The Spectrum of Failure Models

A failure model states which kinds of incorrect behavior a design must tolerate. Some failures last briefly; others persist. Before choosing recovery mechanisms, distinguish a node that stops from one that omits messages, misses a timing requirement, or returns arbitrary results.

The following illustration presents the spectrum of failure models:

Fail-stop

In a fail-stop failure model, a node halts and other nonfaulty nodes can reliably detect that it has stopped. Reliable detection is an assumption of the model, not something established by sending a request and receiving no reply. This assumption makes reasoning about recovery simpler.

Crash