2-out-of-3 voting: why plants use three sensors, and what goes wrong when one lies

In one minute

• Voting uses more than one sensor so that one bad sensor cannot cause a false trip or hide a real one.
• 1oo1 is one sensor deciding alone. 1oo2 trips if either of two agrees. 2oo3 trips when at least two of three agree.
• A spurious trip is a shutdown that should not have happened. A missed trip is a shutdown that should have happened and did not.
• A voted function can quietly collapse to a single sensor when two legs fail, and a plant may not notice.
• A plain voting block tells you two of three agree, but throws away which sensor is the odd one out. That is the half worth keeping.

Who this is for

This guide is for engineers and technicians who work with safety instrumented functions, redundant transmitters, and voted trips. If you have ever specified a 2oo3 trip or chased a spurious shutdown back to one drifting transmitter, this is your territory.

Why one sensor is not enough

Put one sensor in charge of a trip and you have a problem either way it fails. If the sensor fails and reads high, you get a shutdown nobody wanted. If it fails and reads low, the trip never comes when it is needed. One sensor cannot protect you from its own failure.

So plants use more than one. The arrangement is written as a vote.

• 1oo1 means one sensor out of one. It decides alone. Simple, and exposed to its own failure in both directions.
• 1oo2 means trip if either one of two sensors says so. This catches a missed trip well, because it only takes one sensor to act. But it doubles the chance of a spurious trip, because either sensor failing high causes a shutdown.
• 2oo3 means trip when at least two of three sensors agree. This is the balanced choice, and it is the canonical arrangement across the process industry.

With three sensors and a 2-of-3 rule, one failed sensor cannot do much harm on its own. If one sensor fails high, the other two outvote it and no spurious trip happens. If one sensor fails low, the other two can still reach the two votes a trip needs. One lie is tolerated. That is the point of three.

Two ways a trip goes wrong

Every trip has two failure directions, and they pull against each other.

A spurious trip is a shutdown that should not have happened. It costs money, upsets the process, and worst of all it teaches operators that the safety system cries wolf. Over time people work around a system that trips for no reason.

A missed trip is the dangerous one. The condition that should have caused a shutdown occurred, and nothing stopped. This is what a safety function exists to prevent.

1oo1 is exposed to both. 1oo2 cuts missed trips but raises spurious trips. 2oo3 is the arrangement that holds both down at once, which is why it is so common. The quorum rulebook for this case cites its source as IEC 61511 and ISA-TR84.00.02, a 2-out-of-three voted high-level trip. That is the only standards reference this guide makes, and it is the one the rulebook itself makes.

How quorum writes the trip

quorum ships a worked voting rulebook, casebook/vote/vote.cb, for a vessel high-level trip with three independent level transmitters. The three readings are the three transmitters:

observe lt_a_high "transmitter A reads above the trip setpoint"
observe lt_b_high "transmitter B reads above the trip setpoint"
observe lt_c_high "transmitter C reads above the trip setpoint"

The trip condition is 2-of-3, written as the three possible agreeing pairs, then the claim that fires if any pair agrees:

claim pair_ab "A and B both above setpoint" needs lt_a_high lt_b_high
claim pair_ac "A and C both above setpoint" needs lt_a_high lt_c_high
claim pair_bc "B and C both above setpoint" needs lt_b_high lt_c_high

claim level_high_voted "at least two of three transmitters are above the trip setpoint" severity 9
  when any pair_ab pair_ac pair_bc

The trip action then fires on that claim, and it is marked safe, because the fallback for a vessel that can overflow is to stop filling:

action trip safe when any level_high_voted vote_collapsed

The half a PLC throws away

A PLC does 2oo3 in a handful of rungs. It will tell you that two of three agree. What it will not tell you is which transmitter is the odd one out, the one to go and calibrate.

quorum keeps that half. This is the reason vote.cb writes the trip as explicit pairs instead of using the shorter vote 2 of form, and its own comments explain the choice carefully. The pairs are needed anyway, a few lines later, to name the dissenting transmitter. "A and B agree and C does not" is a statement about a specific pair. A counting form like vote 2 of abstracts exactly that away.

So the rulebook adds a claim for each way one transmitter can dissent:

claim lt_c_disagrees "transmitter C reads low while A and B both read high" needs pair_ab
lt_c_high rebuts lt_c_disagrees

Read it plainly: if A and B both read high, then C is the suspect, unless C is in fact also reading high, in which case the suspicion is dropped. There is one of these for each transmitter. The result is a rule that does not just trip. It names the leg to go and check.

There is a quieter, more insidious case, and vote.cb handles it too. The comments in the file call it out directly. If one transmitter reads high while the other two read normal, no trip fires, which is correct, because 2oo3 exists to reject exactly that. But then nothing at all happens, and a transmitter that is drifting or has failed high goes unnoticed until it drifts further or a second leg fails and produces a spurious trip. The file names this a hidden failure: the absence of a trip is not evidence that the instruments are healthy. So the rulebook adds a mirror set of claims for a single transmitter deviating high, and a maintenance response that files a proof-test work order against the suspect leg without tripping the plant.

The vote that quietly collapses

Here is the danger that gives this guide its title. A 2oo3 vote is only a 2oo3 vote while all three legs work. Lose one leg and you have 2oo2. Lose two legs and you have 1oo1: a single transmitter deciding alone whether the vessel overflows. That is not the architecture anyone signed off, and the frightening part is that the plant may not notice. The vote looks like it is still voting. It has quietly become a single point of failure.

A transmitter does not have to go obviously dead to remove its leg. The quorum rulebook watches each leg for two failure signs: a frozen value (flatline) and an unavailable channel. Either one means that leg cannot be believed:

claim leg_a_compromised "voting leg A cannot be believed" when any lt_a_flatline lt_a_unavailable

There is one per leg. Then the collapse claim fires when at least two of the three legs are compromised:

claim vote_collapsed "two legs are compromised; one transmitter is now deciding alone" severity 10
  vote 2 of leg_a_compromised leg_b_compromised leg_c_compromised

Notice the severity. The ordinary voted trip is severity 9. The collapsed vote is severity 10, so a collapsed vote outranks a normal trip decision. The rulebook's reasoning, from its own comments, is that if the architecture is gone, stopping is not a judgement call.

The comments in vote.cb also record a mistake worth knowing about, because it is easy to make. An earlier version of the collapse rule read like "two legs compromised" but actually meant "at least one leg frozen and at least one leg blind". That is a different predicate. It under-fired when two legs failed the same way, such as two frozen transmitters, so the collapse was never caught, which is the dangerous direction. This exact trap, where "at least two of these three" written by hand comes out wrong, is why quorum added the vote 2 of counting form. The quorum language guide (casebook/LANGUAGE.md) documents it, and the compiler proves the vote 2 of form means the same thing as the hand-written pairs across all 512 states of the rulebook, with no differences in outcome or action.

What the every-situation check found

quorum's compiler, cbc, solves every combination of readings in the voting rulebook. There are nine readings, which is 512 situations, and every one is checked. Running cbc on casebook/vote/vote.cb reports that the worst-case situation is the quiet state, where nothing is asserted, because every closed-world edge is live there. The compiler confirms that no situation selects two actions at once, that every situation selects an action, and that every declared action is reachable. These figures come from running the shipped compiler on the shipped rulebook.

One check in that run matters especially for a voted function: the mirror case, a single transmitter deviating high while the other two read normal, was added after a mechanised check asked, for every reading, what the rulebook does when only that one reading is asserted. A single high transmitter had produced nothing at all. That silence was the hidden failure. The every-situation check is what surfaced it.

What quorum does not do

• quorum does not replace the voting hardware or the sensors. It reasons about three readings; the three independent transmitters, their separate taps and cables, and their wiring are the plant's job.
• It cannot see a failure the instruments cannot report. The frozen-value and unavailable-channel checks only work if the channel can tell quorum it has stopped updating.
• It is not certified for safety-critical use, and no plant runs it. Use it beside your existing safety instrumented function, not instead of it.
• The every-situation check proves the rules are sound. It does not prove each transmitter is wired to the right leg or set to the right trip point. That is a loop check on the real vessel, and no plant has done one yet.

For the basics of interlocks and the safe action, read what an interlock is. For why a dead sensor is so dangerous and how quorum notices it, read dead sensors. The voting rulebook is on GitHub in the quorum repository.