Three classes of physical failure Permanent hardware failure. Requires recovery algorithms and may suffer from contamination occurring before detection. Intermittent component failure. Much more likely to corrupt data. Likely to crash entire system.
All processors contain a monitor and memory management process.
All information flow is carried by messages rather than shared storage, to provide location independence. Positive acknowledgment is used for fault tolerance and detection. The OS controls the message system, providing protection, information hiding, and control of error recovery for message failures. Server processes are given a guaranteed minimum of resources, to prevent deadlock. Qualitatively, the messages system causes a performance penalty, in exchange for fault tolerance, ease of system expansion, and possibility for system evolution.