ToolFusion Chemical
ToolFusion Chemical
πŸŽ“ Lesson 16 D5

SIS Architecture Selection: 1oo2 vs. 2oo3 Voting Logic

1oo2 means 'one out of two' β€” the system trips if *any one* of two sensors fails or detects danger; 2oo3 means 'two out of three' β€” it only trips if *at least two* of three sensors agree there’s a hazard.

🎯 Learning Objectives

  • βœ“ Explain the trade-offs between safety integrity and availability for 1oo2 and 2oo3 voting logic
  • βœ“ Calculate hardware fault tolerance (HFT) and safe failure fraction (SFF) implications for each architecture
  • βœ“ Analyze PFDavg (average probability of failure on demand) for 1oo2 vs. 2oo3 configurations using simplified reliability models
  • βœ“ Design a sensor subsystem architecture aligned with target SIL requirements per IEC 61511

πŸ“– Why This Matters

In mining and blasting operations, SIS shutdowns must be *reliably safe* β€” but false trips can halt production, damage equipment, or trigger hazardous unloading sequences. Choosing between 1oo2 and 2oo3 isn’t academic: it directly impacts whether your blast initiation system meets SIL 2 for overpressure protection in a detonator magazine, or SIL 3 for runaway conveyor shutdown near explosives storage. A wrong choice could mean failing an HAZOP audit β€” or worse, permitting a hazardous event due to undetected common-cause failure.

πŸ“˜ Core Principles

Voting logic defines how redundant sensors and logic solvers interpret inputs to decide whether to initiate a safety action. 1oo2 uses two identical channels; a fault in *either* channel causes immediate trip β€” high availability is sacrificed for simplicity and fast response. 2oo3 requires agreement from β‰₯2 of 3 independent channels: it tolerates one random hardware fault without spurious trip (HFT = 1), supports diagnostics, and reduces common-cause vulnerability when combined with diversity (e.g., different sensor technologies, vendors, or installation paths). The choice depends on required SIL, proof test coverage, common-cause failure mitigation, and operational risk tolerance β€” not just component reliability.

πŸ“ PFDavg Comparison for Voting Architectures

For identical, independently failing components with constant failure rates, PFDavg approximates the average probability that the SIS fails *to act* when demanded. Simplified formulas assume perfect diagnostics and no common cause; real-world values require beta-factor modeling per IEC 61508 Annex B.

πŸ’‘ Worked Example

Problem: Given: sensor Ξ»DU = 1.5 Γ— 10⁻⁴ /hr, proof test interval T = 4380 hr (6 months), diagnostic coverage DC = 90%, Ξ² (common cause factor) = 0.05. Compare PFDavg for 1oo2 and 2oo3 architectures.
1. Step 1: Compute safe detected failure rate: Ξ»DU_detected = Ξ»DU Γ— DC = 1.5e-4 Γ— 0.9 = 1.35e-4 /hr
2. Step 2: Compute safe undetected failure rate: Ξ»DU_undetected = Ξ»DU Γ— (1βˆ’DC) = 1.5e-4 Γ— 0.1 = 1.5e-5 /hr
3. Step 3: For 1oo2: PFDavg β‰ˆ 0.5 Γ— Ξ»DU_undetected Γ— T = 0.5 Γ— 1.5e-5 Γ— 4380 = 0.03285
4. Step 4: For 2oo3: PFDavg β‰ˆ (3/4) Γ— (Ξ»DU_undetected Γ— T)Β² + Ξ² Γ— Ξ»DU_undetected Γ— T = (0.75) Γ— (0.0657)Β² + 0.05 Γ— 0.0657 β‰ˆ 0.00323 + 0.00329 = 0.00652
5. Step 5: Compare: 1oo2 PFDavg β‰ˆ 3.3Γ—10⁻² β†’ SIL 1; 2oo3 PFDavg β‰ˆ 6.5Γ—10⁻³ β†’ SIL 2 (since SIL 2 requires PFDavg ∈ [10⁻³, 10⁻²))
Answer: The 2oo3 architecture achieves PFDavg β‰ˆ 6.5Γ—10⁻³ β€” comfortably within SIL 2 β€” while 1oo2 yields 3.3Γ—10⁻², limiting it to SIL 1 under these conditions.

πŸ—οΈ Real-World Application

At Newmont’s Boddington Gold Mine (Western Australia), the SIS for the high-pressure air receiver supplying blasthole drilling rigs uses 2oo3 pressure transmitters (Rosemount 3051S with diverse mounting, cabling, and calibration schedules) feeding into a SIL 3-certified Triconex logic solver. This was selected after LOPA confirmed a credible scenario β€” receiver rupture due to overpressure β€” had a consequence severity requiring SIL 2 minimum. A 1oo2 design failed the PFDavg target during verification due to insufficient margin against common-cause failures (e.g., shared power supply fault), prompting redesign to 2oo3 with segregated power and routed cables β€” achieving PFDavg = 4.2Γ—10⁻³ and passing third-party certification per IEC 61511 Ed. 2.

πŸ“‹ Case Connection

πŸ“‹ Ammonia Refrigeration System PHA & LOPA Integration at Midwest Food Plant

Outdated PHA documentation; no SIL verification for emergency shutdown valves

πŸ“‹ Polymer Reactor Runaway Reaction Mitigation via SIS Redundancy Upgrade

Single-point failure in temperature trip logic led to near-miss runaway event

πŸ“š References

πŸ“„ IEC 61511-1:2022 Functional safety β€” Safety instrumented systems for the process industry sector β€” Part 1: Framework, definitions, system, hardware and application programming requirements
πŸ“„ IEC 61508-2:2010 Functional safety of electrical/electronic/programmable electronic safety-related systems β€” Part 2: Requirements for electrical/electronic/programmable electronic safety-related systems
πŸ“„ Guidelines for Safe Automation of Chemical Processes
← Previous Lesson
SIL Determination Using LOPA & Fault Tre...
Next Lesson β†’
QRA Fundamentals: Dispersion Modeling &...