Before reading further, you may like to read earlier articles on XOR and the Spruchnummer error. In sending the Lorenz cipher, one German operator used the same settings to send two identical messages, or rather, near identical messages. One began 'Spruchnummer' and the other began 'Spruchnr' and continued on.
The allies realised that these two messages used the same key and so they could 'remove the randomness' of the key by XORing the messages together.
When they XORed, they had two plaintexts XORed, the result was gibberish.
Tiltman, then used a 'known plaintext' attack. He guessed some plausible beginnings to the messages, and from experience with Enigma traffic soon guessed that one of the messages would begin 'Spruchnummer' (message number).
He knew his guess was likely to be correct, as XORing 'Spruchnummer' with the start of the message combination, produced a reasonable looking fragment of the second message:
The second message was 'Spruchnrabcd' (where abcd represents the continuation of the second message)
Tiltman then assumed that one message was an abbreviation of the other, so he now guessed the first message was Spruchnummerabcd, this allowed a few more letters of the second message to be found.
He continued in this way through the messages until he was able to decode both messages (the end of the longer message was found as it was an unabbreviated version of the second!) A few times he stalled due to a typing mistake on the part of the German operator, but he could always find a way past the block by trial and error, knowing that the two messages were fundamentally similar.
Now Tiltman had plaintexts and ciphertexts, so he was able to extract the string of key bits which was used. He looked at the behaviour of each of the bits in the key (i.e. the first bit in each character, the second bit and so on), and was able to extract periodically repeating information. This allowed him to deduce the internal structure of the machine. The machine settings would change with each message, but now he knew how the machine did what it did.
This was all a real Tour de force.