Orcaella: Hybrid Fault Tolerance with Client-Selectable Finality Latency

2026-07-06

AI Summary

This work investigates the fault-tolerance limits and protocol design for low-latency consensus under a hybrid failure model combining Byzantine faults (f) and crash faults (c). It establishes, for the first time, a tight lower bound of n ≥ 5f + 3c + 1 for two-message-latency commit protocols. The paper proposes a hybrid fault-tolerant consensus protocol featuring both a fast-commit path and a resilient fallback mechanism, enabling clients to select their desired finality latency. Built upon the partial synchrony model and integrating multi-round safety paths with synchronous recovery, the protocol achieves high performance: under a configuration of n=99, f=16, and c=6, it tolerates up to 22% failed replicas (liveness), 16% malicious nodes with 1-RTT safety, and as many as 54% malicious nodes with 2-RTT safety.

Abstract

Classical partially synchronous state machine replication, as in PBFT, tolerates f Byzantine replicas among n at least 3f+1 using three communication steps per request. Recent protocols such as Minimmit achieve two-message-delay decisions under stronger size assumptions, notably n at least 5f+1 when any silent replica must be counted as a potential equivocator. Hydrangea and Kudzu treat mixed Byzantine and crash faults, focusing on providing a fast-path under optimistic conditions while maintaining a fall-back commitment path similar to PBFT. In this paper, we also consider a mixed model, but focus on studying the fault tolerance of the 2-message-delay commit. For this, we prove a tight bound of n at least 5f+3c+1. Extending this result, we also show that there exists a more resilient commit path that allows an extra f_abc < n-3f-2c alive-but-corrupt faults at 4-message-delays. Core liveness is claimed in executions with at most f equivocators; if this regime is violated (e.g., AbC-induced forks), the protocol enters synchronous recovery, where only the resilient-path safety guarantee is preserved. As a result, for f=16, c=6, and n=99, we obtain a commit path that tolerates 22% of replicas failing for liveness, 16% equivocating for 1-RTT safety, and 54% equivocating for 2-RTT safety.

Problem

• Byzantine faults
• crash faults
• fault tolerance
• state machine replication
• finality latency

Innovation

• Hybrid Fault Tolerance
• Client-Selectable Finality
• Two-Message-Delay Commit
• Alive-but-Corrupt Faults
• Synchronous Recovery