Three simulated gyroscopes each measure the same true rotation rate, but every reading carries its own independent sensor noise. Every voting cycle the FDIR logic compares all three pairwise: if all three agree within the threshold, it trusts their average. If exactly one disagrees while the other two still agree with each other, it concludes that one sensor has drifted or failed, isolates it, and keeps flying on the two that agree.
d12=|s1-s2| d13=|s1-s3| d23=|s2-s3|
if all < threshold → trust mean(s1,s2,s3)
if exactly one pair agrees → isolate the odd sensor,
trust mean(agreeing pair)
This correctly survives a single random fault — inject one and watch the odd sensor get isolated while the acted-upon value stays glued to the true rate. But a correlated co-failure, where two sensors drift together from a shared cause (radiation hit, thermal shock, a shared design flaw), looks identical to the voter: two readings agree, so it trusts them — even though they are the two that are wrong. The genuinely correct sensor becomes the outlier and gets isolated. Watch the acted-upon trace peel away from the true-rate trace and the banner flip to FDIR FOOLED when that happens.
- Sensor noise — independent jitter on every reading; too little makes the demo unrealistically clean, too much makes even healthy sensors occasionally disagree.
- Voting threshold — how much two readings may differ and still count as "agreeing"; too tight and healthy sensors falsely disagree, too loose and real faults slip through unnoticed.
- Fault magnitude — how far an injected fault pushes a sensor's reading from the truth.
Real-world relevance: this exact vulnerability is why spacecraft designers care about fault independence, not just fault count — three sensors from the same batch, wired through the same power rail, sitting in the same radiation shadow, can fail together in ways plain triple-redundant voting cannot tell apart from "two good sensors outvoting one bad one."