Power cycling needs to happen in individual components. In other words sub-systems might power cycle but the user impact should be as small as possible.
OS processes/Erlang processes/Separate Machines(Containers) can reliable do that. Because they isolate fault propagation.
In a shared memory system if something crashes you don't know what the state of the rest of the system is. Maybe on bad client wrote over the memory of other 999999 clients. So just restarting that one thread is not safe.
Another overlooked aspect is to do crash-only right with recovery you need stable storage. That is where you can persist a known good state so you can restore from and continue. That might be hard or easy depending on the environment.
> You monitor observed reliability and make a commercial decision as to whether it's unacceptable and you need to fix some bugs.
Yap. But "you" here is the developer not the end user. When you go to buy socks on a website, it is not your job to monitor and restart their back-end system or switch IPs. They should be doing you are just buying socks.
> Almost all of HN works in the second area.
Because the first is very hard. NASA does it, medical device manufacturers do it. Critical security modules have it. It is very expensive though.
OS processes/Erlang processes/Separate Machines(Containers) can reliable do that. Because they isolate fault propagation.
In a shared memory system if something crashes you don't know what the state of the rest of the system is. Maybe on bad client wrote over the memory of other 999999 clients. So just restarting that one thread is not safe.
Another overlooked aspect is to do crash-only right with recovery you need stable storage. That is where you can persist a known good state so you can restore from and continue. That might be hard or easy depending on the environment.
> You monitor observed reliability and make a commercial decision as to whether it's unacceptable and you need to fix some bugs.
Yap. But "you" here is the developer not the end user. When you go to buy socks on a website, it is not your job to monitor and restart their back-end system or switch IPs. They should be doing you are just buying socks.
> Almost all of HN works in the second area.
Because the first is very hard. NASA does it, medical device manufacturers do it. Critical security modules have it. It is very expensive though.