In capacity planning, what do N+1 and N+2 redundancy mean, and what peak utilization ceiling does N+1 impose on a service spread evenly across three availability zones?

## What N actually counts N is not a server count. It is the amount of capacity required to serve peak load, measured in whatever unit you are willing to lose all at once. That unit is the **failure domain**: a machine, a rack, a cell, an availability zone, a region. Choosing it is the first decision, because N+1 across machines and N+1 across zones are wildly different amounts of money and protect against wildly different events. - **N** — serves peak with nothing to spare. Any loss is a shortfall. - **N+1** — survives the loss of one unit at peak. - **N+2** — survives the loss of two: typically one unit intentionally out (maintenance, a rollout, a drain) *and* one lost unexpectedly during that window. That second point is the whole argument for N+2. If you plan N+1 and then take a zone out for a scheduled upgrade, you are running at N for the duration — and upgrade windows are exactly when unexpected things happen. ## The utilization ceiling, derived Spread load evenly across K equal units, each of capacity C. Total capacity is K x C. To serve peak load P with one unit gone: ``` (K - 1) * C >= P => C >= P / (K - 1) ``` At normal peak each unit carries P / K, so its utilization is ``` (P / K) / (P / (K - 1)) = (K - 1) / K ``` For N+s spares generally the ceiling is `(K - s) / K`: | Units K | N+1 ceiling | N+2 ceiling | |---|---|---| | 2 | 50% | not possible | | 3 | 67% | 33% | | 4 | 75% | 50% | | 5 | 80% | 60% | | 10 | 90% | 80% | This table is the single most useful thing in the topic. It says redundancy gets cheaper as the units get smaller and more numerous, and it says a two-zone deployment is inherently expensive insurance — you buy twice your peak capacity to be N+1. It also explains why large operators slice a region into many cells rather than three big ones: the same failure tolerance at far higher utilization. ## The ceiling is usually the binding constraint In practice, redundancy sets the utilization target more often than performance does. If a team says "we run at 60% because latency degrades above that," and they also run three zones, the redundancy math was already going to cap them near 67%. The number you should carry is the *minimum* of the redundancy ceiling and whatever operational ceiling you have measured for the service. ## Traps that make the headroom fake **Aggregate capacity is not usable capacity.** A fleet at 60% overall can have one zone at 95% if traffic is not evenly distributed — sticky sessions, uneven shard placement, a client library that prefers the nearest zone. Measure utilization per failure domain, never only in aggregate. **Capacity is not fungible.** Replicas in the surviving zones can only take the load if the data is there, the caches are warm, the connection pools are large enough, and quota exists in that zone. Cold caches after a failover can multiply database load exactly when a third of your fleet just vanished. **The tightest dependency defines your real redundancy.** A stateless tier at N+2 in front of a single-zone database primary is N+2 for nothing that matters. Redundancy is a per-dependency property, and the service inherits the worst one. **Untested headroom is a hypothesis.** The way you find out whether the surviving zones absorb the load inside your latency targets is to take a zone out on purpose and watch — deliberately, in daylight, with a way to put it back. Per-zone quota limits, connection ceilings and cold caches all show up there and nowhere else. ## Deciding between N+1 and N+2 It is a cost decision with a stated risk. Ask: how often does a unit go out for planned work, how long is it out, what is the historical rate of unplanned loss, and what does a shortfall cost during the overlap? For a service with monthly maintenance windows and a serious cost of downtime, N+2 is easy to justify. For a batch tier that can be late, N+1 or even N is defensible. What is not defensible is asserting N+2 as a universal standard without knowing what it costs, or claiming N+1 while running three zones at 90%.