TMR Voting Logic Unit
Triple_Modular_Redundancy_Voter
Radiation-hardened FPGA-based majority voter that compares outputs from three independent processor modules and forwards the consensus result, flagging any dissenting module for fault isolation.
Purpose
Ensure no single processor failure or radiation-induced error can propagate to subsystem command outputs. The voter performs bitwise majority comparison on all processor outputs at each clock cycle, producing a guaranteed-correct output when at least two of three modules agree.
Context
TMR voting is the cornerstone of CDH reliability. The voter itself must be the most radiation-hardened component in the processing chain since it is a single point of failure. It is implemented in a radiation-hardened FPGA (Microchip RTG4) with internal TMR on all voter logic. The voter also provides synchronization signals to keep the three processor modules in cycle-accurate lockstep.
Principles
- ▸Bitwise 2-of-3 majority voting on all output vectors every clock cycle
- ▸Voter logic itself is internally TMR-protected within the FPGA fabric
- ▸Disagreement detection triggers processor isolation and fault logging
- ▸Synchronization barriers maintain lockstep execution across all three modules
- ▸Voter bypass mode allows dual-redundant operation when one module is offline
Typical implementations
- ▸Microchip RTG4 radiation-tolerant FPGA (150 krad TID, flash-based, no configuration scrubbing needed)
- ▸Xilinx Virtex-5QV radiation-hardened FPGA (SRAM-based with scrubbing)
- ▸Custom ASIC voter for highest reliability (NanoXplore NG-ULTRA)
- ▸Hardware comparison logic with sub-microsecond voting latency
Lunar considerations
- ▸Voter FPGA must tolerate cumulative TID without performance degradation over 100 years
- ▸Flash-based FPGA preferred over SRAM-based to avoid configuration memory SEUs
- ▸Voter must handle graceful transition from 3-of-3 to 2-of-3 to simplex operation
- ▸Physical placement between processor modules requires careful signal integrity routing
Specifications
Functional
| primary function | Perform majority voting on triple-redundant processor outputs and enforce lockstep synchronization |
| inputs | Output vectors from three L3-CDH-PROC-CPU modules, Synchronization heartbeats from each processor module, Voter configuration registers from L2-CDH-SW flight software, Fault threshold parameters from L2-CDH-AUTO |
| outputs | Voted consensus output to L2-CDH-BUS data bus, Disagreement flags and error logs to L2-CDH-STOR, Processor isolation commands to L3-CDH-PROC-CPU, TMR status telemetry (vote counts, error rates, sync status) |
| voting latency ns | 50 |
| max sync skew ns | 10 |
| disagreement detection cycles | 1 |
| fault isolation time us | 100 |
| throughput bits per cycle | 256 |
Physical
| mass kg | 1.5 |
| dimensions | 0.15m x 0.10m x 0.03m |
| materials | Microchip RTG4 FPGA in ceramic flat package, Radiation-shielded aluminum carrier board, Controlled-impedance polyimide PCB for high-speed signal routing, Hermetic connector to processor backplane |
| operating temp c | -40 to +85 |
| survival temp c | -55 to +125 |
| radiation tolerance krad | 150 |
| seu immune | True |
| vacuum compatible | True |
Operational
| power consumption w | 5 |
| thermal range c | -40, 85 |
| lifetime years | 100 |
| mtbf hours | 500000 |
Interfaces
Provides
- TMR-validated processor outputs guaranteed correct when at least 2 of 3 modules agree, ready for bus distribution.
- Lockstep sync barriers and fault isolation commands to individual processor modules.
- Timestamped records of all TMR disagreements for fault trending and predictive maintenance.
Requires
- Parallel output buses from all three processor modules for bitwise comparison.
- Clean 3.3V and 1.8V rails for FPGA core and I/O banks with <50mV ripple.
Cite this entry
Lunar Ark Codex. "TMR Voting Logic Unit" (L3-CDH-PROC-TMR). Retrieved 10 September 2026, from https://lunarark.com/entry/L3-CDH-PROC-TMR
Licensed CC-BY-SA 4.0. You may reuse and adapt this entry with attribution, under the same licence.