Specifying and using a partitionable group communication service

Group communication services are becoming accepted as eective building blocks for the construction of fault-tolerant distributed applications. Many specications for group commu-nication services have been proposed. However, there is still no agreement about what these speci cations should say, especially in cases where the services are partitionable, that is, where communication failures may lead to simultaneous creation of groups with disjoint memberships, such that each group is unaware of the existence of any other group. In this paper, we present a new, succinct specication for a view-oriented partitionable group communication service. The service associates each message with a particular view of the group membership. All send and receive events for a message occur within the associated view. The service provides a total order on the messages within each view, and each processor receives a pre x of this order. Our specication separates safety requirements from performance and fault-tolerance require-ments. The safety requirements are expressed by an abstract, global state machine. To present the performance and fault-tolerance requirements, we include failure-status input actions in th