How does the Airbus flight computer's voting system work?
As far as I read in various documents about A320 and remember them correctly:

There are three systems handling different parts of the primary flight control:


ELAC (elevator &amp; aileron computer) controls pitch with elevators+trim and roll with ailerons.
SEC (spoiler &amp; elevator computer) controls roll with spoilers and if ELACs fail, pitch with elevators+trim.
FAC (flight augmentation computer) implements yaw damper. Its command is added to the rudder command. In A320 rudder pedals have direct mechanical (hydraulic) link.


The ELAC and FAC are composed of two identical units each, the SEC of three identical units (but only two of the units are used as backup for ELAC).

Each unit is composed of two dissimilar computer boards. One used i386 CPU, the other m86k CPU and each has independently developed software (to minimize risk of the same software bug in both).

One of the boards in each pair calculates the output and the other one verifies it. If the verification fails, that unit declares fault and disconnects. This is the primary way of detecting faults.

I found no reference to comparing outputs of the identical units. Except for spoiler control there are only two output and the check board is more reliable way of detecting faults anyway.

If the FAC fails, the aircraft won't maintain coordinated flight well and will tend to dutch roll, but pilots can compensate it with rudder input.

If the SEC fails, the ELAC can handle control alone. Just spoilers won't be available.

If the ELAC fails, the SEC can take over too. Turning with spoilers may cause some more drag, but not a big problem.

If both ELAC and SEC fail, the pitch trim wheels have direct mechanical (hydraulic) link and roll can be controlled by rudder by taking advantage of the yaw stability. I don't think it was ever needed in practice. Note, that is for A320 family; which controls are available in case of failure of all flight computers is different in each Airbus type.

As for data input, there are three ADIRUs (air data and inertial reference unit) and each flight computer takes input from all three and compares them. It needs two matching (similar within some limit) values to consider it trustworthy. If either more than one unit fails or no two agree, the flight computers degrade to alternate law or direct law.

In alternate law, the system stops providing alpha protection (stall), overspeed protection and, depending on what failed, other flight envelope protection (there are two kinds, with different protections lost).

In direct law it reverts to directly mapping the stick position to control surface position similar to mechanical controls. But most faults only result in alternate law except if all inertial references were lost (that would be very difficult to handle as it would mean unreliable attitude indicators too, but I don't think that ever happened either; the inertial systems are very reliable).

Alternate or direct law can also be entered if some control surface (or its actuator) fails and somewhere in the computer failure sequence, but I don't remember the exact condition (FACs calculate the limits, so if FACs fail, it will certainly degrade).