---
title: Distributed Protocol Synthesis
url: https://www.emergentmind.com/topics/distributed-protocol-synthesis
type: topic
---

# Distributed Protocol Synthesis

Distributed protocol synthesis is the automated derivation, completion, or proof-oriented refinement of distributed protocols from global specifications, partial implementations, symbolic sketches, or structured communication models. In the literature, the term covers several distinct synthesis tasks: completing missing transitions in finite-state process automata, synthesizing local controllers from global contracts, compiling choreographies into local implementations, filling holes in symbolic TLA\(^+\) protocols, synthesizing inductive invariants and cutoff instances needed for parameterized verification, and learning adaptive local protocol policies from simulation feedback [2306.02967][2405.07807][2605.24619]. A central unifying feature is that the synthesized artifact must be compatible with distribution: local components observe only partial state, communication is constrained by topology or scheduling, and correctness is formulated over the global behavior induced by their composition.

## 1. Problem formulations and semantic models

Distributed protocol synthesis is not a single formal problem but a family of related constructions. In completion-based work, the protocol is an incomplete labeled transition system \(M_0\), and synthesis adds transitions to obtain a completion \(M\) satisfying \(\Delta_0 \subseteq \Delta\) together with correctness and structural constraints such as determinism or deadlock-freedom [2306.02967]. In symbolic TLA\(^+\) work, the object is a protocol sketch \(\langle Vars, Holes, Init, Next_0\rangle\), where holes stand for missing preconditions or postconditions and are instantiated from grammars so that the completed protocol satisfies temporal properties [2405.07807]. In proof-oriented work on TLA\(^+\), the transition relation is already fixed and the synthesis target is instead an inductive invariant \(I\) such that
\[
Init \Rightarrow I,\qquad I \land Next \Rightarrow I',\qquad I \Rightarrow Safety,
\]
or a cutoff instance \(\mathcal C\) whose safety implies safety for all parameterized instances [2605.24619][2211.15175].

Other formulations use different semantic substrates. Boolean-network synthesis treats each subsystem as \(S=\langle U,E,Y,f\rangle\), with synthesis producing distributed reactive control protocols \(\pi_i:V_{e_i}\to V_{u_i}\) under a global assumption-guarantee contract [1607.03479]. Choreography-based synthesis starts from a global communication language with constructs for multiparty communication, branching, looping, sequencing, and restricted parallel composition, and compiles it into local automata plus interaction structure [1905.13529]. Petri-game formulations model the environment itself as distributed, with one system token synthesizing a strategy against multiple environment tokens under causal information flow [1710.05368]. Dynamic-link synthesis fixes two synchronous processes but allows the communication graph to vary adversarially each round, with realizability depending on the set of allowed link directions [2002.07545].

A useful way to organize the field is by the synthesized object.

| Formulation | Synthesized object | Representative source |
|---|---|---|
| Transition completion | Missing transitions, guards, or updates | [1402.7150], [1505.04409], [2306.02967] |
| Symbolic sketch completion | TLA\(^+\) expressions filling holes | [2405.07807], [2501.14585] |
| Proof-oriented synthesis | Inductive invariants, strengthening lemmas, cutoff instances | [2605.24619], [2211.15175] |
| Contract/choreography synthesis | Local controllers or endpoint automata | [1607.03479], [1905.13529] |
| Learned protocol adaptation | Decentralized MAC control logic over protocol blocks | [2408.05884] |

This plurality of formulations explains an important terminological point. Some papers synthesize entire local protocols, some synthesize missing expressions in a mostly fixed protocol, and some synthesize proof artifacts rather than protocol behavior. The literature is explicit that these should not be conflated, especially in the TLA\(^+\) setting where invariant synthesis is often the practical bottleneck rather than generation of \(Init\) or \(Next\) themselves [2605.24619].

## 2. Completion of finite-state protocols and symmetry-aware search

A classical line of work models distributed protocol synthesis as completion of finite-state local machines. In the scenario-based approach, Message Sequence Charts are used to derive incomplete communicating input/output automata whose states are determined by local message histories and optional state labels; synthesis then completes the local transition relations so that the global product satisfies safety, liveness, and deadlock-freedom requirements [1402.7150]. The resulting completion problem is PSPACE-complete in general and NP-complete for the single-process variant against a fixed environment, which shows that choosing missing transitions is already harder than mere verification in small architectures [1402.7150].

Completion-based synthesis is especially sensitive to redundancy in the search space. Enumeration modulo isomorphisms addresses this by quotienting completions by permutations of designated permutable states \(A\). Two completions \(M_1\) and \(M_2\) are equivalent when
\[
M_1 \overset{A}{\simeq} M_2
\]
via a bijection on \(A\), and the key semantic lemma is that isomorphic completions have identical trace semantics [2306.02967]. The main algorithmic move is to replace a generalizer \(\gamma\) by its equivalence closure
\[
\overset{\simeq}{\gamma}(\rho) := \bigvee_{\sigma \in [\rho]} \gamma(\sigma),
\]
or, more efficiently, by a permuter-based implementation that applies syntactic state renaming to one generalized formula. Empirically, this removes factorially many redundant candidates and yields speedups of approximately \(2\times\) to \(10\times\), with the clearest cases matching the expected \(2\), \(6\), and \(24\)-fold reductions for \(2\), \(3\), and \(4\) permutable states [2306.02967].

A closely related but more symbolic completion model uses extended state machine sketches with unknown functions in guards and updates. An ESM-S is
\[
A = \langle L, l_0, I, O, S, \sigma_0, U, T, \mathcal{F}_s, \mathcal{F}_w \rangle,
\]
where \(U\) contains unknown function symbols, and synthesis must instantiate them so that the composed product is deterministic, deadlock-free, safe, live under fairness, and symmetric when required [1505.04409]. Symmetry is not merely a verification optimization: the synthesized unknowns must satisfy equivariance constraints of the form
\[
\forall d \in \mathsf{dom}(f),\ \pi(f(d)) = f(\pi(d))
\]
for permutations over symmetric types [1505.04409]. The synthesis loop alternates between SMT-based candidate generation in Z3 and a custom fairness- and symmetry-aware model checker; counterexamples to deadlock, safety, and liveness are converted into weakest-precondition constraints that eliminate future candidates [1505.04409].

These completion approaches are best viewed as designer-guided synthesis. They presuppose a fixed local state space, a communication alphabet, and much of the intended control structure. Their contribution is to make the remaining search over missing reactions feasible by exploiting scenarios, symmetry, counterexamples, or search-space quotienting.

## 3. Symbolic TLA\(^+\) synthesis and synthesis of proof artifacts

Recent work has shifted completion into the symbolic TLA\(^+\) setting, where protocols are naturally expressed over sets, arrays, quantified actions, and opaque domains. Scythe formulates protocol synthesis by sketching: a sketch \(\langle Params, Vars, Holes, Init, Next_0\rangle\) contains typed holes with grammars, and synthesis enumerates expressions for those holes while verifying finite instances with TLC [2405.07807]. Its algorithm combines syntax-guided enumeration, counterexample-guided pruning, and equivalence reduction based on normal forms for Boolean and set expressions. The tool is presented as the first synthesis tool for TLA\(^+\), and it synthesizes nontrivial symbolic completions including a substantial Raft-based dynamic reconfiguration protocol [2405.07807].

PolySemist strengthens this line by introducing interpretation reduction. Instead of quotienting by universal semantic equivalence, it groups expressions by agreement on the concrete interpretations that actually appear in accumulated pruning constraints [2501.14585]. If \(\mathcal A\) is the current set of relevant interpretations, then two expressions are treated as equivalent when they evaluate identically on every \(\alpha \in \mathcal A\). This makes search-space reduction adaptive to the counterexamples seen so far. The method is combined with exact counterexample generalization for safety, deadlock, and liveness, yielding a synthesis procedure that is sound, complete, and guaranteed to terminate on unrealizable instances under a finite-interpretation-class assumption [2501.14585]. Empirically, PolySemist is faster than Scythe in \(160\) of \(171\) realizable experiments, detects unrealizability in \(80/123\) cases versus \(16/123\) for Scythe, and synthesizes a complete TLA\(^+\) distributed lock protocol from scratch in \(125\) seconds where Scythe times out after one hour [2501.14585].

A distinct but adjacent task is invariant synthesis for existing symbolic protocols. IC3Syn applies an IC3-style frame construction to TLA\(^+\) states and uses a Large Language Model only for the semantic generalization step that ordinary SAT-based IC3 would handle mechanically in propositional systems [2605.24619]. The protocol is specified by \(Init\), \(Next\), and \(Safety\), and frames evolve as
\[
F_0 \subseteq F_1 \subseteq \cdots,\qquad F_j = F_{j+1}
\]
at fixpoint [2605.24619]. Candidate clauses are syntax-checked, screened against reachable finite states, and admitted only if they satisfy initiation and relative inductiveness. The paper is explicit that this is not synthesis of complete protocols; it is synthesis of strengthening invariants and proof artifacts for a fixed protocol specification. Nonetheless, it is highly relevant to distributed protocol synthesis because invariant generation is often the practical blocker in synthesis, repair, and design-space exploration. IC3Syn solves all 29 evaluated benchmarks, including MongoLoglessDynamicRaft and one hard Paxos variant unsolved by the compared tools, and the discovered invariants are then proved in TLAPS to hold for unbounded instances [2605.24619].

Taken together, these TLA\(^+\) results mark a shift from explicit-state completion toward symbolic synthesis in a language already used for serious protocol design. They also sharpen the distinction between behavioral synthesis and proof-oriented synthesis: the former fills protocol holes, whereas the latter produces invariants, strengthening lemmas, or unrealizability certificates.

## 4. Compositional synthesis, decidable fragments, and cutoff construction

Another major strand of distributed protocol synthesis obtains decidability or tractability by exploiting structural restrictions. In Boolean networks arranged as a directed acyclic graph, distributed reactive control protocols can be synthesized compositionally from a global assumption-guarantee contract. Local assumptions are obtained by projection,
\[
A^{\downarrow(i)} \doteq A|_{E_i^{ext}},
\]
while guarantees are distributed conservatively and local synthesis is reduced to quantified satisfiability [1607.03479]. The unrestricted distributed decision problem is NEXPTIME-complete, but the decomposition algorithm is sound for arbitrary DAG Boolean networks and complete when assumptions and guarantees factor conjunctively and the interconnection graph is a forest [1607.03479].

CINNABAR targets a different structurally restricted class: distributed agreement-based systems modeled in Mercury using built-in agreement primitives such as broadcast, rendezvous, partition, and consensus [2208.12400]. The synthesis problem is not full design from scratch, but completion of a Mercury sketch with uninterpreted functions so that the completed model is phase-compatible, cutoff-amenable, and safe for all numbers of processes. The central observation is that Quicksilver’s efficiently decidable parameterized-verification fragment is difficult to satisfy manually, so synthesis can be used to “fit” designs into that fragment. CINNABAR uses a multi-stage counterexample-guided loop whose teacher checks phase-compatibility, cutoff-amenability, and safety; in one reported Distributed Store benchmark, a search space of \(163{,}840{,}000\) possible completions is reduced to a correct solution in \(2.2\) minutes and \(203\) iterations [2208.12400].

Cutoff synthesis appears even more directly in work on automated cutoff-based verification. There the protocol is modeled in RML as \(P = \langle D, R, F, \Psi, A, \Phi \rangle\), and the goal is to synthesize a finite interpretation \(\mathcal C\) such that safety of \(\mathcal A_\mathcal{C}^P\) implies safety of every valid instance [2211.15175]. The sufficient conditions are expressed via a simulation relation \(\gamma_\mathcal L\) from arbitrary larger instances \(\mathcal L\) to \(\mathcal C\), with obligations \(\varphi_{init}\), \(\varphi_{step}\), and \(\varphi_{safety}\). The paper then replaces the existential \(\delta_\mathcal C^\ast\) simulation with a lockstep witness \(\tau_\mathcal L\), and proposes a static-analysis procedure that starts from a negated universal safety property, extracts the relevant clauses witnessing a violation, traces those clauses backwards through action guards and updates, and synthesizes the cutoff size, simulation relation, and lockstep proof object [2211.15175]. This is not protocol synthesis in the behavioral sense, but it is synthesis of a parameterized verification certificate.

This family of work shows that the boundary between synthesis and verification is porous. In distributed protocols, synthesizing the implementation, synthesizing a proof-friendly abstraction, and synthesizing a finite representative instance are often algorithmically adjacent tasks.

## 5. Communication structure, information flow, and implementation extraction

Distributed protocol synthesis is also shaped by how communication and knowledge are modeled. In Petri-game formulations, the system is a single token interacting with multiple environment tokens, each carrying its own causal knowledge. Strategies are branching processes satisfying justified refusal, safety, determinism, and deadlock avoidance [1710.05368]. The resulting complexity picture is sharp: bounded Petri games with one system player are decidable in polynomial time for up to two environment tokens, NP-complete for any fixed number of three or more environment tokens, and EXPTIME-complete when the number of environment tokens grows with the size of the net [1710.05368]. This captures a synthesis problem where the environment, rather than the system, is distributed.

In the presence of dynamic communication links, the two-process synthesis problem changes again. Each round, the adversary chooses one graph from
\[
\{\emptynet,\leftnet,\rightnet,\leftrightnet\},
\]
messages are unbounded in size, and processes know which messages were delivered [2002.07545]. The paper proves a complete decidability criterion:
\[
\Synthesis{\Nmodel}\ \text{is decidable iff}\ \emptynet \notin \Nmodel.
\]
Thus the crucial boundary is whether the environment may choose the empty link that blocks both directions forever [2002.07545]. The technical interpretation is that successful links transfer entire causal histories, so the setting naturally models full-information protocols.

At a more implementation-oriented level, synthesis from global communication specifications remains an important theme. Master-triggered choreographies can be compiled into controller-free distributed implementations by generating one local automaton per participant, fresh communication ports for each choreography occurrence, and synchronization interactions that encode branch selection, looping, and sequencing [1905.13529]. The result is then translated to Promela for model checking of behavioral properties. Timed UML service specifications admit a related compilation to protocol entities by assigning time intervals \([\min_t,\max_t]\) to service transitions and subtracting channel delay bounds when synchronization messages are introduced, thereby preserving service-level timing constraints in the synthesized protocol [1409.3160]. For V2V communication, a protocol specification language over global send/ack/nack events is compiled into communication service automata with retransmission loops; retransmission bounds \(n_e\) are chosen by solving an optimization problem that ensures required QoS probabilities under bounded message-drop assumptions [1210.2035].

These works emphasize that “distributed synthesis” often means explicit extraction of implementable local artifacts from a global communication description. The central challenge is not only logical correctness, but faithful distribution of control, timing, and knowledge.

## 6. Learning-based synthesis, empirical trends, and recurring limitations

Not all contemporary work is symbolic or deductive. In wireless MAC design, protocol synthesis has been cast as decentralized learning over protocol building blocks. A MADRL framework places one PPO-based agent at each gNB, with local observation
\[
\mathcal{O}_x = \langle CurrentAction_x,\, NN_x,\, RSSI_C,\, RSSI_I,\, Throughput_x,\, TR_x,\, Delay_x,\, Airtime_x \rangle
\]
and action
\[
\mathcal{A}_x = \langle MCOT_x,\, T_x,\, MCS_x,\, ED_{Th,x},\, T_{df},\, Backoff\_type_x,\, CW_{min,x},\, SensingSlotDuration_x \rangle
\]
[2408.05884]. The resulting protocol is not an explicit symbolic state machine but a decentralized policy over defer time, sensing, backoff, MCOT, MCS, energy-detection threshold, and power. In the reported experiments, the distributed training and distributed execution regime improves mean throughput by at least \(10\%\) over standard 5G NR-U under medium, high, and mixed-rate traffic [2408.05884]. This marks a different synthesis regime: protocol behavior is adapted by optimization over simulation trajectories rather than derived by proof.

Across the field, several limitations recur. First, many methods are completion- or sketch-based rather than unconstrained protocol generation. This is explicit in transition-completion, Mercury-sketch, TLA\(^+\)-sketch, and ESM-S work, all of which assume substantial designer guidance [1402.7150][2208.12400][2405.07807][1505.04409]. Second, parameterized correctness is often mediated through finite-instance reasoning plus a separate proof step: Scythe and PolySemist synthesize on fixed instances, while IC3Syn performs finite-instance invariant discovery and then relies on TLAPS to establish unbounded inductiveness [2405.07807][2501.14585][2605.24619]. Third, many positive decidability results rely on structural restrictions: weakly ordered synchronous architectures for parameterized temporal logics, DAG or forest interconnection for Boolean-network decomposition, no empty link in dynamic-link synthesis, or master-triggered choreographies with independent parallel branches [1705.08112][1607.03479][2002.07545][1905.13529].

A common misconception is therefore that “distributed protocol synthesis” always means synthesis of a full protocol from a high-level formula. The literature surveyed here shows a more differentiated landscape. Some methods synthesize complete local controllers, some synthesize missing pieces of a given protocol, some synthesize verification artifacts that make protocol verification tractable, and some synthesize adaptive protocol policies without producing an interpretable symbolic implementation. This suggests that the field is best understood as a collection of synthesis techniques organized around where the main bottleneck lies: behavioral design, local implementation extraction, parametric proof search, or verification reduction.

Source: https://www.emergentmind.com/topics/distributed-protocol-synthesis