Redundant Backup Provisioning¶
Provision duplicate capacity or components so failure of one does not eliminate critical function.
The Diagnostic Story¶
Symptom: A critical function rests on a single element, and when that element fails the function disappears entirely. Nominal backups exist on paper but have never been activated, their authority is unclear, and they share hidden dependencies with the primary. Recovery depends on procurement, improvisation, or a phone call to someone who might know — during the incident itself.
Pivot: Map critical functions, identify each single point of failure, provision duplicate backup capability, define activation and coverage rules, verify independence from the primary failure mode, and maintain the backup through recurring activation tests.
Resolution: Single-point dependence is reduced for named critical functions. Recovery time and uncertainty decrease because substitute capability already exists and has been verified as real. The system can choose between full service, failover, partial emergency service, or safe shutdown with better information.
Reach for this when you hear…¶
[data center operations] “The generator is listed as our backup power source but we haven't run a real-load test in two years, so we have no idea whether it actually transfers cleanly under the current server configuration.”
[hospital pharmacy] “If our only compounding pharmacist is out sick, we have no way to prepare those IV medications — we've been one absence away from a formulary gap for three years.”
[supply chain] “We single-sourced that component because it was cheaper, and now a port closure on the other side of the world has halted our whole production line for the third time.”
When This Archetype Applies¶
No catalog groundingNone of the structural conditions is currently represented by an accepted prime or domain-specific abstraction.
Diagnostic problem
A critical function has a single point of failure or insufficient backup capacity, so loss of one component, actor, supplier, record, location, tool, or resource can remove the function entirely.
What this problem means
The structural problem is single-point dependence. A function that matters to the system is concentrated in one primary dependency. That dependency may be efficient in normal conditions, but its loss removes the function entirely or delays restoration beyond acceptable limits.
The tension is that redundancy looks wasteful until it is needed. A system optimized only for normal efficiency often removes “duplicate” capability, cross-training, spare parts, alternate suppliers, replicated records, and backup access. When disruption arrives, the missing duplicate becomes the bottleneck. Good backup provisioning pays a controlled overhead before failure so continuity is not hostage to one vulnerable element.
Show the applicability expression
Applicability expression2 distinct conditions
groundedpartly groundedopen
2 conditions, all required.
2Required in every casenumbered 1–2
These hold no matter which pattern applies.
Single vulnerable dependency · open
A critical function depends on one vulnerable element.
Use this archetype when a critical function depends on one component, person, supplier, record set, site, tool, credential, or resource whose failure would interrupt continuity beyond tolerance. The narrower requirement in this condition set is: A critical function depends on one vulnerable element.
Intolerable continuity loss · open
Failure would interrupt continuity beyond tolerance.
Use this archetype when a critical function depends on one component, person, supplier, record set, site, tool, credential, or resource whose failure would interrupt continuity beyond tolerance. The narrower requirement in this condition set is: Failure would interrupt continuity beyond tolerance.
Other requirements and context (3)
Why these sit outside the expression
Solution feasibility — it describes whether the intervention can work, not whether the diagnostic problem exists.
Solution feasibilityA substitute capability can be provisioned before failure.
It is especially useful when the system can provision a substitute before failure but cannot safely rely on emergency procurement, improvisation, or repair after failure. In this archetype, the relevant feasibility condition is: A substitute capability can be provisioned before failure. It identifies something that must be possible or available for the intervention to be workable.
Solution feasibilityActivation time and coverage requirements can be specified.
Solution feasibilityIndependence assumptions can be tested.
Coverage
0 of 2 conditions grounded · 2 open.
Mechanisms / Implementations¶
- Backup Power System: Provides alternate electrical capacity for critical functions when the primary power source fails.
- Backup Restore Drill: Proves the last-resort recovery layer actually works by restoring from it under realistic conditions — turning an assumed backstop into a tested one.
- Backup Supplier Contract: Maintains an alternate source for critical inputs when the primary supplier cannot deliver.
- Deputy Role Assignment: Names a prepared alternate actor who can perform a critical responsibility when the primary actor is absent or impaired.
- Emergency Reserve Stock: Stores critical materials, funds, equipment, or supplies for use when ordinary supply is interrupted.
- N+1 Redundancy Rule: Sizes redundancy by provisioning one spare unit beyond the number needed to carry peak load, so any single unit can fail without dropping the function below its requirement.
- Redundant Server: Duplicates computing capacity so a service, application, or data function can continue after one server fails.
- Replicated Record Store: Keeps the same records on multiple independently-writable replicas so every site stays available locally — the substrate the whole convergence process runs on.
- Spare Part Stock: Keeps replacement parts available so a failed physical component can be replaced without waiting for external procurement.
- Standby Team Roster: Keeps a prepared group available to cover a critical operation during absence, overload, or incident response.
Related Abstractions¶
Abstractions this archetype builds on — directly (a source ingredient) or as a related pattern. Links follow the typed catalog namespace.
Built directly on (3)
- Fault Tolerance: Continue operating under failure.
- Redundancy: Duplicate critical components.
- Resilience: Absorb shocks and adapt.
Also references 9 related abstractions
- Boundary: Defines system limits.
- Continuity: Smooth change without jumps.
- Controllability: Ability to steer system.
- Coupling: Interdependence among subsystems.
- Functional Redundancy (Degeneracy): Multiple pathways fulfill same function.
- Margin of Safety: Buffer capacity.
- Observability: Infer internal state externally.
- Resource Management: Allocation of finite assets.
- Robustness: Maintain functionality under stress.
Variants¶
Narrower or domain-specific specializations that share this archetype's core structure. Recognized variants are established; candidate variants are provisional.
Hot Standby Provisioning · implementation variant · recognized
Maintains a backup component or capacity in a ready-to-use synchronized state so it can assume function with minimal interruption.
Cold Spare Provisioning · implementation variant · recognized
Keeps a replacement component, resource, or capability available but inactive until failure creates a need for restoration.
Role Backup Provisioning · domain variant · recognized
Assigns and prepares alternate people or teams so a critical responsibility can continue if the primary actor is absent or overloaded.
Record Replication Backup · implementation variant · recognized
Maintains duplicate records, data, or institutional memory so a critical function can continue after loss, corruption, or inaccessibility of the primary record set.
Independent Source–Energy Pairs Through Shared Actuation · risk or failure variant · recognized
Give redundant pressure sources independent energy supplies while allowing both to drive a dual-powered modulation element, preventing a common supply loss from disabling control.
Editorial Notes¶
Problem Classification¶
Classification: Fragility, Failure & Continuity Risk → Dependency Concentration & Common-Mode Loss
Problem kernel: a critical function depends on one failure point
Rationale: Earliest causal condition: A critical function has a single point of failure or insufficient backup capacity, so loss of one component, actor, supplier, record, location, tool, or resource can remove the function entirely.
Independent corroboration: The earliest necessary condition in the frozen evidence is: A critical function has a single point of failure or insufficient backup capacity, so loss of one component, actor, supplier, record, location, tool, or resource can remove the function entirely. That is a dependency concentration and common mode loss problem because Nominally plural providers, paths, backups, or pooled exposures share enough concentration or correlation that one cause can remove them together.
Review outcome: Independent reviewer agreement; high confidence.