See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/3709893

Experimental comparison of voting algorithms in cases of disagreement

Conference Paper  in  Conference Proceedings of the EUROMICRO · October 1997

DOI: 10.1109/EURMIC.1997.617368 · Source: IEEE Xplore

CITATIONS READS

27 82

3 authors:

Julian Michael Bass Gholam Reza Latif-Shabgahi

University of Salford Shahid Beheshti University
117 PUBLICATIONS   716 CITATIONS    66 PUBLICATIONS   408 CITATIONS   

SEE PROFILE SEE PROFILE

Stuart Bennett
The University of Sheffield
80 PUBLICATIONS   1,701 CITATIONS   

SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Geographically Distributed Agile Methods View project

Alarm Management View project

All content following this page was uploaded by Julian Michael Bass on 29 November 2015.

The user has requested enhancement of the downloaded file.

 Experimental Comparison of Voting Algorithms in Cases of Disagreement

J. M. Bass, G. Latif-Shabgahi and S. Bennett

Department of Automatic Control and Systems Engineering

University of Sheffield, Mappin Street, Sheffield, S1 3JD, UK.

Email: J.Bass@sheffield.ac.uk

Abstract (through replicated or standby sub-systems called

Voting algorithms are used to mask erroneous results
from redundant sub-systems (variants) in fault-tolerant
systems. While voting algorithms are well-known and
widely used, the authors are not aware of any detailed
investigation of voter behaviour in the presence of mul-
tiple errors. The results of an experimental evaluation
of seven voting algorithms in a variety of simulated er-
ror scenarios are reported. A software error-injection
approach is used to simulate multiple errors in a triple
modular redundant configuration.
The Majority and Plurality voters produce the lowest
number of catastrophic errors, in these tests. The Me-
dian voter produces the largest number of correct re-
sults, but also produces the largest number of cata-
strophic errors. The Three Domain voter results show a
compromise between the large number of correct results
identified by the Median voter and the small number of
catastrophic results produced by the Majority voter.
“variants”). One approach to arbitrating between
variants uses voting algorithms. Voting algorithms
seek to mask erroneous results by accepting as cor-
rect the result produced by a Majority of variants.
This approach assumes that a minority of failed
variants produce identical results.
The behaviour of voting algorithms where there
is no agreement between results is the focus of this
study. In some systems, the probability of multiple
simultaneous errors is considered negligible. In
safety critical systems, however, it is necessary to
consider the behaviour of fault-tolerant mecha-
nisms, such as voters, in worst case conditions. Such
events may be improbable but can have cata-
strophic consequences. Thus multiple error scenar-
ios should be considered in the dependability analy-
sis.

Keywords: fault-tolerance, voting, double errors, triple Background and related work on voting algo-
errors, common errors, error injection. rithms and experimental evaluation of fault-tolerant
mechanisms are described in Section 2. The fault-
1 Introduction injection approach and experimental results are

Increasing dependence is being placed on com- presented in Sections 3 and 4. Some conclusions

puter-based systems in many applications. For ex- and areas of further work are presented in Sections

ample, several modern commercial aircraft use “fly- 5 and 6.

by-wire” flight control systems with limited me-

chanical or analogue electronic connection between 2 Related Work
the pilot and the aircraft control surfaces. In such
systems the demand signals from the pilot to the 2-1 Voting
control surfaces are routed through digital flight
control computers.
2-1-1 Exact (bit-by-bit) Voting
A variant result is selected by the voter as an
Redundancy is required to achieve stringent reli- output if and only if it is in exact agreement with a
ability, availability or safety constraints depending Majority [(n+1)/2] of the other variant results. A
upon the specific application. Redundancy can in- number of approaches to the implementation of
clude information redundancy (for example, such voters is described in [Parhami91].
through coding techniques), temporal redundancy
(for example, retry) or resource redundancy

Proceedings of the 23rd EUROMICRO Conference '97 New Frontiers of Information Technology
1089-6503/97 $10.00 © 1997 IEEE
 Another approach to voter implementation in
hardware is presented in [Standeven89]. Here, a
voter is attached to each of the communication
channels in a parallel computing system. This ap-
proach is intended to provide application inde-
pendent fault-tolerance.
There are two obvious limitations with the exact
(bit-by-bit) voting approach:-
• where design diversity is used, to minimise
software faults, correct results may not have
identical values, and
• further effort may be desirable to ensure that
the voter produces a sensible output where a
Majority does not exist.
This latter issue is the focus of immediate inter-
est here.
2-1-2 Inexact Voting
Several approaches to voting on correct results
with similar but not identical results have been pub-
lished. Formalised definitions of the Majority, Plu-
rality, Weighted Average and Median voting algo-
rithms are presented in [Lorczak89].
The formalised Majority voter constructs sets of
those variant results found to differ from each
other by less than δ. If such a set is found to con-
tain a Majority [(n+1)/2] of variant results one of
the results is chosen at random to form the voter
output.
Formalised Plurality voting is a generalisation of
formalised Majority voting, in which the need for a
strict Majority is relaxed. For example, in a five
modular redundant system, 2-out-of-5 agreement
may be considered acceptable. It is claimed that
plurality voting is equivalent to formalised Majority
voting in triple modular redundant configurations.
In Weighted Average Voting the mean value of
the variant result is calculated. This mean value
may be distinct from all the variant results. The cal-
culation uses weights associated with each variant
result. The weights can be calculated in a number
of ways; the approach adopted here is that they are
inversely proportional to the distance of a given
variant result from the others.
The generalised Median Voter assumes the out-
put space is a metric space. It repeatedly selects
and discards those pairs of variant results with
maximum reciprocal distance. This process leaves a
Proceedings of the 23rd EUROMICRO Conference '97 New Frontiers of Information Technology
1089-6503/97 $10.00 © 1997 IEEE
single variant result (assuming the number of vari-
ants is odd) which is considered as the Median re-
sult and is selected as the voter output.
The linear, first order and three domain algo-
rithms use the formalised Majority voter to identify
cases where a Majority of variant results is in
agreement. Where no such Majority exists, the al-
gorithms use a history of previous results to pro-
duce an expected variant result value. Comparisons
are then performed between the variant result and
the expected result. The variant result with the
smallest distance from the expected result is se-
lected as the voter output. For a more formal defi-
nition of these algorithms see [Bass95].
The expected value used in the predictive voters
can be calculated using a simple linear prediction;
alternatively a first order (Milne predictor-correc-
tor) can be used. The Three Domain voter uses a
first order predictor but also uses diagnostic infor-
mation about each variant to help assess cases of
disagreement. The use of diagnostic information as
part of a voting process has also been used by
[Kanekawa89] in their Stepwise Negotiated Voter.
The approach taken by [Giandomenico90] and
[Blough90] is to make strong assumptions about
the probability of arrival of certain error scenarios.
Thus, idealised voters are proposed based on the
assumed error probabilities. In real applications it
is unlikely that such knowledge of errors and their
probability of occurrence will be available.
2-2 Fault Injection
Experimental evaluation of system dependability
can be usefully conducted at a number of phases in
the development process (for example see
[Iyer95]). Physical faults can be injected into proto-
type systems, in order to estimate detection cover-
age and recovery capabilities. In addition, direct
measurement of systems in the field under real
workloads enables the calculation of parameters
such as mean time between failures.
There are two main approaches to fault-injec-
tion: prototype-based and simulation-based. Faults
are injected into existing physical systems in proto-
type-based fault-injection. Software (for example
see [Kanewati92]) or hardware (for example see
[Finelli87]) based approaches have been reported
in the literature.
 Simulation-based fault-injection can be used in
Saboteur 1
three main levels of abstraction, namely the: elec-
trical, logic and functional levels. During the design
phase simulated fault injection can be used to Voter
Under
evaluate the effectiveness of fault-tolerant mecha- Saboteur 2 Test
Comparator
nisms. The MEFISTO tool, for example, is able to Classified
Result Set
inject errors into VHDL models of systems
Generate
[Jenn94]. These simulation-based methods have the Simulated
Variant Saboteur 3
advantage that they do not require specialised Result
Stream
hardware probes or instrumentation.

3 Experimental Method Figure 1 Experimiental voter configuration.

The experimental work reported here is based
on the following assumptions and terminology:-
• the voter is used in a cyclic system where This represents a simplified version of the error
there exists some relationship between cor- model presented in [Bass96]. These assumptions
rect results from one cycle to the next, are representative of a class of voter applications
• there exists some “correct” application result, common in embedded real-time control systems.
which could be calculated from the current
The assumptions exclude those applications where
inputs and system state, based on the history
voter inputs are randomly distributed through the
of previous system states,
input space in successive cycles.
• that faults cause errors whose symptoms ap-
pear to the voter as numerical input values The voter is tested in a triple modular redundant
perturbed by varying amounts,
configuration, as shown in Figure 1, in these experi-
• that perturbations (below some predefined
ments. One notional correct result is produced by
accuracy threshold) in voter input values are
the input generator in each test cycle. This se-
considered as acceptable inaccuracies,
quence of numbers simulate identical correct re-
• for the purposes of the results reported here
the difficult issues associated with ensuring sults generated by redundant variants.
synchronisation of the inputs to the voter (or
Copies of the notional correct result are pre-
indeed, synchronisation of the inputs to vari-
sented to each saboteur, in every cycle. The sabo-
ants) is ignored,
teurs can be programmed to introduce selected
• that large perturbations in voter input values
are considered as errors, and variant error amplitudes, according to selected ran-
dom distributions. In a given set of tests one, two
• the “notional correct result” is the desired
voter result even where voter inputs are erro- or three saboteurs may be activated to simulate
neous. variant result errors on the voter inputs.
Thus, we can define each voter input as a mem-
A comparator is used to check for agreement be-
ber of a tuple, as follows:-
tween the notional correct result and the voter out-
voter input tuple = {c, vt±, a±}, put. An accuracy threshold is used, in the compara-
in application specific value units. tor, to determine if the distance between the no-
tional variant result and the voter output is within
Where,
acceptable limits.
c, notional correct value,
vt+, upper voter threshold (in those voting 4 Experimental Results
algorithms that depend on thresholds to perform
inexact voting), 4-1 Single Errors
vt-, lower voter threshold,
Each algorithm has been tested with errors acti-
a+, upper accuracy threshold, and
vated on one input channel. These errors have
a-, lower accuracy threshold.
been masked by the algorithms as expected. In
other words, the voter output has been selected on

Proceedings of the 23rd EUROMICRO Conference '97 New Frontiers of Information Technology
1089-6503/97 $10.00 © 1997 IEEE
 Lane Switching in a Threshold−Based Voter
2.2
600

500
1.8

Number of Correct Voter Results

400
1.6
Variant Result

300
1.4

1.2 200

1 100

0.8
0 −2 −1 0 1 2
10 10 10 10 10
Maximum Distance Between Variant Results
0.6
0 2 4 6 8 10 12 14 16 18 20
Cycle, t

Figure 2 Lane switching problem in threshold-based Figure 3 Impact of distance between variant results
voting algorithms. on number of correct results selected.

the basis of the two correct results “out-voting” the with increasing uniformly distributed variant error
single erroneous result. However, interest is fo- amplitudes superimposed on each variant result.
cused here on the cases where more than one input The figure shows an exponential fall in number of
has been subject to errors. correct results selected by a Majority voter. Where
the differences between variant results exceed the
4-2 Multiple Errors voter threshold, it can be seen that the following
relationship holds:-
4-2-1 Voter Threshold Selection
A voter threshold is used, to define the maxi- Nc ≈ N * exp(-Vt - Na)

mum distance between two distinct variant results Where,

for agreement to exist, in all the algorithms apart
from the Median and Weighted Average. The pres-
ence of a voter threshold gives rise to the lane
switching problem shown in Figure 2. The curves
represents a sequence of variant results (dotted)
and associated sequence of Majority voter results
(solid). A discontinuity can be seen in the voter
output where the variant result curves diverge be-
yond the voter threshold. The maximum acceptable
voter output discontinuity represents
bound on the choice of voter threshold.
The lower bound on the choice of voter thresh-
old is determined by the maximum expected dis-
tance between correct but not identical variant re-
sults. Too small a voter threshold would result in
rejection, by the voter, of correct but distinct re-
sults.
The behaviour illustrated in Figure 3 shows the
results of a sequence of simulations performed with
the voter threshold kept constant (at ±0.5 units)
Nc, number of variant results correctly selected
by voter,
N, number of tests,
Vt, voter threshold,
Na, maximum variant error amplitude
superimposed on variant result stream.
These simulation results can be viewed from two
perspectives. The first, and most obvious, interpre-
an upper tation of Figure 3 assumes that the variant errors
superimposed on the variant result stream do in-
deed represent errors occurring in the variants.
Thus, the exponential fall in correct voter results
shows the rejection of erroneous results.
An alternative interpretation considers that the
variant errors superimposed on the variant result
stream represents distinct and correct results. Us-
ing this interpretation, the results show voter rejec-
tion of acceptable results. The exponential fall in
number of correct result selections emphasises the

Proceedings of the 23rd EUROMICRO Conference '97 New Frontiers of Information Technology
1089-6503/97 $10.00 © 1997 IEEE
 Table 1 Impact of Increasing Noise Amplitude (random walk input function)

Voting Algorithm (Voter Threshold = 0.5, Accuracy Threshold = 0.5)

Maximum
Majority Plurality Median Weighted Linear First Order Three
Error
Amplitude Average Predictor Predictor Domain

0.5 Corr. 1000 1000 1000 1000 1000 1000 1000

(Scenario a) Cat. 0 0 0 0 0 0 0

1.0 745.7 745.7 870.7 856.3 783.3 745.7 745.7

(Scenario b) 129.5 129.5 129.3 143.7 199.5 253.9 176.6

2.0 440 440 716.7 726.7 600 497.3 440

(Scenario c) 154.6 154.6 283.3 273.3 323.8 502.7 193.1

Table 2 Impact of Increasing Noise Amplitude (random walk input function)

Voting Algorithm (Voter Threshold = 0.5, Accuracy Threshold = 1.0)

Maximum
Weighted Linear First Order Three
Error Majority Plurality Median
Average Predictor Predictor Domain
Amplitude

0.5 1000 1000 1000 1000 1000 1000 1000

(Scenario d) 0 0 0 0 0 0 0

1.0 884 884 1000 1000 983 1000 932.3

(Scenario e) 0 0 0 0 0 0 0

2.0 486.7 486.3 868 858 713.7 644.3 499.7

(Scenario f) 106.8 106.8 132 142 199 354.6 132

Table 3 Impact of Increasing Error Amplitude (random walk input function)

Voting Algorithm (Voter Threshold = 0.5, Accuracy Threshold = 2.0)

Maximum Weighted Linear First Order Three

Error Majority Plurality Median
Amplitude Average Predictor Predictor Domain

0.5 1000 1000 1000 1000 1000 1000 1000

(Scenario g) 0 0 0 0 0 0 0

1.0 878.3 878.3 1000 1000 984 1000 922.3

(Scenario h) 0 0 0 0 0 0 0

2.0 593.7 593.7 1000 1000 908.7 999.3 632.7

(Scenario i) 0 0 0 0 0 0 0

Proceedings of the 23rd EUROMICRO Conference '97 New Frontiers of Information Technology
1089-6503/97 $10.00 © 1997 IEEE
 importance of choosing a sufficiently large voter strophic errors, but only produces 593.7 correct re-
threshold. sults averaged out of three runs each of 1000 tests.
Thus, 406.3 exceptional results have been produced
4-2-2 Voter Accuracy and Error Amplitude by the voter in this scenario.
Tables 1, 2 and 3 show the results of an investi-
Catastrophic errors are produced by all of the al-
gation of voter accuracy and variant error ampli-
gorithms where the variant error amplitude exceeds
tude with constant voter threshold. Each cell in the
the required voter accuracy. In scenario (b) (Table
tables shows the average result from three runs
1), where the variant error amplitude is 1.0 (which
each of 1,000 repeated tests using a random walk
is twice that of the voter threshold and required
input function. Thus, tables show the results of
voter accuracy) the number of catastrophic errors
27,000 separate voting cycles for each algorithm.
varies between 129.5 for the Majority voter and
There are three possible outcomes in any test cy-
253.9 for the First Order Predictor. In scenario (c)
cle:-
(Table 1) where the error amplitude is four times
• the voter result is correct (i.e. within the ac-
the voter threshold and required accuracy (error
curacy threshold),
amplitude = 2.0) catastrophic errors range between
• the voter produces an incorrect result (i.e. a
154.6 for the Majority voter and 502.7 for the First
catastrophic error), and
Order Predictor.
• the voter is unable to reach agreement and
produces some predefined exceptional out- These results show that the voting algorithms in
put.
this study can be divided into three groups:-
The latter outcome is typically used to initiate
• Majority and Plurality voters,
some sequence of events intended to place the sys-
• Median and Weighted Average voters, and
tem in a safe state. The Median and Weighted Av-
erage voters are thresholdless voters which produce
• predictive voters
These results confirm that the Plurality and Ma-
a result regardless of the level of disagreement be-
jority voters are equivalent, in a triple modular re-
tween variant results. Thus, they are unable to pro-
dundant configuration. The Plurality and Majority
duce an exception flag to indicate disagreement be-
voters produce the smallest number of catastrophic
tween variant results.
errors of the algorithms tested. However, the
In the tables the number of correct and cata- number of correct results identified by these voters
strophic voter results are presented and used to is also the lowest of the algorithms.
contrast algorithm behaviour. It can be seen, from
The results for the Median and Weighted Aver-
Tables 1, 2 and 3, that all the algorithms produce
age voters are broadly similar. These algorithms al-
correct results, where the error amplitude is less
ways produce more catastrophic errors than the
than or equal to the voter threshold and the re-
Majority and Plurality voters where the error am-
quired voter result accuracy. For example, in Table
plitude exceeds the required accuracy.
1, where the required voter accuracy and the maxi-
mum error amplitude are both 0.5 all voter results The Linear and First-Order predictive voters
are correct. There are no catastrophic or excep- produce less correct results than the Median and
tional voter outputs in these tests. Weighted Average voters. They also suffer the dis-
advantage that they produce more catastrophic er-
In addition, no catastrophic errors are produced
rors than the Majority and Plurality voters. The
where the maximum error amplitude is equal to the
Three Domain voter, however, produces less cata-
required voter result accuracy (but larger than the
strophic errors than the other predictive voters.
voter threshold). This can be seen in Scenarios (a),
(e) and (i). Notice, however, that the voter thresh-
4-2-3 Result Visualisation
old value of 0.5 reduces the number of correct
The tabulated results are perhaps best assessed
voter results and increases the number of excep-
using a visual representation. We propose a novel
tional voter outputs, in all but the Median and
application of diagrams used in the field of multi-
Weighted Average voters. In scenario (i), for exam-
objective optimisation. This approach can be seen
ple, the Majority voter does not produce cata-
in Figures 4, 5, 6 and 7. In these diagrams each la-

Proceedings of the 23rd EUROMICRO Conference '97 New Frontiers of Information Technology
1089-6503/97 $10.00 © 1997 IEEE
 Multi-Scenario Voter Visualisation (RW) Multi-Scenario Voter Visualisation
1000 1000

900 900
Number of correct results

Number of correct results

800 800

700 700

600 600

500 500

400 400
a b c d e f g h i a b c d e f g h i
Voter Parameter Scenario Voter Parameter Scenario

Figure 4 Number of correct results for Majority, Me- Figure 6 Number of correct results for Majority, Me-
dian and Three Domain Voters in each scenario (ran- dian and Three Domain Voters in each scenario
dom walk input function). (sinusoidal input function).

Multi-Scenario Voter Visualisation (RW) Multi-Scenario Voter Visualisation

300 300

250 250
Number of catastrophic results

Number of catastrophic results

200 200

150 150

100 100

50 50

0 0
a b c d e f g h i a b c d e f g h i
Voter Parameter Scenario Voter Parameter Scenario

Figure 5 Number of catastrophic results for Majority, Figure 7 Number of catastrophic results for Majority,
Median and Three Domain Voters in each scenario Median and Three Domain Voters in each scenario
(random walk input function). (sinusoidal input function).

beled point on the x-axis represents one of the vot- results, in these tests, but also produces the largest
ing scenarios reported in Tables 1, 2 and 3. For ex- number of catastrophic errors. The Majority voter,
ample, the point labeled (a) represents the results in contrast, produces a smaller number of correct
of scenario (a) where the error amplitude, the voter results but also a lower number of catastrophic re-
threshold and the voter result accuracy are all 0.5. sults. The Three Domain voter results show a com-
Figures 4 and 5 show the results for the Majority promise between the large number of correct re-
(dotted line), Median (solid line) and Three Do- sults identified by the Median voter and the small
main voters (dashed line) with a random walk input number of catastrophic results produced by the
function. Figure 4 shows the number of correct re- Majority voter. The Three Domain voter does not
sults in each scenario. Figure 5 shows the number produces less correct results than the Majority, in
of catastrophic results for each scenario. The Me- these tests, and produces more correct results in
dian voter produces the largest number of correct scenarios (e), (f), (h) and (i).

Proceedings of the 23rd EUROMICRO Conference '97 New Frontiers of Information Technology
1089-6503/97 $10.00 © 1997 IEEE
 Figures 6 and 7 show results for the same sce-
narios as Figures 4 and 5, but based on a sinusoidal
input function. The relationships between the algo-
rithms are equivalent.
5 Conclusions
An experimental evaluation of seven voting algo-
rithms is reported here. Simulated variant results,
contaminated with uniformly distributed
have been presented to each algorithm in a triple
modular redundant configuration.
The results show that all the algorithms produce
correct results, where the error amplitude is less
than or equal to the voter threshold and the re-
quired voter result accuracy. In addition, no cata-
strophic errors are produced where the maximum
error amplitude is equal to the required voter re-
sult accuracy (but larger than the voter threshold).
The Majority and Plurality voters produce the
lowest number of catastrophic errors, in these tests.
The Median voter produces the largest number of
correct results, but also produces the
number of catastrophic errors. The Three Domain
voter results show a compromise between the large
number of correct results identified by the Median
voter and the small number of catastrophic results
produced by the Majority voter.
6 Further Work
This paper has reported on the impact of error
amplitude, voter threshold and voter result accu-
racy. In fact, there are a large number of other pa-
rameters which affect voter behaviour. The impact
of a range of other parameters is the subject of fur-
ther work and will be reported elsewhere.
7 Acknowledgements
The authors gratefully acknowledge the financial
support of UK EPSRC (under grant number GR/K
64310) for this work.
Proceedings of the 23rd EUROMICRO Conference '97 New Frontiers of Information Technology
1089-6503/97View
$10.00 © 1997 IEEE
publication stats
8 References
[Bass95] J. M. Bass, “Voting in Real-Time Distributed
Computer Control Systems”, PhD Thesis, University of
Sheffield, October 1995.
[Bass96] J. M. Bass, P. J. Fleming and A. M. Tyrrell,
“An Error Model for Computer Control Systems”,
UKACC Int. Conf. on Control, Exeter, September 1996,
pp. 353-8.
[Blough90] D. M. Blough and G. F. Sullivan “A Com-
errors,
parison of Voting Strategies for Fault-Tolerant Distrib-
uted Systems”, Proc. IEEE 9th Symp. on Reliable Dis-
tributed Systems, 1990, pp. 136-45.
[Finelli87] G. B. Finelli, “Characterisation of Fault Re-
covery through Fault Injection on FTMP”, IEEE Trans.
on Reliability, Vol. 36, No. 2, June 1987, pp. 164-70.
[Giandomenico90] F Di Giandomenico and L. Strigini,
“Adjudicators for Diverse Redundant Components”, Proc.
IEEE 9th Symp on Reliable Distributed Systems, 1990,
pp. 114-23.
[Iyer95] R. K. Iyer, “Experimental Evaluation”, Special
Issue, IEEE 25th Ann. Int. Symp. on Fault-Tolerant
Computing Systems, Pasadena, June 1995, pp. 115-32.
[Jenn94] E. Jenn, J. Arlat, M. Rimen, J. Ohlsson and J.
Karlsson, “Fault Uinjection into VHDL Models: The
largest
MEFISTO Tool”, Proc. of IEEE 24th Ann. Int. Symp. on
Fault-Tolerant Computing Systems, Toulouse, June 1994,
pp. 66-75.
[Kanawati92] G. Kanawati, N. Kanawati and J. Abra-
ham, “FERRARI: A Fault and Error Automatic Real-
Time Injector”, Proc. 22nd Int. Symp. on Fault-Tolerant
Computing, Boston, 1992.
[Kanekawa89] K. Kanekawa, H. Maejima, H. Kato and
H. Ihara, “Dependable On-Board Computer Systems with
a New Method: Stepwise Negotiated Voting”, IEEE 19th
Int. Symp. on Fault-Tolerant Computing Systems, Chi-
cago, June 1989, pp. 13-19.
[Lorczak89] P. R. Lorczak, A. K. Caglayan and D. E.
Eckhardt, “A Theoretical Investigation of Generalised
Voters”, Digest of Papers, IEEE 19th Int. Symp. on
Fault-Tolerant Computing Systems, 1989, pp. 444-51.
[Parhami91] B. Parhami, “Voting Networks”, IEEE
Transactions on Reliability, Vol. 40, No. 3, pp. 380-93.
[Standeven89] J. Standeven, M. J. Colley and D. M.
Lyons, “A Hardware Voter for Fault-Tolerant Transputer
Systems”, Microprocessors and Microsystems, Vol. 13,
No. 9, 1989.