Redundancy Reactor: fault tolerance, animated

Majority voting converts "any failure" into "a coordinated majority of failures." With N = 2m+1 channels and a voter, the system fails only when a strict majority fails. For i.i.d. channels failing with probability q, that's the upper tail of a binomial — for triple redundancy, P = 3q²(1−q) + q³.

Independent redundancy is superlinear. For small q the tail is dominated by its lowest-order term, so P = Θ(q^m+1): adding channels doesn't subtract a constant from your risk, it raises q to a higher power. On a log-log plot the slope literally steepens. The TMR safety multiplier is 1/(3q − 2q²), which tends to 1/(3q) as q → 0 — about 33× at q = 0.01. (This unbounded gain is an independent-model idealization.)

Correlation installs a floor you can't vote past. Let the channels share a cause. A common-mode fraction ρ splits failures into an independent part the voter fixes and a correlated part it cannot — every channel agrees on the same wrong answer. To first order P_sys ≈ (1−ρ)P_ind + ρq ≥ ρq, and that ρq term doesn't depend on N. So for q < ½, as N → ∞ the system rate tends to ρq and the safety multiplier saturates at 1/ρ. You can pour in infinite redundancy and asymptotically gain nothing.

Ariane 5, 4 June 1996. Two inertial reference units ran identical hardware and identical software in parallel. An unprotected 64-bit→16-bit conversion of the horizontal-bias variable overflowed, because the new rocket flew faster than the Ariane-4 assumptions baked into the code. The backup unit failed first, the active one ~72 ms later — the same Operand Error — and the redundancy voted unanimously to shut down. With identical software ρ ≈ 1, so P_sys ≈ q and N was irrelevant; the vehicle self-destructed ~39 s after ignition, ~4 km up.

The cure is diversity, not count. You can't vote your way out of a shared mistake — you have to engineer the mistakes to be different. Different teams, languages, and vendors drive ρ toward zero, sink the floor, and only then make extra channels pay off. The valuable quantity was never N; it was the independence ρ that makes those channels worth counting. The same lesson governs nuclear interlocks, Mars rovers, and the secure element in your phone.

Scientific Context: Common-mode failure is the dominant limit on high-availability systems. Low-latency, diverse-redundancy mechanisms of this kind are essential in the real-time avionics and flight-simulator data pipelines developed by the author.