(**

Define a measure:
  for instance: 2 for inc_dec
                1 for dec.
                2 for rt=true
  Show that any legal_no_copy transition
  decreases the measure.
  By induction, there is a minimum.
*)


Definition termination_count (m : Message) :=
  match m with
  | copy => 5%Z
  | dec => 1%Z
  | inc_dec s3 => 2%Z
  end.Definition termination_q_count (s1 s2 : Site) (q : queue Message) :=
  reduce Message termination_count q.Definition termination_q_measure (bm : Bag_of_message) :=
  sigma2_table Site LS LS (queue Message) termination_q_count bm.Definition termination_rt_count (b : bool) := if b then 2%Z else 0%Z.Definition termination_rt_measure (t : Site -> bool) :=
  sigma_table Site LS Z (Z_id Site)
    (fun s : Site => termination_rt_count (t s)).Definition termination_measure (c : Config) :=
  (termination_rt_measure (rt c) + termination_q_measure (bm c))%Z.Inductive legal_no_copy2 : Config -> Config -> Prop :=
  | no_copy_init2 : forall c : Config, legal c -> legal_no_copy2 c c
  | after_no_copy2 :
      forall (c c0 : Config) (t : class_trans c),
      ~ copy_p c t ->
      legal_no_copy2 c c0 -> legal_no_copy2 (transition c t) c0.Inductive legal_no_copy2 : Config -> Config -> Prop :=
  | no_copy_init2 : forall c : Config, legal c -> legal_no_copy2 c c
  | after_no_copy2 :
      forall (c c0 : Config) (t : class_trans c),
      ~ copy_p c t ->
      legal_no_copy2 c c0 -> legal_no_copy2 (transition c t) c0.Inductive legal_no_copy2 : Config -> Config -> Prop :=
  | no_copy_init2 : forall c : Config, legal c -> legal_no_copy2 c c
  | after_no_copy2 :
      forall (c c0 : Config) (t : class_trans c),
      ~ copy_p c t ->
      legal_no_copy2 c c0 -> legal_no_copy2 (transition c t) c0.

(* Specifications: *)
Lemma legal_no_copy_transitive2 : forall c0 : Config, legal c0 -> forall c1 c2 : Config, legal_no_copy2 c1 c0 -> legal_no_copy2 c2 c1 -> legal_no_copy2 c2 c0.