Redundancy shares the environment unless the model says otherwise

Let C be a specific common-cause event over the mission, such as a shared control dependency becoming unusable. Suppose C makes both replicas unavailable. Outside C, assume local replica failures are independent with a stated conditional probability q. This is a simplified mixture, not a universal physical law. It separates a high-impact shared scenario from ordinary local failures and uses independence only within the declared normal environment. The unconditional replicas then remain dependent because both respond to the same hidden environment.

Compute each marginal by including common-cause and normal scenarios, and compute joint failure with the same partition of possibilities. Multiplying the resulting marginal probabilities wrongly treats the common scenario as if it occurred independently for each replica. A service can therefore improve local component reliability while its joint outage approaches the common-cause floor. More replicas sharing that cause cannot drive modeled outage below the probability of the cause itself. Removing the cause or changing the conditional impact requires architecture and operational evidence, not just a new replica-count parameter.

A scalar correlation coefficient can summarize one aspect of dependence but does not fully describe a multi-replica outage distribution or its causes. Several different joint models can share similar marginals and correlations while assigning very different probabilities to rare all-replica failure. The mixture's all-or-nothing common cause is deliberately coarse. Real causes can affect a region, a software cohort, a fraction of disks, or repair capacity. Identify the relevant domains and conditional failure mechanisms before choosing a parameterization; do not retrofit a cause solely because a curve fits an incident count.

Diversity can reduce some shared modes while adding integration and operational risk. Different hardware with the same bad deployment still shares that deployment; different regions may still depend on one identity service. Conversely, failures occurring together can reflect common traffic or maintenance rather than direct causation between replicas. Record exposure, changes, and timeline evidence. The model should distinguish simultaneous observation from a demonstrated causal mechanism, and retain uncertainty when logs cannot resolve which shared scenario was active. Rare-event datasets often cannot estimate a tiny common-cause probability precisely.

Compare scenarios that improve local reliability, remove a shared dependency, or reduce a cause's blast radius. Inspect whether the decision is stable across plausible common-cause probabilities. A reliability claim should name which causes were tested and which remain outside the model. Incident reviews and controlled fault injection can reveal missing coupling, but a test in one environment does not certify every future deployment. Preserve evidence for normal periods too, so a model does not learn only from visible outages while forgetting the exposure needed to interpret their frequency.

The binomial lab is an independence baseline, not a common-cause instrument. Reset, set BOTH failure probability p=0.02 and n=2, predict all-failure probability 0.0004, then Play or Step. Reset and re-set BOTH p=0.02 and n=3; predict 0.000008. Edits retain t and playback highlights exact counts. The bars have no shared environment variable and cannot display the mixture's common-cause floor. Use them to compute the normal-environment term, then add the shared scenario explicitly in the worked calculation rather than claiming extra independent trials model real fault-domain diversity.