CouchDB's crash-only design is for durability,why?

Question

When I research on couchDB's durability , I find that couchDB use crash-only design to get durability.But I don't know what's the relationship between crash-only and durability.

Answer 1

Doing the opposite would mean trying to be clever and add error-recovery code. That requires you to correctly identify the error and being correct in your assumptions about the recovery algorithm. Every part of the recovery process may introduce bugs. You may think the error is of a certain type when it's really another, or new unexpected errors may happen while you're already doing recovery.

Error recovery also means not only trying to redo the failed transaction. You must also find the original error, which is probably from some unexpected program or hardware state, and fix that state. Otherwise the same error might happen again.

Crash-only makes the probability of bugs lower, you don't need to find all the edge cases where something went wrong and your system administrator can easily be notified about the error (which may be a hardware error!). With this in mind crash-only may be a sound software design principle in some cases. At least it makes it easier to guarantee your data integrity.

Answer 2

By reading the Wiki of CouchDB

The CouchDB file layout and commitment system features all Atomic Consistent Isolated Durable (ACID) properties. On-disk, CouchDB never overwrites committed data or associated structures, ensuring the database file is always in a consistent state. This is a “crash-only" design where the CouchDB server does not go through a shut down process, it's simply terminated.

The durability is given by the fact that the DB is always in a consistant state, and that this is given by the fact that the structure of the DB is append-only (CouchDB never overwrites committed data or associated structures). This makes the error handling quite easy: it can crash instantaneously if there is an error.

I don't think that it's the "crash-only" that gives the durability. I think that the durability permits the use of "crash-only".