| Vose Software

Industry: Telecommunications and IT
Product: ModelRisk
Application: Cloud Service Reliability


52 Minutes a Year: Sizing the Real Probability of an SLA Breach

A "four nines" SLA — 99.99% availability — buys the customer 52.6 minutes of downtime per year. Miss it and the service-credit clauses, often $10k–$40k per minute over budget for enterprise contracts, trigger immediately. For a regional cloud operator running tens of thousands of tenants, the question is not "what is our average uptime?" — it is "what is the probability the cumulative downtime budget gets blown, and which failure mode is most likely to do it?" That is a tail question, and a deterministic MTBF/MTTR worksheet cannot answer it.

A Tier-1 cloud-services unit rebuilt its reliability view in ModelRisk: four independent failure sources — hardware faults, software incidents, DDoS events, and demand-surge saturation — composed into a single annual-downtime distribution against the 52.6-minute SLA budget. The deterministic worksheet adds the expected contributions to roughly 27 minutes — comfortably inside budget. The simulation tells a different story: the mean lands near 27 minutes, but P90 ≈ 57 min and P99 ≈ 122 min, and the probability of breaching the 52.6-minute budget is ~12% per year. A "comfortable" average conceals a roughly 1-in-8 chance of triggering service-credit clauses.

Annual downtime distribution — regional cloud service

The skew comes from software-incident MTTR: the rare long production rollback is what eats the budget, not the routine hardware blips. Below, each failure source is built up separately and summed per simulated year.

The four downtime stacks

Steady-state availability is the textbook ratio A = MTBF / (MTBF + MTTR), but in a distributed cloud no single MTBF/MTTR pair describes the system — different fault classes have different rates and different recovery shapes. Each is modelled separately and summed per simulated year.

  • Hardware faults. Service-affecting events arrive Poisson with λ = 2.5/yr (post-redundancy). Per-event MTTR is LogNormal with median 2.5 min, σ = 0.55 — failover is fast but garbage-collection of stuck nodes is occasionally slow.
  • Software incidents. Bad deploys, schema-migration bugs, GC pauses: Poisson λ = 1.2/yr, MTTR LogNormal median 8 min, σ = 0.85 — the heaviest right tail in the model because rollbacks involve human judgement.
  • DDoS / cyber. Poisson λ = 0.3/yr (about one mitigated event every three years), MTTR LogNormal median 12 min, σ = 1.0.
  • Demand-surge saturation. Peak/capacity ratio is LogNormal with median 0.50, σ = 0.28; when the ratio exceeds 1.0 the service degrades. The breach probability is ~0.7% per year; conditional MTTR is LogNormal median 18 min.

LogNormal is the right choice for MTTR — fixing an incident is the product of many multiplicative factors (paging delay × diagnosis time × rollback time × verification), and that compounding is exactly what produces a right-skewed distribution.

Why the mean is the wrong number

Adding the expected per-source contributions gives an expected annual downtime of roughly 27 minutes — comfortably inside the 52.6-minute budget. From that number alone, the SLA looks safe. But the distribution above shows the budget is breached ~12% of years, because the right tail of software-incident MTTR carries far more mass than the mean suggests. A deterministic MTBF/MTTR worksheet collapses that tail into a single reassuring average and hides the 1-in-8 SLA-credit exposure entirely.

Which lever moves P99

Sensitivity on the P99 annual downtime tells the SRE team where the next dollar should go.

Tornado on P99 downtime

Software-incident MTTR dominates, followed by the demand-peak / capacity ratio and the DDoS event rate. Hardware fault rate — the thing classical reliability worksheets obsess over — ranks near the bottom because failover already trims it. The takeaway: a faster rollback pipeline (canary deploys, automatic rollback on SLI breach) buys more uptime per dollar than swapping out servers.

Pricing the reliability investment

The team scoped a $10M, three-quarter programme: canary-deploy infrastructure with auto-rollback (cuts software MTTR median 8 → 5 min), a regional always-on DDoS scrubbing service (cuts cyber MTTR 12 → 5 min), and rack-level failover automation (cuts hardware MTTR 2.5 → 1.3 min).

Annual downtime — before vs after a $10M reliability programme

After the programme, P(SLA breach) drops from ~12% to ~1%, mean annual downtime falls from 27 to ~14 min, and P99 from 122 to ~55 min. That converts directly into expected SLA-credit savings.

What downtime actually costs

Revenue for this service runs ~$8,000/min; SLA credits add ~$40,000/min above the 52.6-minute threshold. Putting both into the simulation produces the annual-cost distribution:

Annual downtime cost — revenue loss + SLA penalties

The mean is a modest ~$0.35M, but VaR99 reaches $3.7M and the expected shortfall beyond it is $5.8M — the tail dominated by the rare bad-deploy plus DDoS double-hit, with a 1.6% chance of exceeding $3M in a year. That is the number the CFO needed to see to greenlight the reliability programme: the $10M spend pays for itself by clipping the right tail of this distribution, not by changing the average.

What changed

  • Service-credit accrual budget reduced. Finance switched from a deterministic 27-min downtime forecast to a P90-based reserve, eliminating two years of consecutive variance surprises in quarterly results.
  • Investment decision reframed. The $10M programme was approved not on "MTTR improvement" but on the explicit tail-clipping argument — an 11-point reduction in annual SLA-breach probability.
  • SLA negotiation strengthened. Two enterprise renewals were re-priced with confidence: customers asking for 99.999% (5.3 min/yr) were quoted accordingly because the simulation showed that target was not feasible without geographic diversity the existing footprint could not provide.

ModelRisk Functionality Used

  • Compound Poisson + LogNormal for each of the four downtime stacks, summed per simulated year over 60,000 years — the natural construction for cumulative downtime under heterogeneous fault classes.
  • Sensitivity ranking on P99 downtime rather than the mean, because the SLA breach lives in the tail and the mean masked the relevant driver (software MTTR, not hardware fault rate).
  • Before-after histogram overlay to communicate the $10M programme's impact — a single chart showing the 11-point drop in SLA-breach probability cleared the capital-committee review.
  • Threshold probability output for "P(annual downtime > 52.6 min)" directly tied to the SLA budget — the metric Finance and the SRE team agreed to monitor jointly.
  • LogNormal-from-median parameterisation so operators can update the model from incident-postmortem medians, the number their tooling actually exports.

The mean uptime number is the wrong question for a four-nines SLA. The right question is the probability of breaching the 52.6-minute budget — and Monte Carlo turns that into a single, defensible percentage that maps directly to dollars at risk.