This paper presents a robust and nonblocking group membership protocol for large-scale distributed systems. This protocol uses the causal relation between membership-updating messages (i. e. , those specifying the adding and deleting of members) and allows the messages to be executed in a nonblocking manner. It differs from conventional group membership protocols in the following points: (1) neither global locking nor global synchronization is required; (2) membership-updating messages can be issued without being synchronized with each other, and they can be executed immediately after their arrival. The proposed protocol therefore is highly scalable, and is more tolerant to node and network failures and to network partitions than are the conventional protocols. This paper proves that the proposed protocol works properly as long as messages can eventually be received by their destinations. This paper also discusses some design issues, such as multicast communication of the regular messages, fault tolerance and application to reliable communication protocols (e. g. , TCP/IP).