Triple Modular Redundancy
Triple modular redundancy is the fault-tolerant design pattern that runs three identical copies of the same logic and lets a majority voter overrule whichever one disagrees, turning a single corrupted bit into a non-event instead of a crash. The technique dates to John von Neumann's 1956 work on building reliable machines from unreliable components, but it earns its keep today inside radiation-hardened processors flying on spacecraft, avionics flight computers, and nuclear-plant controllers, anywhere a cosmic ray or an alpha particle from packaging material can flip a bit and nobody is available to reboot the box.
The voter is the part that actually does the work, and it has to be more reliable than the modules it is checking. A standard TMR voter is three 2-input majority gates feeding a final OR, built so any single stuck-at fault inside the voter itself still produces the correct majority answer — if the voter were the weak link, triplicating everything upstream of it would accomplish nothing. Xilinx and its successor AMD publish TMR-specific synthesis flows for their rad-tolerant Virtex and Versal FPGAs precisely because inferring a correct, self-checking voter from ordinary RTL is easy to get wrong.
A single ion strike, not a design bug, is almost always the thing TMR is defending against. When a heavy ion or a high-energy proton passes through silicon, it deposits enough charge along its track to momentarily look like a logic transition — a single-event upset in a flip-flop, or a brief current pulse called a single-event transient if it hits combinational logic. Terrestrial rates are low enough to ignore in a laptop, but at geostationary orbit, unshielded by the atmosphere, upset rates on an unprotected 28nm SRAM cell can run several orders of magnitude higher, which is why JPL and the European Space Agency both mandate TMR or an equivalent on flight-critical paths.
Physical separation matters as much as logical triplication. If all three modules sit on top of each other in the same small patch of silicon, one sufficiently energetic particle can strike more than one at once — a correlated multi-bit upset that defeats the whole scheme. Rad-hard flows therefore spread the three domains across the die with guard-band spacing and sometimes stagger their clock edges so a single event cannot land inside the same latching window on more than one copy; BAE Systems and Honeywell both publish spacing rules of this kind for their space-grade processor lines.
TMR has a cost most designers quote too simply as 3x. The triplication itself is close to 3x the logic area and 3x the switching power, but the voters, the clock and reset fan-out, and the wider physical spacing add more — real flight parts often land closer to 3.5-4x area overhead, which is exactly why TMR is reserved for the fraction of a design that genuinely must survive an upset (registers, state machines, critical control paths) rather than applied blanket-wide across an entire SoC.
Read triple modular redundancy as a bet about where the next failure is coming from: it assumes failures are independent, so the right engineering lever is physical and temporal separation between copies, not just logical duplication, and a design that triplicates logic but packs the three copies into one radiation-correlated patch of silicon has paid the area cost without buying the reliability.