2oo2D Architecture

The 2oo2D architecture will fail with outputs energized if either unit has a dangerous undetected failure or if the system experiences a dangerous undetected common cause failure. This is shown in the fault tree of Figure F-27. 

Figure F-28 shows that a 2oo2D architecture wiU fail safely only if both units fail safely. This can happen due to common cause failures SDC, SUC, or DDC, or if A and B fail safely.

The 2oo2D architecture shows good tolerance to both "safe" and "dangerous" failures. However, since coverage is utilized to convert dangerous failures into safe failures, this tolerance depends in great part... 

Table F-12. Results from the 2oo2D Architecture Calculations...

In architectures with diagnostics control output switches (loolD, 2oo2D and loo2D), it is assumed that detected failures will automatically de-energize outputs (automatic shutdown). 

---