Six small decision models for the questions that recur in architecture reviews, each connected to a shared failure-economics layer. Change the assumptions, inspect the technical boundary, then test whether the proposed resilience is justified by the SLO and cost of downtime.
Want to model the dependencies between those boundaries? Open CTO Workbench V2 and simulate failure propagation.
Turn architecture assumptions into numbers.
Six small models for conversations that become expensive when they stay vague.
How much concurrent work must the service carry?
required in-flight capacity
- Peak traffic
- 750 req/s
- Base concurrency
- 90
Prove at least 122 concurrent requests without violating the latency objective.
What level of resilience is justified?
Connect this technical signal to the SLO and the cost of downtime.
net protection value
- Allowed downtime / year
- 8.76 h
- Error-budget exposure
- $43,800
- Avoided failure cost
- $30,000
- Control cost / year
- $14,400
- Break-even avoidance
- 0.72 h / incident
The modeled avoided failure cost exceeds the proposed control by $15,600 per year.
Use contribution margin, contractual penalties, recovery labour, lost productivity, and customer harm—not topline revenue alone. This is a decision model, not a promise that redundancy will prevent every modeled hour.
Assumptions and limits
Uses Little’s Law with p95 latency as a planning proxy. Real concurrency follows the full latency distribution, traffic correlation, queues, and dependency limits.
Use the result as a question #
These models are deliberately transparent. They expose the arithmetic behind a decision, then state the assumption that most often breaks in production. A green capacity signal is not an investment decision. The Workbench also calculates permitted downtime, error-budget exposure, avoided failure cost, annual control cost, and the break-even recovery improvement.
Useful follow-up questions are concrete: Does the p95 hide a dangerous tail? Can every replica fill its connection pool at once? Are failures correlated? Can the queue drain while new work still arrives? The answer should become an observable production invariant.
Continue the investigation #
- Queues, backpressure, and overload control
- PostgreSQL connections are a capacity budget
- Deadline budgets and retry amplification
- Error budgets as engineering investment policy
- Cache invalidation is a consistency protocol
Have a recurring engineering decision that deserves a tool? Send it to me.