I assume that bugs requiring reboots to resolve is part of the design of the failure model. When a software fault is detected, its consequences are unknowable.

I assume that bugs requiring reboots to resolve is part of the design of the failure model. When a software fault is detected, its consequences are unknowable. Those consequences could include killing the pilot and destroying his $100M aircraft. Therefore, the default response is to reset everything and get to a known-good state ASAP. This is not a bad general-purpose failure strategy: It's been believed for decades that most software faults encountered in production are Heisenbugs[1], and disappear rather than reproduce. [1] http://research.microsoft.com/en-us/um/people/gray/papers/TandemTR85.7_WhyDoComputersStop.pdf http://research.microsoft.com/en-us/um/people/gray/papers/Ta...