Failover

Large internet services don’t run on a single computer, but on many machines simultaneously. Any one of them can break: a power supply burns out, a hard drive dies, a power cable gets accidentally pulled. Failover is the answer to this. It means that the work is automatically taken over by a replacement machine as soon as the actual machine stops responding. Nobody has to get up in the middle of the night to press a button. In the best case, the switchover takes a few seconds, and the user notices at most a brief delay.

What an outage without a backup system costs

For an online shop, every minute of downtime means lost revenue. At a bank, transfers and card payments can get stuck. At a hospital, it’s about patient data that must be available immediately. That’s why providers promise their customers a certain level of availability in contracts. Values like 99.99 percent per year are common. That sounds like a lot, but it only allows for about 52 minutes of downtime per year.

Such figures cannot be maintained without failover. Even a planned software update would eat up the entire budget. With a backup system, on the other hand, you can update one machine at leisure while the other keeps operations running. Afterward, the roles are swapped. Failover therefore serves not only emergencies but also routine maintenance.

This topic is also current in the AI industry. When a language model provider goes down, thousands of apps that rely on it come to a halt all at once. That’s why many companies keep a second provider on hand as a fallback option. This is called a multi-provider strategy: a failover not within one’s own technology, but between two suppliers.

Heartbeat, backup machine, and the address jump

Technically, failover requires three things. First, a replacement that can take over the same task. Second, monitoring that detects the failure. Third, a way to redirect traffic to the replacement. Monitoring usually works via short control signals called a heartbeat. The active machine reports in about once a second. If several reports fail to arrive, it is considered dead.

Then the replacement takes over. Often a network address migrates along with it, so that requests from outside automatically end up at the new machine. You can think of it like call forwarding: the number stays the same, but the phone behind it is a different one. So that the replacement also has the correct data, it is continuously copied beforehand. This ongoing copying is called replication.

A common misconception is confusing failover with a backup. A backup is a copy from yesterday, from which data has to be laboriously restored. Failover keeps operations running immediately, but it does not protect against accidentally deleted files, since the deletion is dutifully copied along as well. Also dangerous is the case where both machines consider themselves active at the same time because only the connection between them was disrupted. Experts call this split brain, and it can render data unusable.

Failover in data centers, in the news, and on your own Wi-Fi

Cloud providers sell failover as a product feature. You distribute your servers across several so-called availability zones, i.e., separate buildings with their own power supply. If one zone fails, the others keep running. Databases, too, usually offer a standby server that steps in during an emergency.

In the news, the term often comes up when it has failed. After major cloud service outages, it’s frequently reported afterward that the switchover didn’t work or took too long. That’s why companies now deliberately test this scenario, shutting down machines during live operation. This practice is known as chaos engineering.

On a small scale, we know this principle from everyday life. A router that switches to mobile data when the cable connection fails is doing failover. So is an emergency generator in a hospital. And anyone who brings a copy of their presentation on a USB stick to a talk has organized their own private backup system.