In Search of an Understandable Consensus Algorithm — TEI-tagged view

Diego Ongaro, John Ousterhout · 2014 · computer-science · source · full text at the source · TEI xml · tagged edition · index · concepts · authors
Where this record's text came from. faceted 2026-08 by reading the locally held text (pdftext); every evidence string verified as an exact substring of that text before merging. One method facet cannot hold this paper: it is simultaneously an algorithm/system design, a controlled behavioural experiment (43 students, paired quizzes, paired t-test, linear regression model), and a partly mechanised formal proof in TLA+. I chose system-or-tool-building because the deliverable is the algorithm and its implementation; the user-study evidence sentence 'A user study with 43 students at two universities shows that Raft is significantly easier to understand than Paxos: after learning both algorithms, 33 of these students were able to answer questions about Raft better than questions about Paxos.' is verbatim in the text if a behavioural-experiment reading is preferred. The Paxos relation is filed as 'contradicts' because the paper argues against Paxos as a foundation rather than merely differing from it. Replication status is untested: the user study is the authors' own and no independent replication is reported. Extraction is clean prose apart from figure and table text (Figure 2's algorithm summary) being interleaved into the body; no quotes were taken from those regions. 2026-08-14 and 2026-08-15 schema-0.3 passes: every quote verified as an exact substring of the staged text and anchored at merge time; concept terms verified present; every edge endpoint an existing node. Update, 15 September 2026: EXCEPTION, measured with the merge gate's own predicate (Paper.locate): 1 quote(s) on this record are not found as one exact string in the current staged text - content_tags.findings[0].evidence. The sentence above does not hold for them as written. Where a row records why - the quote is grounded in another copy of the paper, joins two passages with an ellipsis, or differs from the staged text by extraction noise - that note stays on the row.
1 quote on this page was cut from a different copy of this article. This project holds two extractions of this paper: the plain text every other quote here is anchored in, and the publisher’s own HTML edition, which we are not licensed to republish. It is verbatim in the second and cannot be found in the first — not because the tagging is wrong, but because the extraction damaged the passage: a page number dropped into the middle of a number, a formula moved out of its sentence, a ligature where two letters belong. The record names the copy for each one. The quote is the paper’s; the extraction is not.
Other fields define these differently the same word, defined another way in another discipline
consensus 6 fields · replication 3 fields · decomposition 2 fields · statistical-significance 2 fields · linear regression 2 fields
Tags on this paper every tag the record carries, whether or not the words occur in the text below — a number is how many papers in the corpus carry that tag; a tag with no number is unique to this paper
distributed consensus replicated state machine leader election fault tolerance2 replicated log understandability Paxos decomposition3 nondeterminism state space2 system-or-tool-building173

Our tag layer for this paper

Cross-disciplinary analysis
content-tags & facets: phenomenon · claim-type · cross-domain-transfer · mechanism · claim-relation · replication-status · limitation — grounded in the full text
phenomenondistributed consensus for replicated logs— “Consensus algorithms allow a collection of machines to work as a coherent group that can survive the failures of some of its members.”
claim-typemethod— “The result of this work is a consensus algorithm called Raft.”
method — evidence— “We used our Raft implementation to measure the performance of Raft’s leader election algorithm and answer two questions.”
mechanismdesign alternatives are chosen by asking two stated questions about UNDERSTANDABILITY - how hard is each to explain, and how easily can a reader completely grasp it and its implications - and the authors state plainly that this analysis is highly subjective— “There were numerous points in the design of Raft where we had to choose among alternative approaches. In these situations we evaluated the alternatives based on understandability: how hard is it to explain each alternative (for example, how complex is its state space, and does it have subtle implications?), and how easy will it be for a…mechanisms[0]
mechanismthe first technique is problem decomposition: the problem is divided into pieces that can be solved, explained AND understood relatively independently, and the paper names the four it used— “The first technique is the well-known approach of problem decomposition: wherever possible, we divided problems into separate pieces that could be solved, explained, and understood relatively independently. For example, in Raft we separated leader election, log replication, safety, and membership changes.”mechanisms[1]
mechanismthe second technique reduces the STATE SPACE rather than the code - fewer states to consider, more coherence, nondeterminism removed where possible - and it is made concrete by two rules about what logs are not allowed to do— “Our second approach was to simplify the state space by reducing the number of states to consider, making the system more coherent and eliminating nondeterminism where possible. Specifically, logs are not allowed to have holes, and Raft limits the ways in which logs can become inconsistent with each other.”mechanisms[2]
mechanismNONDETERMINISM IS DELIBERATELY ADDED WHERE IT SHRINKS THE STATE SPACE: randomised approaches handle all possible choices in one fashion - choose any, it does not matter - so randomisation is used to simplify leader election even though the general policy was to eliminate it— “Although in most cases we tried to eliminate nondeterminism, there are some situations where nondeterminism actually improves understandability. In particular, randomized approaches introduce nondeterminism, but they tend to reduce the state space by handling all possible choices in a similar fashion (“choose any; it doesn’t matter”). We used…mechanisms[3]
mechanismthe comparison is a within-subject crossover: every participant learns both algorithms and takes both quizzes, with the ORDER reversed for about half of them, so that individual differences and the experience gained from the first half are both accounted for— “Each student watched one video, took the corresponding quiz, watched the second video, and took the second quiz. About half of the participants did the Paxos portion first and the other half did the Raft portion first in order to account for both individual differences in performance and experience gained from the first portion of the…mechanisms[4]
mechanismthe two ways the experiment FAVOURED THE COMPETITOR are stated by the authors rather than left to a reader: some participants had prior experience with the rival algorithm, and the rival's teaching video was longer— “We tried to make the comparison between Paxos and Raft as fair as possible. The experiment favored Paxos in two ways: 15 of the 43 participants reported having some prior experience with Paxos, and the Paxos video is 14% longer than the Raft video.”mechanisms[5]
mechanismthe regression model's estimate of the quiz effect is reported as LARGER than the raw score difference, and the gap between the two is explained by prior experience with the rival algorithm rather than set aside— “The model predicts that the choice of quiz produces a 12.5-point difference in favor of Raft. This is significantly higher than the observed difference of 4.9 points, because many of the actual students had prior Paxos experience, which helped Paxos considerably, whereas it helped Raft slightly less.”mechanisms[6]
mechanismthe participants' own preference is collected AND THEN DISCOUNTED by the authors, who name both reasons it may be unreliable: self-report against measured scores, and the participants' possible knowledge of the hypothesis being tested— “An overwhelming majority of participants reported Raft would be easier to implement and explain (33 of 41 for each question). However, these self-reported feelings may be less reliable than participants’ quiz scores, and participants may have been biased by knowledge of our hypothesis that Raft is easier to understand.”mechanisms[7]
mechanismthe correctness argument is anchored to a formal specification that is itself the subject of the proof, and the paper states exactly how far the mechanisation reaches - one property mechanically proven, resting on invariants that have not been mechanically checked— “We have developed a formal specification and a proof of safety for the consensus mechanism described in Section 5. The formal specification [31] makes the information summarized in Figure 2 completely precise using the TLA+ specification language [17]. It is about 400 lines long and serves as the subject of the proof. It is also useful on its…mechanisms[8]
extends Paxos consensus algorithm— “It produces a result equivalent to (multi-)Paxos”claim_relations[0]
contradicts Paxos (Lamport)— “Because of these problems, we concluded that Paxos does not provide a good foundation either for system building or for education.”claim_relations[1]
builds-on Oki and Liskov's Viewstamped Replication— “Raft is similar in many ways to existing consensus algorithms (most notably, Oki and Liskov’s Viewstamped Replication [29, 22]), but it has several novel features:”claim_relations[2]
senseunderstandability AT DESIGN TIME - AS TWO QUESTIONS THE AUTHORS ASK THEMSELVES: how hard is each alternative to explain, including how complex its state space is and whether it has subtle implications, and how easy it will be for a reader to understand it completely— “In these situations we evaluated the alternatives based on understandability: how hard is it to explain each alternative (for example, how complex is its state space, and does it have subtle implications?), and how easy will it be for a reader to completely understand the approach and its implications”senses[0]
senseunderstandability AT EVALUATION TIME - AS A QUIZ SCORE: the same word is measured by testing upper-level undergraduate and graduate students on two named university courses, so the paper's central term has one meaning while designing and a different, countable one while evaluating— “To measure Raft’s understandability relative to Paxos, we conducted an experimental study using upper-level undergraduate and graduate students in an Advanced Operating Systems course at Stanford University”senses[1]
sensethe equivalence with Paxos - ON RESULT AND EFFICIENCY ONLY: the paper states the result is equivalent and the efficiency comparable while the structure is different, so a claim proved about one is not automatically a claim about the other— “It produces a result equivalent to (multi-)Paxos, and it is as efficient as Paxos, but its structure is different from Paxos; this makes Raft more understandable than Paxos”senses[2]
controlcounterbalancing the order of the Paxos and Raft portions of the study, half the participants each way — held— “We compared participants’ scores on each quiz to determine whether participants showed a better understanding of Raft.” — rules out that the difference in quiz scores reflects individual differences in ability or learning carried over from whichever algorithm was studied first, rather than the algorithms' understandability— “About half of the participants did the Paxos portion first and the other half did the Raft portion first in order to account for both individual differences in performance and experience gained from the first portion of the study.”controls[0]
auditunderstandability —operationalised-as→ state space — Audit 2026-09-28: DOUBTFUL - read against its full span and kept, but the span gives state-space complexity as one example of how understandability was judged; operationalised-as is loose.— “In these situations we evaluated the alternatives based on understandability: how hard is it to explain each alternative (for example, how complex is its state space, and does it have subtle implications?), and how easy will it be for a reader to completely understand the approach and its implications”concept_edges[0]
effect directiondecomposition —causes→ understandability — increases— “we applied specific techniques to improve understandability, including decomposition (Raft separates leader election, log replication, and safety)”— “to improve understandability, including decomposition”concept_edges[1]
evidential statusdecomposition —causes→ understandability — the authors' DESIGN INTENT, stated as what they applied - not a measured outcome— “we applied specific techniques to improve understandability, including decomposition (Raft separates leader election, log replication, and safety)”— “we applied specific techniques”concept_edges[1]
relationdecomposition —causes→ understandability — decomposition is one of the techniques APPLIED TO IMPROVE understandability— “we applied specific techniques to improve understandability, including decomposition (Raft separates leader election, log replication, and safety)”— “we applied specific techniques to improve understandability, including decomposition”concept_edges[1]
outcomecontrol — held— “About half of the participants did the Paxos portion first and the other half did the Raft portion first in order to account for both individual differences in performance and experience gained from the first portion of the study.”— “We compared participants’ scores on each quiz to determine whether participants showed a better understanding of Raft.”controls[0]
for which uselimitation — the liveness argument: WITHOUT EXTRA MEASURES SPLIT VOTES COULD REPEAT INDEFINITELY— “without extra measures split votes could repeat indefinitely”limitations[0]
for which uselimitation — the safety proof as evidence: THIS PROOF RELIES ON INVARIANTS THAT HAVE NOT BEEN MECHANICALLY CHECKED (FOR EXAMPLE, WE HAVE NOT PROVEN THE TYPE SAFETY OF THE SPECIFICATION)— “However, this proof relies on invariants that have not been mechanically checked (for example, we have not proven the type safety of the specification).”limitations[1]
for which uselimitation — the understandability claim, which is the paper's central selling point: PARTICIPANTS MAY HAVE BEEN BIASED BY KNOWLEDGE OF OUR HYPOTHESIS THAT RAFT IS EASIER TO UN[derstand], and the self-reports MAY BE LESS RELIABLE THAN ... QUIZ SCORES— “However, these self-reported feelings may be less reliable than participants’ quiz scores, and participants may have been biased by knowledge of our hypothesis that Raft is easier to understand.”limitations[2]
for which uselimitation — the performance comparison: Raft's strong-leader design rules out optimisations available to leaderless algorithms— “Raft’s strong leadership approach simplifies the algorithm, but it precludes some performance optimizations.”limitations[3]
for which uselimitation — any performance comparison against optimised implementations: VARIOUS OPTIMIZATIONS HAVE BEEN PROPOSED IN THE LITERATURE FOR OTHER ALGORITHMS; MANY OF THESE COULD BE APPLIED TO RAFT, BUT WE LEAVE THIS TO FUTURE WORK— “Various optimizations have been proposed in the literature for other algorithms; many of these could be applied to Raft, but we leave this to future work.”limitations[4]
for which uselimitation — the claim that this algorithm is more understandable by design: the alternatives were judged by how hard each is to explain and how easy it would be for a reader to understand, which are the authors' own assessments— “In these situations we evaluated the alternatives based on understandability: how hard is it to explain each alternative (for example, how complex is its state space, and does it have subtle implications?), and how easy will it be for a reader to completely understand the approach and its implications”limitations[5]
for which uselimitation — the finding that this algorithm is more understandable than Paxos: it was measured by an experimental study using upper-level undergraduate and graduate students in an Advanced Operating Systems course at Stanford and a distributed computing course elsewhere— “To measure Raft’s understandability relative to Paxos, we conducted an experimental study using upper-level undergraduate and graduate students in an Advanced Operating Systems course at Stanford University”limitations[6]
for which uselimitation — treating results about Paxos as results about this algorithm: the paper states it produces an equivalent result and is as efficient, but that its structure is different— “It produces a result equivalent to (multi-)Paxos, and it is as efficient as Paxos, but its structure is different from Paxos”limitations[7]
for which uselimitation — a description of this algorithm as deterministic by design: the authors state that although they tried in most cases to eliminate nondeterminism, in some situations nondeterminism actually improves understandability— “Although in most cases we tried to eliminate nondeterminism, there are some situations where nondeterminism actually improves understandability”limitations[8]
study locationStanford (city) · wikidata · geonames— “To measure Raft’s understandability relative to Paxos, we conducted an experimental study using upper-level undergraduate and graduate students in an Advanced Operating Systems course at Stanford University and a Distributed Computing course at U.C.”study_location[0]
replicationuntested
limitationwithout extra measures split votes could repeat indefinitely— “without extra measures split votes could repeat indefinitely”limitations[0]
limitationThe mechanised safety proof rests on invariants that were never mechanically checkedlimitations[1]
limitationThe participants' self-reported preference for Raft may be unreliable and biased by knowledge of the authors' hypothesislimitations[2]
limitationRaft's strong-leader design rules out some performance optimisations available to leaderless algorithmslimitations[3]
limitationOptimisations known for other consensus algorithms were not applied or evaluated herelimitations[4]
limitationThe design criterion the paper is built around is the authors' own judgement about how hard things are to explain.limitations[5]
limitationThe understandability result is a quiz given to students on two named courses.
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
limitations[6]
limitationThe equivalence claimed with the algorithm it replaces is on result and efficiency, with the structure explicitly different.
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
limitations[7]
limitationRemoving nondeterminism was the general aim, and the paper records where that aim was abandoned.
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
limitations[8]
Content tags
content-observations: finding · quantity · variable · definition · key-term — grounded in the full text
findingRaft produces a result equivalent to (multi-)Paxos and is as efficient, but its different structure, which separates leader election, log replication and safety, makes it more understandable.
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
content_tags.findings[0]
not machine-vouchedfinding — declared-ellipsis - An elided quote: its 2 pieces ('it produces a result equivalent to (mult' ... 'er election, log replication, and safety') are each in our copy of the paper (with line-break hyphens, spacing and punctuation set aside), and the quote marks the cut with an ellipsis, so the joined string is in no copy. Located mechanically, piece by piece.content_tags.findings[0]
findingA user study showed Raft is easier for students to learn than Paxos; Raft also adds a mechanism for changing cluster membership that uses overlapping majorities to guarantee safety.
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
content_tags.findings[1]
evidence status notefinding — QUOTE REPAIRED: the extractor split a hyphen-space and the quote was recorded faithfully with the damage in it, which made it unanchorable. The repaired string is an EXACT SUBSTRING of the staged text - that is why it was accepted, not because a rule produced it. The text as originally recorded is kept in evidence as extracted.content_tags.findings[1]
quantity43 students — user-study size comparing Raft vs Paxos learnability
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
content_tags.quantities[0]
variableunderstandability (dependent)
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
content_tags.variables[1]
definitionconsensus algorithm
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
content_tags.definitions[0]
evidence status notedefinition — QUOTE REPAIRED: the extractor split a hyphen-space and the quote was recorded faithfully with the damage in it, which made it unanchorable. The repaired string is an EXACT SUBSTRING of the staged text - that is why it was accepted, not because a rule produced it. The text as originally recorded is kept in evidence as extracted.content_tags.definitions[0]
definitionreplicated state machine
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
content_tags.definitions[1]
key-termsconsensus, Raft, Paxos, replication, leader, safety, log, understandable, majority
Concepts
terms this paper carries, each with the sentence it was cut from — the layer that joins one paper to another. Terms with no quote yet are on CONCEPTS.html.
conceptunderstandability
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
concepts[5]
conceptPaxos
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
concepts[6]
conceptdecomposition
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
concepts[7]
conceptnondeterminism
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
concepts[8]
conceptstate space
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
concepts[9]
Statistics — cross-field join keys
field-invariant statistical terms, used in their statistical sense (gated on a number / symbol / test). A p-value or a standard deviation means the SAME thing in physics, biology, psychology and sociology — so these are the strongest cross-field join keys. Grounded verbatim.
regression β as written: linear regression
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
content_tags.statistics[0]
evidence status noteregression — EXTRACTION, NOT THE PAPER: the quote as extracted ended 'and s t n a p…', which is 'participants' reversed. It runs on into 'i f o r e b m u n' ('number of' reversed) - together the rotated y-axis label of Figure 15, which the extractor read bottom-to-top and placed inside this sentence. The sentence resumes 250 characters later at 'the order in…', so the true third factor is the learning order. The quote is TRIMMED rather than mended: joining the two halves would produce a string that reads correctly and exists in no document. Found by an internal tool; this was the only live quote in the corpus reaching into such a region.content_tags.statistics[0]
statistical-significance as written: significantly
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
content_tags.statistics[1]
evidence status notestatistical-significance — QUOTE REPAIRED: the extractor split a hyphen-space and the quote was recorded faithfully with the damage in it, which made it unanchorable. The repaired string is an EXACT SUBSTRING of the staged text - that is why it was accepted, not because a rule produced it. The text as originally recorded is kept in evidence as extracted.content_tags.statistics[1]
t-test t
Quotation withheld — this paper is not ours to reproduce, and the page has already quoted as much of it as the rights layer allows. The tag, its field and its confidence stand; the sentence is at the publisher.
content_tags.statistics[2]

When we have changed our mind. Some entries in the table begin with a word in capitals and the reason for it. EVIDENCE CORRECTED — the finding still stands, but we had quoted the wrong sentence from the paper, and the quotation has been replaced with the right one. RETRACTED — the entry itself was wrong; it stays on the page, marked, with the reason, rather than being deleted. WITHDRAWN AND REPLACED — the entry was wrong, and a corrected version of it appears in the entries below. Each mark carries its own reason, in brackets, because the reasons differ from one entry to the next. An entry we have WITHDRAWN is removed from this page and kept in the record, with its reason. A line reading Audit and a date is a later re-reading of the entry against its whole sentence: DOUBTFUL means it was kept, and the reason says what is loose about it. Quotation marks inside the tagger's sentence. Where a tag is the tagger's own sentence, a phrase in quotation marks inside it is borrowed from the paper — the tagger's wording around it is not. The paper's own sentence is the evidence quote for that row; on this page it is withheld with the article, and the article is at its publisher. Nothing inside quotation marks anywhere on this page is ours: if it is quoted, it is the paper's. Whose words a concept carries. A concept entry records a term the paper itself uses, so the term, the sense given for it, and its evidence are the paper's own words, quoted where the paper fixes them. This is the opposite of a sense entry in the tag table, which is the tagger's sentence about how the paper uses a term. Where a concept entry could not be grounded in the paper's words, the entry says so on its own row.

Tag layer © the Meta-Tagging Project, CC BY 4.0. The paper text is © its authors/publisher and is linked, not reproduced. Excerpts shown are short quotations for identification and verification. · back to index · concepts · authors · עברית
© 2026 Shir Sivroni · ORCID 0009-0000-2597-2824