Design for failure

This page is published under the terms of the licence summarized in the footnote.

The need for Defensive Design

Design by Contract (DBC) means a server will fall over if a client (any client) does not guarantee its preconditions.

Defensive Design (DD) means a server tests (or likely retests) its preconditions are met, and responds gracefully if not.

Distribution of micro apps tends to increases the need for DD.

"You build, you run it"

Amazon's notion of "you build, you run it" is that a development team takes full responsibility for the software in production.

It implies your team has control over deployment, is able to deploy your app with all its dependencies and run it.

The idea is to remove the barriers between development, maintenance, operations and feedback from use.

Like all agile development ideas, it is very good and useful idea… where it can be readily applied.


Martin Fowler says there's no reason why this same approach can't be applied to monolithic apps.

Hmm…  It implies the large app can be divided vertically into silos, each supporting one or a few use cases.

It implies those use cases share little by way of user interface, common modules, data access.

Because the more these things are shared, the more entangled the micro apps become.

Modularisation and decoupling tends to complicate design for failure.

As Martin points out, design for failure becomes an issue. His words are slightly edited below.

Client micro apps need to be designed so that they can tolerate the failure of server micro apps, and respond as gracefully as possible.

This [distribution and separate deployment] is a disadvantage, since introduces additional complexity.

Micro apps teams must constantly reflect on how failures affect the user experience, how to report them, how to handle them.

Netflix's “Simian Army” induces failures of services and even data centers during the working day to test app resilience and monitoring.


Footnote: Creative Commons Attribution-No Derivative Works Licence 2.0                        23/12/2014 14:34

Attribution: You may copy, distribute and display this copyrighted work only if you clearly credit “Avancier Limited:” before the start and include this footnote at the end.

No Derivative Works: You may copy, distribute, display only complete and verbatim copies of this page, not derivative works based upon it.

For more information about the licence, see