Dataset · Source extract and model arithmetic

Eleven nines: what a durability model does not prove

Historical source figures and reproducible fixed-window arithmetic: distinguish Poisson event counts from distinct-shard binomial probabilities, with explicit storage-class scope.

Download CSV21 rows · 7 columns · CSV

File /data/datasets/s3-durability-eleven-nines-derivation.csv · JSON metadata · All datasets · Human-readable note on hesela.com

Method

We reviewed AWS storage-class documentation, Backblaze's 2018 derivation and pinned notebook, and Greenan, Plank and Wylie's HotStorage 2010 position paper. Our Python standard-library generator uses 70-digit Decimal arithmetic. It reproduces the printed 56-window calculation separately from the 8760/hour-window convention, sums the Poisson tail directly, and independently evaluates the finite binomial sum. Four parameter sets are deterministic sensitivity scenarios, not a sample of observed losses. No AWS implementation is reconstructed.

Reproduction: Python code, full-precision JSON and four-scenario CSV. Run python3 durability-model.py --output-dir results with Python 3.12 or newer. No external libraries are required.

Limits

All window calculations assume independent, constant-rate shard failures and independent fixed periods. They do not model overlapping repairs, losses straddling period boundaries, latent corruption, shared dependencies or operational deletion. The fractional annual exponent is a historical approximation, not an event-driven repair simulation. Extra decimal digits reduce rounding error but do not reduce model uncertainty. No empirical confidence interval, provider ranking or guarantee follows.
The 2018 Backblaze inputs are historical, not current provider measurements.
The source extract has 21 rows; the separate model CSV has four deterministic parameter scenarios. Neither count is an empirical sample size.
An expected loss count is not a guaranteed waiting time. Probability of any loss needs assumptions about dependence.
The AWS storage-class source excludes One Zone classes from the three-zone claim.

Table

21 rows, the same rows as the CSV. Value low and value high are legacy column names. Every row here is a point value in the high column, not an uncertainty bound. Units are in the unit column. Sources are the pages opened on 2026-10-15.
Measure	Value low	Value high	Unit	Scope	Note	Citation
S3 Standard durability design target	not stated	99.999999999	percent of objects per year	S3 Standard (vendor target)	Vendor target, not an observed loss rate.	aws-s3-faq
Minimum Availability Zones holding an object	not stated	3	zones	S3 Standard; excludes One Zone classes	One Zone-IA and Express One Zone do not share this three-zone scope.	aws-s3-userguide
S3 Standard availability target	not stated	99.99	percent per year	S3 Standard	Availability target, distinct from durability and any contractual SLA.	aws-s3-faq
Annual loss probability implied by 11 nines	not stated	0.00000000001	probability per object per year	Derived by us: 1 minus 0.99999999999	Arithmetic on the eleven-nines target, not a measured probability.	aws-s3-faq
Expected losses a year with 10,000,000 objects	not stated	0.0001	objects per year	Derived by us: 10,000,000 x 0.00000000001	Linearity of expectation does not require independence; a waiting-time or any-loss probability needs further assumptions.	aws-s3-faq
Shards per object, Backblaze B2	not stated	20	shards	Reed-Solomon, 2018 post	Historical 2018 architecture, not a current specification.	backblaze-2018
Shards needed to rebuild an object	not stated	17	shards	Same scheme	Ideal erasure-code threshold; other forms of corruption are outside this model.	backblaze-2018
Missing shards exceeding the coding tolerance	not stated	4	distinct unavailable shards	Ideal 20/17 code, no other corruption	Four different unavailable shards, not necessarily four Poisson events.	backblaze-2018
Drive annualized failure rate assumed	not stated	0.81	percent per year	Backblaze average over the trailing 60 days of the post	Historical fleet input; not an assumed universal device hazard.	backblaze-2018
Effective failure rate used in the derivation	not stated	0.41	percent per year	Backblaze	Half of 0.81% is 0.405%, rounded by the source to 0.41%; recovery credit is an assumption.	backblaze-2018
Rebuild interval assumed	not stated	156	hours (6.5 days)	Backblaze	The post directly assumes 6.5 days. Its separate 12 TB / 12 day example does not derive 156 hours.	backblaze-2018
Poisson probability of exactly 4 events in one interval	not stated	0.000000000000189	probability per 156 hour interval	Historical event-count approximation	Rounded reproduction of exactly four events; excludes the upper tail and does not count distinct shards.	backblaze-2018
Intervals per year used	not stated	56	intervals	Backblaze	Rounded convention; 8760/156 is approximately 56.153846, not exactly 56.	backblaze-2018
Durability Backblaze states	not stated	11	nines	Backblaze B2, 2018	Vendor claim in the 2018 post, not a loss measurement.	backblaze-2018
Printed-window Poisson approximation, recomputed	not stated	0.0000000000106	probability per object per year	Derived: exactly 4 events, 56 periods	Rounded value; generator separately publishes printed-window and full-year conventions.	backblaze-2018
Same formula with 0.81% failure rate (no recovery credit)	not stated	0.00000000016	probability per object per year	Derived by us	Fourth-power scaling is a rare-event approximation, not an exact law.	backblaze-2018
Same formula with 2% failure rate	not stated	0.0000000060	probability per object per year	Derived by us	The 2% input is illustrative, not an observed replacement population.	backblaze-2018
Same formula with a 312 hour rebuild	not stated	0.000000000085	probability per object per year	Derived by us with 28 intervals a year	Approximate cubic window sensitivity assumes rare events and a fixed-window model.	backblaze-2018
Expected losses for fixed 1e13 object-years	not stated	100	objects	Derived: exposure x 1e-11; not a waiting-time guarantee	Fixed exposure arithmetic; a surviving initial population without replacement would require a survival calculation.	backblaze-2018
MTTDL value cited for the Pergamum archive	not stated	1400	years	Greenan et al. cite it as an example of a Markov-model estimate	Example cited in the position paper; not reproduced by Hesela.	greenan-hotstorage10-pdf
MTTDL for a sample 8-disk RAID4 array	not stated	37.60	years	Greenan Table 1: Markov-model example; not a finite-horizon loss probability	Table 1 comparison example, not a measured mean or an estimate of S3 durability.	greenan-hotstorage10-pdf

Columns

measure (string): The quantity as the source names it, or our derived quantity.
value_low (number): Retained legacy range column; empty for this point-value extract.
value_high (number): Point value, not an upper uncertainty bound; see scope and note.
unit (string): Unit of the value.
scope (string): Population and context the value applies to; 'Derived by us' marks our arithmetic.
note (string): What the value is not, or the source wording behind it.
citation_id (string): Id of the opened source in the citations list; several ids are separated by semicolons.

Rights and reuse

No standalone reuse license has been verified for this mixed-source derived CSV. It combines attributed source figures and labeled arithmetic; it is not an observed loss dataset or a copy of the papers. The sources retain their own rights.

Standalone CSV reuse license: not verified. Rights evidence reviewed 2026-10-15. This records the limits of the evidence, not a conclusion that every use is prohibited.

The JSON field licenseUrl links to this statement for compatibility; it is not a license grant. The review covers the primary publication and any publisher policy listed below, not every secondary source or research artifact.

Amazon S3 FAQs, Durability and Data Protection (AWS, vendor document) (checked 2026-10-15). Reviewed for factual provenance; this source is not a verified standalone reuse license for Hesela's mixed-source CSV.
AWS S3 User Guide: storage classes, durability and Availability Zone scope (checked 2026-10-15). Reviewed for factual provenance; this source is not a verified standalone reuse license for Hesela's mixed-source CSV.
Backblaze Durability Calculates at 99.999999999% And Why It Doesn't Matter, Brian Wilson, Backblaze blog, 17 July 2018 (vendor derivation) (checked 2026-10-15). Reviewed for factual provenance; this source is not a verified standalone reuse license for Hesela's mixed-source CSV.
Mean time to meaningless: MTTDL, Markov models, and storage system reliability, Greenan, Plank, and Wylie, USENIX HotStorage 2010 (USENIX PDF, independent academic source) (checked 2026-10-15). Reviewed for factual provenance; this source is not a verified standalone reuse license for Hesela's mixed-source CSV.
Backblaze erasure-coding durability notebook, pinned revision 37f758d (checked 2026-10-15). Reviewed for factual provenance; this source is not a verified standalone reuse license for Hesela's mixed-source CSV.

Sources

Amazon S3 FAQs, Durability and Data Protection (AWS, vendor document) (accessed 2026-10-15)
AWS S3 User Guide: storage classes, durability and Availability Zone scope (accessed 2026-10-15)
Backblaze Durability Calculates at 99.999999999% And Why It Doesn't Matter, Brian Wilson, Backblaze blog, 17 July 2018 (vendor derivation) (accessed 2026-10-15)
Mean time to meaningless: MTTDL, Markov models, and storage system reliability, Greenan, Plank, and Wylie, USENIX HotStorage 2010 (USENIX PDF, independent academic source) (accessed 2026-10-15)
Backblaze erasure-coding durability notebook, pinned revision 37f758d (accessed 2026-10-15)