The error budget

Abstract

A rolling thirty-day error budget, computed hour by hour over sixty days. Alerts fire only when a long window and a short window agree. The policy is agreed before the incident: ship, slow down, or freeze until the window recovers, and the freeze lifts on its own as the incident rolls out of the window.

Reliability is a budget the team spends deliberately, and the rules for spending it are written before they are needed.

Its figure in the paper: § IV →

The objective and the month

Objective, over a rolling thirty days

Background errors · 0.02%Incident starts on day · 20Incident lasts · 8 hErrors during the incident · 4%

Sixty days, hour by hour

Look at day 20.2

Ship58.9% left · burn 40.0x (1 h) · 3.0x (3 d)

The budget can afford it. Changes go out through the normal pipeline.
page · 2% of the budget in an hour: 40.0x over the long window, 40.0x over the short one. Both agree, so it is significant and still happening.
page · 5% of the budget in six hours: 33.4x over the long window, 40.0x over the short one. Both agree, so it is significant and still happening.
ticket · 10% of the budget in three days: 3.0x over the long window, 33.4x over the short one. Both agree, so it is significant and still happening.

The record · 0 receipts

verified · 0

Nothing has been decided yet.

Try to break it

A claim stands because the attacks on it were attempted and refused. Each one runs against the instrument's own rules. 0 of 3 attempted · 0 refused

Ship during a freeze
The budget is spent; one more feature goes out anyway.
Let a slow leak go unnoticed
No incident, just a background error rate one and a half times what the objective allows.
Freeze forever
Once frozen, nothing ever ships again.

Setting up the instrument…

Declared limits

Five- and thirty-minute windows are approximated at hourly resolution.
Generic and illustrative throughout: the behaviour is shown, the internals of the systems it is drawn from are not.

Instruments beside it in § IV

Which token reaches which environment →

Every attack in the laboratory, on one page: try to break all of it →

Everything you did in the laboratory, in one chain you can rewind: the notebook →