Systems that keep working.
WHAT AVAILABILITY MEANS
The proportion of time a system is usable.
WHAT TO DECIDE
What level is actually required, and what it is worth.
WHY
Each additional nine costs substantially more.
WHAT SINGLE POINTS OF FAILURE ARE
Anything whose failure stops the system.
WHAT TO IDENTIFY
Every one of them.
WHAT REDUNDANCY PROVIDES
Continued operation when one component fails.
WHAT IT REQUIRES
Genuine independence, and automatic failover that has been tested.
WHY TESTED
Failover that has never been exercised frequently does not work.
WHAT GRACEFUL DEGRADATION MEANS
Losing some capability rather than all of it.
WHAT THAT LOOKS LIKE
Showing cached results when a service is unavailable, rather than an error.
WHAT A CIRCUIT BREAKER DOES
Stops calling a failing dependency, allowing it to recover and failing fast meanwhile.
WHY THAT MATTERS
Continuing to call a failing service prolongs the outage and can spread it.
WHAT TO DESIGN FOR
Partial failure, which is normal in any system with dependencies.
WHAT TO TEST
Failure, deliberately.
