Exercises — Redundancy — TMR (triple modular redundancy), voting logic

What we do: count how many of the three outputs are $1$. Two ones ($M_1,M_3$) and one zero. A majority voter returns the value shared by at least two inputs. Two agree on $1$, so the output is $1$. The lone $0$ from $M_2$ is masked — hidden from the system.

More reliable. Because $R=0.9>0.5$, each module is much more likely to work than to fail, so it is rare that two fail at once. The voter only needs two good modules, so it almost always sees a correct majority. (We prove the number in L2.)

Only (a).

• (b) is false: TMR masks faults, it does not diagnose them — you know someone disagrees, not who (add Watchdog Timers or self-checking pairs for that).
• (c) is false: if two of three go bad, they can outvote the one good module. TMR tolerates exactly one faulty module.

What we do: substitute $R=0.9$ into the master formula. $R^2=0.81,3-2R=3-1.8=1.2$ $R_{\text{TMR}}=0.81\times 1.2=0.972$ Why it matters: the failure probability dropped from $0.1$ (single) to $0.028$ (TMR) — a $3.6\times$ improvement, bought with $3\times$ the hardware.

$R^2=0.9801$, and $3-2R=3-1.98=1.02$. $R_{\text{TMR}}=0.9801\times 1.02=0.999702$ $1-R_{\text{TMR}}=0.000298$ Why this is the headline number: a single module fails with probability $0.01$; TMR fails with probability $\approx 0.0003$ — about $33\times$ safer. The better your base modules, the more dramatically TMR pays off, because two-out-of-three simultaneous failures become astronomically rare.

What we do: look for two equal readings. $850=850\ne 920$. Two agree on $850$, so output $=850$. The $920$ reading is masked — it is the outlier (likely a calibration/bias fault). The system proceeds with the trusted majority value.

$R^2=0.16$, $3-2R=3-0.8=2.2$. $R_{\text{TMR}}=0.16\times 2.2=0.352$ Single module reliability is $0.4$. Since $0.352<0.4$, TMR is worse. Why: when $R<0.5$ each module fails more often than it works, so it is common for two modules to fail together and outvote the one good one. Redundancy amplifies unreliability instead of curing it. The figure below makes this crossover visual.

What we do: set $R_{\text{TMR}}=R$ and solve. $3R^2-2R^3=R$ $2R^3-3R^2+R=0\Rightarrow R(2R^2-3R+1)=0$ Factor the quadratic: $2R^2-3R+1=(2R-1)(R-1)$. $R(2R-1)(R-1)=0\Rightarrow R=0,R=0.5,R=1$ Interpretation: the interesting crossover is $R=0.5$ — exactly the orange dashed line in the figure above. Above it TMR helps ($R_{\text{TMR}}>R$); below it TMR hurts. This is the critical-threshold claim from the parent note, now derived rather than asserted.

First, the key idea: for quantitative (real-valued) outputs, the median is the direct generalization of majority voting. Binary majority picks the value that "most" modules share; when values are continuous and rarely match exactly, the median picks the middle value, which by construction lies with the cluster that at least two modules landed near — the same "trust the majority, discard the lone dissenter" logic, just measured by position instead of exact equality.

Average: $(100+105+1000)/3=1205/3=401.67$ (to 2 dp). The wild $1000$ drags the answer far from the two sane readings. Median: sort to $[100,105,1000]$, take the middle $=105$. The outlier is ignored entirely. Why median wins: the median only cares about ordering, not magnitude, so a single arbitrarily large fault cannot move it beyond one position. The average is a sum, so one huge value poisons it. For fault masking, use the median.

What we do: the output is $1$ iff at least two inputs are $1$. Each pair agreeing on $1$ is an AND term; "any pair" is an OR: $V=M_1{M}_2+M_2{M}_3+M_1{M}_3$ Verify on $(1,0,1)$: $V=(1)(0)+(0)(1)+(1)(1)=0+0+1=1$ Correct — two ones present, so majority is $1$. (Here $+$ is logical OR and juxtaposition is AND.)

What we do: two independent things must both succeed — the majority of modules, and the voter. Independent successes multiply. $R_{\text{sys}}=R_{\text{TMR}}\times R_V=0.972\times 0.999$ $R_{\text{sys}}=0.971028$ Why this matters: the voter is a single point of failure — if it dies, all the module redundancy is worthless. That is exactly why real TMR voters are hardened or themselves triplicated. Notice $R_{\text{sys}}<R_{\text{TMR}}$: the voter can only subtract reliability.

TMR path: $R_{\text{TMR}}=0.8^2(3-1.6)=0.64\times 1.4=0.896$. Better-single path: $R=0.97$ by assumption. Since $0.97>0.896$, the better single module wins here on pure reliability — and it uses $1\times$ hardware and power instead of $3\times$. Nuance: TMR still buys you tolerance to transient faults (cosmic-ray bit-flips) that improving one module cannot, because you cannot screen out a random future event. So the honest answer is: fix base reliability first (parent-note advice), then add TMR for the residual transient risk you can't design away.

State the model first (this is the point of the exercise):

• Common-cause event $A$ fires with $P(A)=c=0.05$ and kills both $M_1$ and $M_2$.
• By assumption $M_1,M_2$ have no other failure route, so if $A$ does not fire, both are healthy.
• $M_3$ fails independently with $P(B)=q=0.1$.

What we do: the majority is lost when two or more modules fail.

• If $A$ fires (prob $0.05$): $M_1$ and $M_2$ are both down → two failures → majority already lost, regardless of $M_3$.
• If $A$ does not fire (prob $0.95$): under our stated assumption $M_1,M_2$ are healthy, so at most $M_3$ is down — only one failure → majority survives.

Therefore majority is lost iff $A$ fires: $P(\text{lose majority})=P(A)=0.05$ The lesson: a $5\%$ common-cause coupling completely dominates the design — it single-handedly caps reliability at $0.95$, no matter how good the independent failure rate is (had we included small independent failures for $M_1,M_2$, the answer would rise only slightly above $0.05$, so the conclusion is robust). This is why Common-Cause Failures and Redundancy vs. Diversity matter: identical triplicated modules share identical flaws. Real safety systems use diverse implementations to break the correlation.

What we do: sum the binomial probabilities for "3 work", "4 work", "5 work" out of $5$, with $R=0.9$, $1-R=0.1$. $P(5)=R^5=0.59049$ $P(4)=\left(\genfrac{}{}{0ex}{}{5}{4}\right)R^4(1-R)=5(0.6561)(0.1)=0.32805$ $P(3)=\left(\genfrac{}{}{0ex}{}{5}{3}\right)R^3(1-R{)}^2=10(0.729)(0.01)=0.0729$ $R_{\text{5MR}}=0.59049+0.32805+0.0729=0.99144$ Recall $R_{\text{TMR}}=0.972$. So 5MR pushes failure probability from $0.028$ down to $\approx 0.0086$ — roughly $3\times$ safer, at the cost of $5\times$ hardware and a voter that tolerates two faults instead of one. Diminishing returns: doubling hardware from 3 to 5 did not double the safety margin.

From Exercise 2.2, $R_{\text{TMR}}=0.999702$, so $1-R_{\text{TMR}}=0.000298$ Requirement is $<0.0001$. Since $0.000298>0.0001$, plain TMR does NOT meet it — it misses by roughly $3\times$. What to change (in order of leverage):

1. Raise base $R$: even a modest improvement is cubed-ish in effect. Try $R=0.999$: $R_{\text{TMR}}=0.999^2(3-1.998)=0.998001\times 1.002=0.999997\dots$, failure $\approx 3\times 10^{-6}$ — easily passes.
2. Go to 5MR (Ex. 5.2 style) if you cannot improve modules.
3. Do not ignore the voter and common-cause terms — those, per Ex. 4.2 and 5.1, can dominate and silently blow the budget. Always fold them in before certifying against Safety-Critical Systems Standards.

The TMR crossover reliability below which redundancy hurts ::: $R=0.5$ The majority-gate Boolean expression ::: $V=M_1{M}_2+M_2{M}_3+M_1{M}_3$ Why median beats average as an analog voter ::: median ignores gross outliers; average is poisoned by them The component that is a single point of failure in TMR ::: the voter $V$ What caps reliability regardless of module count ::: common-cause (correlated) failures