Two-out-of-three voting (2oo3) employs three devices instead of one or two. As a result, this arrangement is the most costly and complex.
In this arrangement, if any two switches vote to cause a shutdown, a shutdown will occur. This arrangement is a little hardware to visualize conceptually because each switch needs to have two contacts, as shown in the figure above.
Essentially, there are three sets of parallel switches in series. While this arrangement does not provide two degrees of fault tolerance in any mode, its advantage is that it provides one degree of tolerance to safe failures and also one degree of tolerance to dangerous failures.
Therefore, if any one switch suffers the dangerous welded-closed failure mode, the other two switches will still be able to move the process to a safe state.
Similarly, if any of the three switches suffers the safe open-circuit failure mode, the other two switches will be able to prevent the entire system from being spuriously energized.
Mathematically, the system operates like three 1oo2 systems for safety and three 2oo2 systems for spurious trip avoidance.
As you can see in the table below, the 2oo3 systems has good performance in comparison with a simplex 1oo1 voting arrangement with respect to both safety and nuisance trip avoidance.
Even so, the PFD of the 2oo3 voting system is 3x higher than the PFD of a 1oo2 system, and the spurious trip rate is 3x higher than for a 2oo2 system.
While the 2oo3 system is the most complex and costly it is still very popular when higher SILs (i.e., SIL 2 and SIL 3) need to be achieved, but the plant cannot tolerate the high spurious trip rate associated with 1oo2 voting.