Redundancy — TMR (triple modular redundancy), voting logic: Worked examples

This page lives under the TMR parent topic. Here we stop talking about voting and actually do it — for every kind of input a triple-modular-redundant system can meet. Read the parent first if the words module, voter or majority are new to you; everything else we rebuild from zero.

The scenario matrix

Every cell below is a distinct shape the three inputs $(y_{1}, y_{2}, y_{3})$ can take. Each worked example is tagged with the cell(s) it covers.

Cell	Input pattern	What tests it	Example
A	All three exactly equal	Fault-free "happy path"	Ex 1
B	Exactly two equal, one off	Single masked fault	Ex 1, Ex 2
C	All three different (no consensus)	Voter fails to decide	Ex 3
D	Close-but-not-equal (analog noise)	Tolerance clustering vs. median	Ex 4
E	One module silent (no output)	Degenerate input, fail-silent	Ex 5
F	Binary ${0, 1}$ inputs	Digital majority gate, all 8 rows	Ex 6
G	A wild outlier	Median beats average	Ex 7
H	Limiting reliability $R \to 0, 0.5, 1$	Boundary of when TMR helps	Ex 8
I	Real-world word problem	Furnace safety cutoff	Ex 9
J	Exam twist: two modules fail identically	Common-cause defeats voting	Ex 10
K	Plausible liar within tolerance	Byzantine/adversarial module	Ex 11

Definition Three separate voter algorithms (do not confuse them)

We use three distinct rules. Each has its own input type, its own decision, and its own "return value." Keep them apart.

(1) Exact-bit majority — for digital outputs. Two outputs "agree" only when their raw bit patterns are identical (a bit-for-bit XOR gives all zeros). Formally, writing $bits (y_{i})$ for the stored bit pattern, $V$ returns $v$ when $# {i : bits (y_{i}) = bits (v)} \geq 2$ ; otherwise it returns no-consensus (a signalled error, not a guess). "Byte-for-byte equal" is the whole meaning of equality here — a value that is numerically close but not bit-identical does not count.

(2) Tolerance-cluster voting — for noisy analog outputs, when we want a yes/no consensus with a representative value. Fix a tolerance $τ > 0$ . Two readings agree if $∣ y_{i} - y_{j} ∣ \leq τ$ . Find any group of $\geq 2$ mutually-agreeing readings (a cluster); if one exists, return the median of that cluster as the representative. Selecting the median of the cluster (not "the first value found") makes the answer order-independent — see Ex 4. If no cluster of size $\geq 2$ exists, return no-consensus.

(3) Median-of-three voting — for noisy analog outputs, when we want an answer unconditionally, with no error branch. Sort all three inputs and return the middle one: $V = median (y_{1}, y_{2}, y_{3})$ . This never refuses; it simply discards the two extremes. Use it when a downstream controller must always receive a number (Ex 7, Ex 9).

When to use which: digital exact values → (1); analog where you may declare "no agreement" → (2); analog where you must always output something → (3).

Example 1 — Cells A & B: the happy path and one masked fault

Forecast: guess both answers before reading — does run β even have a defined output?

Run α — count agreements. All three bit patterns equal $850$ , so $# {i : bits (y_{i}) = bits (850)} = 3 \geq 2$ . Why this step? The rule only needs two bit-identical; three is even safer. Output $= 850$ .
Run β — pairwise compare. $y_{1} = y_{2} = 850$ but $y_{3} = 920$ . The pair $(y_{1}, y_{2})$ is bit-identical, so majority $= 850$ . Why this step? "At least two bit-equal" is satisfied by $(y_{1}, y_{2})$ ; we don't need $y_{3}$ . The $920$ reading is masked.
Name the fault. The lone $920$ is a fail-incorrect bias (calibration drift), yet TMR still coped because the other two were healthy. Why this step? Shows cell B: a single wrong-but-plausible value is survivable.

Verify: In α, all equal ⇒ output must equal any input, $850$ . ✅ In β, two of three equal $850$ ⇒ output $850$ , and the outlier's distance $∣920 - 850∣ = 70$ never enters the result. ✅

Example 2 — Cell B: sign-flip fault in flight control

Forecast: the wrong value is the negative of the right one — does that fool the voter?

Bit-compare the pairs. The voter checks equality of raw bit patterns, not magnitudes. $δ_{1}$ and $δ_{2}$ share identical bits; $δ_{3}$ differs in exactly the sign bit. Why this step? Bit comparison is a single-cycle XOR-and-NOR — far faster than floating-point compare, which matters at kilohertz control loops. This is the concrete meaning of "byte-for-byte equal" in rule 1.
Majority found. Pair $(δ_{1}, δ_{2})$ matches, $δ_{3}$ does not ⇒ output $= 5.2°$ . Why this step? Even though $- 5.2°$ would command a violent opposite roll, it is a minority of one and gets discarded.
Aftermath. Aircraft keeps a $+ 5.2°$ deflection; ground logs flag module 3 (see Watchdog Timers for how the disagreement is recorded for maintenance).

Verify: Set $δ = K (θ_{des} - θ_{act})$ with $K = 1.3, θ_{des} = 14°, θ_{act} = 10°$ : $δ = 1.3 \times 4 = 5.2°$ . Two modules give $5.2$ , output $5.2$ ; the flipped $- 5.2$ is masked. ✅

Example 3 — Cell C: no consensus (the voter must refuse)

Forecast: it's tempting to say "pick the middle, 105." Is that what exact voting does?

Count exact matches for each value. For $100$ : one module. For $105$ : one. For $110$ : one. No value reaches count $\geq 2$ . Why this step? Exact voting is unforgiving — "close" is not "bit-equal."
Return no-consensus. The voter signals an error rather than guessing. Why this step? Guessing here would fabricate trust that isn't earned. A safety-critical system prefers a known failure over a silent wrong answer (see Safety-Critical Systems Standards).
Escalate. With three-way disagreement, TMR is exhausted; you need higher redundancy (5-modular) or a fallback mode.

Verify: matches $= max (1, 1, 1) = 1 < 2$ ⇒ no majority ⇒ output is the error sentinel (None), not $105$ . ✅

Example 4 — Cell D: tolerance clustering (and why we return the cluster median)

Forecast: with a $\pm 10$ window, how many of the three cluster together — and which single number do we hand back?

The geometry of this vote is a number line with a sliding tolerance window. Look at the figure: the amber bars are the pairwise distances; a cluster forms when readings sit inside one window of width $τ$ .

Figure — Redundancy — TMR (triple modular redundancy), voting logic

Figure s01 — the three readings 100/105/110 on a number line (cyan dots). Top: with $τ = 10$ the whole trio fits in one window (cyan band), so all three cluster; the amber tick marks the returned value = median of the cluster = 105. Bottom: with $τ = 3$ no two readings are within 3, so the windows never overlap and no cluster of size ≥ 2 forms → no-consensus.

Build the agreement test. Two readings agree iff $∣ y_{i} - y_{j} ∣ \leq τ$ . Pairwise distances: $∣100 - 105∣ = 5$ , $∣105 - 110∣ = 5$ , $∣100 - 110∣ = 10$ . Why this step? Rule 2 clusters by closeness within noise, not exact equality.
Find the largest cluster ( $τ = 10$ ). All three distances are $\leq 10$ , so ${100, 105, 110}$ is one mutually-agreeing cluster of size $3 \geq 2$ . Why this step? A cluster of $\geq 2$ means TMR has consensus.
Return the median of the cluster — this is the fix for order-dependence. The cluster is ${100, 105, 110}$ ; its median is $105$ . Why this step? The reviewer's trap: with the old "first value reaching the threshold" rule, both $100$ and $110$ have three neighbours within $10$ , so the answer depended on iteration order. Returning the cluster median is a single, order-independent, symmetric choice — it does not matter whether you scan the list forwards or backwards.
Now shrink the window ( $τ = 3$ ). Distances $5, 5, 10$ are all $> 3$ , so no pair agrees; no cluster of size $\geq 2$ exists ⇒ no-consensus. Why this step? Shows the trade-off: too-tight $τ$ falsely rejects genuine agreement; too-loose $τ$ would merge a real fault into the cluster.

Verify: With $τ = 10$ , cluster $= {100, 105, 110}$ , its median $= 105$ (order-independent). With $τ = 3$ , no pair within $3$ ⇒ output None. ✅

Example 5 — Cell E: a silent module (degenerate input)

Forecast: with only two live inputs, is a "majority of three" still possible?

Treat missing as "cannot match." A silent module can never be bit-equal to anyone, so it contributes $0$ to every match count. Why this step? This is why we prefer fail-silent over fail-incorrect: a missing value can't win a vote.
Count matches among survivors. $y_{1} = y_{3} = 42$ ⇒ count for value $42$ is $2 \geq 2$ . Why this step? TMR was designed to survive exactly one lost module; two agreeing survivors still form a majority.
Output $42$ ; flag degraded mode. The system now has zero remaining tolerance — a second fault is fatal. A watchdog should raise this alarm.

Verify: live agreeing modules $= 2$ , threshold $= 2 \Rightarrow$ output $= 42$ ; remaining redundancy after one loss $= 0$ . ✅

Example 6 — Cell F: the digital majority gate, all 8 rows

Forecast: how many of the eight rows should give $V = 1$ ? (Count rows with two-or-three ones.)

List all rows and the true majority. With inputs $(M_{1}, M_{2}, M_{3})$ :

$M_{1}$ $M_{2}$ $M_{3}$ ones majority $V$ formula

0 0 0 0 0 0

0 0 1 1 0 0

0 1 0 1 0 0

0 1 1 2 1 1

1 0 0 1 0 0

1 0 1 2 1 1

1 1 0 2 1 1

1 1 1 3 1 1

Why this step? Enumerating every row is the only way to prove a Boolean identity — no case can hide.
Check the formula on one tricky row. Row $(1, 0, 1)$ : $M_{1} M_{2} = 0, M_{2} M_{3} = 0, M_{1} M_{3} = 1$ ⇒ $V = 0 + 0 + 1 = 1$ . Matches majority. Why this step? The two zeros make two product terms vanish; the surviving pair-term fires. This is why we OR three pair-products.
Confirm the count. Exactly $4$ rows have majority $1$ , and the formula gives $1$ on exactly those $4$ .

$M_{1}$	$M_{2}$	$M_{3}$	ones	majority	$V$ formula
0	0	0	0	0	0
0	0	1	1	0	0
0	1	0	1	0	0
0	1	1	2	1	1
1	0	0	1	0	0
1	0	1	2	1	1
1	1	0	2	1	1
1	1	1	3	1	1

Verify: formula column equals majority column in all 8 rows; number of $1$ s $= 4$ . ✅

Example 7 — Cell G: median beats average on an outlier

Forecast: the outlier is $10 \times$ the others — which method ignores it?

The figure shows why: on a number line, the average is a balance point that the far-right outlier tips; the median is a rank position that the outlier cannot budge.

Figure s02 — the three readings on a number line. Two cyan dots sit at 100, one amber outlier at 1000. The white triangle marks the average (400), dragged rightward toward the outlier; the cyan arrow marks the median (100), the middle element after sorting, unmoved by the outlier's magnitude.

Average. $\frac{100 + 100 + 1000}{3} = \frac{1200}{3} = 400$ . Why this step? Averaging lets a single huge outlier drag the answer — $400$ is wrong for a value that should be $100$ .
Median-of-three. Sort: $(100, 100, 1000)$ ; the middle element is $100$ . Why this step? The median only cares about rank, not magnitude, so one extreme value can never move it past the true cluster.
General guarantee. With three inputs where two are healthy and one is arbitrarily bad, the two healthy values occupy ranks that surround the middle, so the median is always one of the healthy values. Why this step? This is the mathematical reason analog TMR voters use median (rule 3), not mean.

Verify: average $= 400$ , median $= 100$ ; only median matches the two-of-three cluster. ✅

Example 8 — Cell H: the reliability boundary $R \to 0, 0.5, 1$

Forecast: at which $R$ do the TMR curve and the line $y = R$ cross?

The figure plots both $y = R$ (single module, dashed white) and $y = 3 R^{2} - 2 R^{3}$ (TMR, cyan). Read it left to right: below the crossover the cyan curve dips under the white line (TMR hurts); above it the cyan curve bulges over (TMR helps). The amber dots mark the three crossings we are about to derive.

Figure s03 — horizontal axis is module reliability $R$ from 0 to 1; vertical axis is system reliability. White dashed line $y = R$ = single module. Cyan curve $y = 3 R^{2} - 2 R^{3}$ = TMR. Amber dots at $R = 0, 0.5, 1$ are the crossings. Cyan shading marks $R > 0.5$ where TMR is above the line (helps); the label "TMR hurts" sits in the region $R < 0.5$ where the cyan curve is below the white line.

Evaluate the corners.
- $R = 0.4$ : $3 (0.16) - 2 (0.064) = 0.48 - 0.128 = 0.352 < 0.4$ — TMR worse.
- $R = 0.5$ : $3 (0.25) - 2 (0.125) = 0.75 - 0.25 = 0.5 = R$ — TMR ties.
- $R = 0.9$ : $3 (0.81) - 2 (0.729) = 2.43 - 1.458 = 0.972 > 0.9$ — TMR helps.
- $R = 1.0$ : $3 - 2 = 1$ — perfect stays perfect. Why this step? Numbers first, so the algebra below has something concrete to explain.
Solve the crossover equation explicitly. Set the two curves equal and move everything to one side: $3 R^{2} - 2 R^{3} = R ⟹ 3 R^{2} - 2 R^{3} - R = 0.$ Factor out $R$ : $R (3 R - 2 R^{2} - 1) = 0 ⟹ - R (2 R^{2} - 3 R + 1) = 0.$ Factor the quadratic $2 R^{2} - 3 R + 1 = (2 R - 1) (R - 1)$ , so $- R (2 R - 1) (R - 1) = 0 ⟹ R (2 R - 1) (R - 1) = 0.$ Each factor gives one root: $R = 0, 2 R - 1 = 0 \Rightarrow R = \frac{1}{2}, R - 1 = 0 \Rightarrow R = 1.$ Why this step? A strict derivation proves the crossover set is exactly ${0, \frac{1}{2}, 1}$ — no guessing from the graph. The only interior crossing is $R = \frac{1}{2}$ , which is the practical threshold.
Read the limits. At $R \to 0$ the curve pins to $0$ (all dead); at $R \to 1$ it pins to $1$ (all perfect). Between the roots $0$ and $\frac{1}{2}$ the cyan curve is below the line; above $\frac{1}{2}$ it is above. Why this step? Confirms the figure's shading is exactly the algebra: TMR helps iff $R > \frac{1}{2}$ .

Verify: $R_{TMR} (0.4) = 0.352$ , $R_{TMR} (0.5) = 0.5$ , $R_{TMR} (0.9) = 0.972$ , $R_{TMR} (1) = 1$ ; factored roots of $3 R^{2} - 2 R^{3} = R$ are ${0, 0.5, 1}$ . ✅

Example 9 — Cell I: real-world furnace safety cutoff

Forecast: two sensors are above $900$ , one below — what's the middle value, and does it exceed the limit?

Median-of-three. Sort $(870, 905, 908)$ ; middle $= 905$ . Why this step? Rule 3 always returns a number (a safety limit-check must never receive "no-consensus" and stall); it is robust to the single low reading ( $870$ ), the likely drifting sensor.
Compare to threshold. $905 > 900$ ⇒ trip. Why this step? The trusted value, not any single sensor, drives the safety action — the whole point of a voter.
Sanity on the discarded low reading. Had we (wrongly) used the minimum $870$ , we'd miss a genuine over-temperature — a dangerous silent failure. Why this step? Confirms median (not min, not average) is the safe choice for a limit check.

Verify: median $(870, 905, 908) = 905$ ; $905 > 900 \Rightarrow$ trip $=$ True. ✅ (Units: all °C, consistent.)

Example 10 — Cell J: exam twist, identical common-cause fault

Forecast: which value has two votes — and is it the right one?

Count matches. Value $50$ appears twice (bit-identical), $75$ once. Majority $= 50$ . Why this step? The voter is blind to correctness; it only counts agreement. Two wrong-but-identical outputs win.
Diagnose the failure of the independence assumption. TMR's reliability math assumed modules fail independently. A shared bug is a common-cause failure — it corrupts two modules the same way, so the vote confidently returns garbage. Why this step? This is the exam trap: TMR does not protect against faults common to multiple channels. See Common-Cause Failures and Byzantine Fault Tolerance.
The fix is diversity, not more copies. Use design diversity — different algorithms or teams per channel — so a single bug cannot infect two modules identically. Why this step? Redundancy multiplies hardware; diversity removes shared failure modes.

Verify: matches for $50$ is $2 \geq 2$ ⇒ voter outputs $50$ (wrong), while the truth is $75$ ; independence assumption violated. ✅

Example 11 — Cell K: a plausible liar inside the tolerance window

Forecast: the liar is only $8$ away from truth. With a generous window it "joins" the honest pair — does it corrupt the returned value?

Tolerance $τ = 12$ . Distances: $∣100 - 100∣ = 0$ , $∣100 - 108∣ = 8$ , $∣100 - 108∣ = 8$ — all $\leq 12$ , so all three form one cluster ${100, 100, 108}$ . Why this step? The liar is close enough to be admitted into the cluster; this is exactly what a smart adversary aims for.
Return the cluster median — the honest majority still dominates. Sort ${100, 100, 108}$ ; median $= 100$ . Why this step? Here is the payoff of voting on the median of the cluster (rule 2, from the definition box): even though the liar entered the cluster, the two honest $100$ s occupy the lower and middle ranks, so the median is $100$ . A single liar within tolerance cannot move the median past the honest pair. Compare this with averaging the cluster, which would give $\frac{100 + 100 + 108}{3} = 102.67$ — corrupted by the lie.
Tolerance $τ = 5$ . Now $∣100 - 108∣ = 8 > 5$ , so the liar is excluded; the honest pair ${100, 100}$ still clusters (distance $0 \leq 5$ ), median $= 100$ . Why this step? A tighter window rejects the liar outright — same correct answer, and now the disagreement is visible to diagnostics.
Where the liar wins. A single within-tolerance liar cannot flip a median-based vote as long as the two honest modules agree. TMR's guarantee ends the moment two channels lie the same way (that is Ex 10's common-cause case, or a coordinated Byzantine attack) — which is exactly why Byzantine Fault Tolerance needs more than three replicas. Why this step? Draws the precise boundary of what one adversary can and cannot do.

Verify: With $τ = 12$ , cluster median $(100, 100, 108) = 100$ (lie masked); the cluster average would be $\approx 102.67$ (corrupted). With $τ = 5$ , liar excluded, honest median $= 100$ . ✅

Recall Self-test

What does "equality" mean in exact-bit majority (rule 1)? ::: The raw bit patterns are identical (a bit-for-bit XOR is all zeros); numerically-close-but-not-identical does not count. When does tolerance-cluster voting (rule 2) return an error? ::: When no group of at least two readings lies within $τ$ of each other, e.g. $(100, 105, 110)$ with $τ = 3$ . Why return the cluster median rather than "the first value found"? ::: The median of the cluster is order-independent and symmetric; "first found" depends arbitrarily on scan direction when several values qualify. Which voter must always output a number with no error branch? ::: Median-of-three (rule 3) — used when a downstream controller cannot stall on "no-consensus" (e.g. the furnace limit check). Can one within-tolerance Byzantine liar corrupt a cluster-median vote? ::: No — as long as the two honest modules agree, the median stays on the honest value; averaging the cluster would be corrupted. At what module reliability does TMR stop helping, and how do we prove it? ::: At $R = \frac{1}{2}$ ; factor $3 R^{2} - 2 R^{3} = R$ into $R (2 R - 1) (R - 1) = 0$ , giving roots ${0, \frac{1}{2}, 1}$ . What kind of fault defeats a majority voter entirely? ::: A common-cause failure that corrupts two modules identically, e.g. $(50, 50, 75)$ returning the wrong $50$ .