Skip to content
Blockchain LabBlockchain LabTHE VENTURE STUDIO

LibraryConsensus1999Design paperCorpus record

Practical Byzantine Fault Tolerance

PBFT. Miguel Castro and Barbara Liskov.

The paper that made a Byzantine quorum practical: a known set of replicas, three phases, and a view change when the leader is useless. Tendermint and HotStuff inherit the shape. Open membership is a different problem.

PBFT gets one answer from a known set of replicas of which fewer than one third may lie. A leader sequences requests. A quorum of two thirds plus one commits them. A view change fires the leader.
Evidence
Primary paper
Re-measured
No
Assumptions
4
Records linked
5

Code

Source, repository, and what is actually hosted

  • OSDI 1999http://pmg.csail.mit.edu/papers/osdi99.pdf
  • The source URL is not a GitHub repository. No code remote is invented.
  • Full text is not mirrored. Public availability is not a licence to copy the file onto this site.
  • Add to a reading list

01 Claim ledger

What the paper is allowed to say

Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.

  1. Claim 01 · Paper model

    The set is known

    Replicas have identities before the protocol starts. PBFT does not discover who the voters are. A public chain that elects validators has to add that layer itself.

  2. Claim 02 · Paper model

    Three phases, one sequence number

    Pre-prepare assigns the number. Prepare shows a quorum saw the same assignment. Commit shows a quorum is willing to execute it. Skip a phase and the intersection argument changes.

  3. Claim 03 · Paper model

    Quorums overlap in an honest replica

    With 3f+1 replicas, any two quorums of 2f+1 share at least one honest node. That is why two committed values cannot both be true. The bound is one third, not a vibe about supermajorities.

  4. Claim 04 · Paper model

    View change is the protocol

    If the leader censors or dies, a new view must carry forward anything that might have committed. A system that restarts from a snapshot without that proof is not PBFT.

02 Three cuts

Observation, model, falsifier

A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.

  1. 01 The set is known

    Observation

    What the study says

    Replicas have identities before the protocol starts. PBFT does not discover who the voters are. A public chain that elects validators has to add that layer itself.

    Model

    What has to hold

    Replicas authenticate messages. A set that can be freely impersonated is not this protocol.

    Falsifier

    What would retire it

    What is f, and what happens at f+1 faulty replicas?

  2. 02 Three phases, one sequence number

    Observation

    What the study says

    Pre-prepare assigns the number. Prepare shows a quorum saw the same assignment. Commit shows a quorum is willing to execute it. Skip a phase and the intersection argument changes.

    Model

    What has to hold

    Fewer than one third of replicas are Byzantine. A larger coalition can commit two values.

    Falsifier

    What would retire it

    Does a view change preserve a request that already had a commit quorum?

  3. 03 Quorums overlap in an honest replica

    Observation

    What the study says

    With 3f+1 replicas, any two quorums of 2f+1 share at least one honest node. That is why two committed values cannot both be true. The bound is one third, not a vibe about supermajorities.

    Model

    What has to hold

    Fewer than one third of replicas are Byzantine. A larger coalition can commit two values.

    Falsifier

    What would retire it

    Is the replica set fixed, staked, or open?

  4. 04 View change is the protocol

    Observation

    What the study says

    If the leader censors or dies, a new view must carry forward anything that might have committed. A system that restarts from a snapshot without that proof is not PBFT.

    Model

    What has to hold

    Replicas authenticate messages. A set that can be freely impersonated is not this protocol.

    Falsifier

    What would retire it

    Does a view change preserve a request that already had a commit quorum?

03 Sequence

One action, as an operating tape

  1. 01A client sends a request to the leader, and eventually to the replicas if the leader is silent.
  2. 02The leader broadcasts a pre-prepare binding the request to a sequence number in this view.
  3. 03Replicas that accept it broadcast a prepare. A replica that sees 2f prepares broadcasts a commit.
  4. 04After 2f+1 commits, the replica executes and replies to the client.
  5. 05The client accepts when f+1 honest-looking replies match. A new view starts if this stalls.

04 Load-bearing

The argument, and where a pitch drops it

  1. Safety does not wait for synchrony

    The cut

    The paper's safety holds even when messages are late. Liveness is what needs a period of timely delivery. Quoting PBFT for instant finality without saying which of those two you mean is how designs get oversold.

    Why it carries weight

    If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

    Where it is dropped

    Liveness still needs some period when messages get through. Safety does not.

  2. Permissioned is not an insult, it is the assumption

    The cut

    The theorem is about a fixed, authenticated set. Tendermint and HotStuff keep the quorum and change the messages. They do not turn the set into 'anyone with a coin'.

    Why it carries weight

    If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

    Where it is dropped

    A permissioned quorum is not a public chain. Citing PBFT does not make a validator set open.

05 Register

What has to be true

  • Stake and threshold · Not re-measured

    Fewer than one third of replicas are Byzantine. A larger coalition can commit two values.

  • Network · Not re-measured

    Messages are eventually delivered when the network is in its good period. Safety does not use that. Liveness does.

  • Network · Not re-measured

    Replicas authenticate messages. A set that can be freely impersonated is not this protocol.

  • Model · Not re-measured

    The client waits for matching replies. A client that trusts the first answer has left the paper.

06 Divergence

What happened after the paper

Tendermint, HotStuff, and the Diem-era protocols are descendants of this quorum shape, with different view changes and signature aggregation. A chain that markets BFT without a known validator set and a view-change story is using the adjective and not the paper.

A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.

07 Pre-mortem

What to check before you use the idea

  5. 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.

08 Anatomy

The paper, in the order a builder needs

The problem it names

Lamport's Byzantine agreement was a proof, not a system that could run a replicated service. PBFT asks how a client gets one answer from replicas that may lie, without a synchrony assumption for safety.

What the design proposes

  • Safety if fewer than one third of replicas are faulty.
  • A leader orders requests. The others vote in pre-prepare, prepare, and commit.
  • A view change elects a new leader without rolling back a committed request.

How the mechanism is specified

  • A request is committed only after a quorum of 2f+1 replicas have agreed the same sequence number in the same view.
  • Two quorums intersect in at least one honest replica, which is why the bound is one third and not one half.
  • The paper assumes the replica set is known. It does not elect that set with mining or stake.

What this page does not treat as proven

  • A permissioned quorum is not a public chain. Citing PBFT does not make a validator set open.
  • Liveness still needs some period when messages get through. Safety does not.
  • Later protocols cut the communication. They do not retire the quorum intersection argument.

Why the desk still reads it

When a pitch says Byzantine fault tolerance, ask whether the set of voters is known, who rotates the leader, and what a view change does to a request that already had a quorum.

09 Lexicon

Terms, opened into the record

View
One leader's turn. A view change is how the set fires that leader.
Quorum
2f+1 replicas. Two quorums must intersect in an honest replica.

10 Repository

Every linked record on this page

Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.

Protocols

Failures

This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.

Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.