Regional Failover Calculator

Test whether surviving regions absorb the load when one fails, and price the standby capacity that makes it possible.

About Regional Failover Calculator

Capacity is judged on the failure case, not the normal case: with three regions the survivors each pick up half the lost traffic, so anything above 66% normal utilisation breaks under a single loss. Availability is modelled as a correlated floor plus an independent term, because a shared control plane or a bad config rollout hits every region at once — and once correlated failures dominate, adding a fourth region buys almost nothing. Multi-region designs fail for three reasons: the survivors were sized for steady state, the replication lag was larger than the stated RPO, or the outage was correlated and no amount of regions helped. All three are visible here before the incident rather than during it. Region costs vary widely, so confirm the standby figure against your provider's pricing.

Formula

Regional Failover

survivors: Regions still serving after one is lost
correlated share: Failures that take out every region together, which extra regions cannot fix
data at risk: Bytes written but not yet replicated when the region fails

Worked example

With the default values below, Regional Failover Calculator returns Survivor Utilisation After Losing a Region of 112.5%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Active regionsaccepts 1–40 regions: 3 regions
Normal total loadaccepts 0–1,000,000 thousand req/s: 90 thousand req/s
Capacity per regionaccepts 0.1–1,000,000 thousand req/s: 40 thousand req/s
Standby postureone of Active-active (full capacity running), Warm standby (scaled-down copy), Pilot light (core services only), Backup and restore (no standing compute): Warm standby (scaled-down copy)
Monthly cost of a full regionaccepts 0–100,000,000 USD: 40,000 USD
Single-region availabilityaccepts 90–100 %: 99.9 %
Failures that hit every region at onceaccepts 0–100 %: 15 %
Recovery point objectiveaccepts 0–1,440 minutes: 5 minutes
Average write throughputaccepts 0–1,000,000 MB/s: 12 MB/s

Results

Survivor Utilisation After Losing a Region: 112.5%
Capacity Margin After the Failure: -10.00 thousand req/s
Capacity Verdict: Losing one region overloads the rest — add capacity or another region
Composite Availability: 99.9850%
Expected Annual Downtime: 78.8 minutes
Standby Capacity Cost: $40,000.00
Data at Risk Within the RPO: 3,600.0 MB

Step by step

1Values used
2Regional Failover
3Survivor Utilisation After Losing a Region= 112.5
4Capacity Margin After the Failure= -10.00 thousand req/s
5Capacity Verdict= Losing one region overloads the rest — add capacity or another region
6Composite Availability= 99.9850
7Expected Annual Downtime= 78.8 minutes
8Standby Capacity Cost= 40,000.00

Assumptions and limits

The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax or compounding frequency into account.
Figures are rounded for display to 4 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Regional Failover calculated?

survivor utilisation = load ÷ (regions − 1) ÷ capacity per region; unavailability = correlated share × single-region unavailability + (independent share × single-region unavailability)^regions; data at risk = write throughput × RPO. Capacity is judged on the failure case, not the normal case: with three regions the survivors each pick up half the lost traffic, so anything above 66% normal utilisation breaks under a single loss. Availability is modelled as a correlated floor plus an independent term, because a shared control plane or a bad config rollout hits every region at once — and once correlated failures dominate, adding a fourth region buys almost nothing.

Why does Regional Failover matter?

Multi-region designs fail for three reasons: the survivors were sized for steady state, the replication lag was larger than the stated RPO, or the outage was correlated and no amount of regions helped. All three are visible here before the incident rather than during it. Region costs vary widely, so confirm the standby figure against your provider's pricing.

What values do I need to enter?

This calculator takes 9 inputs: Active regions, Normal total load, Capacity per region, Standby posture, Monthly cost of a full region, Single-region availability, Failures that hit every region at once, Recovery point objective, Average write throughput. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.