Verification of Eventual Consensus in Synod Using a Failure-Aware Actor Model

Abstract

Successfully attaining consensus in the absence of a centralized coordinator is a fundamental problem in distributed multi-agent systems. We analyze progress in the Synod consensus protocol-which does not assume a unique leader-under the assumptions of asynchronous communication and potential agent failures. We identify a set of sufficient conditions under which it is possible to guarantee that a set of agents will eventually attain consensus. First, a subset of the agents must behave correctly and not permanently fail until consensus is reached, and second, at least one proposal must be eventually uninterrupted by higher-numbered proposals. To formally reason about agent failures, we introduce a failure-aware actor model (FAM). Using FAM, we model the identified conditions and provide a formal proof of eventual progress in Synod. Our proof has been mechanically verified using the Athena proof assistant and, to the best of our knowledge, it is the first machine-checked proof of eventual progress in Synod.

Formal Guarantees of Timely Progress for Distributed Knowledge Propagation

“…Hawblitzel et al [30,31] have proven eventual progress for a Multi-Paxos implementation using Dafny [35]. In [50], we have verified eventual progress in the Synod consensus protocol using Athena.…”

“…Therefore, we believe that our contribution will make the task of reasoning about properties of other distributed coordination protocols, which are implemented using MTR and the M/M/1 queue, in Athena easier in the future as a significant amount of reusable formal constructs to express such properties have already been developed. Nonetheless, additional theories will be required to reason about distributed protocols involving a non-deterministic number of messages (e.g., the Synod consensus protocol [50]). Our eventual goal is to expand the library by adding additional theories from distributions, queues, airborne networks, message sequences, and other necessary domains to support reasoning about a variety of distributed protocols that can be employed for autonomous decentralized UAM applications.…”

“…In [50] we have presented an autonomous protocol for UTM called Decentralized Admission Control (DAC) in which aircraft connected through an asynchronous vehicle-2-vehicle (V2V) [47] network called the Internet-of-Planes (IoP) [51] can coordinate their use of a shared fourdimensional airspace. In DAC, an airspace has a set of owner aircraft which already have the authorization to carry out a fixed set of flight plans through the airspace (Fig.…”