Triple-Modular Redundancy and Voting
Critical L1 channels are triplicated and voted so a single fault is outvoted, giving fail-operational behavior without a single point of failure.
Surviving a single fault
A fail-operational function cannot rest on one channel — that channel is a single point of failure. Kronos triplicates the most critical control and protection channels and votes their outputs: triple-modular redundancy (TMR). With three independent channels and a 2-of-3 voter, one channel's fault is outvoted and the correct action still issues.
How voting works
Three identical channels compute the same result from independent sensing where possible. A voter compares them and forwards the majority. If one disagrees, the majority prevails and the dissenter is flagged for maintenance. The voter itself is simple hardware — its logic is small enough to be highly reliable and, where required, itself redundant.
| Ch A | Ch B | Ch C | Voted |
|---|---|---|---|
| 1 | 1 | 1 | 1 |
| 1 | 1 | 0 | 1 |
| 1 | 0 | 1 | 1 |
| 0 | 1 | 1 | 1 |
| 1 | 0 | 0 | 0 |
| 0 | 1 | 0 | 0 |
| 0 | 0 | 1 | 0 |
| 0 | 0 | 0 | 0 |
The table is the 2-of-3 majority: the output follows whichever value at least two channels agree on, so any single channel error is masked. This is applied to protection trips, key stability channels, and safety-critical estimates.
Independence of channels
- Separate sensing paths where feasible, to avoid common-cause faults.
- Separate fabric regions / devices, separate power where practical.
- Diverse implementation for the highest grades, to avoid shared design flaws.
- Disagreement logged so latent faults are found before a second one occurs.
Cost and placement
TMR is not free — three times the channels — so Kronos applies it where the integrity grade demands fail-operational behavior, not everywhere. The passive magnet failsafe uses redundant channels for the same reason: no single element's failure may defeat protection.