Build fault tolerance around explicit process ownership: define child specifications, group processes according to their dependencies, choose a restart strategy that matches those dependencies, and set a restart limit so a failing subtree can escalate instead of looping indefinitely. OTP supervisors can restart processes; they do not preserve a crashed process’s in-memory state or make interrupted external work safe to repeat.
The examples and API names below follow Elixir’s main-branch v1.21.0-dev documentation. Check them against the Elixir and Erlang/OTP releases actually pinned and deployed by your service before adopting version-specific options.
As an Amazon Associate I earn from qualifying purchases.
What OTP supervision does—and does not—guarantee
An OTP supervisor starts, monitors, and stops child processes, then applies configured restart policies when a child terminates. A supervision tree organizes this recovery into a hierarchy: a local supervisor handles failures within its branch, and a parent can respond if that supervisor itself terminates. The Erlang/OTP supervisor documentation describes the basic idea as keeping child processes alive by restarting them when necessary.
Recommended Free Tools
This is process recovery, not automatic application-level correctness. A restarted process begins with newly initialized state unless your application restores state from elsewhere. Work interrupted by a crash may need explicit recovery, and repeating an external operation can cause duplicate effects unless the operation is made safe to retry.
#1 Best Overall
Design the supervision tree around ownership and dependencies
Start by listing the long-lived processes your application needs and identifying who owns each one. Put the application’s top-level workers and nested supervisors under its top-level supervisor. Group processes under a nested supervisor when they share a meaningful recovery boundary.
- Start a dependency before processes that rely on it when startup order matters.
- Supervisors start children in the order listed and stop them in reverse order.
- Use a top-level
:one_for_onestrategy when children are independent. If a worker’s failure leaves later workers unusable, represent that dependency with a suitable group or:rest_for_onestrategy. - Use
:one_for_allonly when the group genuinely needs to stop and recover as a unit.
Document why a child’s position in the list matters. With :rest_for_one, for example, that order determines which later children are restarted after a failure.
Choose a restart strategy that matches the failure boundary
The supervisor strategy determines how broadly a child failure affects siblings. These options describe recovery scope; they do not replace the work of mapping dependencies between processes.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →| Strategy | Recovery scope | Use it when |
|---|---|---|
:one_for_one |
Restart only the failed child. | Siblings are independent and can continue safely. |
:one_for_all |
Stop and restart the entire group. | The group must recover with a consistent shared lifecycle. |
:rest_for_one |
Restart the failed child and children started after it. | Later children depend on earlier children in the start order. |
For example, if later workers use a connection or service owned by an earlier child, a failure may require restarting the dependent workers too. Choose the strategy based on what becomes invalid when a process fails, not simply on which option sounds most resilient. The Elixir Supervisor documentation and Erlang/OTP supervisor design principles describe the strategies and their ordering behavior.
Rank #3
Define child specifications and restart semantics
A child specification tells a supervisor how to identify and start a child, along with optional lifecycle settings. Its required information includes :id and :start; settings can also include :restart, :shutdown, and :type. Elixir behavior modules commonly provide a child_spec/1 with defaults. When starting multiple instances of the same module, assign distinct IDs so the supervisor can identify them separately.
Choose the child’s restart type according to whether termination is expected:
:permanent: restart whenever the child terminates.:transient: restart after abnormal termination, but not after normal or shutdown exits.:temporary: do not restart after termination.
A long-lived worker that must remain available may need a permanent policy. A short-lived task whose result is returned to a caller should not automatically be restarted after it finishes: the caller may already have received the result or moved on. Verify valid settings and exact behavior against the documentation for your deployed release.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Set restart intensity to bound repeated failures
A supervisor’s restart-intensity limit bounds how many restarts it tolerates within a time window. In the documented Elixir API, the options are :max_restarts and :max_seconds. If the limit is exceeded, the supervisor terminates its children and then terminates; a parent supervisor can then restart or contain the failed subtree. Check the target release’s API for the options and defaults rather than copying values across OTP or Elixir versions.
Best Value
There is no universal threshold. Set one in light of how long startup takes, how the service behaves during a temporary dependency outage, the cost of repeated initialization, and what the parent supervisor will do next. A low threshold can escalate a brief outage; a high threshold can allow repeated initialization and crash loops to continue longer. Crossing the limit is an intentional escalation, so the affected branch may be unavailable while recovery proceeds.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Supervise processes created at runtime
Use DynamicSupervisor for variable child counts
Use DynamicSupervisor when children are created and terminated at runtime instead of listing every child in a static supervision tree. Define the child specification and restart policy, then decide how your application handles duplicate work and resource limits. Elixir’s dynamic-supervision guide explains how to start processes within supervisors.
Use Task.Supervisor for supervised background tasks
Use Task.Supervisor when background work should be owned by a supervisor. Its start_child API starts a task as a child linked to the supervisor rather than to the caller, which is useful for side-effecting work when the caller does not need a result. The documented default restart policy for this child is temporary. Making tasks permanent can repeat side effects after a crash, so do so only when the work is safe to retry and duplicate effects are handled. See the Task.Supervisor API documentation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Test process recovery separately from data and work recovery
Start with a failure test that deliberately kills a supervised worker and verifies that the supervisor starts a replacement. Elixir’s supervision guide demonstrates observing a new process after a supervised process is killed. Then test whether the application remains correct from the outside; a replacement process alone does not prove that its former work or state was recovered.
- Check what happens to state held only in the crashed process’s memory.
- Check whether messages or in-flight work can be lost when a process terminates.
- Check whether retrying an interrupted external write can create duplicate effects.
- Exercise dependency outages to see whether repeated restarts become a crash loop.
- Verify what happens when startup failures exceed the supervisor’s restart intensity and the failure escalates to a parent.
These cases require application-specific recovery and failure handling in addition to supervision. Official API documentation explains the framework’s behavior; it cannot establish that a particular service is fault tolerant without examining and testing that service’s process tree, state persistence, dependencies, and retry behavior.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
