Generalizing the redundancy-relevance boundary: when does added redundancy still improve system value under partial common-cause failure models and general architectures?

Hoepfer, Saleh and Marais (2009) ended a Risk Analysis debate on whether redundancy backfires in the presence of common-cause failures (CCFs) by deriving a quantitative redundancy-relevance boundary: the locus in redundancy-level versus CCF-prevalence space at which a parallel redundant system's mean time to failure drops back to the single-component level. Their boundary, and its companion economic criterion, hold only for identical components with exponential lifetimes in active parallel redundancy under the single-parameter beta-factor model, in which a common cause kills all redundant channels simultaneously. The open problem is to determine the analogous boundary — its existence, shape, and quantitative description — under the multi-parameter CCF models actually used in probabilistic risk assessment (alpha-factor, multiple Greek letter, basic parameter, and binomial failure rate models, which represent partial common-cause events striking only subsets of the redundant components), under broader architectures (k-out-of-n, cold/warm standby with imperfect switching, non-identical components, non-exponential lifetimes), and under refined economic criteria (nonlinear cost scaling, time discounting, mission-dependent utility). None of these generalizations has been carried out, and recent allocation studies still rely on the beta-factor model.

Background

Redundancy — duplicating a critical component so that the system survives if any one copy works, as in a parallel (active, hot-standby) configuration — is the standard design response to unreliable components in safety-critical systems. Its benefit, however, collapses when failures are not independent. A common-cause failure (CCF) is a single shared mechanism — an environmental shock, a design error replicated across identical copies, a maintenance mistake — that disables several redundant channels at once. Whether redundancy still pays under CCFs became a public debate in Risk Analysis: Sagan (2004) argued that adding nuclear security forces can reduce security (through common-mode error, social shirking, and overcompensation), with comments by Apostolakis (2004) and Carroll (2004) in the same issue; Paté-Cornell, Dillon and Guikema (2004) gave a risk-analysis framework showing why redundancy brings diminishing and cost-dependent returns when component failures are dependent; Yellman (2006) countered that these works overemphasized redundancy's pitfalls, distinguishing cascading/induced failures from common-external-cause failures; and Ghaffarzadegan (2008) simulated Sagan's backfire hypotheses for social systems. The debate was qualitative or model-specific: none of these works gave a general, parameterized rule a designer could compute.

Hoepfer, Saleh and Marais (2009) supplied the first such rule, building on the value-of-reliability framework of Saleh and Marais (2006). They modeled $n$ identical actively redundant components with exponential lifetimes and independent failure rate $\lambda_i$, with CCFs represented by the beta-factor model — the oldest and simplest CCF model, in which a single parameter $\beta=\lambda_{cc}/(\lambda_{cc}+\lambda_i)$ is the fraction of each component's failure rate attributable to causes that fail all redundant copies simultaneously. The system survives until either all components have failed independently or a common cause occurs, so

$R_{\mathrm{System}}(t)=\Big[1-(1-e^{-\lambda_i t})^{n}\Big]\,e^{-\frac{\beta}{1-\beta}\lambda_i t}.$

Because the common-cause term caps the system mean time to failure (MTTF) at $1/\lambda_{cc}=(1-\beta)/(\beta\lambda_i)$, added redundancy buys progressively less and can stop paying altogether. The authors defined the redundancy-relevance boundary as the locus in the (redundancy level, $\beta$) plane where $\mathrm{MTTF}_S(n,\beta,\lambda_i)=\mathrm{MTTF}_c=1/\lambda_i$, and an economic counterpart replacing the MTTF test with a cost-benefit test based on the monadic ratio $\alpha=c_0/(u_0\,\mathrm{MTTF}_c)$, where $c_0$ is the incremental per-component cost and $u_0$ a constant utility per unit time. The source describes this economic layer as a cost-benefit analysis that modifies the redundancy-relevance boundary, with the value of redundancy contingent on the prevalence of common-cause failures, on the redundancy level considered, and on the monadic cost-benefit ratio; the explicit threshold in $(\alpha,n,\beta)$ at which added redundancy stops increasing net value is not reproduced in this statement.

Two facts make this boundary incomplete as a decision tool. First, the beta-factor model is known to be conservative for redundancy levels beyond roughly three or four copies, because it forces every common cause to fail all components at once, whereas real common causes often strike only a subset. Probabilistic risk assessment therefore prefers multi-parameter CCF models that represent such partial events: the alpha-factor model (parameters for the conditional frequency of each multiplicity of simultaneous failures), the multiple Greek letter (MGL) model (a reparameterization of the same idea), the basic parameter model with symmetry, and the binomial failure rate / shock models in which a shock hits each component independently with some probability. Second, the derivation assumes hot parallel redundancy of identical, exponentially distributed components with linear cost and constant utility — excluding k-out-of-n:G systems (which work if at least $k$ of $n$ components work), cold or warm standby redundancy with imperfect switching, non-identical components, aging or infant-mortality (non-exponential) life distributions, and any realistic economic valuation. Prior adjacent literature does not fill the gap: redundancy-allocation studies under CCFs, from Bai, Yun and Chung (1991) on k-out-of-n systems to Zhao, Kim, Chung and Yun (2026) on multi-indenture systems, maximize reliability under cost constraints but still assume the beta-factor model and do not produce a value-of-redundancy boundary.

Problem Statement

Determine the redundancy-relevance boundary — or its appropriate generalization when it ceases to be a single locus — for redundant systems beyond the restrictive setting in which it is currently known (identical components, exponential lifetimes, active parallel redundancy, single-parameter beta-factor CCFs, linear cost, constant utility). The boundary condition of Hoepfer, Saleh and Marais (2009) is $\mathrm{MTTF}_S(n,\beta,\lambda_i)=\mathrm{MTTF}_c=1/\lambda_i$, in which $\mathrm{MTTF}_c$ is the single-component mean time to failure evaluated at the independent failure rate $\lambda_i$, so that the reference level excludes the common-cause contribution; for non-identical components, k-out-of-n:G configurations or standby architectures no such comparator is prescribed by the source, and the reference level against which a generalized boundary is defined therefore has to be identified explicitly. Extending that condition, all three parts (a)–(c) below are required. For each part, one general characterization of the boundary (or its appropriate generalization) for the class of settings that part states is required, and the enumerated models, architectures, lifetime distributions, and value criteria must be covered as instances of that characterization rather than derived separately as mandatory cases:

(a) Partial common-cause events. Derive the system reliability and MTTF, and the redundancy-relevance locus, when CCFs follow multi-parameter models in which a common cause disables only a subset of the $n$ redundant components — the alpha-factor model, the multiple Greek letter model, the basic parameter model with symmetry, and binomial failure rate (shock) models — and quantify how and in which direction the beta-factor boundary shifts once the beta model's conservatism (all copies failing together) is removed, comparing against the scalar $\beta$ through an explicitly declared correspondence between $\beta$ and the multi-parameter model's parameter vector, and stating that correspondence as part of the answer.

(b) Architectures and lifetimes. Extend the boundary to k-out-of-n:G configurations, cold and warm standby redundancy with imperfect switching, non-identical components, and non-exponential life distributions (aging, infant mortality).

(c) Value criteria. Extend the economic counterpart of the boundary — in the source a cost-benefit analysis that modifies the redundancy-relevance boundary and makes the value of redundancy contingent on the prevalence of common-cause failures, on the redundancy level considered, and on the monadic cost-benefit ratio $\alpha=c_0/(u_0\,\mathrm{MTTF}_c)$ under linear cost scaling and constant utility — to settings where cost scales nonlinearly with redundancy level, utilities are time-discounted or mission-dependent, or value is multi-attribute. The explicit form of the source's cost-benefit threshold is not reproduced in this statement, so the criterion being generalized must be stated as part of the answer.

Empirical estimation of CCF parameters from field data and the design of CCF mitigation measures are adjacent concerns rather than part of this question.

References

1. V.M. Hoepfer, J.H. Saleh, K.B. Marais (2009), 'On the value of redundancy subject to common-cause failures: Toward the resolution of an on-going debate', Reliability Engineering & System Safety 94(12):1904–1916. DOI: 10.1016/j.ress.2009.06.007, https://doi.org/10.1016/j.ress.2009.06.007
2. M. Elisabeth Paté-Cornell, Robin L. Dillon, Seth D. Guikema (2004), 'On the Limitations of Redundancies in the Improvement of System Reliability', Risk Analysis 24(6):1423–1436. DOI: 10.1111/j.0272-4332.2004.00539.x, https://doi.org/10.1111/j.0272-4332.2004.00539.x
3. Scott D. Sagan (2004), 'The Problem of Redundancy Problem: Why More Nuclear Security Forces May Produce Less Nuclear Security', Risk Analysis 24(4):935–946. DOI: 10.1111/j.0272-4332.2004.00495.x, https://doi.org/10.1111/j.0272-4332.2004.00495.x
4. Ted W. Yellman (2006), 'Redundancy in Designs', Risk Analysis 26(1):277–286. DOI: 10.1111/j.1539-6924.2006.00712.x, https://doi.org/10.1111/j.1539-6924.2006.00712.x
5. George E. Apostolakis (2004), 'Redundancy and Nuclear Security', Risk Analysis 24(4):947–948. DOI: 10.1111/j.0272-4332.2004.00496.x, https://doi.org/10.1111/j.0272-4332.2004.00496.x
6. John S. Carroll (2004), 'Redundancy as a Design Principle and an Operating Principle', Risk Analysis 24(4):955–957. DOI: 10.1111/j.0272-4332.2004.00498.x, https://doi.org/10.1111/j.0272-4332.2004.00498.x
7. Navid Ghaffarzadegan (2008), 'How a System Backfires: Dynamics of Redundancy Problems in Security', Risk Analysis 28(6):1669–1687. DOI: 10.1111/j.1539-6924.2008.01132.x, https://doi.org/10.1111/j.1539-6924.2008.01132.x
8. J.H. Saleh, K. Marais (2006), 'Reliability: How much is it worth? Beyond its estimation or prediction, the (net) present value of reliability', Reliability Engineering & System Safety 91(6):665–673. DOI: 10.1016/j.ress.2005.05.007, https://doi.org/10.1016/j.ress.2005.05.007
9. D.S. Bai, W.Y. Yun, S.W. Chung (1991), 'Redundancy optimization of k-out-of-n systems with common-cause failures', IEEE Transactions on Reliability 40(1):56–59. DOI: 10.1109/24.75334, https://doi.org/10.1109/24.75334
10. Qian Qian Zhao, Jong Woon Kim, Il Han Chung, Won Young Yun (2026), 'Optimal Redundancy Allocation in Multi-Indenture Systems Considering Human Error-Induced Common Cause Failures', Machines 14(6):627. DOI: 10.3390/machines14060627, https://doi.org/10.3390/machines14060627
11. Harry W. Jones (2025), 'Common Cause Failures Dominate and Defeat Redundancy', 2025 Annual Reliability and Maintainability Symposium (RAMS), pp. 1–5. DOI: 10.1109/RAMS48127.2025.10935209, https://doi.org/10.1109/RAMS48127.2025.10935209
12. Tarcisio Abreu Saurin, Natalia Jaeger Basso Werle (2017), 'A framework for the analysis of slack in socio-technical systems', Reliability Engineering & System Safety 167:439–451. DOI: 10.1016/j.ress.2017.06.023, https://doi.org/10.1016/j.ress.2017.06.023
13. Mina Torabi, Marko Čepin (2026), 'An extension to the Alpha Factor method for enhanced common cause failure analysis', Reliability Engineering & System Safety 267:111964. DOI: 10.1016/j.ress.2025.111964, https://doi.org/10.1016/j.ress.2025.111964