Resilience simulation

ResilienceAnalyzer simulates element failures on a design and reports N-1 and N-2 verdicts, single points of failure, blast radius and availability estimates.

Run#

Java

import com.eqixiac.equinix.design.optimizer.MetroOptimizer;
import com.eqixiac.equinix.design.optimizer.model.OptimizationResult;
import com.eqixiac.equinix.design.resilience.ResilienceAnalyzer;
import com.eqixiac.equinix.design.resilience.ResilienceReport;
import com.eqixiac.equinix.design.spec.DesignSpec;
import com.eqixiac.equinix.design.spec.DesignSpecIO;
import com.eqixiac.equinix.design.spi.MetroPortfolio;

DesignSpec spec = DesignSpecIO.read(Path.of("design.yaml"));
OptimizationResult optimized = MetroOptimizer.forSpec(fabric, spec).run();

// the recommended portfolio of an optimization
ResilienceReport report = ResilienceAnalyzer.forSpec(fabric, spec).optimization(optimized).run();

// or a portfolio you name
ResilienceReport dcNy = ResilienceAnalyzer.forSpec(fabric, spec)
    .portfolio(MetroPortfolio.ofCodes("DC", "NY"))
    .run();

System.out.println(report.n1().level() + ": " + report.n1().statement());
System.out.println(report.n2().level() + ": " + report.n2().statement());
report.singlePointsOfFailure().forEach(s -> System.out.println(s.description() + " -> " + s.effect()));
System.out.println(report.toMarkdown());

Design.over(fabric).resilience(spec) returns the same analyser. A supplied optimization must have been computed for the same spec fingerprint.

Method#

DesignGraphBuilder builds a DesignGraph of sites, metros, Cloud Routers, on-ramps, cloud connections, backbone links and cloud regions.
ScenarioCatalog lists every single-element failure and up to 2,000 failure pairs (ResilienceOptions.withMaxPairScenarios(...)).
FailureSimulator evaluates each scenario for paths, latency, capacity and zones.

Verdict	Meaning
`UNAFFECTED`	The failed element carried nothing
`SURVIVES`	Service continues at full capacity on another path
`DEGRADED`	Service continues with a capacity shortfall, a latency breach or a zone violation
`OUTAGE`	At least one workload or site is disconnected

Report#

Accessor	Content
`n1()`	Verdict over single-element failures: `PASS`, `DEGRADED`, `FAIL` or `NOT_APPLICABLE`, with scenario counts and a statement
`n2()`	Verdict over the simulated failure pairs
`singlePointsOfFailure()`	Elements whose loss alone causes an outage, with the effect
`blastRadius()`	Scenarios ranked worst first, with affected site weight, shortfall in Mbps and workloads down
`correlatedRisks()`	Redundant elements that share a failure domain
`remediations()`	Proposed changes, re-simulated where possible
`availability()`	Estimated availability and downtime minutes per year for each workload, with the formula
`singleFailures()`, `outcome(scenarioId)`	Per-scenario detail
`toMarkdown()`, `toJson()`, `toSummary()`	Renderings. The Markdown includes a Mermaid diagram of the graph.

Losses of a cloud region or an Equinix region are shared-fate events. They are reported and ranked, and they are not counted in the N-1 verdict.

Availability assumptions#

Availability per workload composes assumed per-element availabilities, with failures treated as independent. The defaults (AvailabilityAssumptions.defaults()):

Element	Assumed availability
Metro	0.9999
Cloud Router	0.9999
Cloud connection	0.9995
Cloud on-ramp	0.9995
Backbone link	0.9999
Site access	0.999
Cloud region	0.9999

These are round figures chosen for comparison between designs. They are not Equinix or cloud-provider SLAs. Replace them with your contractual figures through ResilienceOptions.defaults().withAvailability(...).

Use in the optimizer#

constraints.minSurvivalPct (0 to 100) makes the optimizer reject a portfolio whose worst single-element failure leaves less than that share of service. The constraint id is min_survival.
ResiliencePlugin adds the simulated_resilience objective and the geo_zones_failover constraint. The objective is active when the spec gives it a weight.

The built-in resilience objective of the Metro Optimizer is a static measure of the worst single-metro loss and does not run the simulator.

Limits#

A failure removes a whole element. Partial degradation of an element is not modelled.
Backbone capacity is unknown and does not constrain the simulation.
A second-router remediation is not re-simulated.
The simulation covers the planned design. It does not read the live estate. Estate analysis reports single points of failure in deployed resources.

MCP tool: design_analyze_resilience (MCP server).