Date of Original Version



Working Paper

Rights Management

All Rights Reserved

Abstract or Description

A guarantee is only as good as its assumptions. Three group membership areas defy firm, practical guarantees: transient faults, reintegration, and large groups. We show why these areas are problematic, discuss current approaches, and illustrate alternative approaches that may lead to a more dependable system. Ultimately, designs should be tested against a comprehensive fault model, and a probabilistic analysis cannot be avoided.