3 ms·

> > The modern approach to High Availability is to have redundant hardware. A single machine being fault tolerant isn't that important anymore. You're making a

> > The modern approach to High Availability is to have redundant hardware. A single machine being fault tolerant isn't that important anymore. You're making a lot of assumptions with regards to the operating environment. What about a probe being sent to Mars, the Moon or wherever? In fact let's just generalize to space-faring craft. That environment demands incredible resiliency and the ability to continue running even if the hardware is having problems - at least enough so ground control can assess the situation and send updates. Weapons systems are another environment you'd prefer to have resiliency. You'd hate to lose control of a missile while in mid-flight. Automotive systems are another environment that comes to mind. There are a lot of embedded/remote environments where the "redundant hardware" solution isn't applicable. Edit: I'm fully-aware these systems have redundant hardware in modern implementations. I'm also fully-are that monolithic kernels are unable to cope with a failure of any of the hardware comprising the system. Hence my calling out this point.

iso1631 3y ago
On a plane or missile I'd assume several computers, with the majority winning the decision
- taylodl 3y ago
  One of those computers just went out. Now how do you form your majority? Besides which, in such systems there's a governing system coordinating the election. What happens if your governing system goes out?
  - Volundr 3y ago
    Your governing system isn't a single system, it's multiple using a suitable algorithm to establish quorum. This is a well studied problem in distributed systems.
  - iso1631 3y ago
    So one computer is out and the other 2 are giving different answers to the same question?
  - dredmorbius 3y ago
    The question is increased resilience not perfection. At some point, a military device / weapons system recognises that it's not operating to spec and either disables itself or diverts and destroys itself in a non-target region. Keep in mind that for most weapons, not activating when not specified is far more useful than failing to activate where and when specified. See the case of several "broken arrow" nuclear weapons incidents in which failsafes prevented unintended detonation. In once case with only a single fail-safe preventing that detonation which would have been in a civilian populated region of the United States.
- goodpoint 3y ago
  No, there's plenty of single purpose systems.
lucozade 3y ago
You are describing environments where it is very common to have hardware redundancy. I mean, sure they may have hardening for each component to reduce the likelihood of losing one of them. But hardware redundancy is a standard tool in safety critical systems.
4gotunameagain 3y ago
Which is why in aerospace and safety critical systems, RTOSes are used and not fully fledged OSes. Also, redundant hardware is quite common (and mandatory by most standards), look up TMR, triple modular redundancy
- ssrc 3y ago
  And yet at some complexity level you have things like ARINC 653 where the usual implementation is to have a classic RTOS running on each of the partitions provided by the "application executive", and today's serverland is hypervisors running VMs running containers. I believe we are too centered on the "Linux vs Minix" debate while in actual practice both tendencies are reflected in most systems.
- snvzz 3y ago
  >RTOSes are used and not fully fledged OSes. The idea that "RTOS" and "fully fledged OS" are incompatible with each other is outdated. seL4 advanced the state of the art with its formally-verified support for mixed criticality, years ago already.
  - gjsman-1000 3y ago
    There’s actually a real-time microkernel that millions of children use daily. It’s called the Nintendo Switch. (But seriously, it’s a homegrown microkernel RTOS. Look up “Nintendo Switch System Software” if that sounds bizarre.)
  - 4gotunameagain 3y ago
    The idea might be outdated, but as I have yet to seen a system running seL4, in practice it is very much true still.
samus 3y ago
These applications indeed have special requirements which general-purpose components almost certainly won't be able to fulfill. Not should they - the tradeoffs in complexity and cost are rarely worth it for the hyperscaling or embedded world where Linux is most commonly used these days.
knome 3y ago
>Weapons systems are another environment you'd prefer to have resiliency. You'd hate to lose control of a missile while in mid-flight. https://devblogs.microsoft.com/oldnewthing/20180228-00/?p=98125 https://devblogs.microsoft.com/oldnewthing/20180228-00/?p=98...
deleted 3y ago
[deleted]
andrewshadura 3y ago
> any of the hardware comprising the system You probably mean the other way around: the system comprising hardware.

iso1631 3y ago

On a plane or missile I'd assume several computers, with the majority winning the decision

taylodl 3y ago
One of those computers just went out. Now how do you form your majority? Besides which, in such systems there's a governing system coordinating the election. What happens if your governing system goes out?
- Volundr 3y ago
  Your governing system isn't a single system, it's multiple using a suitable algorithm to establish quorum. This is a well studied problem in distributed systems.
- iso1631 3y ago
  So one computer is out and the other 2 are giving different answers to the same question?
- dredmorbius 3y ago
  The question is increased resilience not perfection. At some point, a military device / weapons system recognises that it's not operating to spec and either disables itself or diverts and destroys itself in a non-target region. Keep in mind that for most weapons, not activating when not specified is far more useful than failing to activate where and when specified. See the case of several "broken arrow" nuclear weapons incidents in which failsafes prevented unintended detonation. In once case with only a single fail-safe preventing that detonation which would have been in a civilian populated region of the United States.
goodpoint 3y ago
No, there's plenty of single purpose systems.

lucozade 3y ago

You are describing environments where it is very common to have hardware redundancy. I mean, sure they may have hardening for each component to reduce the likelihood of losing one of them. But hardware redundancy is a standard tool in safety critical systems.

4gotunameagain 3y ago

Which is why in aerospace and safety critical systems, RTOSes are used and not fully fledged OSes. Also, redundant hardware is quite common (and mandatory by most standards), look up TMR, triple modular redundancy

ssrc 3y ago
And yet at some complexity level you have things like ARINC 653 where the usual implementation is to have a classic RTOS running on each of the partitions provided by the "application executive", and today's serverland is hypervisors running VMs running containers. I believe we are too centered on the "Linux vs Minix" debate while in actual practice both tendencies are reflected in most systems.
snvzz 3y ago
>RTOSes are used and not fully fledged OSes. The idea that "RTOS" and "fully fledged OS" are incompatible with each other is outdated. seL4 advanced the state of the art with its formally-verified support for mixed criticality, years ago already.
- gjsman-1000 3y ago
  There’s actually a real-time microkernel that millions of children use daily. It’s called the Nintendo Switch. (But seriously, it’s a homegrown microkernel RTOS. Look up “Nintendo Switch System Software” if that sounds bizarre.)
- 4gotunameagain 3y ago
  The idea might be outdated, but as I have yet to seen a system running seL4, in practice it is very much true still.

samus 3y ago

These applications indeed have special requirements which general-purpose components almost certainly won't be able to fulfill. Not should they - the tradeoffs in complexity and cost are rarely worth it for the hyperscaling or embedded world where Linux is most commonly used these days.

knome 3y ago

>Weapons systems are another environment you'd prefer to have resiliency. You'd hate to lose control of a missile while in mid-flight. https://devblogs.microsoft.com/oldnewthing/20180228-00/?p=98125 https://devblogs.microsoft.com/oldnewthing/20180228-00/?p=98...

deleted 3y ago

[deleted]

andrewshadura 3y ago

> any of the hardware comprising the system You probably mean the other way around: the system comprising hardware.