4 ms·
A classic case of correlated failures. If you have multiple redundant systems, but anything that damages one system is also likely going to damage others, then
by jasonhansel 4y ago
A classic case of correlated failures. If you have multiple redundant systems, but anything that damages one system is also likely going to damage others, then a failure is much more probable than you would expect based on the level of redundancy.
In this case the redundant systems were the watertight compartments. The engineers thought the ship wouldn't sink because it was unlikely for five of them to fail at the same time. But they forgot just how likely it was that any incident (e.g. an iceberg collision) that damaged one compartment would likely also damage many others.
- togs 4y agoSo in other words, redundancy requires subsystems' Pr(failure) to be independent of each other.
- Comevius 4y agoI mean the Titanic suffered a 100 meters long side-swipe damage, no redundancy could account for that. No one thought that the Titanic was unsinkable, it's just that no one thought that anyone would smash the ship against an iceberg at that speed, because why would they. Unfortunately the clear, moonless sky effectively camouflaged the iceberg due to the low contrast and false horizon. Even ships today would maintain a lower speed at night when needed despite having a radar and access to satellite images, but the Titanic had to cross the ocean faster than the Olympic did before.
- jasonhansel 4y agoYeah, no redundancy could account for it, which is why confident predictions that the Titanic was uniquely unlikely to sink due to the presence of redundant systems were so ridiculous. Keep that in mind next time you think your system is ultra-reliable because you have 50 instances of every service, but they're all running in us-east-1.