TMR — Architecture & Fault Masking
Overview
Triple‑Modular Redundancy (TMR) is a fault‑tolerance technique based on three redundant channels executing the same logical function. A majority voter selects the value agreed upon by at least two channels, allowing the system to mask a single fault and continue operating correctly. TMR is used when fault detection alone is insufficient and continuous correct operation must be guaranteed.
Why TMR? Detection vs Masking
Dual‑core lockstep (DMR) provides fault detection: if the two cores disagree, a fault is detected and the system must transition to a safe state. TMR provides fault masking: if one channel is faulty, the other two outvote it and the system continues operating correctly. This distinction is essential in systems where availability is as important as safety.
TMR Architecture
A realistic implementation uses a single CPU core that writes a safety‑critical value into three redundant registers. A majority voter then selects the value agreed upon by at least two copies. The figure illustrating this mechanism should be placed here.
Figure 1: TMR Majority Voter (Realistic Single‑Core Case)
Triple‑modular redundancy (TMR). A single CPU core writes the same safety‑critical value into three redundant registers. A majority voter selects the value agreed upon by at least two copies, masking single‑bit or single‑channel faults. Unlike dual‑core lockstep, which detects faults, TMR provides fault masking.
Failure Modes in TMR
- Double faults — if two channels fail in the same way, the voter cannot mask the error.
- Common‑cause faults — shared disturbances may affect all channels unless diversity is added.
- Voter failure — the majority voter becomes a single point of failure unless protected.
- Latent faults — masked faults may remain undetected without periodic diagnostics.
Design Considerations
Spatial diversity
Place the three channels physically apart to reduce the probability of a single disturbance affecting all of them.
Temporal diversity
Introduce small timing offsets between channels to avoid simultaneous corruption.
Voter protection
Use hardened logic, parity, or triplicated voters in high‑integrity systems.
Diagnostic coverage
Even though TMR masks faults, the system must still detect and log them to avoid accumulating latent failures.
Where TMR Is Used
- Flight control computers
- Spacecraft processors
- Nuclear plant controllers
- Railway interlocking systems
- High‑integrity industrial automation
- Radiation‑hardened microcontrollers
