Design and Verification of a Multichip Coherence Protocol