Formal Specification and Verification of a Network Independent Atomic Multicast Protocol

Network S T A T I O N 1 Protocol process 1 User 1 ? 6 ? 6 S T ATI O N2 Protocol process 2 User 2 ? 6 ? 6 ... S T ATI O Nn Protocol process n User n ? 6 ? 6 As already stated before, a set of scenarios is needed for the verification. Each of these scenarios describes a closed system containing the following processes (see the above figure for network configuration): A specific protocol process for each station depending on the scenario. It is obtained by assembling parts of the protocol description used in the particular scenario. In order to reduce the size of the generated state graph, parameters are tuneddown (counters for retry, buffer sizes, . . . ), andonly a singlemulticast group is considered as, according to the protocol and abstract network specifications, two different multicast groups cannot interfere. The messages are reduced to their identification, and the associated counters need not to be able to distinguish more than the maximum number of messages that can exist simultaneously.