DMR, TMR and common failures: what do agreeing copies prove?

Three verifiers vote to release the same failed image. One corrupted replica can be outvoted. A shared wrong input can make all three vote yes. Before counting copies, draw what they share.

Compare two copies; vote among three

A school trip keeps participation bits a, b, and c on copies of a roster. Two-copy DMR requires both to agree on permission. Three-copy TMR accepts at least two yes votes. From all-no, altering two copies to (1,1,0) permits boarding although the original eligibility ledger says no. Agreement and majority describe the copies' relationship. Three rosters do not automatically mean three independent eligibility checks.

Dual modular redundancy, DMR, keeps two copies and compares them. Our gate grants only when both one-bit copies are true. A disagreement raises bad and denies permission. This detects a single replica flip under the stated trusted-comparator model; it cannot identify which copy is right.

Triple modular redundancy, TMR, uses three copies. Majority returns true when at least two copies are true. With three correct false copies, one flip leaves the vote false. Two flips yield 110, so the majority grants although the image remains unauthorized.

The majority voter also exposes disagreement. We compare two policies: continue with majority, or reject whenever any copy differs. Reject-mismatch blocks the two-flip 110 case, but three flips produce unanimous 111. No equality check can distinguish that value from honest agreement.

For an authorized image, one flipped replica creates 011. Majority still grants; rejection blocks service. This is a real availability difference inside the model. It does not establish which policy fits a cryptographic operation whose faulty outputs might leak information.

Calculate the vote and its availability cost

Read the rosters in (a,b,c) order: two ones and one zero mean two yes votes and a mismatch. Majority continuation permits boarding; reject-mismatch refuses. For an eligible student with one copy changed to zero, the latter also denies legitimate service. These are the two policies' trade-offs. The displayed roster order names copies; it is not the packed-bit order of integer mask 3.

Let a,b,c be the three stored permission bits. Majority is (a AND b) OR (a AND c) OR (b AND c). For (a,b,c)=(1,1,0), the terms are 1,0,0, so the vote is 1. Copies disagree, hence bad=1. Majority still grants; reject-mismatch refuses. Decimal mask=3 flips copies a and b. This tuple uses (a,b,c) order; it is not a packed integer displayed from bit 2 down to bit 0.

A failed image starts at (0,0,0), so those two flips cause unauthorized acceptance. A legal image starts at (1,1,1). Flipping only a gives (0,1,1), whose majority remains correct. Rejecting disagreement now blocks legitimate work. The two policies make different security and availability choices; observing bad alone cannot choose between them.

Select target=source with a nonzero mask. The model first changes the shared source from 0 to 1, then writes all three copies, producing (1,1,1). All three AND terms are one and bad=0. The voter follows its rule but the answer is unauthorized. This is a separate shared-source experiment, not a single stored-copy upset.

Count affected replicas separately from events

One action changing both a and b is one event affecting two copies. A claim about tolerating one changed roster needs an at-most-one-copy budget, not merely one action. This lesson observes one boarding request at edge 1. It does not cover the next bus or later recovery, and a mask does not describe real spacing between the papers.

The main campaign has one event before accepting edge 1. The event XORs a selected mask into two DMR bits or three TMR bits. Each bit corresponds to one replica output. We enumerate four DMR masks and eight TMR masks; zero is the no-fault control.

One event can affect two replicas in this abstraction. A claim of protection against one faulty replica therefore needs a replica-count restriction, not merely one event. Storage persistence is irrelevant to this one-edge observation; later operation and recovery are outside the window.

The image reference, input distribution, comparator/voter, clock/reset and handshake stay trusted in the replica campaign. Masks do not represent physical locations or probabilities. Source and voter experiments below replace one target at a time and retain the independent image reference.

Follow shared input through the vote

If all three copyists use one altered master, each writes 1. The resulting (1,1,1) agrees perfectly and is collectively wrong: a source error before distribution. In another experiment all copies stay zero while final boarding permission becomes 1, the voter target. The independent eligibility ledger stays outside both experiments. Correct majority arithmetic cannot repair a common source or final-gate error.

For the source experiment, invert one shared authorization bit before all copies sample it. Every replica now contains true. DMR and TMR agree and grant. The checker has not malfunctioned: it correctly reports equality between three wrong answers.

For the voter experiment, keep all replicas false and invert only final voter grant. The accepting interface observes true. This target lies after replica checking. Do not combine it with a replica upset while claiming a single replica-fault bound.

Clock, reset, enable, input data and placement can create dependencies between replicas. A spatial split may help against a localized effect, but it needs physical evidence. Synthesis can also merge redundant logic. OpenTitan flags that optimization risk in its implementation guidance. Hardware guidance

Separate detection, masking and acceptance

Alter one all-no roster: two votes still refuse and bad reports disagreement. Alter two: bad still reports disagreement, yet majority permits boarding. This separates detection, masking, and actual handover. Switching to rejection changes only the desk response. Four accepting masks out of eight count this enumeration; they do not imply a fifty-percent chance of breaking a school-trip policy.

Choose TMR with mask 1 and unauthorized input. The vote denies and bad is true. That is both disagreement detection and masked release in this model. Now use mask 3. Majority permits a wrong request even though bad remains true. Rejection changes only the local policy.

The eight TMR masks contain four unauthorized majority outcomes: three masks affect two replicas and one affects all three. The four DMR masks contain one unauthorized outcome. These executed finite counts are not reliability estimates. Shared source and voter forcing run outside those tables.

Set authorized true and mask zero for both schemes. Each must accept. Then use one replica flip and compare availability. Save one source trace with unanimous wrong copies. Explain why agreement is evidence of consistency, while the separate reference establishes the authorization error.

Proposed RTL / SVA

Write the teacher's vote as three pairwise AND terms joined by OR to inspect the desk's arithmetic. Security auditing still asks whether a boarding student belongs on the original approved roster: reference_pass. This does not turn three one-bit fields into three full cryptographic cores. The uncompiled RTL also does not establish independence after implementation.

Read this lesson's property: Voting and actual permission

Even a correctly computed grant for (1,1,1) must fail the accepting-edge assertion when the independent ledger says 0. If the desk never boards anyone, use a genuinely authorized student and unaltered rosters for cover and a positive control. Both records cannot come from the same altered master or the audit loses its reference. Cover does not guarantee boarding for every eligible student.

SVA means SystemVerilog Assertions. An assertion checks a rule; it is not the permission gate. At each rising edge outside reset, if accepted_commit (csr_commit in Lesson 9) is one, |-> requires the right-hand condition on that same edge. With no acceptance, this implication raises no authorization failure; positive controls must still demonstrate useful work. disable iff (!rst_n) excludes active reset, without proving reset safety.

Cover seeks one matching path, rather than proving every transaction correct. Reference independently records the expected result in the testbench. The harness supplies inputs, fault budgets and this oracle; DUT means design under test. A two-state model uses only 0/1 logic, excluding X and intra-cycle delay; it does not mean a two-state FSM. Revisit Lesson 1 section 5 for syntax and wiring comparisons. These snippets have not been compiled, so listing a property does not establish a proof.

assign mismatch = (a != b) || (a != c);
assign majority = (a && b) || (a && c) || (b && c);
assign grant = majority && (!REJECT_MISMATCH || !mismatch);
assign accepted_commit = valid && ready && grant;
assert property (@(posedge clk) disable iff (!rst_n)
  accepted_commit |-> reference_pass);
cover property (@(posedge clk) disable iff (!rst_n)
  reference_pass && accepted_commit);

The fragment specifies TMR combinational behavior and an independent harness assertion. It is uncompiled. A product must evaluate voter hardening, replica preservation, latency alignment, reset skew and faulted output leakage. Our one-bit replicas model permission outputs, not three complete cryptographic cores. Lesson 6 follows a shared enable into progress counters.

Check your reasoning

Explain two different rosters: (1,1,0) reports a mismatch; (1,1,1) agrees completely. Both can originate from a refused student's wrong records. Then start with genuine permission, alter one copy, and predict availability under both policies. These questions separate copy relationships from actual eligibility. Agreement alone provides no evidence of independent sources.

1. Does DMR identify the correct copy?

No; disagreement only proves they differ.

2. What TMR mask first enables failed-image majority release?

Any weight-two mask, such as 3.

3. Does reject-mismatch block unanimous wrong copies?

No.

4. Why test authorized input with one replica flip?

It reveals the availability difference between policies.

5. What evidence is needed for independence?

Source, clock/reset, preserved netlist and physical fault scope, not copy count alone.

Engineering wrap-up

The trip review must record the shared master, affected-copy budget, and response before boarding, as well as the number of rosters. The wrap-up keeps the same roster example and the difference between majority and rejection. It does not label every error as blocked.

Threat and fault model: One action selecting two rosters is one event affecting two copies. Boarding at edge 1 does not cover later requests or recovery.

One event affects selected replica outputs at edge 1; DMR width two and TMR width three. Source and final voter targets run separately.
Root cause: A wrong shared master can yield (1,1,1), bad=0, and unauthorized boarding. Agreement establishes the copies' relationship, not eligibility.

Multiple wrong replicas can win a majority or agree unanimously. A shared wrong source is replicated faithfully; a final voter force bypasses all comparisons.
Defense: Refusing an eligible student's one wrong copy costs service. State majority or rejection policy and separately protect source and voter.

Use comparison or voting with a stated replica budget and local response policy. Assess common input and voter protection separately.
Validation: Check four two-copy and eight three-copy masks plus an unaltered genuinely permitted roster. These finite votes do not validate physical independence.

All four DMR and eight TMR masks ran with source/voter witnesses and positive controls. No RTL or physical independence test ran.
Limits: Spaced paper rosters do not prove independent chip copies sharing a source or clock. One-bit authorization also excludes full computation.

One-bit replicas omit complete datapaths, temporal alignment and leakage. Rejection can block authorized work.
Transfer exercise: If a common reset wrongly sets several rosters to permission, define each reset value and inspect boarding. This new target lies outside the replica-mask experiment.

Permit a common reset fault. Define which replicas reset and whether a permissive reset value can obtain a commit.