{{ summaryHeading }}

{{ summaryPrimary }}{{ summaryLine }} {{ badge.label }} {{ badge.value }}
This label does not change the timing calculation.
Include the protected rollback reserve inside this total.
min
min
min
min
min
min
min
%
min
min
min
PhaseDurationElapsed pointOperational meaningCopy
{{ row.phase }}{{ row.duration }}{{ row.elapsed }}{{ row.note }}

Rollback-gate decision

{{ metric.label }}
{{ metric.value }}{{ metric.note }}

Calculation path

margin = window - rollback - safety - active work × (1 + contingency ÷ 100)

{{ guidanceText }}

  • {{ warning }}
Blue-Green Deployment Planner Plan a blue-green deployment with timed traffic shifts and health gates, then review exposure and rollback triggers with route-specific command drafts.
Canary Deployment Planner Plan canary traffic steps and observation windows with guardrail thresholds, exposure estimates and platform-aware rollback warnings.
Change Risk Assessment Reporter Assess an IT change with weighted impact and readiness evidence to produce a residual-risk tier, approval route and gate-closing actions.
Error Budget Calculator Calculate SLO error-budget use from observed traffic, compare burn and policy gates, and estimate runway before a release decision.

A production change can finish its deployment work and still be too late to recover safely. The maintenance window must hold the entire sequence before the go-or-rollback decision, enough time to execute the rollback, and any protected closure or handoff time before the hard stop.

Cutover planning therefore separates active work from protected recovery. Active work can include readiness checks, rollout, database changes, traffic movement, validation, approvals, and stakeholder pauses. Contingency expands that work estimate to reflect expected variation. Rollback reserve is kept outside the active-work budget so a delayed cutover does not quietly consume the time intended for recovery.

Timing termMeaning
Maintenance windowThe complete approved period from start to hard stop.
Cutover finishThe planned end of active work after contingency is added.
Latest rollback decisionThe last point at which protected rollback and safety time can still fit.
Rollback marginThe time between planned cutover finish and that decision point.

A positive margin is a scheduling cushion, not proof that the change is safe. Reversibility must be tested, monitoring must detect failure quickly enough, and the release team must know who can stop the rollout. Database migrations and external dependencies can also make a nominal rollback plan incomplete.

Phase estimates should come from rehearsals or comparable releases where possible. Optimistic averages hide queue waits, operator handoffs, cache warming, replication delay, and observation time. Reducing rollback reserve to make a plan fit improves the arithmetic while weakening the recovery position.

How to Use This Tool:

Translate the runbook into elapsed minutes, then protect the decision point before the window closes.

  1. Enter the complete Maintenance window, including rollback reserve and any hard-stop safety floor.
  2. Estimate each pre-decision phase from tested elapsed time. Include approval or communication holds when they cannot occur in parallel.
  3. Set contingency as a percentage of active work and reserve enough minutes for the tested rollback path. An optional start time changes elapsed labels into local clock times but not the calculation.
  4. Review the Gate decision. If margin is zero or negative, shorten or move real work, justify a different contingency assumption, or obtain a wider window before reducing recovery time.

Interpreting Results:

Gate Clear means the planned cutover finish is no later than the latest rollback decision. A zero-minute margin technically clears the rule because equality is included, but it leaves no allowance beyond the entered contingency and should be treated as fragile.

Gate Risk means active work plus contingency has crossed into protected recovery time. The magnitude shows how many minutes must be removed from the pre-decision plan or added to the approved window while keeping rollback and closure reserves intact.

The margin curve changes only the contingency percentage. It is a sensitivity check, not a probability forecast. Use rehearsal variance to choose a defensible allowance and confirm the final decision against live telemetry, stop criteria, release ownership, and rollback proof.

Technical Details:

The timing model treats all entered work phases as serial elapsed time. Contingency applies to the sum of those phases, while rollback reserve and the safety floor remain protected after the decision gate.

Formula Core

The rollback margin is the maintenance window left after active work, contingency, rollback reserve, and safety time are accounted for.

A=Σentered pre-decision phase minutes C=A×contingency percent100 F=A+C G=window−rollback reserve−safety floor M=G−F

A is active work, C is the contingency buffer, F is cutover finish, G is the latest rollback decision, and M is rollback margin. The required window is F + rollback reserve + safety floor, and hard-stop slack equals the entered window minus that requirement.

Rule Core

ConditionInterpretation
Margin > 0The entered plan preserves that many additional minutes before rollback time begins.
Margin = 0The plan lands exactly on the gate and still counts as clear, with no additional timing cushion.
Margin < 0The plan consumes protected recovery time and is marked at risk.
Contingency = 0A warning notes that no separate variation allowance is modeled.
Validation = 0 or rollback reserve = 0A warning identifies missing validation or unprotected recovery time.

A 180-minute window with 108 minutes of active work, 25% contingency, and a 30-minute rollback reserve produces 27 contingency minutes and a T+135 cutover finish. The latest rollback decision is T+150, leaving a 15-minute margin and requiring 165 total minutes. Increasing contingency to 50% moves finish to T+162 and changes the margin to −12 minutes.

Planning Limits:

This is a deterministic elapsed-time budget. It does not model parallel execution, probability distributions, dependency failures, traffic or incident data, or the technical success of rollback.

  • A phase that can truly run in parallel must be represented by its effect on elapsed time rather than added mechanically.
  • Local start-time labels do not resolve timezone, daylight-saving, or cross-region coordination rules.
  • Approval requires the tested runbook, monitoring signals, rollback compatibility, owners, and explicit stop criteria in addition to a positive margin.

References: