In triple redundancy, also called triple modular redundancy (TMR) when applied to computation, three units compute the same result from the same inputs and a majority voter produces the output. If one unit fails, the other two agree and the fault is masked; if all three disagree, the system can only flag the failure. In aircraft the same idea is applied to sensors, flight computers, actuators and power buses, sometimes with a median of three analogue or digital values instead of a majority vote.
With a perfect voter, the reliability of the triple system is 3R squared minus 2R cubed, where R is the reliability of one channel. This is higher than a single channel only when R is above 0.5 and only for the voted function; the voter itself can fail, so critical designs duplicate or triplicate it. Channels must also be independent: identical software or a shared power supply can create a common-cause failure that all three share.
For drones and eVTOL aircraft, triple redundancy is typical for attitude and air-data sensing, flight-control computing and key actuators of larger or passenger-carrying vehicles, where a single failure must not cause loss of control. A datasheet may state “triplex”, “3x IMU”, “triple-redundant flight controller” or “2oo3 voting”.
A frequent mistake is to count channels rather than independence. Three IMUs on one board with one power rail and one firmware image are not three independent channels, and the claim says nothing about the failure rate or the design assurance level obtained.
