Validation of Remote Object Invocation and Object Migration in CORBA GIOP using Promela/Spin

The General Inter-Orb Protocol (GIOP) is a key component of the OMG's Common Object Request Broker Architecture (CORBA) speci cation. GIOP speci es a standard protocol that enables interoperability between ORBs from di erent vendors. This paper presents the formal modeling and validation of the GIOP protocol using the Promela/Spin package. We discuss a Promela model of a GIOP system which includes remote object invocation and server object migration. We elicit high-level properties based on the informal GIOP speci cation and verify whether these hold of the GIOP model using the Spin model checker. The high-level requirements that we have elicited were con rmed during the validation. However, in the course of the validation two potential problems related to CancelRequest messages and server migration were discovered, and one known deadlock situation of the underlying transport protocol was con rmed. On leave from the University of Waterloo, Department of Electrical and Computer Engineering, Waterloo, Ontario N2L 3G1, Canada