Prove Raft Correct
Amazing job! It has been mentioned on the Raft mailing list that a proof was in a progress, but to be honest I did not expect anything to come up before a year or so. Forgive my lack of faith! :-)<p>Well done!<p>edit: to provide some context<p>- Raft is a distributed consensus algorithm that is seen by many as a viable alternative to *-Paxos because of its relative simplicity. It was created by D. Ongaro and J. Ousterhout (Tcl/Tk!)<p>- D. Ongaro's dissertation includes a TLA+ specifications of Raft; TLA+ is a model checker (see ) for a more detailed explanation of what is a model checker/theorem prover's job<p>- TLA+ is a model checker; Coq is a proof assistant. See <a href="https://stackoverflow.com/questions/22418448/can-coq-be-used-easily-as-a-model-checker" rel="nofollow">https://stackoverflow.com/questions/22418448/can-coq-be-used...</a> for a more detailed explanation.<p>- Verdi is a Coq framework to make formal proof about distributed systems.<p>- Doug Woos and James Wilcox, made a proof of Raft using Verdi; Verdi helps you figure whether your implementation of X (in this case X=Raft) meets the specifications (Leader Safety, strong consistency etc..)<p>Link to the Verdi website: <a href="http://verdi.uwplse.org/" rel="nofollow">http://verdi.uwplse.org/</a><p>edit: as noted by ahelwer, TLA+ is not a model checker but a language to describe a distributed system's specifications. I was referring to TLC which can work with TLA+.