Guaranteeing Convergence of Distributed Systems : From Specification to Implementation via Refinement