Patch Window Calculator

Waves = ceil(hosts ÷ parallelism); window = pre-checks + waves × (install + reboot) + validation + expected failures × rollback time, all in minutes and divided by 60. Patching time scales with the number of waves, not the number of hosts: doubling parallelism halves the elapsed time until you hit the limit of your change tooling or your tolerance for simultaneous outage. The two fixed blocks — pre-change snapshots and post-change validation — dominate small batches, which is why patching 20 hosts rarely takes a third as long as patching 60.

Windows are approved in hours, and the change that overruns is the one that gets your patching programme throttled to quarterly — plan the rollback time in from the start.

This calculator takes 9 inputs: Hosts to patch, Hosts patched in parallel, Patch install time per host, Reboot and service-up time per host, Pre-change checks and snapshots, Post-change validation and smoke tests, Expected failure rate per host, Rollback time per failed host, Approved outage window. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Only up to the point where a simultaneous failure is survivable. If ten hosts patch at once and the update is bad, ten hosts are down and your rollback allowance has to cover all ten. Keep parallelism below the redundancy of the cluster.

Because the change is not finished when the package installs; it is finished when the service is proven healthy. Skipping validation is how a patch window becomes a Monday-morning incident with no clear cause.