Fable
After a shutdown, how long until the clock starts running again
The north city had a master clock that shops used to open, warehouses to ship, and guest halls to change shifts. In the past, the master clock occasionally ran a few minutes slow, and the clockmaker would climb up and adjust it.
Later, the city connected orders, approvals, and all workstations to the master clock. When the clock stopped, customers could not see progress, the warehouse did not know which batch to ship first, and the shopkeeper could not promise delivery times.
The first major shutdown happened at dawn. The clockmaker spent six hours finding the broken gear, and during that time everyone could only pass messages by word of mouth. By afternoon the master clock was restored, but many urgent orders had already been lost.
City Hall's naive fix was to buy more spare gears. But the next failure was the clock tower entrance, the third was the key responsible for switching, and the fourth was that no one knew who could declare temporary business hours.
The new superintendent laid out each type of business on the table: customer inquiries could pause for two hours, ordinary reports for one day, payment confirmations had to recover within half an hour, and key customer tickets needed an alternative path within fifteen minutes.
He wrote down a recovery time for each type of business and worked backward to determine night watch, backup clocks, switchover keys, manuals and drills. The shorter the time, the more expensive the day-to-day preparation.
They also practiced midnight failures. The night watch first announced the scope of impact, then switched to the backup bell; low-risk matters queued, critical matters used a temporary channel, and customers received an estimated recovery time.
Later the master clock stopped once more. The city did not immediately restore all functions, but critical business was available within the promised time. Everyone finally understood that recovery speed is a capability already bought, practiced, and written into responsibilities before an incident. Later the chief steward rearranged the schedule once each quarter. The more critical the business, the faster the promised recovery, and the less the backup clocks, night watchmen, and drills behind it could be omitted. He also reminded each shop that the shorter the promise, the higher the daily cost. If no one is willing to pay for fifteen-minute recovery, they cannot demand a miracle afterward. Later, before every new business went live, it had to first specify how long it could be down. Later, before every new business went live, it had to first specify how long it could be down, who would recover it, and where the backup route was. Later, before every new business went live, it had to first specify how long it could be down, who would recover it, and where the backup route was before it could proceed.