---
slug: common_mode_failure
name: Common-Mode Failure
one_liner: "Nominally independent redundant components fail together because they share a hidden common cause or dependency, so redundancy delivers far less protection than its multiplicity promises."
type: prime
schema_version: 2
status: density_v2_draft
categories: [systemic, structural]
origin_domain: engineering
alternate_origin_domains: [finance_economics, biology, computer_science, organizations_management]
aliases: [common_cause_failure, correlated_failure, common_mode_fault]
related: []
solution_archetypes: []
review_flags:
- "OPERATOR-DERIVED (op-01 dualization, sub-flavor 1c) — the failure-mode dual of redundancy along the shared-dependency axis. Surfaced building the dualization template's 1c few-shot (exemplar 6, 2026-07-02) and independently re-proposed by the re-pilot (1c: coupling -> common_mode_failure). Verified absent via search_prime (nearest: correlation, systemic_risk, dependency — none names the structure). RECOMMENDED ACCEPT, pending owner curation."
- "Created 2026-07-02; did NOT go through Phase-A triage. SI/SF/similarity grades are PROPOSER ESTIMATES pending triangulation."
- "Phase-C action: re-similarity check vs redundancy / single_point_of_failure / correlation / systemic_risk / diversification; draw the failure-dual (redundancy) and near-neighbor edges at incorporation. one_liner must be synced to a v1 draft per CLAUDE.md before merge."
substrate_independence:
  composite_substrate_independence: 4
  domain_breadth: 5
  structural_abstraction: 4
  transfer_evidence: 4
  reasoning: 'The pattern — nominally independent elements share a latent common dependency, so their failures are correlated and multiplicity does not multiply reliability — is a relational fact about a dependency graph with a shared upstream node, medium-neutral and stated without reference to what the components are; structural abstraction is a strong 4 (a notch below 5 only because the sharpest formalization, correlated failure defeating the independence assumption, is usually told through a reliability/probability frame). Domain breadth is a full 5: engineered redundancy (power, avionics, nuclear), financial diversification (correlated defaults in 2008), biological monocultures (a single pathogen wiping a genetically uniform crop), distributed systems (a shared availability zone or dependency taking down "independent" replicas), and organizations (independent reviewers sharing the same blind spot). Transfer is well documented across these (4): the "correlation is the enemy of redundancy" lesson recurs verbatim. Composite 4 — a highly cross-domain structural failure pattern whose formal home is reliability theory but whose reach is general.'
similarity_to_nearest_existing_prime:
  slug: statistical_independence
  similarity: 0.673
structural_framed:
  label: structural
  aggregate: 0.1
  criteria: {vocab_travels: 0.1, evaluative_weight: 0.1, institutional_origin: 0.0, human_practice_bound: 0.0, import_vs_recognize: 0.1}
  rationale: 'Common-mode failure is a relational fact — a shared upstream dependency correlates the failures of nominally independent elements — that holds in physical, biological, financial, and computational substrates with no human in the loop (a shared bus bar, a single pathogen, a common risk factor). Institutional_origin and human_practice_bound read 0.0. The faint 0.1s: the term carries a mild reliability-engineering home vocabulary (vocab_travels), "failure" has a whiff of evaluative weight (it names a breakdown), and recognizing an instance is mildly an act of import from safety analysis (import_vs_recognize). The core is structural: correlation defeating the independence assumption on which redundancy rests.'
phase_b_passes_completed: []
---
# Common-Mode Failure

## Core Idea

Common-mode failure is the breakdown structure in which *nominally independent components fail at the same time because they share a hidden common cause*. Redundancy — running several copies of a critical element so the whole survives the loss of any one — buys reliability only under a load-bearing assumption: that the copies fail *independently*, so the probability of all failing at once is the product of small individual probabilities and therefore vanishingly small. A common-mode failure is precisely the violation of that assumption. Some dependency the copies unknowingly share — a common power supply, a common design flaw, a common environmental stress, a common supplier, a common underlying risk factor — is disturbed, and every "independent" copy fails together, so the redundancy that was supposed to multiply reliability delivers almost none of it.

The structure has three parts, and naming the prime is naming their conjunction. First, there is *apparent redundancy*: several components are arranged so that the system tolerates the failure of any one, and the reliability case rests on their failing independently. Second, there is a *latent shared dependency*: unknown to (or discounted by) the designers, the components have a common upstream — a single cause whose disturbance affects all of them. Third, there is *correlated failure*: when that shared cause is disturbed, the components fail together, collapsing the redundancy in a single stroke. The consequence the prime makes vivid is a severe, systematic *overestimate of reliability*: because the independence assumption enters multiplicatively, believing three copies fail independently when they actually share a cause can inflate the estimated mean-time-between-failures by orders of magnitude over the truth. Three diesel backup generators promise near-certain backup power — unless they sit in the same basement and the same flood drowns all three, at which point the redundancy was an illusion. The single most important thing common_mode_failure names is that *correlation is the enemy of redundancy*: the value of N copies is not set by N but by how independent the copies truly are, and the hunt for hidden shared dependencies is therefore the real work of building a resilient system. It is the failure-mode dual of `redundancy` — the characteristic way redundancy's own success (the confidence it creates) sets up the disaster (the unexamined shared cause).

## Structural Signature

*the apparent redundancy* — *the independence assumption it rests on* — *the latent shared dependency (common cause)* — *the correlated (simultaneous) failure* — *the reliability overestimate the correlation creates*

A common-mode failure is present when each of the following holds:

- **Apparent redundancy (the protective multiplicity).** Several components are arranged so the system is meant to tolerate the loss of any one; the design's reliability claim depends on there being more than one.
- **An independence assumption (the load-bearing premise).** The reliability case treats the components' failures as independent, so the joint failure probability is (assumed to be) the product of the individual ones — small to the power of N. This is the premise a common-mode failure falsifies.
- **A latent shared dependency (the common cause).** The components in fact share an upstream element — a power source, a design, an environment, a supplier, a risk factor — that the independence assumption overlooked. The dependency is often invisible precisely because attention was on the components, not on what they have in common.
- **Correlated failure (the simultaneity).** When the shared cause is disturbed, the components fail together rather than one at a time, so the redundancy provides no staggering and no survivor. The failures are positively correlated, not independent.
- **The reliability overestimate (the diagnostic gap).** Because independence entered the reliability estimate multiplicatively, the real joint-failure probability is far higher than the model's — often by orders of magnitude. The gap between promised and actual reliability is the fingerprint: a system that "cannot fail" fails wholesale.

The components compose into one object — *a shared cause correlating the failures of nominally independent redundant elements* — and it is the latent-dependency-plus-correlated-failure pairing that generates the downstream damage: the collapse of the whole redundant set at once and the severe overestimate of reliability that preceded it.

## What It Is Not

- **Not redundancy.** `redundancy` is the *protective* structure — duplicate elements so the whole survives a part's failure. Common-mode failure is redundancy's *failure-mode dual*: the specific way that protection is defeated when the duplicates turn out not to be independent. Redundancy is the capability; common-mode failure is the characteristic breakdown of that capability. Naming the pair together is the point — you cannot reason well about one without the other.
- **Not a single point of failure.** A `single_point_of_failure` is an element with *no* redundancy — one component whose loss stops the system, and everyone can see there is only one of it. A common-mode failure is more insidious: there *appear* to be several independent components, the redundancy looks real, but a hidden shared dependency makes them a single point of failure *in disguise*. The danger of common-mode failure is precisely that it hides inside apparent redundancy, so it evades the "add a backup" fix that addresses an obvious single point.
- **Not a cascading failure.** A cascading failure spreads *sequentially*: one element fails, which overloads or triggers the next, which triggers the next, in a chain over time. A common-mode failure is *simultaneous and common-caused*: the elements fail together because one shared cause hit them all at once, not because one failure propagated to the others. The tell is timing and mechanism — cascade is a chain of distinct causes; common-mode is one cause with many victims.
- **Not correlation as such.** `correlation` is the general statistical fact that two quantities co-vary. Common-mode failure is the *specific consequential structure* in which correlation among the failures of supposedly-independent protective elements defeats the redundancy built on their assumed independence. Correlation is the ingredient; common-mode failure is the named failure the ingredient produces in a redundant system.
- **Not systemic risk in general.** `systemic_risk` is the broad danger that a whole system can fail as a unit; common-mode failure is one of its principal *mechanisms* — the specific route by which apparently-diversified or apparently-redundant parts turn out to be exposed to one shock. Systemic risk is the outcome-level concern; common-mode failure is a structural cause of it.
- **Common misclassification.** Treating any simultaneous multi-component failure as common-mode. Catch it by checking for the *shared cause*: were the components genuinely independent and unluckily failed near the same time (coincidence), or did a single common dependency make their failures the *same event* (common-mode)? Only the latter is the prime; the former is chance, and chance does not systematically defeat redundancy the way a shared cause does.

## Broad Use

Common-mode failure, read as a shared cause correlating nominally-independent failures, recurs wherever redundancy or diversification is used to buy safety. In **engineering and safety-critical systems**, it is the central concern of reliability analysis: triple-redundant avionics that share a single software bug fail identically on the same input; backup generators in a common flood zone drown together (the Fukushima Daiichi accident, where tsunami flooding disabled multiple redundant cooling systems that shared location and power dependencies); redundant sensors that share a calibration error all read wrong at once. Nuclear and aerospace design explicitly hunts common-cause failures because redundancy is otherwise assumed to make failure negligible. In **finance and economics**, it is the mechanism behind diversification's collapse in a crisis: a portfolio of "independent" mortgage-backed assets shared a common risk factor (national house prices), so when that factor moved they defaulted together in 2008 — diversification that assumed low correlation met a common cause and delivered none of its promised protection; the same structure underlies bank runs (shared exposure to a liquidity shock) and correlated sovereign defaults. In **biology and agriculture**, a genetic monoculture is common-mode failure waiting to happen: a field of genetically identical crops shares a single susceptibility, so one matched pathogen can destroy the entire "redundant" population at once (the Irish potato famine, the Gros Michel banana), which is exactly why genetic diversity is a resilience strategy. In **computer systems and infrastructure**, "independent" replicas that share an availability zone, a power feed, a network dependency, or a common library fail together when that shared element does — cloud outages repeatedly trace to a single shared control-plane or DNS dependency taking down services believed to be redundant. In **organizations and decision-making**, independent reviewers, auditors, or forecasters who share the same training, incentives, or assumptions exhibit common-mode failure of judgment: their "independent" checks all miss the same thing because they share a blind spot, which is why genuine cognitive diversity — not just more reviewers — is what makes review robust. Across all of these the recognizable move is the same: a reliability or safety case rested on independence, a hidden shared dependency violated it, and the redundant set failed as one.

## Clarity

Naming common-mode failure sharpens the single question that redundancy arguments most often get wrong: *not "how many copies are there?" but "how independent are they really?"* Practitioners routinely reassure themselves with multiplicity — three generators, a hundred mortgages, five reviewers, dozens of replicas — and compute a reliability that assumes those copies fail independently. The prime forces the prior question: what do these copies *share*? It relocates the analysis from counting redundant elements to auditing their common dependencies — shared power, shared design, shared location, shared supplier, shared risk factor, shared assumption — because the reliability of a redundant system is set by its weakest shared cause, not by its count. The clarifying force is to convert "we have N backups, so we are safe" into "what single disturbance would take out all N at once, and how likely is it?" — a question that points attention exactly where the naive reliability estimate is blind. The prime also clarifies *why the estimate is not merely wrong but wildly wrong*: because independence enters multiplicatively, a small unmodeled correlation among failures can inflate the true joint-failure probability by orders of magnitude over the independent-case estimate, so common-mode failure is not a minor correction but the difference between "essentially never fails" and "fails wholesale in the one scenario that matters." And it clarifies the correct *remedy*: since the enemy is the shared cause, the fix is *diversity of dependency* — different power sources, different designs, different suppliers, different assumptions — not more copies of the same thing. Adding a fourth generator to the same basement does nothing; putting one on the roof is the whole point.

## Manages Complexity

Common-mode failure compresses a large and superficially unrelated class of disasters — flooded backup generators, correlated mortgage defaults, monoculture crop collapses, cloud outages, groupthink review failures — into a single diagnosable structure, so an analyst can carry one question across all of them rather than re-learning the lesson per domain. The complexity reduction is concrete: instead of separately studying each field's reliability folklore, one recognizes the shared skeleton (apparent redundancy, latent shared dependency, correlated failure, reliability overestimate) and imports the same audit — enumerate what the redundant elements have in common and ask which shared disturbance fails them all. The prime also manages complexity by *redirecting analytic attention to the right object*. Naive reliability analysis scales badly because it invites tracking each component's failure probability in isolation; common-mode failure says the component-level detail is largely a distraction and the real state variable is the *dependency structure* — the graph of what shares an upstream with what. That reframing collapses a high-dimensional per-component problem into a lower-dimensional question about shared causes, which is why safety engineering budgets its effort on common-cause analysis rather than on ever-more-precise single-component reliability. Finally, the prime *bounds optimism*: it supplies a standing correction to the reliability inflation that multiplicative independence assumptions produce, so a designer using it treats every "N-fold redundant, therefore safe" claim as a hypothesis to be tested against the hunt for a shared cause, rather than a conclusion. That single discipline — assume correlation until independence is demonstrated — is what keeps redundancy honest.

## Abstract Reasoning

The common-mode-failure pattern licenses several substrate-independent moves. *Audit the shared dependency, not the count*: presented with any redundant or diversified set, the reasoner should immediately ask "what do these share?" rather than "how many are there?", because the reliability of the set is governed by its common causes, not its multiplicity. *Distrust multiplicative reliability claims*: whenever an estimate assumes independent failures (a joint probability computed as a product), treat it as an upper bound on reliability that a single unmodeled shared cause can destroy — the reasoner should ask what correlation among the failures would do to the estimate and how confident the independence assumption really is. *Diversify the dependency to buy real redundancy*: since the enemy is the shared cause, genuine resilience comes from making the copies differ in their *dependencies* (different power, design, supplier, assumption), so the reasoner's lever is variety of upstream, not quantity of copies — a direct link to `diversity` and `diversification` as resilience strategies. *Look for the disguised single point of failure*: apparent redundancy is where common-mode failure hides, so the reasoner should treat any "we have backups" reassurance as a prompt to find the shared element that makes the backups one thing. *Extend the pattern to judgment*: independent reviewers, models, or forecasts that share training, incentives, or assumptions exhibit common-mode failure of cognition, so the reasoner seeking robust conclusions should engineer *dependency diversity* among the checks — different methods and perspectives — not merely more checks. And *read the dual*: any argument that redundancy makes a system safe is implicitly an assumption that the copies fail independently, so recognizing the prime tells the reasoner exactly what to attack — find the shared cause, and the redundancy argument falls.

## Knowledge Transfer

Because common-mode failure is the bare structural fact of a shared cause correlating nominally-independent failures, a lesson learned in one domain transfers to another by re-identifying the redundant set, its assumed independence, and its latent shared dependency. The founding engineering lesson — "redundant safety systems must not share a common cause, or the redundancy is illusory" — transfers verbatim to finance as the diagnosis of 2008: a diversified portfolio is redundant protection against idiosyncratic default, but shares a common risk factor (aggregate house prices), so when that factor moved the "independent" assets defaulted together exactly as three generators in one basement drown together — the same structure, distinguished only by whether the shared cause is a flood or a macroeconomic variable. It transfers to biology as the case for genetic diversity: a monoculture is a redundant population (many individuals) with a shared susceptibility (identical genome), so a single matched pathogen is the common cause that fails them all, and the remedy — diversify the genome — is structurally identical to diversifying a portfolio's risk factors or a data center's power feeds. It transfers to distributed systems as the discipline of *failure-domain isolation*: replicas are only redundant if they do not share an availability zone, a power source, a network path, or a software dependency, so cloud architects hunt shared dependencies exactly as reliability engineers hunt common causes. And it transfers to organizational decision-making as the case for cognitive diversity: independent reviewers who share a blind spot fail in common, so robust review requires diversity of assumption, not just number of reviewers — the same move as diversifying any other shared dependency. In every transfer the practitioner runs the identical diagnosis — identify the redundant set, surface the independence assumption its reliability rests on, hunt for the latent shared dependency, and estimate how correlated the failures really are — and the transfer is secure because none of these steps names the substrate: a nuclear engineer isolating safety systems, a risk manager stress-testing correlations, a plant breeder diversifying a crop, a cloud architect spreading failure domains, and an editor assembling a diverse review panel are all defending the same structure against the same enemy, correlation among the very elements whose independence their safety was supposed to rest on.

## Examples

### Formal/abstract

Model a redundant system as N components each with individual failure probability `q`, arranged so the system fails only if *all* N fail. Under the **independence assumption** — the premise the prime targets — the system-failure probability is the product `q^N`, which for `q = 0.01` and `N = 3` gives `10^-6`: essentially never. Now introduce a *latent shared dependency*: suppose a common cause, occurring with probability `c`, fails all N components simultaneously when it occurs (the *correlated-failure invariant*). The true system-failure probability is no longer `q^N` but approximately `c + (1-c)·q^N` — dominated by `c` whenever `c ≫ q^N`. With even a small `c = 10^-3`, the true failure probability is about `10^-3`, a *thousand-fold worse* than the `10^-6` the independence model promised (the *reliability-overestimate invariant* made algebraic). The structural lesson is exact and general: once a common cause exists, adding more redundant components (increasing N) drives `q^N` toward zero but leaves `c` untouched, so reliability saturates at the common-cause floor no matter how much redundancy is added. This is the formal statement of "correlation is the enemy of redundancy": the `q^N` term rewards multiplicity, the `c` term ignores it, and beyond a point only reducing `c` — diversifying the shared dependency — improves reliability at all. The β-factor model used in nuclear and aerospace probabilistic risk assessment is exactly this decomposition, with `c` estimated as a fraction β of the single-component failure rate.

**Mapped back:** The `c + (1-c)·q^N` model instantiates every component — the apparent redundancy (N copies), the independence assumption (`q^N`), the latent shared dependency (the common cause with probability `c`), the correlated failure (all N fail together when `c` fires), and the reliability overestimate (`q^N` vs the true `c`-dominated value) — and shows the prime's core pairing (shared dependency plus correlated failure) as the precise reason redundancy saturates and only dependency-diversity, not more copies, lowers the floor.

### Applied/industry

The 2008 collapse of diversified mortgage-backed securities ran the identical structure in a financial substrate, with no engineering vocabulary. The *apparent redundancy* was diversification: a security pooled thousands of individual mortgages so that any single homeowner's default was a negligible fraction of the whole, and the *independence assumption* was that defaults were largely uncorrelated — modeled with low pairwise default correlation, which made the senior tranches look nearly riskless (`q^N`-style reasoning: many independent small risks sum to near-certainty of repayment). The *latent shared dependency* was a common macroeconomic risk factor — national house prices — to which every mortgage in the pool was exposed but which the low-correlation models discounted. When that shared cause was disturbed (house prices fell nationwide), the *correlated failure* struck: mortgages defaulted *together* rather than independently, because they were all exposed to the same factor, so the diversification that assumed independence provided almost none of its promised protection and the "safe" tranches failed wholesale. The *reliability overestimate* was catastrophic and precisely the multiplicative kind — instruments rated as essentially never-defaulting (the finance analogue of `10^-6`) defaulted at rates orders of magnitude higher, because the models' near-zero joint-default probabilities rested entirely on an independence assumption a common cause destroyed. The remedy the prime prescribes is the one risk management adopted: stress-test against *common factors*, not just idiosyncratic risk — diversify the dependency (exposure to different, genuinely uncorrelated risk factors), not merely the count of assets.

**Mapped back:** The 2008 MBS collapse runs the prime end-to-end — apparent redundancy (a diversified pool), an independence assumption (low default correlation), a latent shared dependency (national house prices), correlated failure (defaults arriving together when that factor moved), and a severe reliability overestimate (near-riskless ratings on assets that failed wholesale) — and demonstrates the transfer: a nuclear engineer isolating backup cooling, a plant breeder diversifying a crop, and a risk manager stress-testing common factors are defending the same structure against the same enemy, distinguished only by whether the shared cause is a flood, a pathogen, or a macroeconomic variable.

## Structural Tensions

**T1 — Redundancy versus Independence (the Foundational Illusion).** The prime's core tension is that redundancy's reliability benefit rests entirely on an independence assumption that the redundancy itself does nothing to guarantee. The failure mode is *counting copies instead of auditing dependencies*: treating N-fold multiplicity as N-fold reliability without checking whether the copies share a cause. Diagnostic: for any redundant set, enumerate what the elements share (power, design, location, supplier, risk factor, assumption) and ask which single disturbance fails them all; the reliability is set by that shared cause, not by N.

**T2 — Adding Copies versus Diversifying Dependencies (the Saturation Trap).** Because a common cause is untouched by multiplicity, adding more redundant elements of the same kind improves reliability only up to the common-cause floor and then not at all. The failure mode is *redundancy saturation*: spending on more identical backups that cannot lower the dominant common-cause probability. Diagnostic: decompose failure into an independent part (which more copies reduce) and a common-cause part (which they do not); if the common-cause part dominates, the lever is dependency-diversity — different designs, sources, environments — not additional copies.

**T3 — Visible Redundancy versus Hidden Sharing (the Disguised Single Point).** Common-mode failure is dangerous precisely because it hides inside apparent redundancy, so a system that looks well-protected is a single point of failure in disguise. The failure mode is *false reassurance*: the presence of visible backups suppressing the search for the shared dependency that makes them one thing. Diagnostic: treat every "we have backups" claim as a prompt to find the common element; the more confident the redundancy claim, the more important the hunt for what the copies silently share.

**T4 — Modeled Correlation versus True Correlation (the Estimation Gap).** Reliability and risk models must assign some correlation to the failures of "independent" components, and the temptation is to assign a comfortably low one. The failure mode is *correlation underestimation*: using a small assumed correlation (often for tractability or optimism) that a real common cause blows past, so the joint-failure estimate is orders of magnitude too good. Diagnostic: stress-test the estimate against high-correlation and common-shock scenarios rather than the base-case correlation; if the reliability conclusion is fragile to the correlation assumption, the assumption is doing the work and must be justified, not assumed.

**T5 — Common-Mode versus Coincidence (the Attribution Question).** Not every simultaneous multi-element failure is common-mode; some are genuinely independent failures that happened to coincide. The tension is between over-attributing (seeing a shared cause where there is only chance) and under-attributing (dismissing a real common cause as bad luck). The failure mode on the dangerous side is *coincidence rationalization*: explaining away a common-caused failure as a fluke and therefore not fixing the shared dependency. Diagnostic: ask whether a single identifiable disturbance made the failures the *same event* (common-mode, systematic, will recur) or whether independent causes merely aligned in time (coincidence, will not systematically recur); only the former defeats redundancy by design and demands dependency-diversity as the fix.

## Structural–Framed Character

Common-mode failure sits near the structural end of the [structural–framed spectrum](../conceptual/structural-and-framed-primes.md), with a frontmatter aggregate of 0.1 — most diagnostics read zero or near-zero. The pattern is a relational fact about a dependency graph: a shared upstream node correlates the failures of elements the reliability case treated as independent.

The structure is medium-neutral and demonstrably recurs across substrates with no human necessarily in the loop. It carries only a faint home vocabulary (vocab_travels 0.1): "common-mode / common-cause failure" is a reliability-engineering term, but the underlying structure appears un-named as correlated defaults in finance, monoculture susceptibility in biology, shared failure domains in distributed systems, and shared blind spots in review. Institutional_origin and human_practice_bound read 0.0 — a shared power bus, a single pathogen, and a common macroeconomic factor correlate failures with no institution or human practice required. The small non-zero marks are honest: "failure" carries a whiff of evaluative weight (evaluative_weight 0.1, since it names a breakdown rather than a neutral relation), and recognizing an instance is mildly an act of importing the safety-analysis frame (import_vs_recognize 0.1). But the core — correlation among supposedly-independent elements defeating the independence assumption redundancy rests on — is a structural relation, and the contrast with its dual `redundancy` (the protective structure) confirms the read: both are relations on a set of components, distinguished by whether the components' failures are independent (redundancy works) or share a cause (common-mode failure).

## Substrate Independence

Common-mode failure is strongly substrate-independent — composite **4 / 5** on the [substrate-independence scale](../conceptual/substrate-independence.md). Its signature — a latent shared dependency correlating the failures of nominally-independent redundant elements, so multiplicity does not multiply reliability — is stated as a relation on a dependency graph with no commitment to a medium, earning structural abstraction a strong 4 (a notch below 5 only because the sharpest formalization runs through a reliability/probability frame rather than a purely relational one). Its domain breadth is a full 5: engineered redundancy (avionics, nuclear cooling, backup power), financial diversification (correlated defaults, bank runs), biology and agriculture (genetic monocultures felled by one pathogen), distributed computing (replicas sharing an availability zone or dependency), and organizational judgment (reviewers sharing a blind spot) all exhibit the identical structure. Transfer is well documented (4): the "correlation is the enemy of redundancy" lesson and the "diversify the dependency, not the count" remedy recur verbatim across these fields, and canonical cases (Fukushima, 2008, the potato famine) are textbook instances of the same skeleton. The composite is 4 — a highly cross-domain structural failure pattern whose formal home is reliability theory but whose reach is general across physical, financial, biological, computational, and social substrates.

- **Composite substrate independence — 4 / 5**
- Domain breadth — 5 / 5
- Structural abstraction — 4 / 5
- Transfer evidence — 4 / 5

## Not to Be Confused With

The most important relationship is with the prime's dual, **`redundancy`** (the protective structure whose failure-mode this is). Redundancy duplicates elements so the whole survives a part's loss; common-mode failure is the specific way that protection is defeated when the duplicates share a hidden cause and fail together. They are not rivals but a matched pair — capability and its characteristic breakdown — and the whole value of naming common-mode failure is that it makes redundancy's load-bearing assumption (independence) explicit and therefore auditable. Reasoning about redundancy without common-mode failure is how the reliability overestimate happens.

A second confusion is with **`single_point_of_failure`**. A single point of failure has *no* redundancy and is visible as such — one component, obviously critical. Common-mode failure wears the *opposite* appearance: there seem to be several independent components, the redundancy looks real, but a shared dependency makes them a single point of failure in disguise. The distinction is decisive for the remedy: a visible single point is fixed by adding redundancy, whereas a common-mode failure is *created by* redundancy that shares a cause and is fixed only by diversifying the dependency. Applying the single-point fix (add another copy) to a common-mode problem adds another element with the same shared cause and buys nothing.

A third confusion is with **cascading failure** and, more broadly, with **`correlation`** and **`systemic_risk`**. A cascading failure spreads sequentially — one failure triggers the next in a chain — whereas common-mode failure is simultaneous, with one shared cause producing many victims at once; the tell is whether the failures are links in a chain (cascade) or siblings of one parent cause (common-mode). Correlation is the general statistical ingredient, and common-mode failure is the specific consequential structure correlation produces in a redundant system — correlation among *the very elements whose independence the safety case assumed*. Systemic risk is the outcome-level danger that a whole system fails as a unit, and common-mode failure is one of its principal mechanisms rather than a synonym for it.

For a practitioner these distinctions decide what is being claimed and what to do about it. Confusing common-mode failure with a single point of failure prescribes the wrong fix — more copies where dependency-diversity is needed. Confusing it with a cascade misdirects the investigation toward propagation chains when the real culprit is one shared cause. Confusing it with correlation or systemic risk in the abstract loses the specific, actionable structure — a redundant set, an independence assumption, a latent shared dependency — that tells you exactly where to look. The unifying discipline is the prime's audit: identify the redundant set, surface the independence assumption its reliability rests on, hunt for the shared dependency the copies have in common, and estimate how correlated their failures truly are — and only then trust, or distrust, the redundancy, because the reliability of the whole is set by its shared causes and nothing weaker names them.
