Modular reasoning about open systems: a case study of distributed commit

Abstract

We show how to reason about distributed database management systems, in which a commit protocol is used to coordinate activity of several resource managers. This is an interesting case study of an open system, in which each component is developed independently to operate with many possible environments. We give specifications for each resource manager, and a specification for the commit protocol, and show that the whole system is correct as long as each component has the properties required of it. We then show how to prove that specific examples have these properties.<>