Redundancy — TMR (triple modular redundancy), voting logic: Exercises

5.5.25 · D4 · Coding › Embedded Systems & Real-Time Software › Redundancy — TMR (triple modular redundancy), voting logic

Yeh page ek self-testing ladder hai. Har problem clearly diya gaya hai, phir ek collapsible Solution callout ke peeche chhupa hua hai — pehle khud try karo, tab reveal karo. Hum recognising se shuru karte hain ki TMR kya hai (L1), aur mastering tak jaate hain — reliability trade-offs aur voter design (L5). Yahan sab kuch parent TMR note pe based hai — agar koi symbol unfamiliar lage, woh wahan define kiya gaya tha, aur hum use neeche re-anchor karte hain jab zarurat ho.

Do symbols jo shuru karne se pehle clearly yaad hone chahiye:

Woh master formula jis par hum baar baar lean karte hain:

Level 1 — Recognition

Exercise 1.1

Teen modules binary values $M_{1} = 1$ , $M_{2} = 0$ , $M_{3} = 1$ output karte hain. Majority voter kya output karega?

Recall Solution

Hum kya karte hain: count karo ki teen outputs mein kitne $1$ hain. Do ones ( $M_{1}, M_{3}$ ) aur ek zero. Majority voter woh value return karta hai jo kam se kam do inputs share karte hain. Do $1$ par agree karte hain, isliye output $1$ hai. $M_{2}$ ka akela $0$ mask ho jaata hai — system se chhup jaata hai.

Exercise 1.2

Ek single module ki reliability $R = 0.9$ hai. Bina kisi formula ke, kya teen aise modules se bana TMR system ek module se zyada ya kam reliable hoga? Ek-line ka reason do.

Recall Solution

Zyada reliable. Kyunki $R = 0.9 > 0.5$ hai, har module ke fail hone se zyada chances hain ki woh kaam kare, isliye do ka ek saath fail hona rare hai. Voter ko sirf do good modules chahiye, toh woh almost always correct majority dekhta hai. (Number L2 mein prove karte hain.)

Exercise 1.3

Inme se TMR kya kar sakta hai? (a) ek faulty module ko mask karna, (b) batana ki kaun sa module fail hua, (c) do simultaneous faulty modules tolerate karna.

Recall Solution

Sirf (a).

(b) galat hai: TMR faults ko mask karta hai, diagnose nahi karta — tum jaante ho ki koi disagree kar raha hai, par kaun nahi (uske liye Watchdog Timers ya self-checking pairs add karo).
(c) galat hai: agar teen mein se do kharab ho jaayein, toh woh ek sahi module ko outvote kar sakte hain. TMR exactly ek faulty module tolerate karta hai.

Level 2 — Application

Exercise 2.1

Har module ki $R = 0.9$ hai. $R^{2} (3 - 2 R)$ use karke $R_{TMR}$ compute karo.

Recall Solution

Hum kya karte hain: $R = 0.9$ ko master formula mein substitute karo. $R^{2} = 0.81, 3 - 2 R = 3 - 1.8 = 1.2$ $R_{TMR} = 0.81 \times 1.2 = 0.972$ Kyun matter karta hai: failure probability $0.1$ (single) se gir kar $0.028$ (TMR) ho gayi — $3.6 \times$ improvement, $3 \times$ hardware ke cost par.

Exercise 2.2

Har module ki $R = 0.99$ hai. TMR failure probability $1 - R_{TMR}$ kya hai?

Recall Solution

$R^{2} = 0.9801$ , aur $3 - 2 R = 3 - 1.98 = 1.02$ . $R_{TMR} = 0.9801 \times 1.02 = 0.999702$ $1 - R_{TMR} = 0.000298$ Kyun yeh headline number hai: ek single module probability $0.01$ se fail hota hai; TMR probability $\approx 0.0003$ se fail hota hai — lagbhag $33 \times$ safer. Jitne better base modules, utna dramatically TMR pay off karta hai, kyunki two-out-of-three simultaneous failures astronomically rare ho jaate hain.

Exercise 2.3

Teen temperature sensors $850$ , $850$ , $920$ read karte hain. Exact majority voting apply karo. Output kya hai, aur kaun si reading mask hoti hai?

Recall Solution

Hum kya karte hain: do equal readings dhundho. $850 = 850 \neq = 920$ . Do $850$ par agree karte hain, isliye output $= 850$ . $920$ reading mask ho jaati hai — yeh outlier hai (likely ek calibration/bias fault). System trusted majority value ke saath aage badhta hai.

Level 3 — Analysis

Exercise 3.1

Har module ki $R = 0.4$ hai. $R_{TMR}$ compute karo aur single module se compare karo. Difference ka sign explain karo.

Recall Solution

$R^{2} = 0.16$ , $3 - 2 R = 3 - 0.8 = 2.2$ . $R_{TMR} = 0.16 \times 2.2 = 0.352$ Single module reliability $0.4$ hai. Kyunki $0.352 < 0.4$ hai, TMR worse hai. Kyun: jab $R < 0.5$ hota hai, har module kaam karne se zyada fail karta hai, isliye do modules ka saath fail hona common hai aur woh ek sahi module ko outvote kar dete hain. Redundancy unreliability ko cure karne ki jagah amplify kar deti hai. Neeche wala figure is crossover ko visually dikhata hai.

Neeche wala figure padhna. Horizontal axis single-module reliability $R$ hai ( $0$ se $1$ tak); vertical axis resulting system reliability hai. Violet straight line $y = R$ woh hai jo ek module se milti hai (baseline — system reliability sirf module reliability ke barabar hai). Magenta curve $y = 3 R^{2} - 2 R^{3}$ TMR hai. Dono lines orange dashed line $R = 0.5$ par (black dot par) cross karti hain. Us dashed line ke daayein magenta curve violet line ke upar hoti hai — TMR jeet jaata hai (shaded region "TMR helps"); baayein magenta violet ke neeche dip karti hai — TMR haar jaata hai (shaded "TMR hurts"). Violet square hamare worked point $R = 0.9 \to 0.972$ ko mark karta hai, jo comfortably winning region mein hai; is exercise ka $R = 0.4$ losing region mein hai.

Figure — Redundancy — TMR (triple modular redundancy), voting logic

Exercise 3.2

$R$ ki woh value dhundo jahan $R_{TMR} = R$ ho (woh "crossover" reliability jahan TMR na help karta hai na hurt, trivial endpoints $R = 0$ aur $R = 1$ ke alaawa).

Recall Solution

Hum kya karte hain: $R_{TMR} = R$ set karo aur solve karo. $3 R^{2} - 2 R^{3} = R$ $2 R^{3} - 3 R^{2} + R = 0 \Rightarrow R (2 R^{2} - 3 R + 1) = 0$ Quadratic factor karo: $2 R^{2} - 3 R + 1 = (2 R - 1) (R - 1)$ . $R (2 R - 1) (R - 1) = 0 \Rightarrow R = 0, R = 0.5, R = 1$ Interpretation: interesting crossover $R = 0.5$ hai — exactly woh orange dashed line jo upar figure mein hai. Isse upar TMR help karta hai ( $R_{TMR} > R$ ); neeche TMR hurt karta hai. Yeh parent note ka critical-threshold claim hai, ab assert karne ki jagah derived kiya gaya hai.

Exercise 3.3

Teen analog outputs hain $100$ , $105$ , $1000$ . Average voter aur median voter compare karo. Kaun fault mask karta hai?

Recall Solution

Pehle, key idea: quantitative (real-valued) outputs ke liye, median majority voting ka direct generalization hai. Binary majority woh value pick karta hai jo "zyada" modules share karte hain; jab values continuous hain aur rarely exactly match karte hain, median middle value pick karta hai, jo by construction us cluster ke saath hoti hai jahan kam se kam do modules land kiye — wahi "majority par trust karo, lone dissenter discard karo" logic, bas exact equality ki jagah position se measure kiya gaya.

Average: $(100 + 105 + 1000) /3 = 1205/3 = 401.67$ (2 dp tak). Wild $1000$ answer ko do sane readings se door kheench leta hai. Median: $[100, 105, 1000]$ sort karo, middle lo $= 105$ . Outlier completely ignore ho jaata hai. Kyun median jeetta hai: median sirf ordering care karta hai, magnitude nahi, isliye ek single arbitrarily large fault use ek position se aage nahi hila sakta. Average ek sum hai, isliye ek bada value use poison kar deta hai. Fault masking ke liye median use karo.

Level 4 — Synthesis

Exercise 4.1

Binary inputs $M_{1}, M_{2}, M_{3}$ ke liye Boolean majority gate design karo. Expression likho, phir input row $(M_{1}, M_{2}, M_{3}) = (1, 0, 1)$ par verify karo.

Recall Solution

Hum kya karte hain: output $1$ hoga iff kam se kam do inputs $1$ hain. Har pair ka $1$ par agree karna ek AND term hai; "any pair" OR hai: $V = M_{1} M_{2} + M_{2} M_{3} + M_{1} M_{3}$ $(1, 0, 1)$ par verify karo: $V = (1) (0) + (0) (1) + (1) (1) = 0 + 0 + 1 = 1$ Sahi — do ones present hain, isliye majority $1$ hai. (Yahan $+$ logical OR hai aur juxtaposition AND hai.)

Exercise 4.2

Voter khud ek physical component hai jiska reliability $R_{V} = 0.999$ hai. Teen modules mein se har ek ki $R = 0.9$ hai. Yeh assume karte hue ki system tab hi kaam karta hai jab (module majority hold ho aur voter kaam kare), poori system reliability likho aur evaluate karo.

Recall Solution

Hum kya karte hain: do independent cheezein hain jo dono succeed honi chahiye — modules ki majority, aur voter. Independent successes multiply hote hain. $R_{sys} = R_{TMR} \times R_{V} = 0.972 \times 0.999$ $R_{sys} = 0.971028$ Kyun yeh matter karta hai: voter ek single point of failure hai — agar woh mar jaaye, toh saari module redundancy bekaar hai. Yahi reason hai ki real TMR voters hardened hote hain ya khud triplicated hote hain. Notice karo $R_{sys} < R_{TMR}$ : voter sirf reliability subtract kar sakta hai.

Exercise 4.3

Tumhare paas $R = 0.8$ wale modules hain. Kya tum prefer karoge (a) teen se TMR build karna, ya (b) utni hi effort mein ek module ko $R = 0.97$ tak pahunchana? Justify numerically.

Recall Solution

TMR path: $R_{TMR} = 0. 8^{2} (3 - 1.6) = 0.64 \times 1.4 = 0.896$ . Better-single path: $R = 0.97$ by assumption. Kyunki $0.97 > 0.896$ hai, pure reliability par better single module jeet ta hai — aur $3 \times$ ki jagah $1 \times$ hardware aur power use karta hai. Nuance: TMR phir bhi transient faults (cosmic-ray bit-flips) ke against tolerance deta hai jo ek module improve karke nahi mil sakti, kyunki tum ek random future event ko design out nahi kar sakte. Isliye honest answer hai: pehle base reliability fix karo (parent-note advice), phir remaining transient risk ke liye TMR add karo jo tum design away nahi kar sakte.

Level 5 — Mastery

Exercise 5.1

Teen modules mein se do mein ek hidden common-cause defect hai: probability $c = 0.05$ ke saath woh dono saath fail ho jaate hain (ek single correlated event $M_{1}$ aur $M_{2}$ dono ko ek saath knock out kar deta hai). Arithmetic clean rakhne ke liye, hum modelling assumptions explicit karte hain: us shared event ke alaawa, $M_{1}$ aur $M_{2}$ ki negligible independent failure probability hai, aur $M_{3}$ independently probability $q = 0.1$ se fail hota hai. In stated assumptions ke under, estimate karo ki system apni majority khone ki probability kya hai.

Recall Solution

Pehle model state karo (yahi exercise ka point hai):

Common-cause event $A$ , $P (A) = c = 0.05$ ke saath fire hota hai aur dono $M_{1}$ aur $M_{2}$ ko kill kar deta hai.
By assumption $M_{1}, M_{2}$ ka koi aur failure route nahi hai, isliye agar $A$ fire nahi karta, toh dono healthy hain.
$M_{3}$ independently $P (B) = q = 0.1$ se fail hota hai.

Hum kya karte hain: majority tab lose hoti hai jab do ya zyada modules fail ho jaayein.

Agar $A$ fire karta hai (prob $0.05$ ): $M_{1}$ aur $M_{2}$ dono down hain → do failures → majority already lost, $M_{3}$ chahe kuch bhi kare.
Agar $A$ fire nahi karta (prob $0.95$ ): hamare stated assumption ke under $M_{1}, M_{2}$ healthy hain, isliye zyada se zyada $M_{3}$ down hai — sirf ek failure → majority survive karta hai.

Isliye majority tab lost hoti hai iff $A$ fire karta hai: $P (lose majority) = P (A) = 0.05$ Lesson: ek $5%$ common-cause coupling completely design ko dominate kar deta hai — yeh akele hi reliability ko $0.95$ par cap kar deta hai, chahe independent failure rate kitna bhi achha ho (agar hum $M_{1}, M_{2}$ ke liye small independent failures include karte, toh answer $0.05$ se sirf thoda upar hota, isliye conclusion robust hai). Yahi reason hai ki Common-Cause Failures aur Redundancy vs. Diversity matter karte hain: identical triplicated modules identical flaws share karte hain. Real safety systems correlation break karne ke liye diverse implementations use karte hain.

Exercise 5.2

Per-module $R = 0.9$ ke saath TMR aur 5-modular redundancy (5MR) compare karo. 5MR survive karta hai agar $5$ mein se kam se kam $3$ modules work karein. $R_{5MR}$ compute karo aur qualitative gain state karo.

Recall Solution

Hum kya karte hain: $5$ mein se "3 work", "4 work", "5 work" ke binomial probabilities sum karo, $R = 0.9$ , $1 - R = 0.1$ ke saath. $P (5) = R^{5} = 0.59049$ $P (4) = (4 5) R^{4} (1 - R) = 5 (0.6561) (0.1) = 0.32805$ $P (3) = (3 5) R^{3} (1 - R)^{2} = 10 (0.729) (0.01) = 0.0729$ $R_{5MR} = 0.59049 + 0.32805 + 0.0729 = 0.99144$ Yaad karo $R_{TMR} = 0.972$ . Toh 5MR failure probability $0.028$ se $\approx 0.0086$ tak push karta hai — roughly $3 \times$ safer, $5 \times$ hardware aur ek voter ke cost par jo do faults tolerate karta hai instead of one. Diminishing returns: hardware 3 se 5 tak double karne se safety margin double nahi hua.

Exercise 5.3

Ek mission ko system failure probability $1 0^{- 4}$ se kam chahiye. Tumhare modules ki $R = 0.99$ hai. Kya plain TMR requirement meet karta hai? Agar haan, toh kitne margin se; agar nahi, toh tum kya change karoge?

Recall Solution

Exercise 2.2 se, $R_{TMR} = 0.999702$ hai, isliye $1 - R_{TMR} = 0.000298$ Requirement $< 0.0001$ hai. Kyunki $0.000298 > 0.0001$ hai, plain TMR meet nahi karta — roughly $3 \times$ se miss karta hai. Kya change karna hai (leverage ke order mein):

Base $R$ badhao: thodi si bhi improvement effect mein cube-ish hoti hai. $R = 0.999$ try karo: $R_{TMR} = 0.99 9^{2} (3 - 1.998) = 0.998001 \times 1.002 = 0.999997 \dots$ , failure $\approx 3 \times 1 0^{- 6}$ — easily pass karta hai.
Agar modules improve nahi kar sakte, toh 5MR use karo (Ex. 5.2 style).
Mat bhulo voter aur common-cause terms — woh, Ex. 4.2 aur 5.1 ke according, dominate kar sakte hain aur silently budget blow kar sakte hain. Safety-Critical Systems Standards ke against certify karne se pehle hamesha unhe fold in karo.

Recall Quick self-quiz (finish karne ke baad reveal karo)

TMR crossover reliability jiske neeche redundancy hurt karta hai ::: $R = 0.5$ Majority-gate Boolean expression ::: $V = M_{1} M_{2} + M_{2} M_{3} + M_{1} M_{3}$ Kyun median analog voter ke roop mein average se better hai ::: median gross outliers ignore karta hai; average unse poison ho jaata hai TMR mein single point of failure kaun sa component hai ::: voter $V$ Module count chahe kitna bhi ho, reliability ko kya cap karta hai ::: common-cause (correlated) failures