Worked examples — Redundancy — TMR (triple modular redundancy), voting logic

5.5.25 · D3 · Coding › Embedded Systems & Real-Time Software › Redundancy — TMR (triple modular redundancy), voting logic

Yeh page TMR parent topic ke under rehti hai. Yahan hum voting ke baare mein baat karna band karke actually karte hain — ek triple-modular-redundant system ke saath aane wale har tarah ke input ke liye. Agar module, voter ya majority jaise words naye hain toh pehle parent padho; baaki sab yahan se zero se rebuild karte hain.

---

Scenario matrix

Neeche har cell teen inputs $(y_1,y_2,y_3)$ ki ek alag shape hai. Har worked example un cells ke saath tagged hai jo woh cover karta hai.

Cell	Input pattern	Kya test karta hai	Example
A	Teeno exactly equal	Fault-free "happy path"	Ex 1
B	Exactly do equal, ek alag	Single masked fault	Ex 1, Ex 2
C	Teeno alag (koi consensus nahi)	Voter decide karne mein fail hota hai	Ex 3
D	Close-but-not-equal (analog noise)	Tolerance clustering vs. median	Ex 4
E	Ek module silent (koi output nahi)	Degenerate input, fail-silent	Ex 5
F	Binary $\{0,1\}$ inputs	Digital majority gate, saare 8 rows	Ex 6
G	Ek wild outlier	Median beats average	Ex 7
H	Limiting reliability $R\to 0,0.5,1$	Boundary of TMR kab help karta hai	Ex 8
I	Real-world word problem	Furnace safety cutoff	Ex 9
J	Exam twist: do modules identically fail	Common-cause defeats voting	Ex 10
K	Tolerance ke andar plausible liar	Byzantine/adversarial module	Ex 11

---

Example 1 — Cells A & B: happy path aur ek masked fault

Forecast: padhne se pehle dono answers guess karo — kya run β ka koi defined output bhi hai?

1. Run α — agreements count karo. Teeno bit patterns $850$ ke equal hain, toh $\#\{i:\text{bits}(y_i)=\text{bits}(850)\}=3\ge 2$. Yeh step kyun? Rule sirf do bit-identical chahta hai; teen aur bhi safe hai. Output $=850$.
2. Run β — pairwise compare karo. $y_1=y_2=850$ par $y_3=920$. Pair $(y_1,y_2)$ bit-identical hai, toh majority $=850$. Yeh step kyun? "At least two bit-equal" $(y_1,y_2)$ se satisfy ho jaata hai; $y_3$ ki zaroorat nahi. $920$ reading masked ho jaati hai.
3. Fault ko naam do. Akela $920$ ek fail-incorrect bias hai (calibration drift), phir bhi TMR cope kar gaya kyunki baaki do healthy the. Yeh step kyun? Cell B dikhata hai: ek single wrong-but-plausible value survivable hai.

Verify: α mein, sab equal ⇒ output kisi bhi input ke equal hona chahiye, $850$. ✅ β mein, teen mein se do $850$ ke equal hain ⇒ output $850$, aur outlier ka distance $|920-850|=70$ kabhi result mein nahi aata. ✅

---

Example 2 — Cell B: flight control mein sign-flip fault

Forecast: galat value sahi value ki negative hai — kya woh voter ko fool kar sakta hai?

1. Pairs ko bit-compare karo. Voter magnitudes nahi, raw bit patterns ki equality check karta hai. ${\delta }_1$ aur ${\delta }_2$ ke identical bits hain; ${\delta }_3$ exactly sign bit mein differ karta hai. Yeh step kyun? Bit comparison ek single-cycle XOR-and-NOR hai — floating-point compare se kaafi faster, jo kilohertz control loops par matter karta hai. Yeh rule 1 mein "byte-for-byte equal" ka concrete matlab hai.
2. Majority mili. Pair $({\delta }_1,{\delta }_2)$ match karta hai, ${\delta }_3$ nahi ⇒ output $=5.2°$. Yeh step kyun? Bhale hi $-5.2°$ ek violent opposite roll command karta, woh minority of one hai aur discard ho jaata hai.
3. Aftermath. Aircraft $+5.2°$ deflection rakhta hai; ground logs module 3 ko flag karte hain (dekho Watchdog Timers — disagreement maintenance ke liye kaise record hota hai).

Verify: $\delta =K({\theta }_{\text{des}}-{\theta }_{\text{act}})$ set karo with $K=1.3,{\theta }_{\text{des}}=14°,{\theta }_{\text{act}}=10°$: $\delta =1.3\times 4=5.2°$. Do modules $5.2$ dete hain, output $5.2$; flipped $-5.2$ mask ho jaata hai. ✅

---

Example 3 — Cell C: no consensus (voter ko refuse karna padega)

Forecast: temptation hai ki kahein "beech wala $105$ pick karo." Kya yahi exact voting karta hai?

1. Har value ke liye exact matches count karo. $100$ ke liye: ek module. $105$ ke liye: ek. $110$ ke liye: ek. Koi value count $\ge 2$ tak nahi pahunchti. Yeh step kyun? Exact voting unforgiving hai — "close" matlab "bit-equal" nahi hota.
2. No-consensus return karo. Voter guess karne ki jagah error signal karta hai. Yeh step kyun? Yahan guess karna aisa trust fabricate karna hoga jo earn nahi hua. Ek safety-critical system ek jaani-hui failure prefer karta hai na ki ek silent galat answer (dekho Safety-Critical Systems Standards).
3. Escalate karo. Teen-way disagreement ke saath, TMR exhaust ho gaya; aapko higher redundancy (5-modular) ya fallback mode chahiye.

Verify: matches $=\max (1,1,1)=1<2$ ⇒ koi majority nahi ⇒ output error sentinel hai (None), $105$ nahi. ✅

---

Example 4 — Cell D: tolerance clustering (aur kyun hum cluster median return karte hain)

Forecast: $\pm 10$ window ke saath, kitne teeno cluster karte hain — aur hum wapas kaunsa ek number dete hain?

Is vote ki geometry ek number line hai jisme ek sliding tolerance window hai. Figure dekho: amber bars pairwise distances hain; cluster tab banta hai jab readings width $\tau$ ki ek window ke andar baithe hon.

Figure s01 — teen readings 100/105/110 ek number line par (cyan dots). Upar: $\tau =10$ ke saath poora trio ek window mein fit hota hai (cyan band), toh teeno cluster karte hain; amber tick returned value = cluster ka median = 105 mark karta hai. Neeche: $\tau =3$ ke saath koi bhi do readings 3 ke andar nahi hain, toh windows kabhi overlap nahi karti aur size ≥ 2 ka koi cluster nahi banta → no-consensus.

1. Agreement test banao. Do readings agree karti hain iff $|y_i-y_j|\le \tau$. Pairwise distances: $|100-105|=5$, $|105-110|=5$, $|100-110|=10$. Yeh step kyun? Rule 2 noise ke andar closeness se cluster karta hai, exact equality se nahi.
2. Sabse bada cluster dhundo ($\tau =10$). Teeno distances $\le 10$ hain, toh $\{100,105,110\}$ size $3\ge 2$ ka ek mutually-agreeing cluster hai. Yeh step kyun? $\ge 2$ ka cluster matlab TMR ka consensus hai.
3. Cluster ka median return karo — yeh order-dependence ka fix hai. Cluster hai $\{100,105,110\}$; uska median $105$ hai. Yeh step kyun? Reviewer ka trap: purane "pehli value jo threshold reach kare" rule se, $100$ aur $110$ dono ke $10$ ke andar teen neighbours hain, toh answer iteration order par depend karta tha. Cluster median return karna ek single, order-independent, symmetric choice hai — koi farak nahi padta ki list forward scan karo ya backward.
4. Ab window shrink karo ($\tau =3$). Distances $5,5,10$ sab $>3$ hain, toh koi pair agree nahi karta; size $\ge 2$ ka koi cluster nahi ⇒ no-consensus. Yeh step kyun? Trade-off dikhata hai: bahut-tight $\tau$ genuine agreement ko falsely reject karta hai; bahut-loose $\tau$ ek real fault ko cluster mein merge kar deta.

Verify: $\tau =10$ ke saath, cluster $=\{100,105,110\}$, uska median $=105$ (order-independent). $\tau =3$ ke saath, koi pair $3$ ke andar nahi ⇒ output None. ✅

---

Example 5 — Cell E: ek silent module (degenerate input)

Forecast: sirf do live inputs ke saath, kya "majority of three" phir bhi possible hai?

1. Missing ko "match nahi ho sakta" treat karo. Ek silent module kabhi kisi ke bit-equal nahi ho sakta, toh woh har match count mein $0$ contribute karta hai. Yeh step kyun? Isliye hum fail-silent ko fail-incorrect se prefer karte hain: ek missing value vote jeet nahi sakti.
2. Survivors mein matches count karo. $y_1=y_3=42$ ⇒ value $42$ ka count $2\ge 2$ hai. Yeh step kyun? TMR exactly ek lost module survive karne ke liye design kiya gaya tha; do agreeing survivors phir bhi majority banate hain.
3. Output $42$; degraded mode flag karo. System ab zero remaining tolerance ke saath hai — doosra fault fatal hoga. Ek watchdog yeh alarm raise karna chahiye.

Verify: live agreeing modules $=2$, threshold $=2\Rightarrow$ output $=42$; ek loss ke baad remaining redundancy $=0$. ✅

---

Example 6 — Cell F: digital majority gate, saare 8 rows

Forecast: aath rows mein se kitne $V=1$ dene chahiye? (Do-ya-teen ones wale rows count karo.)

1. Saare rows aur true majority list karo. Inputs $(M_1,M_2,M_3)$ ke saath:

   $M_1$	$M_2$	$M_3$	ones	majority	$V$ formula
   0	0	0	0	0	0
   0	0	1	1	0	0
   0	1	0	1	0	0
   0	1	1	2	1	1
   1	0	0	1	0	0
   1	0	1	2	1	1
   1	1	0	2	1	1
   1	1	1	3	1	1

   Yeh step kyun? Har row enumerate karna hi ek Boolean identity prove karne ka ek maatra tarika hai — koi case chhup nahi sakta.

2. Formula ko ek tricky row par check karo. Row $(1,0,1)$: $M_1{M}_2=0,M_2{M}_3=0,M_1{M}_3=1$ ⇒ $V=0+0+1=1$. Majority se match. Yeh step kyun? Do zeros do product terms ko vanish karwa dete hain; surviving pair-term fire karta hai. Isliye hum teen pair-products OR karte hain.

3. Count confirm karo. Exactly $4$ rows mein majority $1$ hai, aur formula exactly unhi $4$ par $1$ deta hai.

Verify: formula column saare 8 rows mein majority column ke equal hai; $1$s ki sankhya $=4$. ✅

---

Example 7 — Cell G: outlier par median beats average

Forecast: outlier baaki dono ka $10\times$ hai — kaunsa method use ignore karta hai?

Figure dikhata hai kyun: ek number line par, average ek balance point hai jise door-right wala outlier tip kar deta hai; median ek rank position hai jise outlier hila nahi sakta.

Figure s02 — teen readings number line par. Do cyan dots 100 par hain, ek amber outlier 1000 par. White triangle average (400) mark karta hai, outlier ki taraf rightward khicha hua; cyan arrow median (100) mark karta hai, sorting ke baad beech wala element, outlier ki magnitude se unhila hua.

1. Average. $\frac{100+100+1000}{3}=\frac{1200}{3}=400$. Yeh step kyun? Averaging ek single huge outlier ko answer drag karne deta hai — $400$ galat hai us value ke liye jo $100$ honi chahiye thi.
2. Median-of-three. Sort karo: $(100,100,1000)$; beech wala element $100$ hai. Yeh step kyun? Median sirf rank care karta hai, magnitude nahi, toh ek extreme value use kabhi true cluster se aage move nahi kar sakti.
3. General guarantee. Teen inputs ke saath jahan do healthy hain aur ek arbitrarily bad, do healthy values wo ranks occupy karti hain jo middle ko surround karti hain, toh median hamesha healthy values mein se ek hota hai. Yeh step kyun? Yahi mathematical reason hai ki analog TMR voters median (rule 3) use karte hain, mean nahi.

Verify: average $=400$, median $=100$; sirf median two-of-three cluster se match karta hai. ✅

---

Example 8 — Cell H: reliability boundary $R\to 0,0.5,1$

Forecast: kaunse $R$ par TMR curve aur line $y=R$ cross karte hain?

Figure dono plot karta hai: $y=R$ (single module, dashed white) aur $y=3R^2-2R^3$ (TMR, cyan). Left se right padho: crossover se neeche cyan curve white line ke neeche dip karta hai (TMR hurts); uske upar cyan curve upar bulge karta hai (TMR helps). Amber dots un teen crossings ko mark karte hain jo hum derive karne wale hain.

Figure s03 — horizontal axis module reliability $R$ hai 0 se 1 tak; vertical axis system reliability hai. White dashed line $y=R$ = single module. Cyan curve $y=3R^2-2R^3$ = TMR. Amber dots $R=0,0.5,1$ par crossings hain. Cyan shading $R>0.5$ mark karta hai jahan TMR line se upar hai (helps); label "TMR hurts" us region mein hai jahan $R<0.5$ mein cyan curve white line ke neeche hai.

1. Corners evaluate karo.
   • $R=0.4$: $3(0.16)-2(0.064)=0.48-0.128=0.352<0.4$ — TMR worse.
   • $R=0.5$: $3(0.25)-2(0.125)=0.75-0.25=0.5=R$ — TMR ties.
   • $R=0.9$: $3(0.81)-2(0.729)=2.43-1.458=0.972>0.9$ — TMR helps.
   • $R=1.0$: $3-2=1$ — perfect perfect rahta hai. Yeh step kyun? Pehle numbers, taaki neeche ka algebra kuch concrete explain kare.
2. Crossover equation explicitly solve karo. Dono curves equal set karo aur sab ek side move karo: $3R^2-2R^3=R⟹3R^2-2R^3-R=0.$ $R$ factor out karo: $R(3R-2R^2-1)=0⟹-R(2R^2-3R+1)=0.$ Quadratic $2R^2-3R+1=(2R-1)(R-1)$ factor karo, toh $-R(2R-1)(R-1)=0⟹R(2R-1)(R-1)=0.$ Har factor se ek root milta hai: $R=0,2R-1=0\Rightarrow R=\frac{1}{2},R-1=0\Rightarrow R=1.$ Yeh step kyun? Ek strict derivation prove karti hai ki crossover set exactly $\{0,\frac{1}{2},1\}$ hai — graph se guess nahi. Ek maatra interior crossing $R=\frac{1}{2}$ hai, jo practical threshold hai.
3. Limits padho. $R\to 0$ par curve $0$ par pin ho jaata hai (sab dead); $R\to 1$ par $1$ par pin hota hai (sab perfect). Roots $0$ aur $\frac{1}{2}$ ke beech cyan curve line ke neeche hai; $\frac{1}{2}$ ke upar woh upar hai. Yeh step kyun? Confirm karta hai ki figure ki shading exactly algebra hai: TMR helps iff $R>\frac{1}{2}$.

Verify: $R_{\text{TMR}}(0.4)=0.352$, $R_{\text{TMR}}(0.5)=0.5$, $R_{\text{TMR}}(0.9)=0.972$, $R_{\text{TMR}}(1)=1$; $3R^2-2R^3=R$ ke factored roots hain $\{0,0.5,1\}$. ✅

---

Example 9 — Cell I: real-world furnace safety cutoff

Forecast: do sensors $900$ se upar hain, ek neeche — beech wali value kya hai, aur kya woh limit exceed karta hai?

1. Median-of-three. Sort karo $(870,905,908)$; middle $=905$. Yeh step kyun? Rule 3 hamesha ek number return karta hai (ek safety limit-check ko kabhi "no-consensus" receive karke stall nahi hona chahiye); yeh single low reading ($870$) ke against robust hai, jo likely drifting sensor hai.
2. Threshold se compare karo. $905>900$ ⇒ trip. Yeh step kyun? Trusted value, koi bhi single sensor nahi, safety action drive karta hai — voter ka poora point yahi hai.
3. Discarded low reading par sanity check. Agar hum (galat tarike se) minimum $870$ use karte, toh ek genuine over-temperature miss ho jaata — ek dangerous silent failure. Yeh step kyun? Confirm karta hai ki limit check ke liye median (na min, na average) safe choice hai.

Verify: median$(870,905,908)=905$; $905>900\Rightarrow$ trip $=$ True. ✅ (Units: sab °C, consistent.)

---

Example 10 — Cell J: exam twist, identical common-cause fault

Forecast: kaunsi value ke do votes hain — aur kya woh sahi hai?

1. Matches count karo. Value $50$ do baar appear hoti hai (bit-identical), $75$ ek baar. Majority $=50$. Yeh step kyun? Voter correctness ke liye blind hai; woh sirf agreement count karta hai. Do wrong-but-identical outputs jeet jaate hain.
2. Independence assumption ki failure diagnose karo. TMR ki reliability math assume karti thi ki modules independently fail karte hain. Ek shared bug ek common-cause failure hai — yeh do modules ko same tarike se corrupt karta hai, toh vote confidently garbage return karta hai. Yeh step kyun? Yahi exam trap hai: TMR multiple channels par common faults ke against protect nahi karta. Dekho Common-Cause Failures aur Byzantine Fault Tolerance.
3. Fix redundancy nahi, diversity hai. Design diversity use karo — har channel ke liye alag algorithms ya teams — taaki ek single bug do modules ko identically infect na kar sake. Yeh step kyun? Redundancy hardware multiply karta hai; diversity shared failure modes remove karta hai.

Verify: $50$ ke liye matches $2\ge 2$ hain ⇒ voter $50$ output karta hai (galat), jabki truth $75$ hai; independence assumption violated. ✅

---

Example 11 — Cell K: tolerance window ke andar ek plausible liar

Forecast: liar sirf $8$ door hai truth se. Ek generous window ke saath woh honest pair mein "join" ho jaata hai — kya woh returned value corrupt kar deta hai?

1. Tolerance $\tau =12$. Distances: $|100-100|=0$, $|100-108|=8$, $|100-108|=8$ — sab $\le 12$, toh teeno ek cluster $\{100,100,108\}$ banate hain. Yeh step kyun? Liar itna close hai ki cluster mein admit ho jaata hai; yahi ek smart adversary aim karta hai.
2. Cluster median return karo — honest majority phir bhi dominate karta hai. Sort karo $\{100,100,108\}$; median $=100$. Yeh step kyun? Yahan cluster ka median vote karne ka payoff hai (rule 2, definition box se): bhale hi liar cluster mein ghus gaya, do honest $100$s lower aur middle ranks occupy karte hain, toh median $100$ hai. Tolerance ke andar ek single liar median ko honest pair se aage move nahi kar sakta. Compare karo cluster ko average karne se, jo $\frac{100+100+108}{3}=102.67$ deta — jhooth se corrupted.
3. Tolerance $\tau =5$. Ab $|100-108|=8>5$, toh liar exclude ho jaata hai; honest pair $\{100,100\}$ phir bhi cluster karta hai (distance $0\le 5$), median $=100$. Yeh step kyun? Ek tighter window liar ko outright reject karta hai — same correct answer, aur ab disagreement diagnostics ko visible hai.
4. Liar kab jeet sakta hai. Ek single within-tolerance liar median-based vote flip nahi kar sakta jab tak do honest modules agree karte hain. TMR ki guarantee us waqt khatam hoti hai jab do channels same tarike se jhooth bolte hain (woh Ex 10 ka common-cause case hai, ya ek coordinated Byzantine attack) — aur isliye Byzantine Fault Tolerance ko teen se zyada replicas chahiye. Yeh step kyun? Ek adversary kya kar sakta hai aur kya nahi, uski precise boundary draw karta hai.

Verify: $\tau =12$ ke saath, cluster median$(100,100,108)=100$ (lie masked); cluster average $\approx 102.67$ hota (corrupted). $\tau =5$ ke saath, liar excluded, honest median $=100$. ✅

---

Recall Self-test

Exact-bit majority (rule 1) mein "equality" ka kya matlab hai? ::: Raw bit patterns identical hote hain (bit-for-bit XOR saare zeros deta hai); numerically-close-but-not-identical count nahi hota. Tolerance-cluster voting (rule 2) error kab return karta hai? ::: Jab kam se kam do readings ka koi group $\tau$ ke andar na ho, jaise $(100,105,110)$ with $\tau =3$. Cluster median kyun return karte hain na ki "pehli mili value"? ::: Cluster ka median order-independent aur symmetric hota hai; "pehla mila" arbitrarily scan direction par depend karta hai jab kai values qualify karti hain. Kaunsa voter bina kisi error branch ke hamesha ek number output karta hai? ::: Median-of-three (rule 3) — jab downstream controller "no-consensus" par stall nahi kar sakta (jaise furnace limit check). Kya ek within-tolerance Byzantine liar cluster-median vote corrupt kar sakta hai? ::: Nahi — jab tak do honest modules agree karte hain, median honest value par rehta hai; cluster ko average karna corrupted ho jaata. Kaunse module reliability par TMR help karna band kar deta hai, aur hum ise kaise prove karte hain? ::: $R=\frac{1}{2}$ par; $3R^2-2R^3=R$ ko $R(2R-1)(R-1)=0$ mein factor karo, roots milte hain $\{0,\frac{1}{2},1\}$. Kaunsa fault majority voter ko completely defeat karta hai? ::: Ek common-cause failure jo do modules ko identically corrupt karta hai, jaise $(50,50,75)$ galat $50$ return karta hai.