Chapar: certified causally consistent distributed key-value stores

Abstract

Today's Internet services are often expected to stay available and render high responsiveness even in the face of site crashes and network partitions. Theoretical results state that causal consistency is one of the strongest consistency guarantees that is possible under these requirements, and many practical systems provide causally consistent key-value stores. In this paper, we present a framework called Chapar for modular verification of causal consistency for replicated key-value store implementations and their client programs. Specifically, we formulate separate correctness conditions for key-value store implementations and for their clients. The interface between the two is a novel operational semantics for causal consistency. We have verified the causal consistency of two key-value store implementations from the literature using a novel proof technique. We have also implemented a simple automatic model checker for the correctness of client programs. The two independently verified results for the implementations and clients can be composed to conclude the correctness of any of the programs when executed with any of the implementations. We have developed and checked our framework in Coq, extracted it to OCaml, and built executable stores.

Safe replication through bounded concurrency verification

“…The system described above is quite general insofar as it makes no assumptions on either the timing or order in which effects are generated and propagated. Indeed, the model abstracts many realworld distributed data stores [Lakshman and Malik 2010;Riak 2018;Sivasubramanian 2012;Voldemort 2009], and is consistent with the models used in a number of research prototypes such as Walter [Sovran et al 2011], Chapar [Lesani et al 2016], Antidote [Shapiro et al 2018], and Quelea [Sivaramakrishnan et al 2015]. Fig.…”

“…These efforts require support from developers who must either write detailed contracts [Sivaramakrishnan et al 2015], define deep specifications within a mechanized theorem prover [Lesani et al 2016;Wilcox et al 2015], state and prove various kinds of local and global assertions within the context of a program logic [Gotsman et al 2016], and/or fix counterexamples that prevent inductive generalization [Padon et al 2016]. Given such input, these approaches are capable of addressing important verification challenges in realistic distributed systems.…”

CLOTHO: directed test generation for weakly consistent database systems

“…There have been several recent proposals to reason about programs executing under weak consistency [Alvaro et al 2011;Bailis et al 2014a;Balegas et al 2015;Li et al 2014Li et al , 2012. All of them assume a system model that offers a choice between a coordination-free weak consistency level (e.g., eventual consistency [Alvaro et al 2011;Bailis et al 2014a;Balegas et al 2015;Li et al 2014Li et al , 2012) or causal consistency Lesani et al 2016]). In contrast, our focus is agnostic to the particular consistency guarantees provided by the underlying storage system, and is concerned with statically identifying violations of a particular class of invariants, namely those that hold precisely when transactions exhibit serializable behavior.…”

Automatic Analysis of Consistency Properties of Distributed Transaction Systems in Maude

“…There is also work [23,34,39] that focuses on specifying, implementing and verifying distributed systems using the Coq proof assistant. Their executable Coq "implementations" can be seen as executable high-level formal specifications, but the theorem proving requires nontrivial user interaction.…”