Despite means of fault prevention such as extensive testing or formal veri?cation, errors inevitably occur during system operation. To avoid subsequent system fa ures, critical distributed systems, therefore, require engineering of means for fault tolerance. Achieving fault tolerance requires some redundancy, which, unfor nately, is bound