Choosing a Safety Architecture

How the three IEC 61508-6 reference architectures differ in fault tolerance, achievable SIL, reliance on diagnostics and spurious-trip behaviour — and what each one asks of your hardware and software.

Channel structure of the 1oo1, 1oo2 and 1oo2D safety architectures under IEC 61508-6: signal path from sensor input through logic to the final element, with diagnostics and de-energised safe state.

Overview

Redundancy architectures are named “MooN”: M out of N channels must demand the safety function for it to take place. IEC 61508-6 Annex B describes the reference architectures used to model hardware safety integrity. This page compares the three most common ones for embedded safety controllers.

1oo1 is a single channel. 1oo2 has two channels, either of which can trip. 1oo2D has two channels with diagnostic voting: they act together in normal operation and fall back to the healthy channel when a fault is detected.

The right choice depends on your target SIL, the safe failure fraction (SFF) your hardware can reach, the cost of a spurious trip, and your strategy against common-cause failure.

Each subsystem stands on its own. Sensor, logic and final element must independently meet both the architectural constraints and their share of the PFD/PFH budget. The function’s SIL is capped by the weakest link: a 1oo2 logic solver behind a single sensor is not a SIL 3 function.

Pattern comparison matrix

Aspect1oo11oo21oo2D
Hardware fault tolerance (HFT)011, as commonly claimed *
Max SIL, Type B element, Route 1HSFF < 60 %: not allowed
60 to < 90 %: SIL 1
90 to < 99 %: SIL 2
≥ 99 %: SIL 3		SFF < 60 %: SIL 1
60 to < 90 %: SIL 2
90 to < 99 %: SIL 3
≥ 99 %: SIL 4		As 1oo2, if HFT 1 is accepted
Dependence on diagnosticsHigh. Diagnostics raise SFF and turn detected faults into a safe state, but add no fault tolerance.Moderate for fault tolerance — it does not rely on diagnostics. But the SIL ceiling still runs through SFF: SIL 3 at HFT 1 needs SFF ≥ 90 %, which on a Type B MCU demands serious diagnostic coverage. Diagnostics don’t change the voting; they still gate the achievable SIL.Essential. Diagnostics decide the voting mode, so their coverage and speed govern both safety and availability.
Spurious tripsA safe failure of the channel trips the process.Higher than 1oo1, roughly double for identical channels: a safe failure in either channel trips.Lower than 1oo2. Both channels must demand the trip, and a detected fault leads to degraded operation instead of a trip.
Common-cause failureNot applicable (no redundancy).Quantified with a β-factor (IEC 61508-6 Annex D); reduced by separation, diversity and other measures. Note that two channels running identical software give no protection against a software fault: homogeneous redundancy addresses random hardware failures, not systematic ones. Only diversity (toolchain, algorithm, or independent implementation) reduces software common-cause.As 1oo2. The cross-channel monitoring must also be independent of the channel it monitors.
Software complexityLowestModerate: synchronisation, cross-monitoring, discrepancy handlingHighest: fault allocation, voting reconfiguration, degraded-mode and re-integration logic

Architectural constraints are one of three criteria for a SIL claim, alongside the PFD/PFH target and systematic capability. Microcontrollers are Type B elements. Route 2H, an alternative based on field reliability data, is not shown.

* A strict reading of IEC 61508-2 §7.4.4.1.1 leads some experts to classify 1oo2D as HFT 0. Agree the claim with your assessor early.

The three architectures in detail

1oo1 — single channel (HFT 0)

One channel (input, logic, output) performs the safety function, so a single dangerous failure causes its loss. On-line diagnostics such as a watchdog, memory tests or output read-back can detect faults and drive the output to the safe state. When they act through an independent switch-off path, the design is often called 1oo1D.

Advantages

  • simplest hardware and software, and the easiest to analyse and certify
  • lowest component count
  • well suited when the target SIL is reachable with HFT 0

Disadvantages

  • no fault tolerance
  • for microcontroller-based hardware, SIL 2 needs an SFF of at least 90 % and SIL 3 at least 99 % (Route 1H)
  • any safe failure trips the process

Typical use cases: SIL 1 and SIL 2 machinery and process functions with a modest risk-reduction requirement; protection functions in industrial equipment; smart field devices later combined into redundant arrangements at system level.

1oo2 — one out of two (HFT 1)

Two channels run in parallel and either can perform the safety function. With de-energise-to-trip outputs, each channel drives its own switch-off element and the two are wired in series, so either one opening removes power. The function is lost only if both channels fail dangerously. Cross-comparison between channels is a diagnostic: it reports faults but is not part of the switch-off path.

Advantages

  • tolerates one dangerous hardware fault
  • under Route 1H, allows one SIL higher than 1oo1 for the same SFF
  • much lower PFD/PFH than a single channel, provided common-cause failures are controlled

Disadvantages

  • a safe failure in either channel trips the process, so spurious trips roughly double compared with 1oo1
  • common-cause failures limit the benefit and must be quantified
  • more hardware, and more software for synchronisation, cross-monitoring and discrepancy handling

Typical use cases: SIL 3 process safety functions such as emergency shutdown, burner management and high-integrity pressure protection; two-channel machinery functions such as emergency stop and safe torque off; controllers where safety takes priority over availability.

1oo2D — one out of two with diagnostics (HFT 1 *)

As defined in IEC 61508-6, two channels are connected in parallel. In normal operation both must demand the safety function before it takes place. If the diagnostics in either channel detect a fault, the output voting adapts so the output follows the healthy channel, and the system runs as 1oo1 until repair. If both channels show faults, or a discrepancy cannot be allocated to either channel, the output goes to the safe state. Each channel can read the other’s state through a means independent of that channel.

The “D” stands for diagnostics, not diversity. Some manufacturers use “1oo2D” for other schemes, so always check the vendor’s definition.

Advantages

  • combines fault tolerance with high availability
  • a single safe failure does not trip the process
  • a detected fault leads to degraded operation instead of a shutdown

Disadvantages

  • safety depends heavily on diagnostic coverage, diagnostic test interval and the reliability of the switch-over
  • IEC 61508-6 worked examples show a PFH better than 1oo1 but not as low as 1oo2
  • the HFT 1 claim may be challenged by an assessor
  • the most complex of the three to design, verify and assess

Typical use cases: continuous processes and machines where a spurious trip is costly or itself hazardous; safety PLCs and logic solvers designed for high availability; applications that must keep running in degraded mode for a defined repair time.

Summary

1oo1

Best for: lower-SIL functions, or high-SFF single-channel designs where simplicity matters.

Key trade-off: no fault tolerance; every safe failure is a trip.

1oo2

Best for: the highest safety integrity from two channels, such as SIL 3.

Key trade-off: roughly double the spurious trips of 1oo1; common-cause failure must be controlled.

1oo2D

Best for: high safety together with high availability.

Key trade-off: safety depends on diagnostic quality and switch-over; highest complexity; HFT claim to agree.

Choose the simplest architecture that meets your SIL requirement and your availability expectation. Related architectures worth knowing: 1oo1D, a single channel plus an independent diagnostic switch-off; and 2oo3, three channels where two must agree, tolerating one dangerous and one safe failure.

Recommended courses

Go deeper on the standard that governs the architecture you choose with our functional-safety training:

Regulatory and certification landscape

StandardHow it relates to redundancy architectures
IEC 61508 (2010)Generic functional safety standard. Part 2 sets the architectural constraints (HFT, SFF, Routes 1H and 2H); Part 6 gives the reference MooN architectures, PFD/PFH formulas and the β-factor method. It does not mandate a particular architecture.
EN IEC 62061:2021Machinery standard derived from IEC 61508, covering SIL 1 to 3. Applies HFT, diagnostic and common-cause concepts to machine control systems.
EN ISO 13849-1:2023Machinery standard based on Performance Levels (PL a to e) and designated architectures (Categories B, 1, 2, 3 and 4). Categories 3 and 4 are two-channel, with a minimum common-cause score of 65 points.
Regulation (EU) 2023/1230Applies from 20 January 2027. Sets outcome-based requirements (Annex III §1.2.1) without prescribing an architecture. Presumption of conformity comes from harmonised standards; EN ISO 13849-1 and EN IEC 62061 are the expected references.
ISO 26262 (2018)Automotive; uses ASIL, not SIL. Hardware metrics (SPFM, LFM, PMHF) are in Part 5; ASIL decomposition across sufficiently independent redundant elements is in Part 9, Clause 5.
EN 50129:2018Railway signalling. Describes composite, reactive and inherent fail-safety and allows them to be combined. No architecture is mandated, though 2oo2-based composite designs are common at SIL 4.

Frequently Asked Questions

Can I upgrade from 1oo1 to 1oo2 later?

Yes, if you plan for it from the start. The upgrade adds a second channel with its own inputs, processing and independent switch-off path, plus cross-channel diagnostics and discrepancy handling in the software. Hardware partitioning, connectors, power supplies and the software architecture should anticipate that second channel.

The safety case must then be redone: FMEDA and SFF, PFD/PFH including the common-cause beta-factor, systematic capability, and verification and validation. The spurious trip rate also rises, which must be acceptable for the application.

Can I upgrade from 1oo2 to 1oo2D later?

Only with significant rework, because 1oo2D is a different voting concept, not "1oo2 plus more diagnostics". You need per-channel diagnostics good enough to allocate a fault to a channel, an independent way for each channel to read the other's state, output circuitry that can switch from 2oo2 voting to single-channel operation, and software to manage degraded mode.

Because normal operation becomes 2oo2, you must show again that the safety targets are met, including switch-over efficiency and diagnostic test times, and agree the HFT claim with your assessor. If high availability is a likely requirement, design for 1oo2D from the start.

How much does diversity actually help?

Diversity reduces common-cause failures, which often dominate the residual risk of any redundant architecture, whether 1oo2, 1oo2D or 2oo3. It is one of several measures scored in IEC 61508-6 Annex D, alongside physical separation, design maturity, analysis and field feedback, procedures, competence and environmental control. The scoring gives a beta-factor between 0.5 % and 5 % for logic subsystems, and between 1 % and 10 % for sensors and final elements.

Diversity earns significant points but is not mandatory, and it can add complexity and new failure modes. It does not remove shared causes such as common power, environment or maintenance errors. Field data (SINTEF report A26922) put typical beta-factors for redundant sensors and valves at 12 to 15 %, so justify your value conservatively.

What happens if 1oo2 channels disagree?

In a true 1oo2 architecture the output goes to the safe state whenever either channel demands it, so a disagreement cannot prevent a trip. Cross-channel comparison is a diagnostic: when it finds a discrepancy outside a defined tolerance and time window, the system reports the fault and normally goes to, or stays in, the safe state within the diagnostic test interval assumed in the safety analysis.

In 1oo2D, a discrepancy the diagnostics can allocate to one channel leads to degraded operation on the other channel; one that cannot be allocated leads to the safe state.

Is 1oo2D overkill for my application?

Often, yes. 1oo2D pays off when spurious trips are expensive or hazardous and the process must keep running through a single fault. If your target SIL can be met with 1oo1 (or 1oo1D) and adequate SFF, or with 1oo2, and occasional spurious trips are acceptable, the extra diagnostic, voting and verification effort is rarely justified. Consider 2oo3 too: it offers a similar balance of safety and availability through majority voting rather than diagnostic reconfiguration.

Can I use COTS safety controllers for 1oo2 or 1oo2D?

Yes. Certified safety PLCs and logic solvers are available in 1oo2, 2oo2, 1oo2D and 2oo3 configurations. The manufacturer's safety manual defines the architecture, HFT, failure rates, diagnostic intervals and conditions of use. Check the vendor's definition of "1oo2D", which may differ from IEC 61508-6. The controller is only the logic subsystem: sensors and final elements must also meet the architectural and probabilistic requirements of the safety function.

Do I really need 99 % SFF for SIL 3 on a single channel?

Under Route 1H, yes. But reaching 99 % SFF on a complex MCU in 1oo1 is often unrealistic. Route 2H (IEC 61508-2 §7.4.4.3) offers an alternative based on field-reliability / proven-in-use data, with its own minimum HFT requirements per SIL. It can be the realistic path when Route 1H is out of reach — at the cost of the reliability evidence it demands.

Discuss your application

Tell us about your use case and our engineers will help you scope it.

Contact Us