Achieving Zero RPO and Sub-Second RTO with Active-Active Distributed Sagas
This article explores the architectural shift from active-passive to multi-region active-active topologies for mission-critical banking systems, focusing on distributed sagas and SQL databases. It details how to achieve zero RPO and sub-second RTO by leveraging synchronous consensus and resilient orchestrators like Temporal, addressing the mathematical trade-offs between latency and availability.
Read original on Dev.to #architectureTraditional active-passive disaster recovery setups in core banking systems face significant challenges for high-availability requirements, particularly concerning Recovery Point Objective (RPO) and Recovery Time Objective (RTO). Asynchronous replication leads to data loss (non-zero RPO), and manual failovers result in long downtimes (high RTO). Additionally, distributed transactions (sagas) in flight during an outage can become corrupted, leading to inconsistent states.
Multi-Region Active-Active Topologies for Tier-1 Systems
To overcome these limitations, the Xenon Architecture Standard advocates for multi-region active-active topologies, specifically for distributed saga orchestrators (like Temporal) backed by distributed SQL engines (like CockroachDB or Google Cloud Spanner). This approach aims to eliminate single-region failure risks and achieve RPO = 0 and RTO < 1s across regional disasters.
Xenon Architecture Standard
The Xenon Architecture Standard provides comprehensive blueprints for high-availability banking platforms, including BIAN service domain mappings and dual-orchestration patterns. It emphasizes deploying multi-region active-active setups for critical components.
BIAN Service Domain HA & SLA Matrix
Not all business capabilities require the same level of disaster recovery. The article categorizes BIAN Service Domains by criticality, outlining target RPO, RTO, and the appropriate multi-region topology and database consensus strategy for each tier. This demonstrates a pragmatic approach to system design, balancing cost and complexity with business needs.
| BIAN Service Domain | Criticality Tier | Target RPO | Target RTO | Multi-Region Topology Pattern | Database Consensus Strategy |
|---|
Mathematical Model: Multi-Region Consensus Latency vs. Availability
Achieving zero RPO in active-active regions necessitates synchronous consensus (e.g., Raft or Paxos). This implies that a transaction is only acknowledged after a quorum of regions confirms persistence, directly impacting commit latency. The article presents a formula for minimum commit latency based on local execution time, RTT to the closest majority quorum, and fsync time. It also defines system availability across multiple independent active-active regions based on individual region unavailability probability.