Chapter 9 · Watch, then practise
Fault Tolerance
State the failure model before selecting a recovery or agreement mechanism. Contrast a silent crash with inconsistent behavior and work the classical Byzantine agreement bound.
3 questions · 3 with related videos. Matches are based on playlist titles; broader background matches are labeled.
What to study
- Crash and Byzantine failures
- Agreement requirements
- Fault-model assumptions
Chapter playlists
Existing chapter playlist
Notes
Distributed Systems 2.2: The Byzantine generals problem
Martin Kleppmann · 10:42
Byzantine-generals lecture for arbitrary behavior compared with a crash.
1. Crash versus arbitrary behavior
How can a Byzantine failure be more difficult to handle than a crash?
A crashed participant stops acting. A Byzantine participant may send inconsistent or false information to different peers. An algorithm designed only for crashes cannot automatically tolerate these conflicting messages; its correctness argument assumes a narrower failure model.
Distributed Systems 2.2: The Byzantine generals problem
Martin Kleppmann · 10:42 · Background lecture
Byzantine-agreement background; use the model assumptions and bound stated in this question.
2. Worked resilience bound
Under the classical synchronous oral-message Byzantine agreement model, how many participants are needed to tolerate two faulty participants?
The bound is n ≥ 3f + 1, so f = 2 requires at least 7 participants. This result relies on the model’s communication assumptions. It is not a universal formula for every signed-message or asynchronous protocol.
Byzantine Generals Problem
Mark Reddick · 4:15 · Background lecture
Byzantine-generals background for the distinction between agreement and validity.
3. Agreement alone is insufficient
Would an algorithm that always chooses retreat solve the Byzantine generals problem?
It makes loyal participants agree, but violates validity when a loyal commander ordered attack. Correctness needs both agreement among loyal participants and obedience to a loyal commander’s order, under the specified failure and communication assumptions.