Voting and Redundancy Architecture
Critical safety signals are triplicated and voted so that a single failed channel is outvoted and flagged, not obeyed.
Two-out-of-three, and why
A single sensor or channel can fail in a way that reads plausible but wrong. Kronos triplicates the most critical safety signals and votes them two-out-of-three (2oo3). A single deviating channel is outvoted, the machine keeps running on the agreeing pair, and the odd channel is flagged for maintenance. Two channels must fail the same way at the same time to defeat the vote, which is far less likely than one.
| Ch A | Ch B | Ch C | Voted | Fault flag |
|---|---|---|---|---|
| 1 | 1 | 1 | 1 | none |
| 1 | 1 | 0 | 1 | C |
| 1 | 0 | 1 | 1 | B |
| 0 | 1 | 1 | 1 | A |
| 1 | 0 | 0 | 0 | A |
| 0 | 0 | 0 | 0 | none |
def vote_2oo3(a, b, c):
voted = (a and b) or (a and c) or (b and c)
disagree = [name for name, v in (('A',a),('B',b),('C',c)) if v != voted]
return voted, disagree # value + which channel to flagDegrading gracefully
When one channel is flagged out, the survivors form a 1oo2 pair. The design chooses whether the remaining pair votes conservatively (either can trip) or agreeing (both must confirm) based on whether the function is trip-critical or availability-critical. Safety-critical trips favor 1oo2 trip-if-either; the trade is a slightly higher spurious-trip rate, accepted deliberately.
The choice between 1oo2 trip-if-either and 2oo2 confirm-both after a channel is lost is made per function and recorded, because it trades spurious-trip rate against missed-trip rate and only the hazard analysis knows which way to lean. Safety-critical protections accept more spurious trips to guarantee real ones; availability-critical but non-hazardous functions lean the other way. Voting logic itself is kept simple enough to verify by inspection, since a clever voter is a common-cause hazard.
Redundancy defends against random channel failure but not against a common cause that takes all three at once — a shared power rail, a shared calibration error, a shared firmware bug. That gap is closed by diversity, covered in common-cause failure mitigation. Voting composes with watchdog supervision, which itself votes on liveness.