Introduction The increasing importance, criticality, and complexity of communications software makes very desirable the application of formal methods to gain high assurance about its correctness. These needs are even greater in the context of active networks, because the diculties involved in ensuring critical properties such as security and safety for dynamically adaptive software are substantially higher than for more static software approaches. There are in fact many obstacles to the insertion of formal methods in this area, and yet there is a real need to nd adequate ways to increase the quality and reliability of critical communication systems. As a consequence, in spite of the existence of good research contributions in formal approaches to areas such as distributed algorithms and cryptographic protocols, in practice new systems are developed for the most part in a traditional engineering way, using informal techniques, and without much to go by before detailed simulatio