From: Paul Brannan <pbrannan@...>
Date: 2004-09-29T01:37:43+09:00
Subject: Re: safety of timeout()

On Tue, Sep 28, 2004 at 03:57:58PM +0100, Brian Candler wrote:
> In order to be able to tell with certainty whether your command was
> accepted AND acted upon, I believe you really need to use a
> sequence-number type of mechanism, where both ends keep track of which
> messages they have sent and have been acknowledged by the other side.

I don't think sequencing messages is sufficient to solve the problem.
A protocol like what you describe provides reliable messaging, but
not much more.  For example, suppose I want to fail over to the backup
system if I time out -- I can do this, but I run the risk of performing
the operation more than once.  At that point it becomes a question of
policy (can I afford to take that risk, or is that risk truly
necessary?).

If there were any easy solutions, then a lot of real-time researchers
would be out of work.

Paul