Redundancy Design Principles

Redundancy design provides backup capability so that failure of one component doesn't cause system failure. But experienced engineers distinguish between types of redundancy that have very different risk profiles. Active redundancy: both systems run simultaneously, and one takes over instantly if the other fails (e.g., dual engines on aircraft). Standby redundancy: the backup is inactive until needed, introducing the risk it won't activate when called upon (e.g., emergency generators). Diverse redundancy: backups use different technology to avoid common-mode failures — if both primary and backup use the same software, a bug crashes both (e.g., nuclear plants using different control system vendors for primary and backup). N+1 redundancy: for N required components, provide N+1 total (data center power supplies). The practitioner's hard-won lesson: redundancy can create false confidence.

When to use it

When designing any system that needs to survive component failures, evaluating whether existing backup systems would actually work when needed, choosing between types of redundancy based on failure consequences and costs, or stress-testing backup plans by asking whether they share common vulnerabilities with primary systems.

How it can help

This model reveals that 'having a backup' is not sufficient — the TYPE of backup matters enormously. In organizational design, having two people who can do the same job (active redundancy) is different from having someone 'on call' who hasn't done the job in months (untested standby redundancy). Key person risk is often addressed with nominally redundant roles that would fail under actual load. The diverse redundancy principle — using different approaches to avoid common-mode failure — applies to investment portfolios, supply chains, and information sources. If your diversification uses correlated assets, you have the illusion of diversification without the protection.