Cell architecture
A cell is a separate copy of the full service path that serves a fixed group of users. With 4 cells, a failure in 1 cell affects only 25 percent of users. Parts that the cells share connect their failures again.
See it on the board
The same traffic runs on two boards. The simulator measured both when this page was built.
| Measure | Goal | All groups share one path | Each group has its own cell |
|---|---|---|---|
| Availability (Group b) | at least 100% | 50% Fail | 100% Pass |
| Availability (Group c) | at least 100% | 50% Fail | 100% Pass |
| Availability (Group d) | at least 100% | 50% Fail | 100% Pass |
| Availability (Group a) | at least 40% | 50% Pass | 50% Pass |
| Monthly cost | 16 USD/mo | 16 USD/mo | |
| p99 latency | 24 ms | 24 ms | |
| Error rate | 50% | 50% | |
| Level rules | none broken | Board is not complete Fail | Pass |
Key numbers
| Number | Value |
|---|---|
| Mean time between failures, one server | 8,760 h |
| Recovery time after a failure | 30 s |
| Requests per second, one API server | 10,000 ops/s |
Four cells · cell A is down · 75% of requests work
How it works
A large service with one shared path has one blast radius: all users. If the path fails, everyone is down. A cell design cuts the service into several full copies. Each cell has its own servers, its own data and its own queues. Each user group belongs to one cell.
In the mini board there are four equal groups of users. Without cells all four groups use one request path, here cell A. When cell A fails for 30 s, every group fails with it. With four cells, group A uses cell A, group B uses cell B, and so on. The failure of cell A reaches only group A. The other three groups stay fully available, and the service keeps at least 75 percent of requests working.
The key rule is that cells share nothing that can fail. A shared database, a shared queue or a shared deploy pipeline joins the cells again. Even a shared configuration push can take all cells down at once.
Cells give a second gain. You can roll out a change to one cell first, and you can test a new version on a small group.
The cost is more copies to run, and a router in front that sends each user to the right cell. Size the router for the full load, and keep it simple.
In the levels you give each group its own path and check that one failure stays inside one cell.