A temperature measurement in a safety function carries two obligations: be right, and prove you are right. A single transmitter can fail silently — drift away, corrode open, freeze on a stale value — and the safety logic never knows. The RTT80 class answers with dual channels in hot-backup architecture: two sensing paths on one duty, SIL 2/3 capability, and diagnostics that catch drift and corrosion before they become fiction.
What hot-backup means in practice
Both channels measure continuously; the output feeds from the active path while the backup tracks it. Discrepancy between the two is a diagnostic event — not a trip, not a silent failure, but a maintenance call placed by the instrument itself. When one channel degrades, the other has already been carrying the truth, and the proof-test story shortens because the redundancy is verified live, not annually on a bench.
Drift and corrosion diagnostics: the honest extras
Thermowell corrosion and sensor drift are the classic slow failures of temperature duty — the measurement keeps displaying while its truth decays. The RTT80-class diagnostics watch the signatures: sensor resistance trends, loop behavior, the patterns that precede failure. In SIL terms, that diagnostic coverage is what the rating is made of; in plant terms, it is the difference between scheduled replacement and surprise outage.
The decision rule
Temperature inputs inside a safety-instrumented function, or process points where a silent failure is expensive — reactor temperature, exotherm monitoring, trip-initiating duties — earn the dual-channel class. Ordinary monitoring points stay honestly on single transmitters. The instrument lands in the plant's temperature transmitter layer with its diagnostics reporting upward like any smart device.
Does dual-channel mean two thermowells?
Not necessarily — dual elements can share one assembly where the duty allows, but separate wells are the conservative answer for mechanical-independence arguments. The SIL study decides how much independence the function's architecture requires.
Is SIL 2 enough or do I need SIL 3?
The safety study answers, not the catalog — the instrument contributes its capability and its failure rates to the loop calculation. Buying capability the loop cannot use is budget theater; underselling a loop that needs more is the real risk.
