2.5Designing availability & capacity (at design time)

With availability and capacity, noticing a shortfall only after operation begins is often too late. That is exactly why, at the design stage of a service, the configuration must be decided with an eye to the availability target derived from requirements and to peak demand. This section covers how to eliminate single points of failure through redundancy, how availability changes in series and parallel configurations, and how to design capacity from a future demand forecast—each within the judgment axis of trade-offs with cost.

2.5.1Availability targets and redundant design

• An availability target is the required availability (e.g., 99.9%), derived from business impact (the loss when it stops). Availability is expressed as MTBF÷(MTBF+MTTR) and is raised from both fault-resistance (reliability = MTBF) and recovery speed (maintainability = MTTR). The target is set at the design stage and a configuration that meets it is chosen.
• A single point of failure (SPOF) is a spot where, if that one thing breaks, the whole service stops. Redundant design (duplicating equipment, paths, power, etc., so that if one fails the other continues) eliminates the SPOF to raise availability. But redundancy involves added cost, so it must be applied to an extent commensurate with business impact.

2.5.2Availability in series and parallel

• A series configuration stops entirely if any one element fails. Overall availability is the product of each element's availability (e.g., two 0.99 elements in series give 0.99×0.99 = 0.9801). The more elements added in series, the lower the overall availability, so reducing the number of series-connected elements is also a design judgment.
• A parallel (redundant) configuration places elements of the same function in parallel and continues unless all fail simultaneously. Overall availability is 1−(1−a)ⁿ (a is one unit's availability, n is the number in parallel) and is higher than series (e.g., two 0.9 units in parallel give 1−(1−0.9)² = 1−0.01 = 0.99). Parallel (redundancy) greatly raises availability but incurs cost proportional to the number of units.

2.5.3Demand forecasting and capacity design

• A demand forecast estimates how far a service's usage (transaction count, data volume, concurrent connections, etc.) will grow in the future. At the design stage, capacity is decided by factoring in not just averages but peak demand and future growth. Too little causes performance degradation and SLA breaches at peak; too much wastes cost.
• Design-time capacity balances allowing a safety margin (buffer) on the needed processing power while not over-provisioning into excessive cost. For future demand growth, adopting a configuration that is easy to scale up in advance (a design that can scale) is also part of the judgment.

A service manager is deciding, at the design stage, the availability and capacity of a new online application service being launched. On availability first, the manager hears from the business unit that "if intake stops, a corresponding opportunity loss occurs per hour," and sets a monthly availability target of 99.9% (allowable downtime about 43 minutes per month). To meet it, the manager first enumerates single points of failure on the configuration diagram. Among the web server, application server, database, load balancer, power, and network paths, any single-unit spot is a SPOF where "if it breaks, the whole thing stops." Considering that the elements are connected in series (if any one stops, the whole stops), overall availability in a series configuration is the product of each element's availability, and the more elements, the lower the whole, so a configuration that simply lines up one of each will not reach 99.9%. The manager therefore makes the high-impact elements (database, load balancer, power) parallel (redundant). Even if one unit's availability is 0.99, two in parallel raise it to 1−(1−0.99)² = 1−0.0001 = 0.9999, giving a prospect of eliminating SPOFs while meeting the target. But making every element redundant would double the cost, so a cost trade-off judgment is needed to make only the elements commensurate with business impact redundant. Next, on capacity, this service is expected to see applications concentrate during campaign periods, so the manager factors peak demand, not average load, into the demand forecast. Designing on averages alone would let responses lag at peak so the service is effectively unusable, and even if the availability target is met, the customer experience could amount to an SLA breach. The manager therefore secures processing power with a safety margin over peak demand while adopting a scalable configuration that can be augmented when needed, so that idle equipment is not excessive in off-peak periods. Design-time availability and capacity design is thus not "just make everything redundant and augment," but essentially to derive targets from requirements (business impact, peak demand) and judge single-point-of-failure elimination, series/parallel availability, and future demand growth within trade-offs with cost.

2.5.4Section summary

• Derive the availability target from business impact; availability = MTBF÷(MTBF+MTTR), raised from both reliability and maintainability
• Eliminate a single point of failure with redundant design (parallel). Series is the product of availabilities and decreases; parallel is 1−(1−a)ⁿ and increases
• Decide design-time capacity by a demand forecast (peak, future growth), not averages; set targets for both availability and capacity by trade-offs with cost