More In This Article
3. Clearly, four failures are too many because there are only nine devices, so any four failures would leave fewer devices than functions. However, any three failures can be tolerated. If the failures are all the backups, there is no problem because the primaries are still doing their functions. If the failures are all the primaries, then the solution to the warm-up shows that the backups can fill the gaps. If one primary (P1) and two backups fail, then either the remaining backup can step in for P1 or it can step in for another primary (P2) that can itself step in for P1.
For example, suppose the primary for function A fails along with backups 1 and 3. Then backup 2 steps in for the primary doing function E and that primary takes over the function A.