FDIR Majority Voting: Correlated Sensor Failure

Spacecraft flight computers cannot simply trust a single sensor, since any one of them can fail or drift out of calibration without warning. Mission-critical systems fly three redundant sensors measuring the same quantity — this simulator uses a rotation-rate gyroscope as the example — and vote 2-of-3: if one disagrees with the other two, it is isolated and the spacecraft flies on safely. Inject a single random fault to see that case handled correctly, then inject a correlated two-sensor co-failure to see the same voting logic get fooled: it trusts the two sensors that happen to agree, even though they are the ones that failed together, and isolates the one sensor still reporting the truth.