I am currently researching triple-modular redundancy implementations and majority-gate voting logic and I'm wondering how the canonical single-bit majority voters found in textbooks are scaled up to large, bus-width implementations.

If we use the TMR voter \$\,\,\mathrm{Maj}(A,B,C) = AB + BC + AC\$, this function always agrees for single-bit input (there is always a 2-way majority output). However, for larger, multi-bit implementations, there is an additional option - the individual bit majority gates may agree 2-of-3 on a per-bit basis, but agree differently as a whole and thus the output of a majority bus not equal to any of the inputs. For example, \$\mathrm{Maj}(\mathtt{0xF32D}, \mathtt{0xA79B}, \mathtt{0xD232}) = \mathtt{0xF33B}\$.

How do actual TMR systems handle this? I've looked through a number of resources, such Koren & Krishna's Fault Tolerant Systems and Shooman's Reliability of Computer Systems and Networks and can't find a treatment of this particular case. From the more general readings, it seems like one of two approaches may be used:

1. Assume that the system is designed to correct only single faults and thus leave the output as-is, judging the risk of this scenario to be acceptable
2. Use some sort of additional to flag to indicate "ultimate disagreement", i.e. the voting could not produce a correct output given the inputs

Are there other means to handle this issue or further couple the voting outputs?

I am currently researching triple-modular redundancy implementations and majority-gate voting logic and I'm wondering how the canonical single-bit majority voters found in textbooks are scaled up to large, bus-width implementations.

If we use the TMR voter \$\,\,\mathrm{Maj}(A,B,C) = AB + BC + AC\$, this function always agrees for single-bit input (there is always a 2-way majority output). However, for larger, multi-bit implementations, there is an additional option - the individual bit majority gates may agree 2-of-3 on a per-bit basis, but agree differently as a whole and thus the output of a majority bus is not equal to any of the voting inputs. For example, \$\mathrm{Maj}(\mathtt{0xF32D}, \mathtt{0xA79B}, \mathtt{0xD232}) = \mathtt{0xF33B}\$.

How do actual TMR systems handle this? I've looked through a number of resources, such Koren & Krishna's Fault Tolerant Systems and Shooman's Reliability of Computer Systems and Networks and can't find a treatment of this particular case. From the more general readings, it seems like one of two approaches may be used:

1. Assume that the system is designed to correct only single faults and thus leave the output as-is, judging the risk of this scenario to be acceptable
2. Use some sort of additional to flag to indicate "ultimate disagreement", i.e. the voting could not produce a correct output given the inputs

Are there other means to handle this issue or further couple the voting outputs?