5.5.25 · D1Embedded Systems & Real-Time Software

Foundations — Redundancy — TMR (triple modular redundancy), voting logic

2,836 words13 min readBack to topic

The parent note on TMR and voting logic leans on a pile of shorthand. Rather than list that shorthand now (it would just be noise before you have met it), this page introduces each symbol only at the moment we need it, building every one from nothing, in an order where each idea rests on the one before. A 12-year-old who has never seen any of this should be able to follow from line one.


1. A "module" and the letter

Picture it. Three identical vending machines standing side by side. Press the same button on all three; each drops a can. Same machine, three bodies.

Why the topic needs it. TMR is defined as three modules. Without the idea "one copy among several identical copies", the word redundancy has no meaning.

Figure — Redundancy — TMR (triple modular redundancy), voting logic
Figure 1 — One input (yellow) fans out to three identical modules (blue boxes), each producing its own output (green). Take away: the machine is the same; only the body and the label number differ.


2. Input , function , and output

Picture it. A box with a slot on the left ( goes in) and a slot on the right ( comes out). The box's inside is the rule .

Since each module runs the same rule on the same input, we write each module's output as Here is "the output of copy number ". Note the careful reading: is the machine (the box), while is the number that comes out of it. If all copies are healthy, . If one is broken, its disagrees.

Why the topic needs it. The voter compares . Everything downstream is a comparison of these three outputs, so we must first name them.


3. Probability , and reliability

Picture it. A bar of length . Colour the fraction green (works) and the remaining red (fails). The two pieces always add to the full bar.

Figure — Redundancy — TMR (triple modular redundancy), voting logic
Figure 2 — The certainty bar has total length . The green slice is (module works); the red slice is (module fails). Take away: work and fail are the only two outcomes, so their probabilities must add up to exactly .

Why the topic needs it. The whole point of TMR is to raise reliability. To prove it helps we must measure before and after — so and are the currency of the entire derivation.


4. Why probabilities multiply for independent copies

Picture it. Toss two coins. Chance of heads-then-heads is , because only one of the four equally-likely corners of a grid is "both heads". Replace by and you get ; for three copies, .

Why the topic needs it. The parent's Step 1, "", is only true because failures are independent. This assumption is fragile in real life — when it breaks you get Common-Cause Failures, which the topic warns about.


5. Counting the ways:

Picture it. Three switches; you must turn exactly two ON. List them: (1,2), (1,3), (2,3). Three pictures, hence the number .

Why the topic needs it. "Exactly 2 of 3 work" can happen in distinct arrangements, each with probability . So the total is — the parent's Step 2. Without the counting factor you would undercount by three times.


6. Adding disjoint cases, and the full TMR reliability

We now have two pieces: (all three work) and (exactly two work). A TMR system is healthy whenever at least two modules work, which is "all three work" or "exactly two work". To combine an "or", we need one more rule of probability.

"All three work" and "exactly two work" are disjoint: you cannot have all three working and exactly one failing in the same trial — the count of survivors is either or , never both. So we are allowed to add them.

Sanity check. With : — better than a single module's . This is the exact formula the parent note uses; you now know where every term comes from.


7. The failure rate and the curve

Picture it. A slide that starts full-height and curves gently downward, never quite touching the floor. Steeper slide = bigger .

Figure — Redundancy — TMR (triple modular redundancy), voting logic
Figure 3 — Reliability over time, , for a slow-failing module (blue, small ) and a fast-failing one (red, large ). Both start at (yellow dot) and curve toward without ever touching it. Take away: bigger = steeper drop = shorter useful life.

Why this tool and not a straight line? A straight line would eventually cross below zero (impossible for a probability) and would assume things fail at a constant clock time. instead says "in every equal time slice, the same fraction of survivors fails" — the natural model for random hardware death. That is exactly why the parent writes .


8. The majority gate and the voter output

Up to now meant a whole machine and meant its output number. To talk about the voter circuit cleanly, we zoom into the simplest case where each output is a single bit — just or . Call these three bits ====, where is module 's one-bit output (so when the output is already a single bit).

Read the voter as a sentence. " is if bits 1-and-2 both agree on , OR bits 2-and-3 do, OR bits 1-and-3 do." Any pair agreeing on forces — that is exactly "at least two out of three".

Figure — Redundancy — TMR (triple modular redundancy), voting logic
Figure 4 — The majority voter: three AND gates (yellow), one per pair of modules, feed a single OR gate (green) that outputs . Take away: whenever any one pair agrees on , i.e. whenever at least two of the three inputs are .

Why the topic needs it. This is the digital voter that produces . For continuous (analog) outputs the same "ignore the odd one out" job is done by the median — defined next.


9. Median vs average, defined symbolically

Why median, not average? The average is dragged toward any wild value; the median simply ignores it.

  • — the broken pollutes the result.
  • — the outlier is thrown away. ✅

That single difference is why analog voters use the median: it is the continuous cousin of "2-out-of-3 majority".


Prerequisite map

The diagram below is a dependency graph: read it top-to-bottom, each box is an idea from this page, and each arrow means "the idea at the tail must be understood before the idea at the head". Follow any path of arrows and you are walking the exact order in which we built things; every path eventually funnels into the "TMR topic" box.

Module M and subscript i

Output y = f of x

Probability P from 0 to 1

Reliability R and 1 minus R

Independent copies multiply

Choose count 3 pick 2

Disjoint events add

Failure rate lambda and e to the minus lambda t

Majority gate V from bits

Median for analog outputs

TMR reliability formula

TMR topic

Feeds forward into: Fault Tolerance Fundamentals, Watchdog Timers, Redundancy vs. Diversity, and the deeper failure models of Byzantine Fault Tolerance.


Equipment checklist

Test yourself — answer before revealing.

What does the subscript in mean?
It labels the copy — "module number 2" of the three identical modules.
What does mean, and what does it NOT mean?
"Apply rule to input "; it is NOT multiplied by .
What is the difference between and ?
is the machine (the box); is the number that machine outputs.
If reliability is , what is the chance of failure?
, because working and failing fill the whole probability bar of length .
Why can we write ?
Because the modules fail independently, so their working probabilities multiply.
When are you allowed to ADD two probabilities?
When the events are disjoint (mutually exclusive) — they cannot both happen at once.
Why does ?
There are three distinct ways to choose which two of the three modules are the survivors.
What is the full TMR reliability formula?
.
For which values of does TMR beat a single module?
Only when ; at they tie, and for TMR is worse.
What is , and what does do over time?
is a fixed constant; starts at and decays smoothly toward , faster for larger .
In the voter , what are , and ?
are the modules' one-bit outputs; (juxtaposition) is logical AND; is logical OR — not arithmetic.
How do you compute and why prefer it to the average?
Sort the three and take the middle (or ); it ignores a single outlier while the average is dragged toward it.
Recall Self-check: state the one core idea in a sentence.

Run the same job on three identical copies and trust the answer that at least two of them agree on, so a single faulty copy is masked.