Voting Redundancy and Average Probability of Failure on Demand

A redundant channel arrangement is described by a shorthand that looks like arithmetic and is not: 1-out-of-2 means the function is performed if one of two channels is healthy, 2-out-of-3 means two of three must agree. The shorthand hides the two questions that determine whether the arrangement meets its target. The first is what the voter does when the channels disagree, because disagreement is the normal state after a single failure and the arrangement’s usefulness depends entirely on that behaviour. The second is how the arrangement’s failure probability is calculated, because the intuitive answer, the product of two small numbers, is wrong by one to three orders of magnitude once common cause is included.

The PFD integral and why the answer is an average

In low demand mode, a channel’s contribution to the probability of failure on demand is the probability that it is failed at the moment a demand arrives. That probability is not constant: a channel starts a proof-test interval healthy, its undetected dangerous failures accumulate, and the proof test detects and repairs them. If undetected dangerous failures arrive as a Poisson process with rate lambda, the probability of being failed at time t after the test is approximately lambda times t, and the average over an interval of length T is the integral of that linear ramp divided by T, which is lambda times T divided by two.

That factor of one half is the entire reason the proof-test interval matters so much. Doubling T doubles the average PFD, so a channel that just meets a target with an annual proof test would miss it by a factor of two with a two-year interval. The linear approximation holds while lambda times T is small, which is the case for any credible safety channel; when it is not small, the exact expression is one minus the exponential, and the approximation is no longer adequate.

Detected dangerous failures enter the same calculation differently. A failure that diagnostics detect within a diagnostic test interval contributes an exposure of roughly lambda times the interval rather than half of it, and the repair time adds a term proportional to the failure rate times the mean time to restore. In a channel whose diagnostics cover most of its failure modes, the detected term can dominate the undetected one, which is why the diagnostic coverage figure and the repair time both appear in the calculation alongside the proof-test interval.

The average is a design convenience and a real limitation. The actual probability at the end of the interval is twice the average, so a demand arriving just before a proof test sees a channel that is twice as likely to be failed as the number in the safety case suggests. Where demands are not uniformly distributed in time, and where the process has states that make demands more likely at particular moments, the average is the wrong statistic and the calculation should use the distribution of demand times instead.

1-out-of-2 and the common-cause floor

Two channels in a 1-out-of-2 arrangement fail the function only if both fail. Without common cause, the average PFD for the pair is of order lambda squared times T squared divided by three, which for a channel at 10^-6 per hour with an annual test interval is around 10^-5: roughly two orders of magnitude better than the single channel’s 4.4 times 10^-3.

The pair does not achieve that, because the channels are not independent. The standard treatment splits each channel’s undetected dangerous failure rate into an independent fraction and a common-cause fraction, with beta denoting the common-cause share. The pair’s PFD then becomes the sum of an independent term, of order the square of the reduced rate, and a common-cause term that is linear in the failure rate: beta times lambda times T divided by two. The second term dominates whenever beta is larger than roughly the product of the rate and the interval, which is essentially always.

Working the numbers makes the point concrete. With lambda at 10^-6 per hour and a one-year interval of 8,760 hours, a single channel gives 4.4 times 10^-3, which sits in the second integrity level’s band. A 1-out-of-2 pair with beta at 0.1 gives a common-cause term of 4.4 times 10^-4 and an independent term around 2 times 10^-5, totalling roughly 4.6 times 10^-4, which reaches the third level’s band. The pair improved the number by a factor of ten, not by a factor of a thousand, and almost all of the improvement came from the independent share of the failures. Setting beta to 0.01 instead gives 4.4 times 10^-5, another factor of ten, which shows that the common-cause fraction is the parameter worth attacking.

This is why Common-Cause Failure and What Design Diversity Actually Buys treats beta as the central quantity. Redundancy without diversity hits a floor set by beta, and adding channels barely moves it.

2-out-of-3 and the meaning of disagreement

A 2-out-of-3 arrangement performs the function when at least two channels agree, which buys something 1-out-of-2 does not: the ability to keep operating correctly after one channel has failed, and to identify which channel is the odd one out. The identification is the valuable part, because a disagreeing channel can be flagged for maintenance while the function continues, and availability stays high without weakening the safety claim.

The PFD of a 2-out-of-3 arrangement is worse than that of a 1-out-of-2 built from the same channels, and the reason is structural rather than numerical: a pair fails when both its members fail, while a triple fails when any two of its three fail, and there are three such pairs. The independent term therefore grows by a factor of three relative to the pair, while the common-cause term is set by the shared cause and is not reduced by adding channels. The arrangement is chosen for availability and fault isolation, not for the lowest achievable PFD, and a safety case that uses 2-out-of-3 must justify why the availability benefit is worth the higher failure probability.

The voter is where the arrangement’s real complexity lives. A 2-out-of-3 voter must handle four situations, and only the first is easy.

All three agree: the output is the agreed value, and the voter does nothing interesting.

Two agree and one differs: the output is the majority value, and the differing channel is declared faulty. The declaration must be sticky, because a channel that produced one wrong value and then recovers is not trustworthy, and a voter that forgets the disagreement will re-admit it. The declaration must also be recorded somewhere that survives the mission, since the maintenance action depends on it.

All three differ: there is no majority, and the voter has no basis for choosing. The safe response is to declare the arrangement failed and drive the outputs to the safe state, which for a fail-operational system is itself a serious event. Voters that pick the median value in this case are making a choice that the majority rule does not license, and the choice must be argued explicitly if it is made at all.

One channel is silent and two agree: the arrangement still has a majority, but the voter must distinguish silence from disagreement, because a silent channel is a failed channel and the remaining pair is now a 1-out-of-2 with no further fault tolerance. The system should announce the degradation rather than continue as if nothing happened.

The last case is where the state machine matters. A 2-out-of-3 arrangement that loses a channel is now a 1-out-of-2, and the PFD that the safety case claims for the triple no longer applies. The claimed figure has to be the figure for the degraded state weighted by the probability of being in it, or the architecture has to limit how long it may operate degraded. Aviation practice handles this with a dispatch decision: the aircraft may fly with one channel failed for a bounded number of flights, and the bound is derived from the degraded PFD rather than chosen for convenience.

A voter that latches dissent and refuses to guess

The voter’s own logic is part of the safety claim, which constrains it to be small enough that every branch can be exercised. The version below excludes channels already marked faulty, requires a strict majority among the healthy ones, and latches every dissenter.

/* 2-of-3 voter with sticky fault latching. A channel marked faulty stays
   excluded until the proof test clears the mask, so one bad value cannot
   be silently outvoted twice in the same interval. */
static uint8_t faulty_mask;

/* Returns the agreed value, or -1 when the healthy channels cannot agree. */
int vote3(int v0, int v1, int v2)
{
    int v[3] = { v0, v1, v2 };
    int healthy = 0, ones = 0;

    for (int i = 0; i < 3; i++) {
        if (faulty_mask & (1u << i))
            continue;
        healthy++;
        ones += v[i] ? 1 : 0;
    }

    /* Fewer than two healthy channels, or an exact tie, leaves no
       majority: the caller must drive the safe state rather than guess. */
    if (healthy < 2 || ones * 2 == healthy)
        return -1;

    int majority = (ones * 2 > healthy);

    /* Latch every healthy channel that dissented. */
    for (int i = 0; i < 3; i++)
        if (!(faulty_mask & (1u << i)) && v[i] != majority)
            faulty_mask |= 1u << i;

    return majority;
}

The mask must be cleared only by a proof test, which means it lives in memory the proof-test procedure explicitly resets. Without the latch, a channel that returns to agreement after one wrong value is indistinguishable from a channel that was never wrong, and the maintenance action the disagreement should have triggered is lost.

Removing the voter as a single point of failure

A software voter can fail to a state of “always return the first channel’s value”, and when it does, the claimed PFD for the arrangement no longer applies: the triple has become a single channel with no indication. Two structural responses are available.

The first keeps a central voter but implements it in hardware whose failure modes are enumerable, such as a small programmable logic device with an independent clock, and compares its output against a second implementation. A gate-level majority of three is a small combinational network whose stuck-at failure modes can be analysed exhaustively, which is not true of a processor executing a voting function.

The second distributes the voting so that agreement is physical. Each channel drives a shared open-drain line for its value, and the actuator enable is a conjunction of the line states rather than a computed result.

/* Distributed agreement over two open-drain lines with pull-ups. A channel
   commanding one pulls AGREE_LO down; a channel commanding zero pulls
   AGREE_HI down. A line reads high only if every channel released it, so
   the pair encodes the value and unanimity without a central voter. */
static int channel_agree(uint8_t value)
{
    gpio_write(AGREE_LO, value ? 0 : 1);
    gpio_write(AGREE_HI, value ? 1 : 0);

    /* Give the pull-ups time to restore the released line, then sample:
       unanimity on one leaves HI high and LO low, unanimity on zero leaves
       the reverse, and a mixture leaves both lines low. */
    delay_settle();
    uint8_t hi = gpio_read(AGREE_HI);
    uint8_t lo = gpio_read(AGREE_LO);

    return value ? (hi == 1 && lo == 0) : (hi == 0 && lo == 1);
}

The failure modes are worth stating because they are not symmetric. A channel whose driver fails open releases both lines, so it dissents from whatever the others command and the arrangement degrades to a pair. A channel whose driver fails shorted holds one line low permanently, so agreement is never reported for either value, which is the safe direction for a fail-silent design and a permanent nuisance for availability. Neither failure can make the arrangement report agreement on a value the healthy channels did not command, which is the property that matters. The limitation is that the scheme detects unanimity rather than majority, so it implements 3-out-of-3 agreement at the wire and leaves the majority decision to logic that still needs its own argument.

Choosing between the arrangements

The choice is not a matter of picking the highest number of channels. A 1-out-of-2 arrangement is the cheapest way to get a factor set by beta, and it suits functions where a trip is acceptable. A 2-out-of-3 arrangement costs a third channel, a voter, and a degradation policy, and it suits functions where spurious trips are expensive or where continued operation after a failure is required. A single channel with strong diagnostics can meet a lower integrity target at a fraction of the cost, and the honest engineering question is whether the target demands redundancy at all.

The architecture also interacts with the hardware fault tolerance requirement, which is not the same thing as the PFD target. IEC 61508 requires a minimum hardware fault tolerance for a given integrity level and a given safe failure fraction, and that requirement can force redundancy even where the PFD arithmetic would be satisfied by a single channel. The two constraints are evaluated separately, and a design that satisfies one while failing the other is not compliant. Fault tolerance is a statement about the architecture’s ability to survive a fault; the PFD calculation is a statement about the probability of failing a demand. They answer different questions, and both have to be answered before the arrangement can be claimed.

The interaction with detection is the third constraint. The safe state has to be reachable when the voter declares failure, and that path is the subject of Safe States and Fail-Silent Behaviour in Control Systems. A voter that correctly identifies a disagreement but cannot drive the actuator to a safe value has converted a detected fault into an undetected hazard, which is the worst outcome the architecture can produce.