Voting Logic.

Voting logic is the rule a safety function applies to its redundant sensors before it acts. With two or three transmitters watching the same condition, how many must agree that the limit has been crossed before the function trips. It is the single most consequential architectural decision in a safety instrumented function because it sets both failure modes at once. A 1oo2 arrangement trips if either sensor calls the condition, which almost never misses a real demand but trips spuriously when one sensor fails high. A 2oo2 arrangement trips only when both agree, which almost never trips spuriously but is exposed if one sensor fails low. A 2oo3 arrangement, any two of three, improves both numbers at the same time, which is why it dominates SIL 2 and SIL 3 service. The voting is implemented in the certified logic solver, not in custom control code, so that the arrangement is provably deterministic and carries its certification into the SIL verification calculation, where the voting topology, the per-component failure rates, the diagnostic coverage, and the proof-test interval together produce the probability of failure on demand. Degraded-mode voting such as 1oo2D re-architects on a detected sensor fault to keep the safety function available while a failed transmitter is repaired. On the drawing and in the cause-and-effect matrix the voting is named alongside the instruments it governs, and it has to match the safety requirement specification exactly.