Common-Cause and Common-Mode Failure Mitigation

Redundancy fails when copies fail together; Kronos attacks the shared cause with diversity in physics, supply, power, clock, and software.

The correlated-failure trap

Triplicated channels and layered defenses assume independence. Common-cause failure (CCF) breaks that assumption: a shared vulnerability — one power supply, one firmware image, one calibration procedure, one environmental exposure — can knock out redundant copies simultaneously. In reliability math the CCF term, modeled by a beta-factor, usually dominates the residual risk once independent failures are made rare.

def system_pfd(channel_pfd, n, beta):
    # n redundant channels; beta = fraction of failures that are common-cause
    independent = (channel_pfd * (1 - beta)) ** n
    common = beta * channel_pfd
    return independent + common      # common term sets the floor

print(system_pfd(1e-2, n=3, beta=0.05))   # ~5e-4, floored by CCF

How Kronos drives beta down

• Physical diversity: back the digital reflex with an analog/latching failsafe on a different principle.
• Supply diversity: source redundant sensors and controllers from different lines where feasible.
• Power and clock domain separation so one rail or one clock cannot take all channels.
• Software diversity and staggered updates so a single firmware bug does not deploy everywhere at once.
• Procedural diversity: independent calibration and installation checks to break shared human error.

Environmental CCF gets specific attention on these machines: neutron and gamma fields, strong magnetic fields, cryogenic temperatures, and vacuum all stress electronics in correlated ways. Safety electronics are sited, shielded, and rated so that a single environmental excursion does not exceed the qualified envelope of an entire redundant set at once.

Diversity is finite, so it is applied where it matters most: on the highest-integrity functions and on the shared resources whose loss would defeat a whole redundant set at once. A single diverse failsafe behind three identical digital channels usually buys more real safety than a fourth identical channel, precisely because it breaks the common cause rather than adding another correlated copy. The beta-factor, not the channel count, is the number the design works to reduce.

CCF mitigation is what gives the defense-in-depth layers their real independence, and it is audited during commissioning by deliberately faulting shared resources and confirming the surviving diversity holds.