Pretend synchrony: synchronous verification of asynchronous distributed programs

Abstract

We present pretend synchrony, a new approach to verifying distributed systems, based on the observation that while distributed programs must execute asynchronously, we can often soundly treat them as if they were synchronous when verifying their correctness. To do so, we compute a synchronization, a semantically equivalent program where all sends, receives, and message buffers, have been replaced by simple assignments, yielding a program that can be verified using Floyd-Hoare style Verification Conditions and SMT. We implement our approach as a framework for writing verified distributed programs in Go and evaluate it with four challenging case studiesÐ the classic two-phase commit, the Raft leader election protocol, single-decree Paxos protocol, and a Multi-Paxos based distributed key-value store. We find that pretend synchrony allows us to develop performant systems while making verification of functional correctness simpler by reducing manually specified invariants by a factor of 6, and faster, by reducing checking time by three orders of magnitude. CCS Concepts: • Theory of computation → Program verification; Program analysis; Distributed computing models; Concurrency; • Software and its engineering → Software notations and tools.

TLA+ model checking made symbolic

“…More importantly, our framework opens the door for applying more advanced techniques such as abstraction [Ball et al 2001;Clarke et al 2003] and reduction [Cohen and Lamport 1998;Lipton 1975]. Reductions were shown to be efficient for special classes of fault-tolerant distributed algorithms by [Damian et al 2019;Konnov et al 2017b;von Gleissenthall et al 2019]. We are going to explore similar techniques, in order to check complex TLA + specifications of Raft by [Ongaro 2014], Disk Paxos [Gafni and Lamport 2003], and Egalitarian Paxos by [Moraru et al 2013].…”

“…Several projects on proving correctness of distributed algorithms with interactive theorem provers were conducted by [Hawblitzel et al 2017], [Wilcox et al 2015], [Rahli et al 2017], [Sergey et al 2018], [Azmy et al 2018], and[von Gleissenthall et al 2019]. Although, guarantees provided by such proofs are much stronger, they demand a different level of verification efforts.…”

On the k-synchronizability of Systems

“…Reduction recently received an increasing interest for verification purpose, e.g. by Kragl et al [11], or Gleissenthal et al [15].…”

A fault-tolerant programming model for distributed interactive applications

“…More recently, Atkey [2017] adds external communication to classical processes, with a focus on the external high-level behavior, bringing the abstraction level closer to our goals for F R . v. Gleissenthall et al [2019] extracts typical communication structures from programs with only minimal annotations, and generates a synchronous model for those communications for which proofs apply to the original asynchronous program. This extraction fits the synchronous model of F R , so future could apply their analysis.…”