Lamport's Paxos algorithm is a classic consensus protocol for state machine
replication in environments that admit crash failures. Many versions of Paxos
exploit the protocol's intrinsic properties for the sake of gaining better
run-time performance, thus widening the gap between the original description of
the algorithm, which was proven correct, and its real-world implementations. In
this work, we address the challenge of specifying and verifying complex
Paxos-based systems by (a) devising composable specifications for
implementations of Paxos's single-decree version, and (b) engineering
disciplines to reason about protocol-aware, semantics-preserving optimisations
to single-decree Paxos. In a nutshell, our approach elaborates on the
deconstruction of single-decree Paxos by Boichat et al. We provide novel
non-deterministic specifications for each module in the deconstruction and
prove that the implementations refine the corresponding specifications, such
that the proofs of the modules that remain unchanged can be reused across
different implementations. We further reuse this result and show how to obtain
a verified implementation of Multi-Paxos from a verified implementation of
single-decree Paxos, by a series of novel protocol-aware transformations of the
network semantics, which we prove to be behaviour-preserving.Comment: Accepted for publication in the 27th European Symposium on
Programming (ESOP'18
