Engineering
Why Fail-Safe Design Uses Both Redundancy and Diversity
Quick fact
In aerospace, the Boeing 777 uses triple-redundant fly-by-wire systems with three different processor architectures and two different software languages to protect against both hardware and software common-mode failures.
Why this is interesting
Imagine a plane with two identical engines, both made by the same manufacturer with the same design. If they fail for the same reason, you have no engine left. How do engineers guard against that scenario?
Read the full explanation
Understanding Why Fail-Safe Design Uses Both Redundancy and Diversity
Redundancy is about having backups: if one pump fails, a second identical pump takes over. It’s a simple and powerful idea. But redundancy only works if the backups fail independently. If all pumps are identical and they all clog from the same dirty fuel, they fail together. That’s a common-mode failure. Diversity addresses this by using different technologies or implementations to achieve the same function. For example, a car might measure speed using both a wheel-speed sensor and a GPS-based speedometer. If the wheel sensor gets blinded by mud, the GPS still works. Redundancy gives you quantity; diversity gives you variety, and variety is what protects against the unexpected.
A deeper explanation
Diversity defends against systematic errors, which are bugs or design flaws that affect every identical copy. If every channel of a redundant system runs the same software, a software bug can crash them all at once. If every channel uses the same sensor model, a manufacturing defect or external interference can disable them simultaneously. By using different hardware, software, or physical principles, diversity ensures that each channel has a different set of vulnerabilities. When one channel fails, another is likely to remain functional. Fail-safe design then uses voting to decide what action to take: if two of three diverse channels agree, the system proceeds; if they disagree, it defaults to a safe state, like shutting down or pulling over. Thus, redundancy and diversity work together: redundancy provides a path to continue, and diversity ensures that path is not blocked by a single point of failure.