Skip to main content

A Rigorous Correctness Proof for Pastry

Part of the Lecture Notes in Computer Science book series (LNTCS,volume 9675)


Peer-to-peer protocols for maintaining distributed hash tables, such as Pastry or Chord, have become popular for a class of Internet applications. While such protocols promise certain properties concerning correctness and performance, verification attempts using formal methods invariably discover border cases that violate some of those guarantees. Tianxiang Lu reported correctness problems in published versions of Pastry and also developed a model, which he called LuPastry, for which he provided a partial proof of correct delivery assuming no node departures, mechanized in the TLA\(^+\) Proof System. Lu’s proof is based on certain assumptions that were left unproven. We found counter-examples to several of these assumptions. In this paper, we present a revised model and rigorous proof of correct delivery, which we call LuPastry\(^+\). Aside from being the first complete proof, LuPastry\(^+\) also improves upon Lu’s work by reformulating parts of the specification in such a way that the reasoning complexity is confined to a small part of the proof.

This is a preview of subscription content, access via your institution.

Buying options

USD   29.95
Price excludes VAT (USA)
  • DOI: 10.1007/978-3-319-33600-8_5
  • Chapter length: 16 pages
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
USD   64.99
Price excludes VAT (USA)
  • ISBN: 978-3-319-33600-8
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
Softcover Book
USD   84.99
Price excludes VAT (USA)
Fig. 1.
Fig. 2.
Fig. 3.
Fig. 4.
Fig. 5.


  1. 1.

    Nodes also maintain routing tables for the purpose of efficient message routing, but these are irrelevant to our discussion.

  2. 2.

    For compactness, we omit parts of the specification irrelevant to the discussion. TLA\(^+\) functions and operators have been given new names for better readability.

  3. 3.

    Both examples can be found in our proof files in module ProofCorrectness.

  4. 4.

    See \(AddToLSetInvCo\) and \(AddAndDelete\) in LuPastry module \(ProofLSetProp\).

  5. 5.

    Currently, TLAPS requires that enabled be unfolded manually in the machine-checked proof.


  1. LuPastry\(^+\): Specification and Proof Files.

  2. Bakhshi, R., Gurov, D.: Verification of peer-to-peer algorithms: a case study. Electron. Notes Theor. Comput. Sci. 181, 35–47 (2007)

    CrossRef  Google Scholar 

  3. Borgström, J., Nestmann, U., Onana, L., Gurov, D.: Verifying a structured peer-to-peer overlay network: the static case. In: Priami, C., Quaglia, P. (eds.) GC 2004. LNCS, vol. 3267, pp. 250–265. Springer, Heidelberg (2005)

    CrossRef  Google Scholar 

  4. Cousineau, D., Doligez, D., Lamport, L., Merz, S., Ricketts, D., Vanzetto, H.: TLA\(^{+}\) proofs. In: Méry, D., Giannakopoulou, D. (eds.) FM 2012. LNCS, vol. 7436, pp. 147–154. Springer, Heidelberg (2012)

    CrossRef  Google Scholar 

  5. Lamport, L.: Specifying Systems: The TLA\(^+\) Language and Tools for Hardware and Software Engineers. Addison-Wesley, Boston (2002)

    Google Scholar 

  6. Lu, T.: Formal verification of the pastry protocol using TLA\(^+\). In: Li, X., Liu, Z., Yi, W. (eds.) SETTA 2015. LNCS, vol. 9409, pp. 284–299. Springer, Heidelberg (2015). doi:10.1007/978-3-319-25942-0_19

    CrossRef  Google Scholar 

  7. Rowstron, A., Druschel, P.: Pastry: scalable, decentralized object location, and routing for large-scale peer-to-peer systems. In: Guerraoui, R. (ed.) Middleware 2001. LNCS, vol. 2218, pp. 329–350. Springer, Heidelberg (2001)

    CrossRef  Google Scholar 

  8. Stoica, I., Morris, R., Karger, D., Kaashoek, M.F., Balakrishnan, H.: Chord: a Scalable Peer-to-peer lookup service for internet applications. In: SIGCOMM 2001, pp. 149–160. ACM (2001)

    Google Scholar 

  9. Yu, Y., Manolios, P., Lamport, L.: Model checking TLA\(^+\) specifications. In: Pierre, L., Kropf, T. (eds.) CHARME 1999. LNCS, vol. 1703, pp. 54–66. Springer, Heidelberg (1999)

    CrossRef  Google Scholar 

  10. Zave, P.: Using lightweight modeling to understand chord. ACM SIGCOMM Comput. Commun. Rev. 42(2), 49–57 (2012)

    CrossRef  Google Scholar 

  11. Zave, P.: How to Make Chord Correct (Using a Stable Base). CoRR abs/1502.06461 (2015)

    Google Scholar 

Download references

Author information

Authors and Affiliations


Corresponding author

Correspondence to Noran Azmy .

Editor information

Editors and Affiliations

Rights and permissions

Reprints and Permissions

Copyright information

© 2016 Springer International Publishing Switzerland

About this paper

Cite this paper

Azmy, N., Merz, S., Weidenbach, C. (2016). A Rigorous Correctness Proof for Pastry. In: Butler, M., Schewe, KD., Mashkoor, A., Biro, M. (eds) Abstract State Machines, Alloy, B, TLA, VDM, and Z. ABZ 2016. Lecture Notes in Computer Science(), vol 9675. Springer, Cham.

Download citation

  • DOI:

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-33599-5

  • Online ISBN: 978-3-319-33600-8

  • eBook Packages: Computer ScienceComputer Science (R0)