I wouldn't be so sure that ELB's are actually failing whole IP addresses across availability zones. Given the current ELB architecture is heavily dependent on dynamic DNS resolution, I am pretty suspicious that they are using DNS for failover. The separate set of DNS servers specifically for elb.amazonaws.com and the 60 second TTLs on the CNAMEs they generate seem to indicate this. Of course, there is no documentation to either confirm, or deny this. Amazon simply states in vague terms that it's highly available, but doesn't state how it's designed, or even possible failure outcomes.