Redundancy Architectures
Redundancy uses multiple channels so a single failure does not defeat a function; the architecture chosen trades availability against safe-fault detection.
More Than One Way to Be Right
Redundancy provides more than one means of performing a function so that the failure of any one does not cause the whole to fail. It is the primary tool for achieving high reliability and high safety integrity. The specific arrangement, how many channels there are and how their outputs are combined, determines what kinds of failure the system survives.
Common Voting Architectures
- 1oo1: one channel, no redundancy; a single failure defeats the function
- 1oo2: two channels, either can act; tolerant of one dangerous failure but prone to spurious trips
- 2oo2: both must agree to act; avoids spurious trips but a single failure can prevent action
- 2oo3: triple modular redundancy with majority vote; tolerates one failure while resisting spurious trips
The Availability-Versus-Safety Trade
Architectures differ in which failure they favor. A 1oo2 arrangement trips if either channel calls for it, maximizing the chance of protecting against a real hazard but also increasing nuisance trips. A 2oo2 arrangement acts only if both agree, minimizing spurious trips but risking a missed real hazard. Triple-redundant 2oo3 voting balances both: the majority carries the decision, so one failed channel neither causes a false trip nor prevents a true one.
Common-Cause Failure
Redundancy only helps against independent failures. If all channels share a weakness, a common design flaw, a shared power supply, the same environmental stress, one event can fail them together and the redundancy is illusory. Guarding against common-cause failure uses diversity: different designs, different technologies, physical and electrical separation, so that no single cause can take down all channels.
Redundancy in Practice
The right architecture depends on whether the function is protective, where missing a real demand is the danger, or availability-critical, where spurious action is costly. Safety functions often favor architectures that ensure the protective action happens; continuous control favors architectures that avoid unnecessary shutdowns. Complex facilities mix both, applying redundancy where an analysis shows it is needed and pairing it with fault-tolerant failover so operation continues through single faults.