Avoiding Common-Cause Failure

Redundancy only works if units fail independently; common-cause avoidance protects the N+1 margin from single shared faults.

The redundancy killer

Redundancy assumes failures are independent. A common-cause failure defeats that assumption: one event — a shared cooling loop, a shared control network, a single physical location, a common software fault — takes multiple units at once, collapsing the N+1 margin into a single point of failure. Avoiding common cause is what makes redundancy real.

How Aegis stays independent

Independence is engineered on several axes: physical separation so one external event cannot reach multiple units; independent auxiliaries (cooling, control, fuel handling) where practical; diverse or isolated software and networks so one fault does not propagate; and staggered maintenance so human error touches one unit at a time.

• Physical separation between units
• Independent cooling, control, and fuel handling
• Diverse or isolated software and networks
• Staggered maintenance to bound human error

Why it is central to the honest case

The whole resilience argument rests on turning a moderate single-unit availability (0.86–0.995) into high system availability through redundancy. If common-cause failures are not controlled, that argument fails — the system is only as available as its shared component. Common-cause avoidance is therefore not a detail but the load-bearing assumption.

Stated as an engineering requirement, it is the load-bearing assumption behind the whole resilience case: redundancy delivers high system availability only to the degree that the units genuinely fail independently. Every proposed shared resource is examined against this test: if one failure of it could take more than one unit, it is either eliminated, duplicated, or isolated before the layout is accepted.