Most of us here debug systems for a living, and the best mental model I have found for cascading failure did not come out of a distributed systems paper. It came out of an anatomy guide, so bear with me for a minute.
The human body is usually taught as eleven organ systems, each with its own list of organs and its own list of functions. Students memorize the lists, pass the exam, and forget most of it, because a list is not a model. The version that sticks treats the eleven as one machine with eleven subsystems and a shared objective, which happens to be exactly how we are supposed to think about the services we run.
Eleven Subsystems, One Shared Objective
Every organ system exists to serve one goal: homeostasis, holding internal conditions inside a narrow band while the outside world keeps changing. Core temperature near 37 degrees Celsius. Blood pH between 7.35 and 7.45. Fasting blood glucose between 70 and 100 milligrams per deciliter.
Nothing in that architecture is decorative. Each subsystem has one job, and the job is defined relative to the shared objective rather than in isolation. That is the part that transfers. When a service in your stack cannot state its purpose in terms of the system level objective, it usually means nobody has decided what the objective is.
Failure Travels Along The Couplings
Kidney failure causes fluid retention, which strains the heart. Diabetes is an endocrine problem that goes on to damage blood vessels, nerves, kidneys and eyes. Chronic liver disease impairs clotting factor production, which shows up in the blood and eventually in the brain.
None of that is surprising once you have the dependency graph. It is very surprising when all you have is eleven separate lists. This is the same reason a connection pool exhaustion incident gets filed as a checkout outage: the symptom appears where the coupling ends, not where the fault started. Medicine moved toward a systems level approach for exactly this reason, and it is worth noticing that the field with the highest stakes got there first.
The Control Loop Is Already Familiar
Homeostasis runs on negative feedback. A sensor detects a deviation from a set point, a control center evaluates it, an effector corrects it. Blood glucose rises after a meal, the pancreas releases insulin, cells absorb glucose, levels come back down. Drop too low and glucagon does the reverse, telling the liver to put stored glucose back into circulation.
That is a control loop with a set point, an error signal and an actuator, which is to say it is your autoscaler. Positive feedback exists in the body too and it is rare, because it does not stabilize anything, it drives a process to completion. Blood clotting is the example: activated clotting factors activate more clotting factors until the wound is sealed. When that pattern shows up in software with no terminating condition, we call it a retry storm.
What To Take From It
Pick one event and trace it through the whole system instead of studying components one at a time. Climb a flight of stairs and six subsystems respond in the same second: muscles pull more glucose, the nervous system speeds the heart, breathing deepens, the adrenals release epinephrine, sweat glands open for thermoregulation, the kidneys hold fluid to protect blood pressure. One event, six subsystems, one objective.
If you want the biology properly, all eleven systems with their organs, functions and interactions laid out in one place, this guide covers it and it is where the examples above came from.
Do that same trace with an incident timeline and you will learn more in an afternoon than a month of reading service docs in isolation will teach you. The lists were never the point. The couplings were.