Technology / Technical guide
Redundant Sensors: Voting, Agreement & Common Causes
Several measurements can provide more information than one, but sensor count alone does not establish trustworthy feedback. Voting can suppress an isolated disagreement under stated assumptions while shared faults or biases affect every channel. Agreement and correctness remain different properties.
A majority can agree on the same wrong information.
Understand the represented quantity, independence assumptions and decision rule before interpreting redundancy as failure tolerance.
01 / Comparable channels
Redundancy needs the same intended information.
Three values only form comparable observations when they refer to the same quantity, boundary and time basis.
Three values only form comparable observations when they refer to the same quantity, boundary and time basis. A motor angle, nacelle heading and requested orientation are not three independent measurements of the same physical output.
Delayed or differently filtered channels can disagree during a change without any component being faulty. The filtering guide explains that effect. Validity and signal meaning precede a voting rule.
02 / Decision rule
Binary majority and an analogue median are different.
A binary two-out-of-three rule takes the state reported by at least two eligible channels.
A binary two-out-of-three rule takes the state reported by at least two eligible channels. An analogue median selects the middle value in an ordered set. Each is a defined mathematical rule; neither automatically identifies which sensor is physically correct.
Hypothetical scalar readings: 40, 41 and 80 units have median 41 units. The median limits one extreme’s influence in this set. Without a reference or justified channel assumptions, the calculation cannot prove that 80 is faulty or that 41 equals the physical quantity.
03 / Independent model
A numerical voting benefit depends on assumptions.
Consider an invented binary model where each of three channels independently reports the wrong state with probability q = 0.10 for one observation.
Consider an invented binary model where each of three channels independently reports the wrong state with probability q = 0.10 for one observation. A majority is wrong when exactly two or all three are wrong: 3q²(1−q) + q³ = 0.028.
The 2.8% result belongs to that independent, identical-error-probability model. It is not a failure rate per hour, a MARSTON result or a system-safety claim. It changes if the channels share error causes, have different probabilities or do not observe the same state.
04 / Common causes
Shared dependencies can defeat the independent model.
A common supply, environment, mounting influence, processing error or copied calibration bias can affect several channels together.
A common supply, environment, mounting influence, processing error or copied calibration bias can affect several channels together. Extra channels do not remove a dependency that every one shares. The probability of several errors is then not obtained by multiplying independent probabilities.
NASA’s fault-management draft emphasises that a tolerance mechanism covers specified fault classes, rather than every failure. The voting benefit must be understood within that scope. Dissimilar channels can change dependencies but also introduce different quantities or response characteristics.
05 / Diagnosis boundary
Disagreement and fault isolation are not identical.
A disagreement can be detected without uniquely identifying its cause.
A disagreement can be detected without uniquely identifying its cause. Two agreeing channels may share a bias while a third provides the better observation. If one channel becomes unavailable, the information and decision problem change again.
The voter, communication and resulting control path are also system components. Reliable individual observations do not establish reliable selection or actuator behaviour. The failure-response guide addresses the complete functional consequence.
06 / Product scope
Sensor count does not establish a safety level.
No redundant heading sensors, voter, fault-isolation logic or alternative feedback path is confirmed for MARSTON by these concepts.
No redundant heading sensors, voter, fault-isolation logic or alternative feedback path is confirmed for MARSTON by these concepts. An ideal probability calculation cannot substitute for applicable functional-safety assessment or establish SIL.
The examples give no voting threshold, channel bypass, fault injection or wiring procedure. Their purpose is to explain why a selected mathematical rule and its independence assumptions must remain separate from an implemented control system.
Continue the review with Yaw Feedback: Setpoint, Measurement & Closed-Loop Error.
Continue the review with Fail-Safe & Fail-Operational: Wind Control Concepts.
Continue the review with Wind Sensors: Resolution, Repeatability & Hysteresis.
General background: NASA fault-management handbook draft: fault tolerance and response terminology. These references explain industry concepts; they are separate from the applicable MARSTON product and project documents.
Key concepts and conditions.
Read each quantity with its reference, units and stated conditions. A general relation does not establish a model-specific value.
| Concept / quantity | Meaning / relation | Conditions / limits |
|---|---|---|
| Channel comparability | Quantity, location and represented time | Different signals need not be redundant observations. |
| Binary vote | Two eligible matching states out of three | Decision rule is distinct from physical truth. |
| Median | Middle ordered scalar reading | It limits an extreme but does not diagnose it. |
| Independent probability | 3q²(1−q)+q³ | Identical independent binary errors are assumed. |
| Common cause | Shared influences on several channels | Independent probability multiplication may fail. |
Engineering questions.
Do three sensors automatically prove correct feedback?
No. Comparability, validity and shared dependencies matter.
Does median 41 prove the 80-unit channel failed?
No. The invented readings alone cannot identify the physical truth.
Is 2.8% a product failure probability?
No. It belongs only to the stated ideal binary observation model.
Does voting remove a shared bias?
Not automatically. Several channels can agree on the same biased value.
Does redundancy count establish SIL?
No. A safety level requires its own applicable assessment.
Are redundant MARSTON sensors specified here?
No actual sensor count or voting implementation is assigned.
Technical enquiry
Discuss the technical question.
Several measurements can provide more information than one, but sensor count alone does not establish trustworthy feedback. Share the model and applicable operating or design information for an engineering discussion.