Common Cause Failure

When redundant or independent safety systems fail simultaneously because they share a vulnerability that was assumed not to exist. Unlike cascade failures (where one failure causes the next), common cause failures involve multiple components failing independently for the same root reason. The Fukushima disaster is the defining example: backup generators were designed to be redundant, but they all shared the same vulnerability—placement at flood level—so the tsunami disabled all of them simultaneously. The pattern: (1) safety is designed with redundancy (multiple independent barriers), (2) the independence assumption is wrong—components share a common vulnerability (location, manufacturer, software version, maintenance crew, power source), (3) an event that exploits the shared vulnerability defeats all redundant layers simultaneously, (4) the system experiences the exact total failure that redundancy was supposed to prevent. The insidious quality: common cause failures turn redundancy from a strength into an illusion. You think you have four layers of defense; you actually have one, duplicated four times.

When to use it

When designing redundant safety systems. When evaluating whether backup systems are genuinely independent. When investigating failures that defeated supposedly redundant defenses. During risk assessment of critical infrastructure.

How it can help

Transforms redundancy design from 'add more backup' to 'ensure backups are genuinely independent.' The intervention: (1) for every redundant system, map shared dependencies: same power source? same vendor? same physical location? same maintenance team? same software? (2) apply 'diversity' principle: use different technologies, different vendors, different locations for redundant systems, (3) stress-test the independence assumption: 'What single event could take out both the primary and backup systems?' (4) include 'common cause' as a specific category in failure mode analysis. The rule: if your backup shares any single vulnerability with your primary, it's not a true backup.