On decomposing and refining specifications of distributed systems

Abstract

This paper is concerned with the use of transition systems with fairness constraints for specifying message-passing distributed systems. A distributed system is specified through the sequence of messages that can be sent and received in an execution of the system. We use fair transition systems to specify such sequences in analogy with the way finite automata are used as acceptors of finite strings. Safety properties are specified by the set of transitions of the transition system. Liveness properties are specified by the fairness constraints on the executions of the transition system. We consider two verification problems: (1) obtaining the specification of a composed system from specifications of its components, and (2) verifying that one transition system correctly refines (i.e., implements) another. For the second problem, we present existing techniques that reduce the verification problem to classical verification conditions, using a notation with guarded assignment statements. We examine conditions under which the techniques are complete. One results is a variant of a completeness theorem due to Abadi and Lamport [AL88]. Simple examples are included to illustrate the techniques.