N+1 vs N+2 capacity

The decision

Say your peak load needs N servers. N+1 means you run N plus one spare, so you can lose one server and still serve the peak. N+2 means two spares. A spare is paid for every hour and used only on a bad day, so the question is how much insurance to buy. The answer depends on four things. First, how often servers are out. Second, how many you lose at once (a rack, a zone). Third, how often you deploy. Fourth, what a shortfall costs. A shortfall at peak is not a small slowdown: the remaining servers take more load and may fail too.

Choose N+1 when

• The fleet is small and one more server is a large share of the bill. With N = 2, one spare is a 50 percent increase.
• Servers fail alone and are replaced fast, in minutes, by automation.
• A shortfall is a slowdown with a fallback, not an outage. You can shed low-value traffic.
• You deploy outside peak hours, or with extra surge servers, so a deploy does not use the spare at peak.

Choose N+2 when

• You take servers out of service for rolling deploys and patches. During a deploy, the first spare is already in use.
• Replacing a server is slow (hours), so a second failure can arrive before the first is fixed.
• The fleet is large. With N = 100, N+2 costs only 2 percent.
• A shortfall at peak is very costly, or it cascades: the survivors become overloaded and fail.
• Failures are correlated: servers in one rack or one batch of hardware fail together.

The numbers that change the answer

All of these are Assumptions unless marked as calculation or cited.

Extra cost by fleet size (calculation). One spare is 100 / N percent. N+2 is 200 / N percent.

Odds of a shortfall (calculation). Assumption: each server is out of service 1 percent of the time, for any reason, and servers fail independently. For N = 10:

• N+1 means 11 servers. You are short when 2 or more are out. P(2 or more of 11) = 1 - 0.99^11 - 11 x 0.01 x 0.99^10 = 0.0052. That is 0.52 percent, about 45 hours a year.
• N+2 means 12 servers. You are short when 3 or more are out. P(3 or more of 12) = 0.000206, which is 0.02 percent, about 1.8 hours a year.

Only the peak counts (assumption). The shortfall hurts only when load is near peak. Assumption: 4 hours a day, which is 4 / 24 = 17 percent of the time. Shortfall hours at peak: N+1 is 45.4 x 0.167 = 7.6 hours a year. N+2 is 1.8 x 0.167 = 0.3 hours a year.

Does the second spare pay? (assumptions). One server costs Rs 30,000 a month. A spare costs 30,000 x 12 = Rs 3.6 lakh a year (one lakh is 100,000). Revenue is Rs 5 lakh an hour. If one server is missing from 10, about 10 percent of requests suffer. A shortfall hour then costs 5 x 0.1 = Rs 0.5 lakh. N+2 saves (7.6 - 0.3) x 0.5 = Rs 3.6 lakh a year. That equals the cost of the server, so at these numbers the choice is a tie in money.

A tie means money does not decide. Small changes flip it: at Rs 10 lakh an hour N+2 pays twice over, and at Rs 2 lakh an hour it does not pay. Risk decides: cascade, deploys, and the cost of a failure for trust.

The cascade (calculation). If one of 10 needed servers is missing at peak, the other 9 carry 10 / 9 = 1.11 times their load. A fleet that was tested at 100 percent now runs at 111 percent. It may get slow and fail. The money model above does not count this. If it did, N+2 would look better.

Deploys eat the spare (calculation). A rolling deploy takes one server out at a time. With N+1, no spare is left during the deploy. If any of the other 10 servers fails in that hour, you are short: 1 - 0.99^10 = 9.6 percent. With N+2, two of the other 11 must be out: 1 - 0.99^11 - 11 x 0.01 x 0.99^10 = 0.52 percent. Deploying outside peak hours avoids most of this risk.

Zones (cited). AWS describes the case of losing a whole Availability Zone, a separate data centre in a region. With three zones it over-provisions by 50 percent. Each zone then runs at about 66 percent of its tested level, and two zones can carry the load (see Sources). For N = 10 that is 15 servers, 5 more than the 10 you need. N+1 and N+2 do not protect against this case.

What breaks with each choice

N+1.

• A second failure or a deploy leaves you short at peak. Fallback: deploy with surge capacity, shed low-value traffic, and keep replacement automatic.
• A hidden shared cause, such as one rack, takes out two at once. Fallback: spread servers across racks and zones.
• A cascade follows a small shortfall. Fallback: limits on each server and graceful degradation.

N+2.

• You pay for idle servers, and teams use the spare for other work. Fallback: alarms on spare headroom, and a rule that the spare is for failures.
• It gives false comfort against zone loss, a bad deploy or a shared dependency. Fallback: plan zone loss on its own.

What it costs

• Money (Assumption): one server is Rs 30,000 a month. N+1 is Rs 3.6 lakh a year, N+2 is Rs 7.2 lakh a year.
• People (Assumption): about a day to set the capacity number and an alarm for spare headroom. A load test each quarter costs 2 engineer-days.
• Changing your mind: it is a setting, and you can add a server in minutes. The expensive mistake is to learn that you were short during an incident.

How each level answers

SDE-1: N+1 means one spare server. If a server fails, the others still serve the peak.

SDE-2: I size to peak load, add one spare, and put servers in two zones. For a rolling deploy I add one more, so a deploy does not use the only spare.

Senior: With 10 servers at 1 percent downtime each, N+1 is short 0.52 percent of the time, about 7.6 peak hours a year. N+2 is short 0.3 peak hours. The second spare costs Rs 3.6 lakh a year and saves about the same. So money is a tie, and cascade risk and deploys decide. If I need to survive a zone loss in three zones, I need 15 servers, not 11 or 12.

Staff: I ask what a peak-hour shortfall costs in money and trust, and I write the number with finance and product. I own the capacity rule with the platform team and set it by tier: N+2 for revenue paths, N+1 for the rest. I measure spare headroom and shortfall hours. I revisit the rule when the fleet size or deploy speed changes. I start with N+1 plus surge deploys. I move to N+2 when deploys leave us short more than once a quarter. I also move when the fleet passes about 20 servers, where the extra is only 10 percent. I know it was right when we see no shortfall at peak in a year.

Say it in the interview

For 10 servers at peak I would run 12, which is N+2. With 1 percent downtime per server, N+1 is short about 7 hours of peak a year, and N+2 about 20 minutes. The second spare costs Rs 3.6 lakh a year, which is about what it saves. So I choose on risk: rolling deploys use the first spare, and a shortfall can cascade. If we must survive losing one of three zones, I need 15 servers, so I would plan that case separately.

Common mistakes

• Counting only random failures. Deploys and patches remove servers on purpose and use the spare.
• Using N+1 as protection against a zone. One spare does not cover a third of the fleet.
• Spare capacity that other work uses. The next failure then finds no spare.
• Ignoring the cascade. A missing server raises load on all the others.

Sources

• AWS Builders' Library, "Static stability using Availability Zones" (with three Availability Zones, over-provision by 50 percent so each zone runs at about 66 percent of its load-tested level): https://builder.aws.com/content/3K9SiqiJ369TGkkGzqPM95BuYWI/static-stability-using-availability-zones (opens in a new tab) (checked 26 Oct 2026; the older aws.amazon.com address redirects here).
• The 1 percent downtime per server, the peak share, the server price, the revenue and the share of requests hurt are assumptions made for teaching. The odds, hours, costs and the 111 percent load are calculations.