Carnegie Mellon: The Rare Glitch Project                                                          E. Clarke and D. Kroenig
Problems with Membership Service
Verifying Protocol Properties
lNo data is accepted from a node without consistent
membership information
lMembership service is therefore safety critical
lProblem: Correctly working nodes may loose membership
lOne is maybe better off without Membership Service
Example on next slide

GM would prefer TTP/C without membership service since they need redundancy manangement for higher levels anyway. This redundancy management can be used for all lower levels, too.