Skip to content
flowss
Start freeChecking your session
Fault tree (FTA) templates

Fault Tree — Regional Cloud API Outage

A month of a three-zone regional service, where one shared datastore sits inside all three availability-zone branches: the exact evaluation shows the two-of-three vote buys far less than the architecture diagram promises.

Fault tree (FTA)Operations & OpsFault tree (FTA) syntax docs
Template previewFault tree (FTA)
Regional API unavailability — multi-AZ serviceFault tree (IEC 61025) · 9 basic events · 7 gates · depth 3topPublic APIunavailable in the…0.007484entry_lostTraffic cannot reachthe service0.003754dns_faultAuthoritative DNSmisconfiguration0.0012edge_lbEdge load balancerfleet failure0.002158tls_expiryCertificate expirynot renewed4.00e-4capacity_lostServing capacityinsufficient2/30.002548az_aAvailability zone Aunavailable0.00649az_a_infraZone Ainfrastructure event0.004shared_storeShared regionaldatastore degraded0.0025az_bAvailability zone Bunavailable0.00649az_b_infraZone Binfrastructure event0.004shared_storeShared regionaldatastore degraded0.0025az_cAvailability zone Cunavailable0.00649az_c_infraZone Cinfrastructure event0.004shared_storeShared regionaldatastore degraded0.0025control_planeControl plane blocksrecoveryno_rollback0.060.0012deploy_regressionBad deploymentreaches the region0.02Top event probability (exact)0.007484Minimal cut sets8Smallest cut set order1Single points of failure4Mission time720 hRepeated basic events1Exact top-event probability 0.007484 · rare-event sum ΣP(cut set) 0.007506The usual approximation overstates this tree by 0.28% — that gap is the overlap between cut sets, which only the exact evaluation removes.Minimal cut sets — by order, then probability1. {shared_store} order 1 P 0.0025 33.4% of the top ← single point of failure2. {edge_lb} order 1 P 0.002158 28.8% of the top ← single point of failure3. {dns_fault} order 1 P 0.0012 16% of the top ← single point of failure4. {tls_expiry} order 1 P 4.00e-4 5.3% of the top ← single point of failure5. {deploy_regression, no_rollback} order 2 P 0.0012 16% of the top6. {az_a_infra, az_b_infra} order 2 P 1.60e-5 0.2% of the top7. {az_a_infra, az_c_infra} order 2 P 1.60e-5 0.2% of the top8. {az_b_infra, az_c_infra} order 2 P 1.60e-5 0.2% of the topImportance — Fussell–Vesely (share of current risk) and Birnbaum (potential swing)shared_store — Shared regional datastore degraded q 0.0025 FV 33.4% B 0.995003 CR 33.2%edge_lb — Edge load balancer fleet failure q 0.002158 FV 28.8% B 0.994662 CR 28.7%dns_fault — Authoritative DNS misconfiguration q 0.0012 FV 16% B 0.993708 CR 15.9%deploy_regression — Bad deployment reaches the region q 0.02 FV 16% B 0.059622 CR 15.9%no_rollback — Automated rollback disabled for the change q 0.06 FV 16% B 0.019874 CR 15.9%tls_expiry — Certificate expiry not renewed q 4.00e-4 FV 5.3% B 0.992913 CR 5.3%az_a_infra — Zone A infrastructure event q 0.004 FV 0.4% B 0.007909 CR 0.4%az_b_infra — Zone B infrastructure event q 0.004 FV 0.4% B 0.007909 CR 0.4%Rectangle intermediate event · dome AND · shield OR · shield with k/n voting · hexagon INHIBIT with its oval condition · circle basic · diamond undeveloped · triangle transfer

Make it your own.

title "Regional API unavailability — multi-AZ service"
mission 720h                      # one calendar month

top "Public API unavailable in the region" = OR(entry_lost, capacity_lost, control_plane)

gate entry_lost "Traffic cannot reach the service" = OR(dns_fault, edge_lb, tls_expiry)
gate capacity_lost "Serving capacity insufficient" = KOFN(2, az_a, az_b, az_c)
gate az_a "Availability zone A unavailable" = OR(az_a_infra, shared_store)
gate az_b "Availability zone B unavailable" = OR(az_b_infra, shared_store)
gate az_c "Availability zone C unavailable" = OR(az_c_infra, shared_store)
gate control_plane "Control plane blocks recovery" = INHIBIT(deploy_regression, condition: no_rollback)

event az_a_infra "Zone A infrastructure event" p=0.004
event az_b_infra "Zone B infrastructure event" p=0.004
event az_c_infra "Zone C infrastructure event" p=0.004
event shared_store "Shared regional datastore degraded" p=0.0025
event dns_fault "Authoritative DNS misconfiguration" p=0.0012
event edge_lb "Edge load balancer fleet failure" rate=3.0e-6
event tls_expiry "Certificate expiry not renewed" p=0.0004
event deploy_regression "Bad deployment reaches the region" p=0.02
condition no_rollback "Automated rollback disabled for the change" p=0.06