Test whether surviving regions absorb the load when one fails, and price the standby capacity that makes it possible.
Capacity is judged on the failure case, not the normal case: with three regions the survivors each pick up half the lost traffic, so anything above 66% normal utilisation breaks under a single loss. Availability is modelled as a correlated floor plus an independent term, because a shared control plane or a bad config rollout hits every region at once — and once correlated failures dominate, adding a fourth region buys almost nothing. Multi-region designs fail for three reasons: the survivors were sized for steady state, the replication lag was larger than the stated RPO, or the outage was correlated and no amount of regions helped. All three are visible here before the incident rather than during it. Region costs vary widely, so confirm the standby figure against your provider's pricing.
Regional Failover
survivor utilisation = load ÷ (regions − 1) ÷ capacity per region; unavailability = correlated share × single-region unavailability + (independent share × single-region unavailability)^regions; data at risk = write throughput × RPO.
survivor utilisation = load ÷ (regions − 1) ÷ capacity per region; unavailability = correlated share × single-region unavailability + (independent share × single-region unavailability)^regions; data at risk = write throughput × RPO. Capacity is judged on the failure case, not the normal case: with three regions the survivors each pick up half the lost traffic, so anything above 66% normal utilisation breaks under a single loss. Availability is modelled as a correlated floor plus an independent term, because a shared control plane or a bad config rollout hits every region at once — and once correlated failures dominate, adding a fourth region buys almost nothing.
Multi-region designs fail for three reasons: the survivors were sized for steady state, the replication lag was larger than the stated RPO, or the outage was correlated and no amount of regions helped. All three are visible here before the incident rather than during it. Region costs vary widely, so confirm the standby figure against your provider's pricing.
This calculator takes 9 inputs: Active regions, Normal total load, Capacity per region, Standby posture, Monthly cost of a full region, Single-region availability, Failures that hit every region at once, Recovery point objective, Average write throughput. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.