Using I/o Automata for Developing Distributed Systems Using I/o Automata for Developing Distributed Systems 279 Sion of I/o Automata. Other Tool Support for I/o Automata Includes the Spectrum Programming Language and Simulator Gol90]. 13.2 General Design Guidelines

This paper describes a new experimental programming language, IOA, for modeling and implementing distributed systems, plus designs for a set of tools to support IOA programming. The language and tools are based on the I/O automaton model for reactive systems, which has been used extensively for research on distributed algorithms. The language supports structured modeling of distributed systems using shared-action composition and levels of abstraction. The tools are intended to support system design, several kinds of analysis, and generation of eecient runnable code. 13.1 Introduction Distributed systems are required to provide increasingly powerful services, with increasingly strong guarantees of performance, fault-tolerance, and security. At the same time, the networks in which these systems run are growing larger and becoming less predictable. It is no wonder that distributed systems have become very complex. The best approach to managing the increased complexity involves organizing systems in structured ways, viewing them at diierent levels of abstraction and as parallel compositions of interacting components. Such structure makes systems easier to understand, build, maintain, and extend, and can serve as the basis for documentation and analysis. However, in order to be most useful, this structure must rest on a solid mathematical foundation. This is obviously necessary if the structure is to support formal methods of constructing or analyzing systems; however , even without formal methods, a mathematical basis is essential for precise understanding. 277 278 Garland & Lynch One reasonable mathematical basis is the I/O automaton model LT87], which has been used to describe and verify distributed algorithms and to express impossibility results (see, e.g., Lyn96]). Several aspects of this model make it good for such tasks. It is based on set-theoretic mathematics rather than on a particular logic or programming language. I/O automata are nondeterministic, which allows systems to be described in their most general forms. I/O automata have a simple notion of external behavior based on sets of traces of external actions. Moreover, I/O automata can be composed by identifying external actions, in a way that respects external behavior, and pairs of automata can be related using various forms of implementation relations that preserve external behavior. The model supports a rich set of proof methods, including invariant assertion techniques for proving that a property is true in all reachable states, forward and backward simulation methods for proving that one automaton implements another, and compositional methods for reasoning about collections of interacting components. Also, …