The Second Node Buys Uptime, Not Capacity
The Second Node Buys Uptime, Not Capacity
Ada re-derives this chapter’s own numbers step by step, at full precision
ADA · CALCULATION AUDIT
The Second Node Buys Uptime, Not Capacity
This chapter’s smart building runs 4,000 devices and must hit 99.9% uptime — no more than about 8.76 hours of downtime a year. The chapter is blunt that a single broker handles the traffic easily, yet one node at a typical 99.5% uptime still misses that target, so the design pays for a second node. This audit checks the availability arithmetic to ask what that extra node actually buys, since it adds no capacity the building needs.
Companion to the chapter MQTT Production Operations — every number here comes from that chapter.
See the relationship before changing it
The figure reads from left to right. The blue card is single-node uptime. The middle card applies the page rule. The green card is two-node downtime. Walk the arrows once: set the input, apply the rule, then read the result with its unit.
Derive the baseline in four named moves
- 1
Name the input. The chapter baseline is 99.5 %.
- 2
Name the relationship. downtime = (1 - uptime)^2 x 8,766 h x 60
- 3
Substitute with units. (1 - 0.995)^2 x 8,766 x 60 = 13.15 minutes/year
- 4
Read the result. Keep the unit beside the value. Use it only inside the technical boundary on this page.
Predict, then change single-node uptime
Try Predict the direction of downtime = (1 - uptime)^2 x 8,766 h x 60. Test another single-node uptime, then compare two-node downtime.
Observe This independence model explains redundancy value, but shared failures remain outside it. Reset single-node uptime to 99.5 and compare two-node downtime.
Explain This independence model explains redundancy value, but shared failures remain outside it.
Check yourself
What should you do before trusting a moved-control result?
What does this small model leave out?
Ready: use the stated baseline inputs, then compare each displayed result.
Ada: Step 2 already showed one broker handles this building’s load, yet the design still specifies two nodes. Let me audit the availability arithmetic that justifies the extra node, because it is the whole reason to pay for redundancy the throughput does not need.
First the target. A 99.9% SLA allows 0.001 x 365.25 x 24 = 0.001 x 8766 = 8.77 hours of downtime per year. A single node at a typical 99.5% uptime is down 0.005 x 8766 = 43.83 hours/year, failing the target by nearly 5x.
Now two independent nodes; the cluster is down only when both are:
- Cluster availability:
1 - (1 - 0.995)^2 = 1 - 0.005^2 = 1 - 0.000025 = 0.999975, i.e.99.9975% - Cluster downtime:
0.000025 x 8766 = 0.219 hours = 13.1 minutes/year
That is an improvement of 43.83 / 0.219 = 200x (equivalently 0.005 / 0.000025), and it clears the 8.77-hour budget with roughly a 40-fold margin. The point the numbers make is that the second node contributes no throughput the building requires, since Step 2 proved one node suffices, so its entire job is to convert a single point of failure into 200x less downtime. Redundancy here is bought for availability, and the per-device cost of that insurance is $175 / 4000 = $0.044/device/month.
Every number above is taken from the chapter’s own material and re-derived step by step.