Trip Class
Trip class is a designation on a P&ID or interlock document that flags how a safety instrumented function, SIF responds to a measured deviation. Which hardware participates, what voting is applied, what the fail-safe action is. Trip-class designations like 1oo1, 1oo2, 2oo3, 2oo2 describe the sensor-voting topology, and prefix letters often indicate the overall function class, Class A through Class C in some operator standards.
Read one of your own drawings.
Drop a P&ID, instrument index, or schedule. Tagsight reads it to the tag and opens a workspace you keep when you sign in.
PDF · DWG · DXF · TIFF · PNG · XLSX
Trip class is the shorthand a drawing or an interlock schedule uses to say how a safety instrumented function is built. How many sensors watch the condition, how many of them must agree before the function fires, and what the final element does when it does. The voting notation, 1oo1, 1oo2, 2oo2, 2oo3 is the core of it, and some operator standards add a letter class, Class A through C, or a similar house scheme that bundles the voting with the response time and the fail-safe action into a single named category referenced from the legend. The reason the class matters is that it is the bridge between the hazard study and the hardware. A layer of protection analysis sets a SIL target for the function. The trip class is the architectural choice that, together with the certified component data and the proof-test interval, delivers that target. It is not a substitute for the SIL calculation, because a 2oo3 arrangement is not automatically SIL 3. On the drawing the class is annotated next to the voting instruments, often on the tag itself, a PT-101A, B, C group with a 2oo3 callout. When that scope is captured on an I/O list, the voting annotation belongs in the description column so the SIS audit can reconcile what the drawing asserts against what the safety requirement specification requires, a mismatch that is one of the most common findings in a pre-startup safety review.
Voting topology in plain language.
1oo1 one-out-of-one. A single transmitter, single trip. Cheap but no redundancy. 1oo2 one-out-of-two. Two transmitters, either one alone trips. Maximum safety, prone to spurious trips. 2oo2 two-out-of-two. Both must agree to trip. Minimum spurious trips, less robust against sensor failure. 2oo3 two-out-of-three. Three sensors, any two trigger. The compromise position with good fault tolerance and good spurious-trip immunity. 2oo3 dominates SIL 2 and SIL 3 services in practice.
How trip class shows up in extraction.
On the P&ID. The trip class is annotated next to the voting instrumentation, often in a small inset legend or directly on the tag, PT-101A, B, C with 2oo3 callout. When extracting an I/O list, the voting annotation surfaces in the description column, and downstream the SIS audit register reconciles the drawing-asserted voting against the SRS-required voting. Mismatches between drawing and SRS are common findings in pre-startup safety reviews.
Frequently asked.
Does trip class always equal SIL.
No. SIL is a quantified reliability target. Trip class is the architectural choice that contributes to meeting that target. A 2oo3 architecture is not automatically SIL 3. The certified-safe components, proof-test interval, and overall PFD calculation determine the SIL achieved.
What is a degraded operating mode, e.g. 1oo2D.
1oo2D adds diagnostic coverage. If one of two transmitters fails the diagnostic, the function gracefully degrades to 1oo1 on the surviving transmitter rather than going to 1oo2 and risking either an unrevealed dangerous failure or a spurious trip. Most modern certified-safe transmitters include the diagnostic coverage that makes this architecture viable.
How does trip class get recorded on an I/O list.
The I/O list typically includes a voting or trip-class column for SIS-tagged instruments. A PSH rated 2oo3 would list three rows, one for each transmitter, PSHE-101A, PSHE-101B, PSHE-101C, with the voting class annotated in the trip-class column. The SIS vendor uses this column to verify that the logic-solver configuration matches the drawing-asserted voting topology before PSSR sign-off.