Physical-World Failure Modes
Power loss, tampering, clock drift, thermal limits, and a truck through the fibre.
4 to work through
-
beginner Multiple choice
A courier fleet of 8000 phones sends one location update every 5 seconds while on shift, 8 hours a day. Each update is about 400 bytes on the wire including headers on a reused connection. Roughly how much cellular data is that per device per month?
3 min answer -
advanced
A logistics platform's software is correct and the operation still fails regularly. What failure modes does software architecture usually ignore?
2 min answer -
advanced
A logistics system's software is correct and operations still fail. What class of failure is this, and how should the architecture accommodate it?
2 min answer -
advanced
A regional power cut takes out 9,000 building-controller devices for six hours. Power returns and 8,700 of them reconnect within ten minutes. The other 300 never come back, and the gateway logs show TLS handshake failures with "certificate is not yet valid". The certificates do not expire for another year. What failed, and which design decision made it possible?
3 min answer
5 terms in this topic
Clock Drift
Device clocks diverging from real time, which corrupts ordering, expires certificates early or late, and produces data that appears to arrive from th…
metricException Path Frequency
The rate at which physical operations diverge from the system's model - a business metric to be managed rather than a defect rate to be eliminated, a…
conceptInvalid-Clock Boot
A device booting with no trustworthy notion of time, which makes certificate validity unverifiable and creates a dependency loop - correct time needs…
conceptPhysical World Failure Mode
The failure classes that only exist once software controls or observes physical equipment, where the system cannot be restarted and the consequences …
practiceSensor Input Validation
Treating readings from physical devices as untrusted input requiring plausibility checks - because a sensor that fails toward a well-formed wrong val…
Neighbouring topics
Edge, Mobile & IoT
General material on architecture beyond the data centre boundary.
Mobile App Architecture
Layering, navigation, background execution, and the platform rules you do not set.
Offline-First
Treating connectivity as an optimisation, with a local store as the source of truth.
Sync & Conflict Resolution
Two devices that both changed the same record while neither could see the other.
CRDTs
Data types that converge without coordination, and the semantics you must accept.
Mobile Release Strategy
Store review, staged rollout, and supporting versions you can never force off.
Push & Background Work
Delivery that is best-effort, and an operating system that will kill your process.
Device Identity
Identifying a thing rather than a person, and rotating a credential you cannot type.
Edge Compute Topologies
Regional, metro, on-premises and on-device, and what each tier is genuinely for.
Edge Functions
Short-lived compute at the CDN, its runtime limits, and what must stay at origin.
Edge Data Consistency
Replicated read state at hundreds of locations, and writes that still go to one.
IoT Ingest Architecture
Millions of small, unreliable, frequently duplicated messages arriving continuously.
Device Provisioning
Getting identity and configuration onto hardware at manufacture or first boot.
Fleet Management
Inventory, health, configuration and grouping across devices you will never see.
OTA Updates
Updating firmware over a flaky link, with rollback, and without bricking the device.
Constrained Protocols
MQTT, CoAP and their kin, chosen for power, packet size and intermittent links.
Device Telemetry at Scale
Deciding what a device sends, how often, and what is aggregated before it leaves.
Digital Twin
A server-side model of a physical thing's reported and desired state.
Edge Security & Attestation
Secure boot, hardware roots of trust, and proving what is running on a device.