9.12 Self-test

Why do computers deliberately crash rather than return wrong results? What does that design choice hide?

Define partial failure. Why is nondeterminism the thing that makes it hard?

List the six things that may have happened when a request times out. Which of them mean the operation already took effect?

Give four reasons TCP's "reliability" doesn't give you application-level reliability. What do you actually need?

Why doesn't redundant network hardware reduce faults as much as expected?

Give two examples of asymmetric or partial network faults from the chapter.

Enumerate the four points at which a packet can be queued, and say which one is invisible to both endpoints.

Why does a system near capacity have far worse delay variance than one with spare capacity?

Why is there no "correct" timeout value? What should you do instead of a constant?

Explain the cascading-failure loop caused by a timeout that's too short.

Contrast a telephone circuit with a TCP connection. Why did the internet choose packet switching?

"Variable delays are not a law of nature." Explain the cost/benefit trade-off in one sentence.

Give three properties of monotonic clocks and three of time-of-day clocks. Which is safe for measuring a timeout, and why?

Why do bad clocks cause silent data loss rather than visible crashes?

Walk through the LWW example where a causally later write gets an earlier timestamp. Name three separate problems with client-clock LWW.

Why can NTP never be accurate enough to guarantee correct event ordering?

What is a clock confidence interval? Why do most APIs not expose one, and what do TrueTime and ClockBound do differently?

Explain Spanner's commit-wait. Why are atomic clocks helpful but not strictly necessary?

Find both bugs in the lease-renewal loop. Which one survives switching to a monotonic clock?

List six causes of a multi-second process pause. Which two can occur without any code of yours running?

Why don't mutexes and semaphores translate to distributed systems?

What does "hard real-time" require at each layer, and why is real-time not the same as high-performance?

Describe the technique of treating a GC pause as a planned outage.

Tell the three "majority rules" parables. What is the moral, in one sentence?

Why can there only ever be one majority? What does that buy you?

Draw both distributed-lock failure modes. Which one involves no pause at all?

Why is STONITH insufficient? Give three reasons.

Explain fencing tokens. What must the storage side do, and what must a newly-elected leaseholder do immediately?

How do you fence a leaderless replicated store with LWW?

Define a Byzantine fault. Give two contexts where BFT is warranted and two things it cannot protect against.

Name three cheap defences against "weak lying."

Define the three timing models and the four node-failure models. Which combination is most useful, and which failure mode does it fail to capture?

Distinguish safety from liveness precisely (not "bad" vs "good"). Which one may be conditioned on caveats, and what caveats are standard?

Why does node amnesia break quorum correctness? What does that tell you about system models?

Compare model checking, fault injection, and DST on what each finds and misses. Why is DST's replayability so valuable?

List six places determinism has appeared in this book so far. Name two residual sources of nondeterminism even after mocking I/O and clocks.