Skip to content

Failover

Switch a protected function from a failed primary path to a prepared alternate so continuity is preserved.

The Diagnostic Story

Symptom: A system depends on one primary path—a component, channel, provider, person, or site—and when that path fails or degrades, the essential function stops. There is no prepared alternate; or an alternate exists but has never been activated; or no one is sure who owns the function if the primary is unavailable. Continuity requires the primary to always work, which means any failure becomes a full outage.

Pivot: Prepare an alternate path capable of assuming the protected function, instrument the primary so failure or degradation is detectable, transfer flow and authority to the alternate when triggered, and preserve enough state and context for the alternate to operate safely. Manage recovery or failback according to an explicit policy.

Resolution: The protected function continues through the alternate with bounded disruption and preserved integrity. Ownership is unambiguous, in-flight work is handled safely, and the system can return to the primary—or remain on the alternate—through a governed process that does not corrupt state.

Reach for this when you hear…

[database reliability] “We have a replica in another region, but we've never actually promoted it—if the primary goes down tonight, nobody knows the exact steps and the replica might be hours behind.”

[power infrastructure] “The backup generator is tested once a year, but the transfer switch hasn't been exercised under real load, so I'm not confident it'll take over cleanly when we need it.”

[organizational succession] “Our director is the only person with signing authority for contracts over fifty thousand, and there's no named deputy—if she's unreachable we're just stuck.”

Abstractions this archetype builds on — directly (a source ingredient) or as a related pattern. Links follow the typed catalog namespace.

Built directly on (8)

  • Alternate Path
  • Controlled Reentry: Re-establishing a suspended activity or state through staged, monitored steps with the capacity to abort, because returning to normal is a separate engineered process and not a simple reversal of the exit.
  • Health Check
  • Observability: Infer internal state externally.
  • Recovery Policy
  • Redundancy: Duplicate critical components.
  • State Synchronization
  • Switching Rule

Also references 11 related abstractions

Variants

Narrower or domain-specific specializations that share this archetype's core structure. Recognized variants are established; candidate variants are provisional.

Primary / Secondary Switchover · implementation variant · recognized

Switch from a primary component, route, or actor to a prepared secondary alternative when the primary fails.