Localized slice
HotStuff: view change, pacemaker, and safe memory
How a new leader collects QCs, selects highQC, and proposes again without erasing the protocol’s safety memory.
A timeout changes the leader, not the history
When a view stops making progress, every replica sends the next leader signed evidence of its highest QC. A new-view message carries verifiable memory; it is not permission to restart from an empty state.
The leader selects evidence, not a convenient branch
The new leader gathers 2f + 1 messages, verifies signatures, and selects the highest-view QC. Its proposal must extend that tip or satisfy the safety rule against each replica’s local lock.
- highQC orders evidence by view, but signatures and quorum membership are verified again.
- A Byzantine leader cannot make an old tip safe merely by repeating it.
The pacemaker separates safety from progress
Voting and locking rules preserve safety during delay; the pacemaker coordinates views and timeouts to recover liveness after the network stabilizes. This separation keeps clocks from being mistaken for cryptographic evidence.
References
[1]
HotStuff: BFT Consensus in the Lens of BlockchainPrimary work for linear view change, highQC, and chained HotStuff.
[2]
LibraBFT: State Machine Replication in the Libra BlockchainOperational description of the pacemaker and the HotStuff adaptation.