Assignment # 1

Formal Methods In
Software Engineering
CASE STUDY:

MilliCent from Compaq/Digital

Digital Equipment Corporation, which is nowadays a part of Compaq Computer Corporation, has
presented their proposal as a micropayment system, MilliCent that is perhaps the smallest and
simplest implementation of the contemporary systems. The system has been in beta tests and it is
very well documented and thus rather interesting. The mechanism is basically a very simple
protocol for two participants which is extended in the realm of systems to cover a multitude of
payment situations. It is, however, designed for the handling of a series of inexpensive and
casual transactions

Instead of using traditional money for purchases, the MilliCent implementation is based on a
new kind of currency that is called scrip. Scrip is an electronic manufacturer coupon that has a
pre-paid value, just like the conventional cash does. It has an intrinsic value, but it is valid only
with a specific vendor. In other words, it can be spent only in the context to which it was
originally meant. The Figure 3 presents the basic idea of the protocol. More detailed information
is available on the home page of the MilliCent system

Figure: High-Level MilliCent System Model

In the MilliCent system, scrip is issued by brokers that act as simplifying intermediaries between
customers and content vendors. The brokers represent a sort of agents that produce scrip on
behalf of many vendors. Unused scrip associated with one vendor can definitely be exchanged,
via a broker, for scrip of another vendor. When a customer wants to buy MilliCent scrip, just a
simple click of mouse button is required to start the purchase transaction. The whole process
operates automatically in the background.

The brokers can make a profit if they buy scrip in bulk from vendors at a discount price and then
correspondingly reselling these to customers at a retail price. Of course, the customers can also
buy scrip directly from the vendors. The use of the brokers, however, eliminates the need for
customers to set up accounts with multiple content vendors.
The flow of Money

From the viewpoint of electronic commerce the MilliCent protocol will not alone be sufficient
because there is no direct way to transform ordinary money into scrip and vice versa.

Building up a relationship in the MilliCent system can be described for instance like this:

1. The customer requests broker scrip.

2. The broker sells the scrip to the customer.
3. The broker requests scrip from a vendor.
4. The vendor sells the scrip to the broker.

One purchase scenario in MilliCent could go like this:

1. The customer sends a request to the broker for specific vendor scrip along with the broker scrip bought
previously.
2. The broker sends the vendor scrip back along with the possible change in the form of new broker scrip.
3. The customer sends the scrip to the vendor.
4. The vendor accepts the scrip, delivers the service and sends back the possible change in the form of new
vendor scrip.
5. The customer sends the possible vendor scrip to the broker.
6. The broker changes it back to broker scrip and sends it back to the customer.
 Transition system: [MilliCent System Model]

Local:

Broker: money, scrip

Seller: license, goods

Customer: money, scrip

In

[Broker]

Money /\ Scrip  Seller = License /\ Customer = Money

[Seller]

License /\ Goods  Customer = Scrip /\ Broker = Money

[Customer]

Money /\ Scrip  Broker = Scrip /\ Seller = Goods

End
 Formal Specification

States:

States: types = [# % RECORD

Broker,
Seller,
Customer #] % END

Events:

Events: types = [Money, Goods, Scrip, License]

Next States:

Sn = nextstate(Sc, ev)
Seller = (Broker, Money), Broker = (Seller, License)
Customer = (Seller, Goods), Seller = (Customer, Scrip)
Broker = (Customer, Scrip), Customer = (Broker, Scrip)

With Statement:

St With (Seller: = goods, Seller: = licenses, Customer: = money, Customer: = scrip, Broker: =
money, Broker: = scrip)

Broker: States =

IF broker  Money Then

St With [Seller: = goods, Customer: = money]
Else broker  Scrip
St With [Seller: = license, Customer: = scrip]

Seller: States =

IF seller  Goods Then

St With [customer: = Money, Broker: = Money]
Else Seller  License
St With [broker: = Scrip, Customer: = Scrip]

Customer: States =

IF Customer Money Then

St With [broker: = money, Seller: = goods]
Else Customer  Scrip
St With [Seller: = License, broker: = Scrip]