Distributed Protocol Synthesis

• Distributed protocol synthesis is the automated derivation, completion, or refinement of protocols from global specifications, partial implementations, and structured communication models.
• It employs diverse methods such as transition completion, symbolic TLA⁺ sketch filling, and invariant synthesis to bridge behavioral design and proof-oriented verification.
• Techniques leverage symmetry reduction, counterexample-guided pruning, and compositional approaches to ensure efficient handling of state-space complexity and reliable distributed performance.

Distributed protocol synthesis is the automated derivation, completion, or proof-oriented refinement of distributed protocols from global specifications, partial implementations, symbolic sketches, or structured communication models. In the literature, the term covers several distinct synthesis tasks: completing missing transitions in finite-state process automata, synthesizing local controllers from global contracts, compiling choreographies into local implementations, filling holes in symbolic TLA$^+$ protocols, synthesizing inductive invariants and cutoff instances needed for parameterized verification, and learning adaptive local protocol policies from simulation feedback (Egolf et al., 2023, Egolf et al., 2024, Cao et al., 23 May 2026). A central unifying feature is that the synthesized artifact must be compatible with distribution: local components observe only partial state, communication is constrained by topology or scheduling, and correctness is formulated over the global behavior induced by their composition.

1. Problem formulations and semantic models

Distributed protocol synthesis is not a single formal problem but a family of related constructions. In completion-based work, the protocol is an incomplete labeled transition system $M_0$, and synthesis adds transitions to obtain a completion $M$ satisfying $\Delta_0 \subseteq \Delta$ together with correctness and structural constraints such as determinism or deadlock-freedom (Egolf et al., 2023). In symbolic TLA$^+$ work, the object is a protocol sketch $\langle Vars, Holes, Init, Next_0\rangle$, where holes stand for missing preconditions or postconditions and are instantiated from grammars so that the completed protocol satisfies temporal properties (Egolf et al., 2024). In proof-oriented work on TLA$^+$, the transition relation is already fixed and the synthesis target is instead an inductive invariant $I$ such that

$$Init \Rightarrow I,\qquad I \land Next \Rightarrow I',\qquad I \Rightarrow Safety,$$

or a cutoff instance $\mathcal C$ whose safety implies safety for all parameterized instances (Cao et al., 23 May 2026, Bhat et al., 2022).

Other formulations use different semantic substrates. Boolean-network synthesis treats each subsystem as $M_0$0, with synthesis producing distributed reactive control protocols $M_0$1 under a global assumption-guarantee contract (Sahin et al., 2016). Choreography-based synthesis starts from a global communication language with constructs for multiparty communication, branching, looping, sequencing, and restricted parallel composition, and compiles it into local automata plus interaction structure (Jaber et al., 2019). Petri-game formulations model the environment itself as distributed, with one system token synthesizing a strategy against multiple environment tokens under causal information flow (Finkbeiner et al., 2017). Dynamic-link synthesis fixes two synchronous processes but allows the communication graph to vary adversarially each round, with realizability depending on the set of allowed link directions (Bérard et al., 2020).

A useful way to organize the field is by the synthesized object.

Formulation	Synthesized object	Representative source
Transition completion	Missing transitions, guards, or updates	(Alur et al., 2014, Alur et al., 2015, Egolf et al., 2023)
Symbolic sketch completion	TLA$M_0$2 expressions filling holes	(Egolf et al., 2024, Egolf et al., 24 Jan 2025)
Proof-oriented synthesis	Inductive invariants, strengthening lemmas, cutoff instances	(Cao et al., 23 May 2026, Bhat et al., 2022)
Contract/choreography synthesis	Local controllers or endpoint automata	(Sahin et al., 2016, Jaber et al., 2019)
Learned protocol adaptation	Decentralized MAC control logic over protocol blocks	(Keshtiarast et al., 2024)

This plurality of formulations explains an important terminological point. Some papers synthesize entire local protocols, some synthesize missing expressions in a mostly fixed protocol, and some synthesize proof artifacts rather than protocol behavior. The literature is explicit that these should not be conflated, especially in the TLA$M_0$3 setting where invariant synthesis is often the practical bottleneck rather than generation of $M_0$4 or $M_0$5 themselves (Cao et al., 23 May 2026).

2. Completion of finite-state protocols and symmetry-aware search

A classical line of work models distributed protocol synthesis as completion of finite-state local machines. In the scenario-based approach, Message Sequence Charts are used to derive incomplete communicating input/output automata whose states are determined by local message histories and optional state labels; synthesis then completes the local transition relations so that the global product satisfies safety, liveness, and deadlock-freedom requirements (Alur et al., 2014). The resulting completion problem is PSPACE-complete in general and NP-complete for the single-process variant against a fixed environment, which shows that choosing missing transitions is already harder than mere verification in small architectures (Alur et al., 2014).

Completion-based synthesis is especially sensitive to redundancy in the search space. Enumeration modulo isomorphisms addresses this by quotienting completions by permutations of designated permutable states $M_0$6. Two completions $M_0$7 and $M_0$8 are equivalent when

$M_0$9

via a bijection on $M$0, and the key semantic lemma is that isomorphic completions have identical trace semantics (Egolf et al., 2023). The main algorithmic move is to replace a generalizer $M$1 by its equivalence closure

$M$2

or, more efficiently, by a permuter-based implementation that applies syntactic state renaming to one generalized formula. Empirically, this removes factorially many redundant candidates and yields speedups of approximately $M$3 to $M$4, with the clearest cases matching the expected $M$5, $M$6, and $M$7-fold reductions for $M$8, $M$9, and $\Delta_0 \subseteq \Delta$0 permutable states (Egolf et al., 2023).

A closely related but more symbolic completion model uses extended state machine sketches with unknown functions in guards and updates. An ESM-S is

$\Delta_0 \subseteq \Delta$1

where $\Delta_0 \subseteq \Delta$2 contains unknown function symbols, and synthesis must instantiate them so that the composed product is deterministic, deadlock-free, safe, live under fairness, and symmetric when required (Alur et al., 2015). Symmetry is not merely a verification optimization: the synthesized unknowns must satisfy equivariance constraints of the form

$\Delta_0 \subseteq \Delta$3

for permutations over symmetric types (Alur et al., 2015). The synthesis loop alternates between SMT-based candidate generation in Z3 and a custom fairness- and symmetry-aware model checker; counterexamples to deadlock, safety, and liveness are converted into weakest-precondition constraints that eliminate future candidates (Alur et al., 2015).

These completion approaches are best viewed as designer-guided synthesis. They presuppose a fixed local state space, a communication alphabet, and much of the intended control structure. Their contribution is to make the remaining search over missing reactions feasible by exploiting scenarios, symmetry, counterexamples, or search-space quotienting.

3. Symbolic TLA$\Delta_0 \subseteq \Delta$4 synthesis and synthesis of proof artifacts

Recent work has shifted completion into the symbolic TLA$\Delta_0 \subseteq \Delta$5 setting, where protocols are naturally expressed over sets, arrays, quantified actions, and opaque domains. Scythe formulates protocol synthesis by sketching: a sketch $\Delta_0 \subseteq \Delta$6 contains typed holes with grammars, and synthesis enumerates expressions for those holes while verifying finite instances with TLC (Egolf et al., 2024). Its algorithm combines syntax-guided enumeration, counterexample-guided pruning, and equivalence reduction based on normal forms for Boolean and set expressions. The tool is presented as the first synthesis tool for TLA$\Delta_0 \subseteq \Delta$7, and it synthesizes nontrivial symbolic completions including a substantial Raft-based dynamic reconfiguration protocol (Egolf et al., 2024).

PolySemist strengthens this line by introducing interpretation reduction. Instead of quotienting by universal semantic equivalence, it groups expressions by agreement on the concrete interpretations that actually appear in accumulated pruning constraints (Egolf et al., 24 Jan 2025). If $\Delta_0 \subseteq \Delta$8 is the current set of relevant interpretations, then two expressions are treated as equivalent when they evaluate identically on every $\Delta_0 \subseteq \Delta$9. This makes search-space reduction adaptive to the counterexamples seen so far. The method is combined with exact counterexample generalization for safety, deadlock, and liveness, yielding an overview procedure that is sound, complete, and guaranteed to terminate on unrealizable instances under a finite-interpretation-class assumption (Egolf et al., 24 Jan 2025). Empirically, PolySemist is faster than Scythe in $^+$0 of $^+$1 realizable experiments, detects unrealizability in $^+$2 cases versus $^+$3 for Scythe, and synthesizes a complete TLA$^+$4 distributed lock protocol from scratch in $^+$5 seconds where Scythe times out after one hour (Egolf et al., 24 Jan 2025).

A distinct but adjacent task is invariant synthesis for existing symbolic protocols. IC3Syn applies an IC3-style frame construction to TLA$^+$6 states and uses a LLM only for the semantic generalization step that ordinary SAT-based IC3 would handle mechanically in propositional systems (Cao et al., 23 May 2026). The protocol is specified by $^+$7, $^+$8, and $^+$9, and frames evolve as

$\langle Vars, Holes, Init, Next_0\rangle$0

at fixpoint (Cao et al., 23 May 2026). Candidate clauses are syntax-checked, screened against reachable finite states, and admitted only if they satisfy initiation and relative inductiveness. The paper is explicit that this is not synthesis of complete protocols; it is synthesis of strengthening invariants and proof artifacts for a fixed protocol specification. Nonetheless, it is highly relevant to distributed protocol synthesis because invariant generation is often the practical blocker in synthesis, repair, and design-space exploration. IC3Syn solves all 29 evaluated benchmarks, including MongoLoglessDynamicRaft and one hard Paxos variant unsolved by the compared tools, and the discovered invariants are then proved in TLAPS to hold for unbounded instances (Cao et al., 23 May 2026).

Taken together, these TLA$\langle Vars, Holes, Init, Next_0\rangle$1 results mark a shift from explicit-state completion toward symbolic synthesis in a language already used for serious protocol design. They also sharpen the distinction between behavioral synthesis and proof-oriented synthesis: the former fills protocol holes, whereas the latter produces invariants, strengthening lemmas, or unrealizability certificates.

4. Compositional synthesis, decidable fragments, and cutoff construction

Another major strand of distributed protocol synthesis obtains decidability or tractability by exploiting structural restrictions. In Boolean networks arranged as a directed acyclic graph, distributed reactive control protocols can be synthesized compositionally from a global assumption-guarantee contract. Local assumptions are obtained by projection,

$\langle Vars, Holes, Init, Next_0\rangle$2

while guarantees are distributed conservatively and local synthesis is reduced to quantified satisfiability (Sahin et al., 2016). The unrestricted distributed decision problem is NEXPTIME-complete, but the decomposition algorithm is sound for arbitrary DAG Boolean networks and complete when assumptions and guarantees factor conjunctively and the interconnection graph is a forest (Sahin et al., 2016).

CINNABAR targets a different structurally restricted class: distributed agreement-based systems modeled in Mercury using built-in agreement primitives such as broadcast, rendezvous, partition, and consensus (Jaber et al., 2022). The synthesis problem is not full design from scratch, but completion of a Mercury sketch with uninterpreted functions so that the completed model is phase-compatible, cutoff-amenable, and safe for all numbers of processes. The central observation is that Quicksilver’s efficiently decidable parameterized-verification fragment is difficult to satisfy manually, so synthesis can be used to “fit” designs into that fragment. CINNABAR uses a multi-stage counterexample-guided loop whose teacher checks phase-compatibility, cutoff-amenability, and safety; in one reported Distributed Store benchmark, a search space of $\langle Vars, Holes, Init, Next_0\rangle$3 possible completions is reduced to a correct solution in $\langle Vars, Holes, Init, Next_0\rangle$4 minutes and $\langle Vars, Holes, Init, Next_0\rangle$5 iterations (Jaber et al., 2022).

Cutoff synthesis appears even more directly in work on automated cutoff-based verification. There the protocol is modeled in RML as $\langle Vars, Holes, Init, Next_0\rangle$6, and the goal is to synthesize a finite interpretation $\langle Vars, Holes, Init, Next_0\rangle$7 such that safety of $\langle Vars, Holes, Init, Next_0\rangle$8 implies safety of every valid instance (Bhat et al., 2022). The sufficient conditions are expressed via a simulation relation $\langle Vars, Holes, Init, Next_0\rangle$9 from arbitrary larger instances $^+$0 to $^+$1, with obligations $^+$2, $^+$3, and $^+$4. The paper then replaces the existential $^+$5 simulation with a lockstep witness $^+$6, and proposes a static-analysis procedure that starts from a negated universal safety property, extracts the relevant clauses witnessing a violation, traces those clauses backwards through action guards and updates, and synthesizes the cutoff size, simulation relation, and lockstep proof object (Bhat et al., 2022). This is not protocol synthesis in the behavioral sense, but it is synthesis of a parameterized verification certificate.

This family of work shows that the boundary between synthesis and verification is porous. In distributed protocols, synthesizing the implementation, synthesizing a proof-friendly abstraction, and synthesizing a finite representative instance are often algorithmically adjacent tasks.

5. Communication structure, information flow, and implementation extraction

Distributed protocol synthesis is also shaped by how communication and knowledge are modeled. In Petri-game formulations, the system is a single token interacting with multiple environment tokens, each carrying its own causal knowledge. Strategies are branching processes satisfying justified refusal, safety, determinism, and deadlock avoidance (Finkbeiner et al., 2017). The resulting complexity picture is sharp: bounded Petri games with one system player are decidable in polynomial time for up to two environment tokens, NP-complete for any fixed number of three or more environment tokens, and EXPTIME-complete when the number of environment tokens grows with the size of the net (Finkbeiner et al., 2017). This captures an overview problem where the environment, rather than the system, is distributed.

In the presence of dynamic communication links, the two-process synthesis problem changes again. Each round, the adversary chooses one graph from

$^+$7

messages are unbounded in size, and processes know which messages were delivered (Bérard et al., 2020). The paper proves a complete decidability criterion: $^+$8 Thus the crucial boundary is whether the environment may choose the empty link that blocks both directions forever (Bérard et al., 2020). The technical interpretation is that successful links transfer entire causal histories, so the setting naturally models full-information protocols.

At a more implementation-oriented level, synthesis from global communication specifications remains an important theme. Master-triggered choreographies can be compiled into controller-free distributed implementations by generating one local automaton per participant, fresh communication ports for each choreography occurrence, and synchronization interactions that encode branch selection, looping, and sequencing (Jaber et al., 2019). The result is then translated to Promela for model checking of behavioral properties. Timed UML service specifications admit a related compilation to protocol entities by assigning time intervals $^+$9 to service transitions and subtracting channel delay bounds when synchronization messages are introduced, thereby preserving service-level timing constraints in the synthesized protocol (Dallal, 2014). For V2V communication, a protocol specification language over global send/ack/nack events is compiled into communication service automata with retransmission loops; retransmission bounds $I$0 are chosen by solving an optimization problem that ensures required QoS probabilities under bounded message-drop assumptions (Wiltsche et al., 2012).

These works emphasize that “distributed synthesis” often means explicit extraction of implementable local artifacts from a global communication description. The central challenge is not only logical correctness, but faithful distribution of control, timing, and knowledge.

6. Learning-based synthesis, empirical trends, and recurring limitations

Not all contemporary work is symbolic or deductive. In wireless MAC design, protocol synthesis has been cast as decentralized learning over protocol building blocks. A MADRL framework places one PPO-based agent at each gNB, with local observation

$I$1

and action

$I$2

(Keshtiarast et al., 2024). The resulting protocol is not an explicit symbolic state machine but a decentralized policy over defer time, sensing, backoff, MCOT, MCS, energy-detection threshold, and power. In the reported experiments, the distributed training and distributed execution regime improves mean throughput by at least $I$3 over standard 5G NR-U under medium, high, and mixed-rate traffic (Keshtiarast et al., 2024). This marks a different synthesis regime: protocol behavior is adapted by optimization over simulation trajectories rather than derived by proof.

Across the field, several limitations recur. First, many methods are completion- or sketch-based rather than unconstrained protocol generation. This is explicit in transition-completion, Mercury-sketch, TLA$I$4-sketch, and ESM-S work, all of which assume substantial designer guidance (Alur et al., 2014, Jaber et al., 2022, Egolf et al., 2024, Alur et al., 2015). Second, parameterized correctness is often mediated through finite-instance reasoning plus a separate proof step: Scythe and PolySemist synthesize on fixed instances, while IC3Syn performs finite-instance invariant discovery and then relies on TLAPS to establish unbounded inductiveness (Egolf et al., 2024, Egolf et al., 24 Jan 2025, Cao et al., 23 May 2026). Third, many positive decidability results rely on structural restrictions: weakly ordered synchronous architectures for parameterized temporal logics, DAG or forest interconnection for Boolean-network decomposition, no empty link in dynamic-link synthesis, or master-triggered choreographies with independent parallel branches (Jacobs et al., 2017, Sahin et al., 2016, Bérard et al., 2020, Jaber et al., 2019).

A common misconception is therefore that “distributed protocol synthesis” always means synthesis of a full protocol from a high-level formula. The literature surveyed here shows a more differentiated landscape. Some methods synthesize complete local controllers, some synthesize missing pieces of a given protocol, some synthesize verification artifacts that make protocol verification tractable, and some synthesize adaptive protocol policies without producing an interpretable symbolic implementation. This suggests that the field is best understood as a collection of synthesis techniques organized around where the main bottleneck lies: behavioral design, local implementation extraction, parametric proof search, or verification reduction.