actuates when any two of the three transmitters are above the trip setpoint. One transmitter reading high on its own raises an alarm and a diagnostic, and does not trip the vessel, which is the spurious trip protection the arrangement was chosen for. Put one transmitter into maintenance bypass and the logic no longer has three healthy channels: the arrangement degrades to whatever the configuration defines, commonly 1oo2, so a single remaining high reading now trips. That degraded state is a design decision recorded in the safety requirements specification, it is alarmed, and it carries a written time limit on the repair. The same notation on the final element side means something physically different: two shutdown valves in series are a 1oo2 arrangement for a fail closed duty, because either one closing achieves the safe state, while the same two valves in parallel would be 2oo2.

MooN voting architectures, what trips and what does not

M out of N: M channels of the N installed must vote before the function actuates. The same notation is used for sensor subsystems and for final elements.

Architecture	Actuates when	Fails to actuate when	Spurious trip tendency against 1oo1	Where it is usually seen
1oo1	The single channel votes to trip	That one channel fails undetected in the safe direction	Baseline	A single transmitter on a lower integrity trip
1oo2	Either of the two channels votes	Both channels fail undetected	Roughly doubled	Sensors where a missed demand matters more than a false trip
2oo2	Both channels vote together	Either channel fails undetected	Roughly halved	Duties where a false trip is more costly than a missed demand
2oo3	Any two of the three channels vote	Two of the three fail undetected	Much lower	Continuous units at higher integrity targets
1oo3	Any one of the three channels votes	All three fail undetected	Roughly tripled	Rare, where a missed demand dominates every other concern
2oo4	Any two of the four channels vote	Three of the four fail undetected	Much lower	Large machines where one channel is often out for maintenance
1oo2D	Either channel votes, with internal diagnostics deciding how a detected fault is treated	Both channels fail in a way diagnostics do not see	Lower than 1oo2	Inside a certified logic solver, defined by the platform

What voting degrades to when a channel is taken out of service

The degraded arrangement is a design decision recorded in the safety requirements specification, not something the operator chooses at the time.

Installed arrangement	Healthy channels	Effective voting	Usual operating consequence
2oo3	3	2oo3	Normal operation
2oo3	2	1oo2 or 2oo2, whichever the logic is configured to degrade to	Alarm, a written time limit on the repair, and a recorded bypass
2oo3	1	1oo1	Usually not permitted; the unit trips or shuts down
1oo2	1	1oo1	Alarm and a time limit on the repair
2oo2	1	The function either trips or must be bypassed under authorisation	There is no middle state; the arrangement has no redundancy left

Common questions

What is the difference between 1oo2 and 1oo2D.

1oo2D adds diagnostic coverage to the 1oo2 architecture. Each channel performs continuous self-diagnostics that detect a fraction of failures, typically 60-90% and trigger automatic restoration. The 'D', diagnostics reduces PFDavg by detecting and restoring dangerous failures before the proof-test interval. SIL-certified smart transmitters and logic solvers often implement 1oo2D internally.

Can different channels use different technology in a 2oo3 architecture.

Yes, and this is often the design choice. A 2oo3 architecture using three identical sensors is vulnerable to common-cause failures, a manufacturing defect, a calibration error, a corrosion mechanism that affects all three. A 2oo3 architecture using diverse technologies, e.g. differential pressure, radar, and tuning fork for level has lower common-cause beta factor, typically 2% instead of 5-10% for identical channels. Diverse voting is the gold standard for SIL 3 sensor voting.

What is the common-cause beta factor.

The common-cause beta factor is the fraction of failures that affect multiple channels of a voted architecture simultaneously. A β of 10% means 10% of the failure modes affect all channels. Only the remaining 90% benefit from voting. The β value depends on diversity, same-vendor same-model identical channels. 5-10%. Same-vendor different-model channels. 3-5%. Different-vendor different-technology channels. 1-3%.

When is 1oo1 acceptable for a SIL 2 SIF.

1oo1 architecture can achieve SIL 2 PFDavg if the single-channel failure rate is sufficiently low and the proof-test interval is sufficiently short. SIL-certified smart transmitters with high diagnostic coverage can sustain SIL 2 in 1oo1 architecture. SIL 3 in 1oo1 is rarely achievable. SIL 4 in 1oo1 is essentially impossible. Higher SIL targets drive redundant voting architectures.

Written byTagsight Functional Safety DeskUpdated 20 September 2026

Get the SIL verification workbook.

PFDavg by voting arrangement, with proof-test interval and the architectural constraint on the same sheet. Plain .xlsx.

Download the SIL workbook Request a pilot