Redundancy in Designs

The author contends that a previous Risk Analysis article overemphasized the pitfalls of incorporating redundancy into designs. Relevant aspects of that article are reviewed and commented upon, then the potentials and pitfalls of redundancy in systems and procedures are more broadly discussed. To provide a solid foundation for that discussion, some definitions for systems risk analysis terminology are presented. It is shown that pairs and larger sets of related failures (the physical causes of shortfalls in redundancy effectiveness) can be divided into two types: (1) cascading/induced failures and (2) common‐external‐cause failures. Each type has its own physical characteristics and implications for mathematical modeling. Service experience with large‐commercial‐airplane jet‐engine propulsion systems is used to illustrate the two types of related failures. Finally, an overview is provided of event‐sequence analysis, an alternative approach to systems risk analysis. When the possibility of related failures of mutually‐redundant system elements must be accounted for, event‐sequence analysis can usually do that better than fault‐tree analysis.