In the truck-scale case, why is the availability of the PC an architecture question, and how does it interact with isolation?
Because weighing releases the raw materials for production: if the PC fails, the raw material supply stops. Backup, recovery and a replacement system can be organised locally and isolated, but falling back on standard IT procedures breaks the isolation again.
* Backup and recovery inside the boundary keep the isolation; central IT services break it again. *
The PC is a single point of failure for production. So you have to ask how its availability and failover are handled:
- (a) Local, isolated: backup, recovery, a spare system organised inside the isolation. The isolation holds, but it costs effort.
- (b) Standard IT procedures: the central backup server, software distribution and other IT services reach the PC, and the isolation is broken again.
This is the operating problem of isolation in miniature: every operational need either gets a local solution or opens a path through the boundary.
Go deeper:
Single point of failure — Wikipedia — one component whose failure stops the whole process.
NIST SP 800-34 Rev. 1 — Contingency Planning Guide — backup, recovery and spare-system planning for a system that must keep running.