Applying Triple Modular Redundancy Principles

In this lesson, you will learn how to design a majority-voting architecture that masks single-point hardware failures using Triple Modular Redundancy (TMR).

The Concept of TMR

Triple Modular Redundancy is a fault-tolerance technique where three identical hardware modules perform the same computation in parallel. Because a single-point failure (like a bit-flip caused by radiation or a logic gate failure) is unlikely to occur in two modules simultaneously, the system can use a "voter" circuit to determine the correct result by taking a majority vote. If one module produces a corrupted output, the voter ignores it and passes the two matching, correct results forward.

Implementing a Majority Voter

In an embedded system, the voter is the most critical piece of infrastructure because it is the "single point of failure" for the redundancy scheme. To keep the design robust, the voter itself should ideally be simple, hardware-based, and verified using the assertions for runtime verification techniques we discussed previously.

Consider this simplified logic for a voter processing three binary outputs:

typedef enum { LOW = 0, HIGH = 1 } signal_t;

signal_t majority_voter(signal_t a, signal_t b, signal_t c) {
    // Basic majority logic: if at least two are HIGH, output HIGH
    if ((a == HIGH && b == HIGH) || (a == HIGH && c == HIGH) || (b == HIGH && c == HIGH)) {
        return HIGH;
    }
    return LOW;
}

Critical Design Considerations

While the logic seems straightforward, applying TMR in safety-critical systems requires careful attention to synchronization. If your three processing units are not executing in lockstep—meaning they are not processing the exact same inputs at the same clock cycle—the voter will receive mismatched data even when the hardware is healthy.

Furthermore, you must account for common cause failures. If all three modules share the same power rail or clock source, a single electrical surge could disable all three simultaneously, rendering your TMR useless. To maximize reliability, designers often use independent power domains and physically separated hardware components for each of the three modules to ensure that a failure in one is truly isolated from the others.

Key Takeaway: TMR masks hardware faults by comparing three parallel outputs through a majority voter, ensuring that the system continues to operate correctly even when one module experiences a terminal hardware failure.