Modeling and verifying clustering properties in a vehicular ad hoc network protocol with Event-B