Crash-only software is a great concept, and this article is a very interesting summary of what it is (and what it's not). If you read only one section of Candea

Crash-only software is a great concept, and this article is a very interesting summary of what it is (and what it's not). If you read only one section of Candea and Fox's paper, I would recommend section 3 "Properties of Crash-Only Software". It lays out some basic properties of proper crash-only software, which work as guidelines even for software that doesn't go all the way to the crash-only ideal. My favorite one of the principles is "All important non-volatile state is managed by dedicated state stores". Being both crash-only (or even just tolerating crashes) and keeping state is a very difficult combination, and you don't want every one of your services needing to solve that problem over and over. Dedicated state stores let you hand this problem off, which turns many systems stateless (or at least without hard state). Tolerating crashes in soft-state-only services is much easier, perhaps even trivial if you follow the other rules. I wrote a blog post about this paper a while back (http://brooker.co.za/blog/2012/01/22/crash-only.html http://brooker.co.za/blog/2012/01/22/crash-only.html), if anybody is interested.