N+1 and 2N Redundancy
Provisioning one spare beyond required capacity versus provisioning double, and the failure assumptions each encodes.
N+1 — enough capacity for demand plus one unit. Survives a single failure with no degradation, and is the standard for most systems because the marginal cost is one unit.
2N — full duplication. Survives the loss of an entire set, which is what a zone or site failure actually is.
N+2 sits between them and matters for a specific reason: it survives a failure during maintenance. With N+1, taking one unit out for patching leaves zero margin, so routine maintenance becomes a risk window.
The critical planning error is failing to size for redundancy under load. Three zones each running at 50% utilisation means that losing one leaves two at 75% — acceptable. Three zones at 70% means losing one leaves two at 105%, and the survivors fail in sequence. Redundancy that cannot absorb the redistributed load is not redundancy; it is a slower cascade.
Autoscaling is not a substitute, because scale-up takes minutes and the redistribution is instant.