Autonomous Database automatically fails over to a local standby database as follows:

• When the primary database becomes unavailable and users are not able to connect, Autonomous Data Guard automatically fails over to a local Autonomous Data Guard standby database if a local standby database is available, based on the Recovery Time Objective (RTO) and when Autonomous Data Guard determines that the automatic failover data loss limit will not be exceeded.

• Autonomous Data Guard performs automatic failover to a local standby database when a local standby database is available and the system can guarantee either the default zero data loss or up to the data loss limit you specified a data loss limit when you enabled Autonomous Data Guard. You can specify an automatic failover data loss limit between 0 and 3600 seconds. If this target cannot be met then automatic failover does not occur and you have the option to perform a manual failover.

  See Enable Autonomous Data Guard for information on setting the automatic failover data loss limit.

• After automatic failover to a local standby database completes, Autonomous Database creates a new local standby database for you.

  Autonomous Data Guard for a particular standby, either local or remote, is not enabled while the system is provisioning the new standby database. After Autonomous Data Guard completes the provisioning step for the standby database and it becomes available, you then have a new standby database with Autonomous Data Guard enabled on it.

• After automatic failover completes, Autonomous Database reports the time of the last failover when you hover over the in the Role field.

• After an automatic Autonomous Data Guard failover, if there was a regional failure, when the region comes back online the standby database is automatically reconnected or if required reprovisioned.

If the primary database has failed or is unreachable and the conditions for Autonomous Data Guard automatic failover have not been met, then Oracle Cloud Infrastructure console shows a banner indicating that automatic failover did not succeed, provides a reason, such as possible data loss above the default 0 RPO or above the limit you set for the automatic failover data loss limit, and provides a link for you to initiate manual failover. See Perform Manual Failover to a Local Standby Database for more information.

See Autonomous Data Guard Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for more information.