When determining the values for SIS points, aren’t the two-out-of-three and two-out-of-two safety levels the same?

It seems that two-out-of-two doesn’t have a higher security level than three-out-of-two. The specifications only state that redundancy should be employed for SIL2 levels, and that it is necessary to use redundancy for SIL3 levels. The recommendation is to choose two out of three.

But logically speaking, there doesn’t seem to be much difference

The thinking behind it shouldn’t differ much, right? With two-out-of-two, if one fails, it might never be able to interlock again; whereas with three-out-of-two, isn’t there obviously an extra redundancy point?

Three-out-of-two is more secure than two-out-of-two; two-out-of-two focuses on availability, while three-out-of-two offers both high security and high availability

1. 3-out-of-2 means that when performing normal functions, a decision is made once 2 channels agree, thereby enabling the corresponding function to be carried out. 2. When 2 out of 2 fingers are used to perform normal functions, both channels must agree in their decision before the corresponding function can be carried out. Assume that the system uses the same device A to construct a 3-out-of-2 system and a 2-out-of-2 system. If the hazard failure rate of A is 0.1, then the hazardous failure combinations for the 3-out-of-2 system are: all 3 devices failing, or any 2 devices failing while the third one does not fail. In this case, the Hazard Rate = 0.1*0.1*0.1 + 0.1*0.1*0.9*3 = 0.028. The hazardous failure combination for the 2-out-of-2 system is: both devices failing, and the Hazard Rate in this case is 0.1*0.1 = 0.01. It is clear that the 2-out-of-2 system is safer than the 3-out-of-2 system. SIS uses 3 out of 2 to ensure system security while also taking into account system availability. On railways, 2 by 2 sampling is now more often used in place of 3 by 2 sampling, which provides better safety and reliability. Of course, the cost is higher than that of 3-out-of-2 due to an additional set of equipment, but in reality the design is simpler than that of 3-out-of-2.

Personally, I believe that a three-out-of-two system is more secure than a two-out-of-two system, for the following reasons: The SIS system is fail-safe, and logically it operates on inverse logic, that is, 0 triggers interlocks. 2oo2 refers to a parallel circuit; using A and B as indicators, if either A or B fails and becomes 1, the interlock will never be triggered. It is generally recommended that when a failure in A or B is detected, 2oo2 should change to 1oo1. If 2003 is represented by A, B, and C, it refers to A&B in series, A&C in series, and B&C in series, with these three combinations then connected in parallel. Even if any one of A/B/C fails and becomes 1, interlocked shutdown can still be ensured. It is generally recommended that when a fault is detected in A/B/C, 2oo3 should be changed to 1oo2.

Personally, I believe that a three-out-of-two system is more secure than a two-out-of-two system, for the following reasons: The SIS system is fail-safe, and logically it operates on inverse logic, that is, 0 triggers interlocks. 2oo2 refers to a parallel circuit; using A and B as indicators, if either A or B fails and becomes 1, the interlock will never be triggered. It is generally recommended that when a failure in A or B is detected, 2oo2 should change to 1oo1. If 2003 is represented by A, B, and C, it refers to A&B in series, A&C in series, and B&C in series, with these three combinations then connected in parallel. Even if any one of A/B/C fails and becomes 1, interlocked shutdown can still be ensured. It is generally recommended that when a fault is detected in A/B/C, 2oo3 should be changed to 1oo2. Agree with this view

From a safety perspective, three-out-of-two and two-out-of-two should be the same; the only difference is that since it is already known today that there are abnormalities in the sequential signal points, it is possible to bypass those abnormal points, which provides more flexibility in operations