Data communications over telegraph circuits 1907

Well, you may want to reconsider.

All complex systems have mbuttive failures. You may reduce the impact of them by duplicating; but once you get past the low-hanging fruit you are at slightly below three nines uptime.

From there onwards you are on a hyperbola. Cost x downtime is pretty much constant. Most of us would want to follow that curve for a while, but all of us have a pain point.

I much prefer to have the failures while they are still benign and controllable. We had a very sober discussion about this with customers leading up to major systems decisions in the mid 1980s. "How much downtime do you want to pay for" was the query.

This is a discussion that isn't done, as participants whip themselves info a frenzy of many nines.

I will rather see fewer nines, but more benign failures.

I'll give some examples.

The main system for a bank can halt pretty often as long as at least some of the distrubuted transaction mills keep running. This is a major reason banks keep the "official amount" and the "available amount". The available figure is a simple one, deducted and added to with simple front-end transactions; but these leave all the complicated stuff for the back end that give the official amount.

The back end is really just needed for the last-resort clearing, interest, and other batch processing stuff.

The "available amount" is re-seeded from the back end, usually daily. The "available" figure would go out of whack fast if left only to the front ends; but is acceptably close for a single day.

There are a large number of front ends; all the debit and credit networks interface to this. Any one of these can fail totally, you would just go to the compebreastion ATM across the street.

Because the "available" amount is still a usable short-term approximation to your money the front ends can, if they have to, rough it out alone for several days.

Ditto for the 747. I want it simple, so the pilot easily sees that the automatic control system has failed, and can switch to a backup; possibly himself.

A nuclear power plant is not much different. It is reasonably simple to make a bailout plan for system crash. A simple feedback that push control rods in when temperature is high will do. It will run the plant at less than 100% efficiency, possibly at a total shutdown. Such a simple override would have eliminated the Chernobyl incident.

This is what has made a silent revolution in technical diving. You realize that any component or system can fail, and design and train for it.

Technical failures are going to be part of our lives as long as we live in an advanced civilization. These should also be designed right.

-- mrr