4 ms·

What about true HA hardware, for example like Tandem, or the systems on the Space Shuttle, etc.? A discussion of those systems from the 70s, 80s and 90s seems a

What about true HA hardware, for example like Tandem, or the systems on the Space Shuttle, etc.? A discussion of those systems from the 70s, 80s and 90s seems appropriate (but I am not knowledgeable enough to start it).

dfox 8y ago
The hardware failures that hardware-based HA systems solve without software assistance are extremely unlikely on any modern platform (eg. CPU failure). In this regard it is somewhat remarkable, that original Pentium supports glueless(!) high-reliability redundant CPU mode (2 cores execute same instruction stream and you get NMI when the results diverge). It is somewhat telling that probably world's first 2 votes out of 3 HA implemented in hardware computer (SAPO, first Czech computer) was motivated by the fact that used CPU implementation technology (mechanical relays) was highly unreliable. Both Tandem and Space Shuttle Flight Computer relied highly on software support for HA. And it is my experience that most approaches to bolting on redundacy on system that is originally designed to run on single node are actually detrimental to the resulting availability. Either because it introduces additional failure modes that have to do with the fail-over mechanism itself (too eager failover, various byzantine generals failures of the control layer...) or because it depends on global consistency assumptions that are not in fact met (case in point: one high-reliability soft-realtime system with redundant application CPUs I was involved with is built with the assumption that you can reboot the application CPU at any time and it will catch up with system state as long as at least one other CPU is still running correctly. This ends up to not be a case as there is initialization phase that has to happen for the CPU to know the overall system state which interferes with the overall system operation as it involves injecting test patterns into global system inputs.)
- skyde 8y ago
  very interesting could you please give more detail on how Tandem and Space Shuttle Flight Computer relied on software support ?

dfox 8y ago

The hardware failures that hardware-based HA systems solve without software assistance are extremely unlikely on any modern platform (eg. CPU failure). In this regard it is somewhat remarkable, that original Pentium supports glueless(!) high-reliability redundant CPU mode (2 cores execute same instruction stream and you get NMI when the results diverge). It is somewhat telling that probably world's first 2 votes out of 3 HA implemented in hardware computer (SAPO, first Czech computer) was motivated by the fact that used CPU implementation technology (mechanical relays) was highly unreliable. Both Tandem and Space Shuttle Flight Computer relied highly on software support for HA. And it is my experience that most approaches to bolting on redundacy on system that is originally designed to run on single node are actually detrimental to the resulting availability. Either because it introduces additional failure modes that have to do with the fail-over mechanism itself (too eager failover, various byzantine generals failures of the control layer...) or because it depends on global consistency assumptions that are not in fact met (case in point: one high-reliability soft-realtime system with redundant application CPUs I was involved with is built with the assumption that you can reboot the application CPU at any time and it will catch up with system state as long as at least one other CPU is still running correctly. This ends up to not be a case as there is initialization phase that has to happen for the CPU to know the overall system state which interferes with the overall system operation as it involves injecting test patterns into global system inputs.)

skyde 8y ago
very interesting could you please give more detail on how Tandem and Space Shuttle Flight Computer relied on software support ?