Nobody claims faults of core functions must be survivable in microkernel designs. The restarting of driver processes is a nice trick, but in the end the isolati

Nobody claims faults of core functions must be survivable in microkernel designs. The restarting of driver processes is a nice trick, but in the end the isolation and clean interfacing are particularly useful in an imperfect world. The goal is to minimize the trusted computing base (TCB) so that it is, at least to some degree, verifiably correct. Then tack on features using isolated components.