APPENDIX B $$ VERIFICATION MODEL OF A LEADER ELECTION ALGORITHM The model below follows the description of the leader election protocol in a unidirectional ring from $[82]$ as it is discussed and formalized in $[63].1$ #define N $5/*$ nr of processes $*/2$ #define I $3/*$ node given the smallest number $*/3$ #define L $10/*$ size of buffer $(>=2*$N$)*/45$ mtype $=\{$one$,$ two, winner$\}$; $/*$ three symbolic msg names $*/6$ chan q$[$N$]=[$L$]$ of $\{$mtype$,$ byte$\}$; $/*$ asynchronous channel $*/78$ byte nr$\_$leaders $=0$; $/*$ count the number of process that $9$ think they are leader of the ring $*/10$ proctype node $($chan in$,$ out; byte mynumber$)/*$ process template $*/11\{$ bit Active $=1,$ know$\_$winner $=0$; $12$ byte nr$,$ maximum $=$ mynumber, neighbourR; $1314$ IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, VOL. $23,$ NO$.5,$ MAY $1997$ J:$\backslash$PRODUCTION$\backslash$TSE$\backslash 2-$INPROD$\backslash$MAY$\backslash 104928\mathrm{.}0\backslash 104928\_1.$DOC regularpaper$97.$dot S $19,96805/29/974$:$13$ PM $14/14$ xr in; $/*$ claim exclusive recv access to channel in $*/15$ xs out; $/*$ claim exclusive send access to channel out $*/1617$ printf$($MSC: percentd

$,$ mynumber$)$; $18$ out!one$($mynumber$)$; $/*$ send msg of type one, with par mynumber $*/19$ end: do $20$ :: in$?$one$($nr$)->/*$ receive msg of type one, with par nr $*/21$ if $22$ :: Active $->23$ if $24$ :: nr $!=$ maximum $->25$ out!two$($nr$)$; $26$ neighbourR $=$ nr $27$ :: else $->28/*$ max is greatest number $*/29$ assert$($nr $==$ N$)$; $30$ know$\_$winner $=1$; $31$ out!winner,nr; $32$ fi $33$ :: else $->34$ out!one$($nr$)35$ fi $3637$ :: in$?$two$($nr$)->38$ if $39$ :: Active $->40$ if $41$ :: neighbourR $>$ nr && neighbourR $>$ maximum $->42$ maximum $=$ neighbourR; $43$ out!one$($neighbourR$)44$ :: else $->45$ Active $=046$ fi $47$ :: else $->48$ out!two$($nr$)49$ fi $50$ :: in$?$winner,nr $->51$ if $52$ :: nr $!=$ mynumber $->53$ printf$($MSC: LOST

$)$; $54$ :: else $->55$ printf$($MSC: LEADER

$)$; $56$ nr$\_$leaders$++$; $57$ assert$($nrleaders $==1)58$ fi; $59$ if $60$ :: know$\_$winner $61$ :: else $->$ out!winner,nr $62$ fi; $63$ break $64$ od $65\}6667$ init $\{/*$ the initial process $*/68$ byte proc; $69$ atomic $\{/*$ atomically activate N copies of proc template node $*/70$ proc $=1$; $71$ do $72$ :: proc $<=$ N $->73$ run node $($q$[$proc$-1],$ q$[$procpercentN$],($N$+$I$-$proc$)$percentN$+1)$; $74$ proc$++75$ :: proc $>$ N $->76$ break $77$ od $78\}79\}$ in spin model checker with output screenshots