Originally Posted by
rideforever
Easy, you mirror the uncommitted database queue as much as is feasible.
One changeover you have a procedure to immediately process that queue, and if a few bits get missed then you deal with it in the field and accept that loss.
If you have to restart procedures for certain events (passenger boarding for instance) ... then these are isolated and expedited. Meaning 5 plane loads of passengers are disembarked and reembarked.
In other words every part of the procedure is planned for.
Nothing is out of process.
And practiced, a failure is just another day at work.
If airlines do not do this, they are completely irresponsible.
This is normal.
It should be that easy, but the intricacies are otherwise. Do you mirror or shadow? How often do you synch (remembering that the synch period involves all participating to hold their breath briefly while all participants confirm that they are in synch with the active system - remember, also, that your performance is now at the level of the slowest machines in the 'plex).
What is on the face of it a simple task becomes difficult very quickly.
I'd add that even a planned scheduled datacenter swap is replete with many considerations.
I've seen an uncommanded one take down a bank for 6 hours back in the day.