Cassandra: Consensus with Partial Progress via Robust Partitionable View Synchronization

Abstract: Replicated databases and permissioned blockchain systems rely on Byzantine Fault-Tolerant (BFT) consensus to maintain a globally consistent order of transactions across distributed replicas. These protocols preserve safety even under asynchrony, as they commit a transaction only after agreement among a strong quorum of replicas. During network partitions, however, when no strong quorum is reachable, they lose liveness and cannot make useful progress. In this paper, we present Cassandra, a consensus protocol that enables partial progress without sacrificing safety. Cassandra achieves this through a two-tier certification framework that decouples availability from commitment, allowing each partition to extend its own chain and reconcile these chains once the network is restored. To support this, Cassandra introduces a pacemaker that advances views without requiring a strong quorum and calibrates each replica's timeout off the critical path. Our evaluation results show that Cassandra remains competitive with state-of-the-art BFT protocols under stable conditions, sustaining 900K TPS at 16 replicas and 480K TPS at 104 replicas, with latency ranging from 0.31s at 16 replicas to 0.75s at 104 replicas. Under severe partitions, Cassandra maintains non-zero speculative throughput through PoA-backed progress, preserving work that can be reconciled once connectivity is restored.

• The paper introduces partial progress by enabling transaction ordering with f+1 replicas through a two-tier certification framework (PoA and PoR) during network partitions.
• The protocol features a leaderless, deterministic proposal mechanism with a decoupled pacemaker that avoids recovery storms and ensures smooth round advancement.
• Empirical evaluations show Cassandra's resilience with up to 900K TPS and rapid reconciliation upon reconnection, outperforming traditional BFT protocols in partitioned settings.

Robust Partial Progress for BFT Consensus: An Analytical Overview of "Cassandra: Consensus with Partial Progress via Robust Partitionable View Synchronization" (2607.02856)

Motivation and Problem Formulation

The Cassandra protocol directly addresses the long-standing gap in Byzantine Fault-Tolerant (BFT) consensus: the inability to make useful progress under network partitions. Traditional protocols—PBFT, HotStuff, Tusk, AutoBahn, RCC, SpotLess—preserve safety but require strong quorum ($2f+1$ out of $n=3f+1$) for liveness, resulting in zero throughput during partitions where no component contains a full quorum. Empirical evidence from major outages (AWS, Cloudflare, Solana) demonstrates that network partitions are a practical rather than theoretical challenge.

Cassandra challenges the classical CAP theorem’s tradeoff by introducing partial progress: connected components with only $f+1$ reachable replicas continue ordering transactions (via PoA certificates) without violating global safety, even if global commitment is stalled.

Technical Contributions

Two-Tier Certification

Cassandra introduces a two-tier certificate architecture:

• Proof of Availability (PoA): Requires $f+1$ votes, certifies that proposal data is retrievable and reflects local ordering progress, but does not justify commit.
• Proof of Reliability (PoR): Requires $2f+1$ votes, used for commit and enforcing consistency.

During partitions, components unable to assemble a strong quorum can still generate PoA certificates, preserving partial ordering and enabling speculative execution of PoA-backed proposals.

Partitionable Leaderless Operation and Deterministic Proposal Priority

Unlike leader-dependent BFTs, Cassandra allows all replicas to propose, deterministically electing the strongest proposal (highest PoR, then PoA, then common coin). This leaderless design eliminates recovery storms during partitions and provides implicit convergence upon network restoration.

Decoupled Pacemaker for Round Synchronization

Cassandra’s decoupled pacemaker separates consensus-critical round advancement (driven by certificates rather than synchronized timeouts) from background timeout calibration. Logical rounds can advance with only weak quorums, and local replica timeouts adapt independently, avoiding critical-path stalls when strong quorums are unavailable.

Implicit Reconciliation and Chain Merge

When partitions heal, Cassandra’s deterministic selection ensures correct replicas all converge on the globally strongest branch, reestablishing PoR-based commitment. Divergent PoA branches are resolved without explicit merge logic.

Detailed Protocol Operation

Cassandra's rounds progress via:

1. Proposal Exchange: All replicas broadcast proposals containing latest known PoR, PoA, and parent hashes.
2. Election and Certification: Deterministic selection (certificate recency, then tie-breaker coin) is used to vote for the strongest proposal. Votes are aggregated:
   • $2f+1$: PoR certificate → commit
   • $f+1$: PoA certificate → partial progress
3. Round Advancement: If PoR is absent, RC certificates (round advancement via weak quorum) allow continued progression.
4. Locking/Commitment: Two-PoR rule commits proposals once two successive PoR-backed blocks are formed.

Safety, Liveness, and Partial Liveness Guarantees

Safety is maintained via strong quorum intersection and lock monotonicity; no correct replica commits conflicting proposals. Liveness is probabilistically ensured during extended synchronous periods due to timeout calibration and coin-based proposal selection. Partial liveness holds for any component with $f+1$ correct, timeout-sufficient replicas.

Evaluation and Empirical Results

Cassandra is empirically evaluated against Tusk, AutoBahn, PBFT, HotStuff, SpotLess, and RCC across AWS clusters and geo-distributed settings.

(Figure 1)

Figure 1: Evaluation summary across scalability and partition scenarios for Cassandra and baseline protocols.

Key numerical results and claims:

• Throughput: Cassandra sustains $900$K TPS at $16$ replicas, and $n=3f+1$0K TPS at $n=3f+1$1 replicas, with latency ranging from $n=3f+1$2s (16) to $n=3f+1$3s (104).
• Partition resilience: When partitions leave only $n=3f+1$4 reachable nodes, Cassandra maintains speculative throughput up to $n=3f+1$5K TPS via PoA; competing protocols drop to zero.
• Recovery bursts: Upon network reconnection, Cassandra rapidly reconciles accumulated partial progress, achieving fast recovery and minimizing wasted work.
• Byzantine resilience: Cassandra exhibits predictable latency and only marginal throughput drops under leader-delay and tail-forking attacks, outperforming leader-dependent protocols.

Practical Implications

Cassandra’s architectural paradigm provides robust guarantees for geo-distributed replicated systems and blockchains under real-world operational failures, notably network partitions and leader isolation. The dual-path optimization facilitates linear communication in stable conditions (via fast path) and fallback to quadratic base path during failures.

Contradictory claim: Cassandra enables progress when no strong quorum is present—a departure from CAP-imposed constraints and classical BFT protocol architecture.

Theoretical Impact and Future Directions

Cassandra’s two-tier certification and partitionable pacemaker mechanisms challenge the dominant model of quorum-driven consensus, enabling progress under weaker connectivity. The protocol is suitable for integration as the intra-shard consensus algorithm in sharded ledgers, potentially improving the throughput and resilience of permissioned blockchains in adversarial and unstable networks.

Emerging directions in BFT research may incorporate Cassandra’s partition-aware techniques into asynchronous and sharded consensus, rethinking leader selection and round synchronization primitives. Speculative execution on PoA branches further enables incremental state updates and reduces recovery latency.

Conclusion

Cassandra is a formally-validated, empirically-tested BFT protocol that supports partial progress under network partitions, achieved via a two-tier certification framework, deterministic proposal selection, and decoupled pacemaker. The protocol demonstrates competitive performance with state-of-the-art BFTs under stable conditions and uniquely delivers continuous partial throughput and rapid recovery during and after partitions. Its practical and theoretical advances underscore a new approach for resilient consensus in decentralized systems.