CORRECTNESS AND LIVENESS. The correctness and liveness properties of CFPaxos were formally proven when the protocol was intro- duced [37]. Proving the same properties for BasicMCF and ExtendedMCF is a matter of reducing these protocols to CFPaxos. The reduction is rather simple, as we now show. To understand the reduction, observe that the idea be- hind BasicMCF and ExtendedMCF is to use a set of coor- dinators forming overlapping quorums to implement each collision-fast proposer. Hence, an action of a collision- fast proposer in the original protocol is implemented by executing the same action in at least a quorum of the cor- respondent coordinators in our protocols. In the following discussion, we refer to each action A of BasicMCF as A, to differentiate it from its homonym in CFPaxos. Exten- decMCF is discussed afterward. The original Propose action and our extended version Propose differ only in the number of messages sent by the proposer. Instead of sending a single message to a collision-fast proposer, the proposer sends the message to all coordinators in its group. In fact, even in the original protocol, it is up to the proposer to choose to which co- ordinators to send its proposals and this choice does not affect the correctness of the protocol, although it could af- fect liveness. Hence, Propose implements Propose. The other actions of phase one, Phase1a and Phase1b, are exactly the same in both protocols and, hence, implemen- tations of each other. Action Phase2Start (c, i) implements action Phase2Start (c, i) by performing the same sub-actions under the same pre-conditions. More than that, Phase2Start (c, i) also implements a special case of action Phase2Prepare(c, i) if c is in some coordquorum for round i. To avoid having a flag variable to indicate this special condition in Phase2Prepare(c, i) as in CFPaxos, we added the sub-actions to Phase2Start (c, i). Phase2Prepare(c, i), where c is not the creator of i, differs from Phase2Prepare(c, i) only in that in the first c must be in some Gi -coordquorum for some group G, while in the last c must be in the list of collision-fast proposers of round i. As we men- tioned above, for each collision-fast proposer g in CF- Paxos, there is a corresponding set of coordinators in G forming coordquorums to implement g . Hence, ac- tion Phase2Prepare(g, i) is implemented by the compo- sitions of actions Phase2Prepare(c, i) for every coordi- nator c in some Gi -coordquorum anddue to the recep- tion of the same “2S” message (and Phase2...
CORRECTNESS AND LIVENESS. The MCC algorithm satisfies the safety properties of consensus mainly because it ensures that rounds are con- sistent with previous decisions. As described in the defi- nition of Phase1b, executing action Phase1b for a given round prevents the same acceptor from executing action Phase2b for any smaller round, and action Phase2a se- lects the previously chosen value, if any. If different coor- dinators keep starting new rounds, it may happen that ac- ceptors continuously execute Phase1b for the new rounds before executing Phase2b for the smaller rounds, and no value is ever chosen. In the simplified case where rounds are single- coordinated, if a quorum of acceptors, a coordinator, a proposer, and learner do not crash, then the learner will eventually learn the decision if there is a single coordina- tor that believes itself to be the leader (by using an Ω ora- cle) and the proposer proposes some value. This is equiv- alent to the rounds of the original Paxos protocol [23]. A similar condition may seem harder to achieve for multicoordinated rounds, since any of its coordinators can start the round but, in fact, the complexity is exactly the same. In a multicoordinated round, a proposal will be accepted by an acceptor only if a quorum of coordina- tors has forwarded such a value. Since all coordinator quorums intersect, at most one value is accepted in such rounds. Coordinators of rounds executed afterward con- tact only the acceptors and are not influenced by the mul- tiple coordinators of lower rounds. Roughly speaking, a multicoordinated round i will finish if no other round is started, some proposal is made, and at least one of its co- ordquorums is composed of non-crashed coordinators and all of its coordinators receive the same proposal. More- over, because our protocol is an extension of Fast Paxos, it can switch to single-coordinated rounds at any moment and ensure liveness under the same conditions of Classic Paxos. We formalized this argument in [6].
