Warning: It is a long story....... 
We have an argument with our end user (customer) regarding the Target SIL Rating for an ESD function. This has a big impact on the ESD system in terms of design if we have to go ahead with the end user's advise.
Case-1:
Transmitter-A (2oo3) is causing a trip on Low Low Flow. Required SIL rating for this ESD function is SIL-3. To reduce the target SIL level, another IPL (Independent Protection Layer) has been added (addition of a 2oo3 Transmitter-XYZ which trips the system on High High temperature, hence a barrier of defense to prevent occurring of Low Low Flow trip).
End user's advise is that, the HH temp transmitter should be considered in a different ESD system all together (different IO card, cabinet, processor, etc).
Case-2:
Transmitter-A (2oo3) is causing a trip on High High Level. Required SIL rating for this ESD function is SIL-3. To reduce the target SIL level, another IPL (Independent Protection Layer) has been added (a new DCS transmitter considering an alarm which alerts the operator on high level of some tank which acts as a defense). As in case of most of the refineries, DCS-ESD communicates through Modbus over TCP/IP.
End user's advise is to consider DCS transmitter in a different controller than what is being used to communicate with ESD.
PS: Our Process Safety engineers dismiss the end user's recommendation saying it is verified to be SIL1 without segregation and no need of complicating the design. But the end user is adamant and asks us to do as per his command saying that if it is an "Independent Protection Layer", everything has to be "independent".
We are procuring a ESD system which is certified as SIL3. When we have considered the probability of failure of Control System already (0.1) in the target SIL analysis, should we still go ahead with the end-user's demands here?
I mean, the ESD system is supposed to be a centralized system for shutting down the plant/critical equipment. Just for 1 or 2 transmitters, how valid is it to consider a different cabinet,processor, field cable etc?? Has anyone experienced a similar situation?