Redundancy — TMR (triple modular redundancy), voting logic: Question bank

5.5.25 · D5 · Coding › Embedded Systems & Real-Time Software › Redundancy — TMR (triple modular redundancy), voting logic

Yeh Hinglish parent ka companion trap bank hai. Yeh seedha parent topic par build karta hai aur Fault Tolerance Fundamentals, Common-Cause Failures, Byzantine Fault Tolerance, aur Redundancy vs. Diversity par lean karta hai. Har item ek aisi misconception ko target karta hai jo topic quietly invite karta hai.

Definition Is page mein use hone wale symbols (pehle padho)

Kisi bhi trap se pehle, notation pin down karo taaki neeche kuch bhi guess na ho.

== $R$ = EK module ki reliability==: probability ki ek single module mission time ke dauran correct output produce karega. Yeh $0$ aur $1$ ke beech ka number hai (e.g. $R = 0.9$ matlab "90% time sahi").
== $R_{TMR}$ == = probability ki poora teen-module voted system correct output produce karega.
== $M_{1}, M_{2}, M_{3}$ == = teen module output signals. Binary hone par, har ek $0$ ya $1$ hai.
== $V$ = voter ka output==: woh single value jo voter $M_{1}, M_{2}, M_{3}$ compare karne ke baad downstream bhejta hai. Binary signals ke liye $V \in {0, 1}$ .
Majority-gate formula mein, juxtaposition ka matlab logical AND hai aur $+$ ka matlab logical OR hai: $M_{1} M_{2}$ padho " $M_{1}$ AND $M_{2}$ ", aur $M_{1} M_{2} + M_{2} M_{3} + M_{1} M_{3}$ padho "( $M_{1}$ AND $M_{2}$ ) OR ( $M_{2}$ AND $M_{3}$ ) OR ( $M_{1}$ AND $M_{3}$ )".
Precedence: AND OR se tighter bind karta hai (bilkul jaisa ordinary arithmetic mein $\times$ , $+$ se tighter bind karta hai). Toh $M_{1} M_{2} + M_{2} M_{3} + M_{1} M_{3}$ ka matlab hai "pehle teen AND-pairs banao, phir unhe OR karo" — koi brackets nahi chahiye, bilkul jaisa $ab + b c + c a$ algebra mein padha jata hai.

Formula

$R_{TMR} = R^{2} (3 - 2 R)$ actually kahan se aata hai Pehle, notation ka ek piece: == $(2 3)$ ("3 choose 2")== ek binomial coefficient hai — yeh count karta hai kitne alag tarike hain jisme tum 3 mein se 2 items pick kar sakte ho. Yahan yeh count karta hai ki teen modules mein se kaun se 2 correct hain. List karke: {1,2}, {1,3}, {2,3} — yeh $(2 3) = 3$ ways hain.

System tab correct hota hai jab 3 mein se kam se kam 2 modules correct hon (voter ko majority chahiye). Do disjoint cases majority dete hain:

Teeno 3 correct: har ek independently $R$ probability se correct hai, toh multiply karo — $R \cdot R \cdot R = R^{3}$ .
Exactly 2 correct, 1 wrong: do correct ( $R^{2}$ ) aur ek wrong ( $1 - R$ ), aur $(2 3) = 3$ choices hain ki kaun sa module wrong hai, giving $3 R^{2} (1 - R)$ .

Do disjoint cases add karo (yeh binomial "3 mein se 2-or-more successes" hai): $R_{TMR} = R^{3} + 3 R^{2} (1 - R) = R^{3} + 3 R^{2} - 3 R^{3} = 3 R^{2} - 2 R^{3} = R^{2} (3 - 2 R) .$ $(2 3) = 3$ factor — woh count ki kitne ways mein ek module odd one out ho sakta hai — exactly yahi reason hai ki middle term triple hai.

Intuition Dono curves

$R = 0.5$ par kyun cross karti hain (Figure 2)

Grey line ek single module hai: reliability sirf $R$ hi hai, ek seedha diagonal. Blue curve TMR hai, $R^{2} (3 - 2 R)$ , jo left mein diagonal ke neeche sagging karta hai aur right mein upar uthta hai. Woh exactly red dot, $R = 0.5$ par milti hain. Shape ko ek story ki tarah padho:

$0.5$ ke right (green arrow): good modules majority hain, toh voting occasional bad one ko out-vote karti hai — blue curve grey ke upar arc karti hai. TMR help karta hai.
$0.5$ ke left (orange arrow): bad modules majority hain, toh unke do good module ko out-vote kar dete hain — blue curve grey ke neeche dip karti hai. TMR hurt karta hai.
$0.5$ par: correct aur incorrect equally likely hain, toh tripling kuch nahi badalta — curves cross karti hain. Algebraically, $R^{2} (3 - 2 R) = R$ se $R = 0.5$ crossover milta hai, yahi tumhari aankh dekhti hai jahan lines touch karti hain.

True or false — justify

TMR hamesha ek single module se system ko zyada reliable banata hai.

False. Sirf tab jab har module ki reliability

R > 0.5

ho; neeche, do flaky modules ek good one ko zyada baar outvote karte hain instead of teeno ke succeed karne ke, toh

R_{TMR} < R

Exactly

R = 0.5

par, TMR reliability single-module reliability ke barabar hoti hai.

True.

R_{TMR} = R^{2} (3 - 2 R) = 0.25 \times 2 = 0.5 = R

, toh crossover point precisely

R = 0.5

hai — Figure 2 mein grey aur blue curves wahan cross karti hain, sirf touch nahi karti.

Ek TMR system do simultaneous module failures survive kar sakta hai.

False. Do failures sirf ek working module chodti hain, jo majority nahi bana sakta; voter ke paas 2-out-of-3 agreement nahi hai aur system fail ya halt ho jata hai.

TMR tumhe batata hai ki kaun sa module fail hua.

False. Yeh sirf batata hai ki minority disagree ki; tum jaante ho ki koi wrong hai lekin kaun, bina extra diagnostics jaise Watchdog Timers ya comparison logic ke nahi jaante.

Classic TMR mein voter khud ek single point of failure hai.

True. Agar voter ek plain unreplicated circuit hai, toh uska failure teeno modules ko ek saath defeat kar deta hai — yahi wajah hai ki voters ko hardened ya khud replicated kiya jata hai.

Modules ki independent failure TMR ki guaranteed property hai.

False. Yeh ek assumption hai. Shared power supplies, clocks, ya identical software bugs Common-Cause Failures cause karte hain jo teeno ko ek saath hit karte hain, math ki assumed independence ko todkar.

Teen identical processors par same software run karna ek software bug se protect karta hai.

False. Identical software mein identical bugs hote hain; teeno wahi wrong answer produce karte hain aur voter khushi se pass kar deta hai. Iske liye design diversity chahiye, sirf replication nahi.

Ek median voter aur ek Boolean majority voter apne respective data types ke liye same idea implement karte hain.

True. Dono disagreeing minority ko discard karte hain: binary values ke liye majority, continuous values ke liye median — median woh "middle vote" hai jise outliers door nahi kheench sakte.

Spot the error

"Voter basically ek OR gate hai — agar koi bhi module 1 output kare, hum 1 output karte hain."

Wrong. OR ek single faulty 1 ko pass kar deta hai; voter output

V

ek majority gate hona chahiye

V = M_{1} M_{2} + M_{2} M_{3} + M_{1} M_{3}

(products = AND, pehle bind karte hain;

+

= OR) toh

V

sirf tab 1 hota hai jab kam se kam do agree karein.

"Hamen teen sensor readings ko average karna chahiye best estimate pane ke liye."

Fault masking ke liye wrong. Averaging ek wild outlier ko result skew karne deta hai (100,100,1000 → 400); median (→100) faulty value ko completely ignore karta hai.

"TMR ek module ko handle kar leta hai jo plausible-but-wrong values output karta hai, bilkul theek se."

Sirf partly. Yeh ek fail-incorrect fault hai; voter isse mask kar leta hai jab tak sirf ek module jhootha ho, lekin agar do independently alag wrong values produce karein, majority toot jaati hai — fail-silent behavior se zyada mushkil.

"Kyunki do sensors agree kar rahe hain, teesra definitely tuta hua hai."

Certain nahi. Do agreeing modules ek common-cause fault share kar sakte hain aur saath mein galat ho sakte hain jabki akela module sahi ho — agreement correctness ka proof nahi hai.

"Analog sensor readings ko vote karne ke liye exact equality use karo maximum strictness ke liye."

Wrong. Analog noise ka matlab hai ki good sensors kabhi last bit tak match nahi karte; tumhe ek tolerance window ke andar approximate voting chahiye, warna valid readings falsely "disagree" karti hain.

"Voting tolerance bahut large set karna safe choice hai — yeh false disagreements avoid karta hai."

Wrong. Bahut badi tolerance genuinely diverged values ko agreement maan kar real faults mask kar deti hai; tolerance ko sensor noise aur fault magnitude ke beech balance karna chahiye.

"Teen modules saare disagree kar rahein, voter bas pehla wala pick kar leta hai."

Wrong. Three-way disagreement ek consensus failure hai; ek correct voter no-decision return karta hai (ya halt karta hai), kyunki koi majority nahi hai jis par trust kiya ja sake.

"TMR 3× reliability deta hai kyunki tumhare paas 3 modules hain."

Wrong. Reliability

R^{2} (3 - 2 R)

hai,

3 R

nahi.

R = 0.9

par tumhe

0.972

milta hai,

2.7

nahi — reliability ek probability hai jo 1 par capped hai, aur gain "3×" se bahut chhota hai.

Why questions

TMR ko odd number of modules kyun chahiye?

Even count tie kar sakta hai (e.g. 2 vs 2), voter ko koi majority nahi deta; odd count guarantee karta hai ki ek side hamesha single-value comparison ke liye dusre se zyada ho.

TMR faults detect kyun nahi kar sakta, sirf mask kar sakta hai?

Voter ka output

V

sirf majority value reveal karta hai, na ki kaun se inputs disagree kiye; minority ko record kiye bina culprit diagnose karne ke liye needed information khо jaati hai.

Fail-silent module ko fail-incorrect se zyada aasaani se tolerate kyun kiya ja sakta hai?

Fail-silent module simply drop out ho jata hai, ek clean 2-out-of-2 majority chodta hai; fail-incorrect module actively ek wrong value inject karta hai jise voter ko out-vote karna hota hai, aur coordinated wrong values isse defeat kar sakti hain — yahi Byzantine Fault Tolerance ka essence hai.

Hardware voters often bit-by-bit compare kyun karte hain instead of numeric equality use karne ke?

Bit comparison ek fixed, fast, gate-level operation hai predictable delay ke saath; floating-point equality slower hai aur representation quirks ke subject hai jo tight real-time deadlines ke liye unsuitable hain.

Reliability formula tab kyun help nahi karta jab modules correlated hon?

Derivation

R \times R \times R

multiply karta hai independent failures assume karke; correlation ka matlab hai ek event kai modules ko saath knock out kar deta hai, toh true reliability formula ke predict se bahut kam hoti hai.

Middle term

3 R^{2} (1 - R)

mein 3 ka factor kyun hai jabki "all correct" term

R^{3}

mein nahi?

(2 3) = 3

alag modules hain jo single failing one ho sakte hain, toh teen distinct scenarios woh probability share karte hain; "all correct" ek single scenario hai, toh ise aisa koi count nahi chahiye.

Plain triplication ki jagah diversity (different implementations) kabhi kabhi kyun prefer ki jaati hai?

Identical copies identical design flaws share karti hain; diverse implementations alag tarah se fail hoti hain, toh woh common-cause aur common-bug weaknesses ko attack karti hain jo plain redundancy wide open chodti hai — dekho Redundancy vs. Diversity.

TMR reliability ke liye space aur power trade kyun karta hai instead of reliability free mein pane ke?

Tum physically computation ki teen copies chalate ho, toh hardware area, energy, aur cost roughly triple ho jaati hai; reliability gain un resources ke saath kharidha jaata hai, conjured nahi.

Edge cases

Voter kya karta hai jab exactly do modules output produce karte hain aur dono agree karte hain?

Woh unki agreed value

V

ke roop mein output karta hai — ek fail-silent teesra module phir bhi ek valid 2-of-2 majority chodta hai, jo exactly single-fault case hai jise TMR survive karne ke liye build kiya gaya hai.

Voter kya karta hai jab do modules silent hain aur sirf ek output produce karta hai?

Isse insufficient quorum maano — ek akela survivor 2-out-of-3 majority nahi bana sakta, toh voter ko ise blindly accept nahi karna chahiye; use redundancy loss signal karna chahiye aur (safety-critical use mein) halt ya safe state pe hand off karna chahiye.

Kya hota hai agar teeno modules healthy hon lekin ek transient ek single cycle ke liye glitch kare?

Voter us cycle ko instantly mask karta hai; healthy pair output carry karta hai, aur glitching module next cycle recover kar leta hai — ek transient mask karna TMR ka everyday kaam hai.

Kya toot jaata hai jab module failures correlated hoti hain instead of independent ke?

Ek single root event (shared power dip, common clock fault, identical software bug) do ya teen modules ko ek saath usi tarah flip kar sakta hai; voter phir wrong values ki ek false "majority" dekhta hai aur confidently garbage output karta hai —

R^{2} (3 - 2 R)

math ab apply nahi hota kyunki usne independence assume ki thi, toh real reliability us shared component ki taraf collapse hoti hai. Yahi wajah hai ki Common-Cause Failures ko engineer out karna hoga, sirf vote around nahi karna.

Boundary

R \to 1

par, single-module aur TMR reliability kaise compare karte hain?

Dono 1 approach karte hain, aur gap zero ki taraf shrink hota hai — near-perfect modules voting se almost kuch nahi gain karte, kyunki mask karne ke liye bahut kam failure bachi hai.

R \to 0

par,

R_{TMR} = R^{2} (3 - 2 R)

kya approach karta hai aur kyun?

Yeh 0 approach karta hai (

3 R^{2}

se dominated), aur single module ke

R

se faster aise karta hai, confirming karta hai ki TMR bahut unreliable parts ke liye strictly worse hai.

Teen analog readings ke liye correct voter response kya hai jo tolerance se pare mutually far apart hain?

No-consensus report karo aur alarm raise karo; ek "middle" value fabricate karna ek genuine multi-fault condition ko hide kar dega jiske baare mein operator ko pata hona chahiye.

Agar voter khud triplicated hai, toh ab tumhe kaun si nayi problem solve karni hai?

Tumhe teen voter outputs combine karne ka tarika chahiye — single-point-of-failure question ek level upar push ho jaata hai — aksar separate actuators drive karke ya ek final hardened comparator se resolve kiya jaata hai.

Recall Ek-line self-test

Agar koi kahe "humne TMR add kiya toh system ab teen guna safer hai," toh unhe correct karne wala ek sentence kya hai? ::: Reliability $R^{2} (3 - 2 R)$ follow karti hai aur sirf tab help karti hai jab $R > 0.5$ ; gain bounded hai aur unreliable modules ke liye negative bhi ho sakta hai.