A computer-implemented method for comparing a set of redundancy models to thereby determine an Availability Management Framework, AMF, configuration of a highly available, HA, system based on quantified service availability of the HA system, wherein the AMF is a middleware responsible for maintaining the service availability, wherein a component is a building block of the AMF configuration, and wherein components collaborating to provide a service are grouped into a service-unit, wherein each redundancy model defines assignments of a plurality of service-instances representing workload to a plurality of service-units representing resources, and wherein each service-unit represents a unit of replication in the redundancy models, the method comprising the steps of: constructing an analysis model of the HA system to capture recovery behaviors of the HA system for each of the redundancy models, wherein the redundancy models include at least a first redundancy model and at least a second redundancy model that is different from the first redundancy model in that, when a component of one of the service-units fails, - service-instances being served by the failed component are failed-over to other service-units, and service-instances being served by another component of the one service-unit keep their assignment with the one service-unit according to the first redundancy model, and - the entire one service-unit is failed-over according to the second redundancy model; quantifying the service availability of the HA system based on the analysis model under one or more of a plurality of scenarios including failure scenarios and recovery scenarios; comparing levels of the service availability provided by the redundancy models; identifying, based on the compared levels of the service availability and subject to constraints of the HA system, one of the redundancy models that provides a required level of service availability for the HA system; and executing recovery by the AMF in accordance with an AMF configuration specifying the identified redundancy model in case of a component failure. wherein the AMF is a middleware responsible for maintaining the service availability, wherein a component is a building block of the AMF configuration, and wherein components collaborating to provide a service are grouped into a service-unit, wherein each redundancy model defines assignments of a plurality of service-instances representing workload to a plurality of service-units representing resources, and wherein each service-unit represents a unit of replication in the redundancy models, the method comprising the steps of: constructing an analysis model of the HA system to capture recovery behaviors of the HA system for each of the redundancy models, wherein the redundancy models include at least a first redundancy model and at least a second redundancy model that is different from the first redundancy model in that, when a component of one of the service-units fails, - service-instances being served by the failed component are failed-over to other service-units, and service-instances being served by another component of the one service-unit keep their assignment with the one service-unit according to the first redundancy model, and - the entire one service-unit is failed-over according to the second redundancy model; quantifying the service availability of the HA system based on the analysis model under one or more of a plurality of scenarios including failure scenarios and recovery scenarios; comparing levels of the service availability provided by the redundancy models; identifying, based on the compared levels of the service availability and subject to constraints of the HA system, one of the redundancy models that provides a required level of service availability for the HA system; and executing recovery by the AMF in accordance with an AMF configuration specifying the identified redundancy model in case of a component failure. constructing an analysis model of the HA system to capture recovery behaviors of the HA system for each of the redundancy models, wherein the redundancy models include at least a first redundancy model and at least a second redundancy model that is different from the first redundancy model in that, when a component of one of the service-units fails, - service-instances being served by the failed component are failed-over to other service-units, and service-instances being served by another component of the one service-unit keep their assignment with the one service-unit according to the first redundancy model, and - the entire one service-unit is failed-over according to the second redundancy model; - service-instances being served by the failed component are failed-over to other service-units, and service-instances being served by another component of the one service-unit keep their assignment with the one service-unit according to the first redundancy model, and - the entire one service-unit is failed-over according to the second redundancy model; quantifying the service availability of the HA system based on the analysis model under one or more of a plurality of scenarios including failure scenarios and recovery scenarios; comparing levels of the service availability provided by the redundancy models; identifying, based on the compared levels of the service availability and subject to constraints of the HA system, one of the redundancy models that provides a required level of service availability for the HA system; and executing recovery by the AMF in accordance with an AMF configuration specifying the identified redundancy model in case of a component failure.