M. Baptista, L. Rodrigues, P. Veríssimo, S. Graf, J.L. Richier, C. Rodriguez, and J. Voiron.
From "Formal Description Techniques", III, pages 345-352, J. Quemada, J. Mañas, and E. Vazques, editors, 1991, North-Holland.
This paper presents an experience in protocol building area, by involving a close interaction between protocol design and formal verification, and shows off its application in the design of a real distributed system: a network independent atomic multicast protocol.
Also available extended report (gzip postscript), (pdf) .