paper

Crash-Only Software

  • Authors:
Read the paper

📜 Abstract

Crash-only programs crash safely and recover quickly. There is only one way to stop such software—by crashing it—and only one way to bring it up—by initiating recov￾ery. Crash-only systems are built from crash-only compo￾nents, and the use of transparent component-level retries hides intra-system component crashes from end users. In this paper we advocate a crash-only design for Internet sys￾tems, showing that it can lead to more reliable, predictable code and faster, more effective recovery. We present ideas on how to build such crash-only Internet services, taking successful techniques to their logical extreme.

✨ Summary

Summary

The paper proposes crash-only software, in which crashing is the sole supported shutdown mechanism and recovery is the sole startup mechanism. The design goal is to make crashes safe, recovery fast, and failure behavior predictable. The approach separates important nonvolatile state from application logic, places that state in crash-only state stores, isolates components, uses timeouts and leases to limit coupling, and attaches idempotency and time-to-live information to requests. A restart/retry layer can then crash-restart suspected components and transparently resubmit eligible requests. The authors report that their prototype completed 78% more client requests under a fault workload than a non-crash-only implementation.

Documented influence

  • A subsequent USENIX OSDI paper on microrebootable software explicitly identifies this work as the earlier introduction and motivation for crash-only software, and applies its principles—small isolated components, state separation, leases, timeouts, and transparent request retries—to a practical application-server platform. (usenix.org)
  • Later reliability research treated component-level restarts as a form of software rejuvenation. A 2005 Reliability Engineering & System Safety paper cites crash-only software when analyzing policies combining partial and full restarts. (sciencedirect.com)
  • The concept was incorporated into the broader recovery-oriented computing research program; a dissertation by Candea presents crash-only software as a set of design principles for reboot-friendly systems. (dslab.epfl.ch)
  • An industrially oriented 2020 manufacturing-systems paper discusses a “crash-only” microservices architecture as a way to improve fault tolerance and adaptability in a sensor/data-acquisition demonstrator. This provides evidence of later application of the concept beyond Internet application servers, but does not establish widespread commercial adoption. (sciencedirect.com)