How it works
Why does it behave this way?
- 1
Feedback loops
What changes when the offered load depends on the system's own latency?
10 pages - 2
Metastable failure
How can two identical systems under identical load be in different states?
7 pages - 3
Cascading failure
Why is the dependency graph that governs failure not the one on the architecture diagram?
9 pages - 4
Gray failure
Why can no failure detector decide whether a component is dead or slow?
8 pages - 5
Death spirals
Why does deferred work become a debt whose interest rises with the balance?
7 pages - 6
Overload defences
Why must every overload defence lose work on purpose, and which three things can it change?
5 pages - 7
What failure dynamics forbids, and six questions for any design
What does the whole of failure dynamics forbid, and which six questions find these failures in a design review?