Availability Target for a Redundant Server Cluster
A service must meet 99.9% availability (about 8.76 hours downtime per year). The architecture is two active servers behind a load balancer, each with MTBF estimated at 4,000 hours from vendor data. Repair takes 4 hours on average, including dispatch and part swap. A single shared database has MTBF 20,000 hours and MTTR 2 hours, and is not redundant. The vendor MTBF figures come from a 25 C lab with continuous operation; the data center runs at 32 C. The business owner asks whether the design meets 99.9% and what single change would most improve availability.
1. Estimate the availability of the server pair and the database, and determine whether the combined system meets 99.9%. State assumptions.
Read the worked answer
Server pair (active-active, either can carry load).
- Single server: A = MTBF/(MTBF+MTTR) = 4000/4004 = 0.99900.
- Unavailability of one server = 0.001. For a two-unit redundant pair where both must fail for outage, approximate parallel unavailability = (0.001)^2 = 1e-6, so A_pair ≈ 0.999999. (This assumes independent failures and that one server can carry full load; if not, the pair behaves as a series and A = 0.998.)
Database (series, single point).
- A_db = 20000/20002 = 0.99990. Unavailability = 1e-4.
Combined. Series combination: A_sys ≈ 0.999999 × 0.99990 = 0.99990. That is below 99.9% (0.99990 < 0.999), so the design does not meet target even before temperature derating.
Assumptions to state: failures independent; repair restores good-as-new; one server can carry full load; MTBF figures are representative; temperature effect not yet applied.
Temperature caveat. Vendor MTBF at 25 C will be optimistic at 32 C. If failure rate scales with an Arrhenius factor, the effective MTBF is lower and the database - already the binding constraint - worsens.
2. What single change most improves system availability, and how would you justify it quantitatively?
Read the worked answer
The database is the binding constraint. Its unavailability (1e-4) dominates the pair's contribution (1e-6). Adding a third server barely moves the pair term and does nothing for the database.
Best single change: make the database redundant (or cut its MTTR).
- Redundant database with the same per-unit reliability: unavailability ≈ (1e-4)^2 = 1e-8, so A_sys ≈ 0.999999, comfortably above 99.9%.
- Alternatively, halving database MTTR from 2 h to 1 h halves its unavailability to 5e-5, which alone is not enough (A_sys ≈ 0.99995, still short of 0.999? actually 0.99995 > 0.999, so it would meet target). Show the arithmetic either way.
Justification. Compare the availability gain per unit of cost for each option: database redundancy vs. MTTR reduction vs. a third server. The database options dominate because they attack the largest unavailability term. Also address the temperature gap: derating the MTBF assumptions may require more margin than the nominal calculation suggests, so validate with field data or a lab test at 32 C before signing off.