(* Specifications: *)
Lemma legal_alternate : forall (s : Site) (c : Config), legal c -> alternate (bm c s owner) /\ (rt c s = false -> D_queue (bm c s owner)).
Lemma count_alt_queue : forall q : queue Message, alternate q -> (reduce Message dec_count q + 1 >= reduce Message new_inc_count q)%Z /\ (D_queue q -> (reduce Message dec_count q >= reduce Message new_inc_count q)%Z).
Lemma count_inc_and_dec_alt_queue : forall q : queue Message, alternate q -> (reduce Message dec_count q + 1 >= reduce Message new_inc_count q)%Z.
Lemma count_inc_and_dec_D_queue : forall q : queue Message, D_queue q -> (reduce Message dec_count q >= reduce Message new_inc_count q)%Z.
Lemma copy_count_is_positive : forall q : queue Message, (reduce Message copy_count q >= 0)%Z.
Lemma dec_count_is_positive : forall q : queue Message, (reduce Message dec_count q >= 0)%Z.
Lemma invariant5 : forall c : Config, legal c -> forall s : Site, (Int (rt c s) + reduce Message dec_count (bm c s owner) + reduce Message copy_count (bm c owner s) - reduce Message new_inc_count (bm c s owner) >= 0)%Z.
Lemma other_definition_for_sigma_receive_table : forall t : Recv_T, sigma_receive_table t = sigma_table Site LS Z (Z_id Site) (fun s : Site => Int (t s)).
Lemma direct_son_is_positive : forall c : Config, legal c -> forall s : Site, direct_son c s -> (Int (rt c s) + reduce Message dec_count (bm c s owner) + reduce Message copy_count (bm c owner s) - reduce Message new_inc_count (bm c s owner) > 0)%Z.
Lemma sigma_rooted_fun2 : forall (s s1 s2 : Site) (d : Message), s2 <> owner -> s1 <> s -> s2 <> s -> rooted_fun s s1 s2 d = 0%Z.
Lemma sigma_rooted_fun3 : forall s1 : Site, sigma_but Site owner eq_site_dec LS (fun s : Site => rooted_fun s s1 owner dec) = 0%Z.
Lemma sigma_rooted_fun4 : forall (s s1 : Site) (l : list Site), ~ In s l -> sigma_but Site owner eq_site_dec l (fun s0 : Site => rooted_fun s0 s1 owner (inc_dec s)) = 0%Z.
Lemma sigma_rooted_fun6 : forall (s s1 : Site) (l : list Site), ~ In s l -> sigma_but Site owner eq_site_dec l (fun s0 : Site => rooted_fun s0 s owner copy) = 0%Z.
Lemma sigma_rooted_fun7 : forall (s : Site) (l : list Site), only_once Site eq_site_dec s l -> s <> owner -> sigma_but Site owner eq_site_dec l (fun s0 : Site => rooted_fun s0 s owner copy) = 1%Z.
Lemma sigma_rooted_fun8 : forall (s2 : Site) (l : list Site), ~ In s2 l -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s owner s2 dec) = 0%Z.
Lemma sigma_rooted_fun9 : forall (s2 : Site) (l : list Site), only_once Site eq_site_dec s2 l -> s2 <> owner -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s owner s2 dec) = 1%Z.
Lemma sigma_rooted_fun10 : forall s2 : Site, sigma_but Site owner eq_site_dec LS (fun s : Site => rooted_fun s owner s2 copy) = 0%Z.
Lemma sigma_rooted_fun11 : forall (s1 s2 : Site) (l : list Site), s2 <> owner -> s1 <> owner -> ~ In s2 l -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s s1 s2 dec) = 0%Z.
Lemma sigma_rooted_fun12 : forall s1 s2 : Site, s2 <> owner -> s1 <> owner -> only_once Site eq_site_dec s2 LS -> sigma_but Site owner eq_site_dec LS (fun s : Site => rooted_fun s s1 s2 dec) = 1%Z.
Lemma sigma_rooted_fun13 : forall (s1 s2 : Site) (l : list Site), s2 <> owner -> s1 <> owner -> ~ In s1 l -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s s1 s2 copy) = 0%Z.
Lemma sigma_rooted_fun14 : forall (s1 s2 : Site) (l : list Site), s2 <> owner -> s1 <> owner -> only_once Site eq_site_dec s1 l -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s s1 s2 copy) = 1%Z.
Lemma sigma_rooted_fun5 : forall s s1 : Site, only_once Site eq_site_dec s LS -> s <> owner -> sigma_but Site owner eq_site_dec LS (fun s0 : Site => rooted_fun s0 s1 owner (inc_dec s)) = 1%Z.
Lemma sigma_rooted_fun1 : forall (s s1 s2 : Site) (d : Message), s2 <> owner -> ~ In s1 LS -> ~ In s2 LS -> sigma_but Site owner eq_site_dec LS (fun s : Site => rooted_fun s s1 s2 d) = 0%Z.
Lemma add_reduce4 : forall x y z a : Z, (x + y)%Z = (z + a)%Z -> (x - a)%Z = (z - y)%Z.
Lemma add_reduce5 : forall x y z a : Z, (x - a)%Z = (z - y)%Z -> x = (a + z - y)%Z.
Lemma add_reduce6 : forall x y z : Z, x = (z + y)%Z -> (x - z)%Z = y.
Lemma parent_invariant_inductive_optim1 : forall (c : Config) (t : class_trans c) (s1 s2 : Site) (q : queue Message) (n : s1 <> s2) (e : bm c s1 owner = input Message dec (input Message (inc_dec s2) q)), legal c -> (legal c -> forall s : Site, indirect_son1 c s -> exists s0 : Site, direct_son c s0 /\ ancestor c s0 s) -> legal (transition c (redirect_inc c s1 s2 q n e)) -> forall s : Site, indirect_son1 (transition c (redirect_inc c s1 s2 q n e)) s -> exists s0 : Site, direct_son (transition c (redirect_inc c s1 s2 q n e)) s0 /\ ancestor (transition c (redirect_inc c s1 s2 q n e)) s0 s.
Lemma parent_invariant_inductive : forall (c : Config) (t : class_trans c), legal c -> (legal c -> forall s : Site, indirect_son1 c s -> exists s1 : Site, direct_son c s1 /\ ancestor c s1 s) -> legal (transition c t) -> forall s : Site, indirect_son1 (transition c t) s -> exists s1 : Site, direct_son (transition c t) s1 /\ ancestor (transition c t) s1 s.
Lemma parent_invariant : forall c : Config, legal c -> forall s : Site, indirect_son1 c s -> exists s1 : Site, direct_son c s1 /\ ancestor c s1 s.
Lemma not_s1_s2 : forall s s1 s2 : Site, s1 <> s2 -> s1 <> s \/ s2 <> s.
Lemma not_owner_inc : forall (c : Config) (s1 s2 : Site), legal c -> ~ In_queue Message (inc_dec owner) (bm c s1 s2).
Lemma not_owner_inc2 : forall (c : Config) (s0 s1 s2 : Site), legal c -> In_queue Message (inc_dec s0) (bm c s1 s2) -> s0 <> owner.
Lemma not_owner_inc3 : forall (c : Config) (s1 s2 : Site), legal c -> forall s0 : Site, In_queue Message (inc_dec s0) (bm c s1 s2) -> s0 <> owner.
Lemma not_owner_inc4 : forall (c : Config) (s1 s2 : Site), legal c -> forall (m : Message) (s0 : Site), m = inc_dec s0 -> In_queue Message m (bm c s1 s2) -> s0 <> owner.
Lemma empty_q_to_me : forall c : Config, legal c -> forall s : Site, bm c s s = empty Message.
Lemma not_reflexive : forall c : Config, legal c -> forall s1 s5 : Site, In_queue Message (inc_dec s1) (bm c s5 owner) -> s1 <> s5.
Lemma not_in_queue_post : forall (b : Bag_of_message) (s1 s2 s3 s4 : Site) (m1 m2 : Message), m1 <> m2 -> ~ In_queue Message m1 (b s1 s2) -> ~ In_queue Message m1 (Post_message Message m2 b s3 s4 s1 s2).
Lemma not_in_queue_collect : forall (b : Bag_of_message) (s1 s2 s3 s4 : Site) (m1 : Message), ~ In_queue Message m1 (b s1 s2) -> ~ In_queue Message m1 (Collect_message Message b s3 s4 s1 s2).
Lemma inc_dec_owner : forall (c : Config) (s1 s2 : Site), legal c -> s1 = owner \/ s2 <> owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma inc_dec_owner2 : forall (c : Config) (s1 s2 : Site), legal c -> s1 <> owner -> s2 <> owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma inc_dec_owner3 : forall (c : Config) (s1 s2 : Site), legal c -> s2 <> owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma inc_dec_owner4 : forall (c : Config) (s1 s2 : Site), legal c -> s1 = owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma empty_queue1 : forall c : Config, legal c -> forall s1 s2 : Site, s1 = s2 -> bm c s1 s2 = empty Message.
Lemma empty_queue2 : forall c : Config, legal c -> forall s1 s2 s : Site, s1 = s -> s2 = s -> bm c s1 s2 = empty Message.
Lemma st_rt : forall (c0 : Config) (s0 : Site), legal c0 -> s0 <> owner -> (st c0 s0 > 0)%Z -> rt c0 s0 = true.
Lemma owner_rt_true : forall c : Config, legal c -> rt c owner = true.
Lemma cardinal_post_message : forall (m : Message) (s1 s2 : Site) (b : Bag_of_message), cardinal (Post_message Message m b s1 s2 s1 s2) = (cardinal (b s1 s2) + cardinal_count m)%Z.
Lemma cardinal_collect_message : forall (m : Message) (s1 s2 : Site) (b : Bag_of_message), first Message (b s1 s2) = value Message m -> cardinal (Collect_message Message b s1 s2 s1 s2) = (cardinal (b s1 s2) - cardinal_count m)%Z.
Lemma sigma_weight_post_message : forall (m : Message) (s1 s2 : Site) (b : Bag_of_message), sigma_weight (Post_message Message m b s1 s2) = (sigma_weight b + cardinal_count m)%Z.
Lemma sigma_weight_collect_message : forall (m : Message) (s1 s2 : Site) (b : Bag_of_message), first Message (b s1 s2) = value Message m -> sigma_weight (Collect_message Message b s1 s2) = (sigma_weight b - cardinal_count m)%Z.
Lemma eq_bool_dec : forall b : bool, {b = true} + {b = false}.
Lemma invariant1_init : sigma_send_table send_init = (sigma_receive_table rec_init + sigma_weight bag_init - 1)%Z.
Lemma invariant1_inductive : forall (c : Config) (t : class_trans c), legal c -> sigma_send_table (st c) = (sigma_receive_table (rt c) + sigma_weight (bm c) - 1)%Z -> sigma_send_table (st (transition c t)) = (sigma_receive_table (rt (transition c t)) + sigma_weight (bm (transition c t)) - 1)%Z.
Lemma invariant1 : forall c : Config, legal c -> sigma_send_table (st c) = (sigma_receive_table (rt c) + sigma_weight (bm c) - 1)%Z.
Lemma legal_alternate : forall (s : Site) (c : Config), legal c -> alternate (bm c s owner) /\ (rt c s = false -> D_queue (bm c s owner)).
Lemma count_inc_and_dec_alt_queue : forall q : queue Message, alternate q -> (reduce Message dec_count q + 1 >= reduce Message new_inc_count q)%Z.
Lemma count_inc_and_dec_D_queue : forall q : queue Message, alternate q -> D_queue q -> (reduce Message dec_count q >= reduce Message new_inc_count q)%Z.
Lemma copy_count_is_positive : forall q : queue Message, (reduce Message copy_count q >= 0)%Z.
Lemma dec_count_is_positive : forall q : queue Message, (reduce Message dec_count q >= 0)%Z.
Lemma invariant5 : forall c : Config, legal c -> forall s : Site, (Int (rt c s) + reduce Message dec_count (bm c s owner) + reduce Message copy_count (bm c owner s) - reduce Message new_inc_count (bm c s owner) >= 0)%Z.
Lemma other_definition_for_sigma_receive_table : forall t : Recv_T, sigma_receive_table t = sigma_table Site LS Z (Z_id Site) (fun s : Site => Int (t s)).
Lemma sigma_rooted_fun2 : forall (s s1 s2 : Site) (d : Message), s2 <> owner -> s1 <> s -> s2 <> s -> rooted_fun s s1 s2 d = 0%Z.
Lemma sigma_rooted_fun3 : forall s1 : Site, sigma_but Site owner eq_site_dec LS (fun s : Site => rooted_fun s s1 owner dec) = 0%Z.
Lemma sigma_rooted_fun4 : forall (s s1 : Site) (l : list Site), ~ In s l -> sigma_but Site owner eq_site_dec l (fun s0 : Site => rooted_fun s0 s1 owner (inc_dec s)) = 0%Z.
Lemma sigma_rooted_fun6 : forall (s s1 : Site) (l : list Site), ~ In s l -> sigma_but Site owner eq_site_dec l (fun s0 : Site => rooted_fun s0 s owner copy) = 0%Z.
Lemma sigma_rooted_fun7 : forall (s : Site) (l : list Site), only_once Site eq_site_dec s l -> s <> owner -> sigma_but Site owner eq_site_dec l (fun s0 : Site => rooted_fun s0 s owner copy) = 1%Z.
Lemma sigma_rooted_fun8 : forall (s2 : Site) (l : list Site), ~ In s2 l -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s owner s2 dec) = 0%Z.
Lemma sigma_rooted_fun9 : forall (s2 : Site) (l : list Site), only_once Site eq_site_dec s2 l -> s2 <> owner -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s owner s2 dec) = 1%Z.
Lemma sigma_rooted_fun10 : forall s2 : Site, sigma_but Site owner eq_site_dec LS (fun s : Site => rooted_fun s owner s2 copy) = 0%Z.
Lemma sigma_rooted_fun11 : forall (s1 s2 : Site) (l : list Site), s2 <> owner -> s1 <> owner -> ~ In s2 l -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s s1 s2 dec) = 0%Z.
Lemma sigma_rooted_fun12 : forall s1 s2 : Site, s2 <> owner -> s1 <> owner -> only_once Site eq_site_dec s2 LS -> sigma_but Site owner eq_site_dec LS (fun s : Site => rooted_fun s s1 s2 dec) = 1%Z.
Lemma sigma_rooted_fun13 : forall (s1 s2 : Site) (l : list Site), s2 <> owner -> s1 <> owner -> ~ In s1 l -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s s1 s2 copy) = 0%Z.
Lemma sigma_rooted_fun14 : forall (s1 s2 : Site) (l : list Site), s2 <> owner -> s1 <> owner -> only_once Site eq_site_dec s1 l -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s s1 s2 copy) = 1%Z.
Lemma sigma_rooted_fun5 : forall s s1 : Site, only_once Site eq_site_dec s LS -> s <> owner -> sigma_but Site owner eq_site_dec LS (fun s0 : Site => rooted_fun s0 s1 owner (inc_dec s)) = 1%Z.
Lemma sigma_rooted_fun1 : forall (s s1 s2 : Site) (d : Message), s2 <> owner -> ~ In s1 LS -> ~ In s2 LS -> sigma_but Site owner eq_site_dec LS (fun s : Site => rooted_fun s s1 s2 d) = 0%Z.
Lemma add_reduce4 : forall x y z a : Z, (x + y)%Z = (z + a)%Z -> (x - a)%Z = (z - y)%Z.
Lemma add_reduce5 : forall x y z a : Z, (x - a)%Z = (z - y)%Z -> x = (a + z - y)%Z.
Lemma add_reduce6 : forall x y z : Z, x = (z + y)%Z -> (x - z)%Z = y.
Lemma not_s1_s2 : forall s s1 s2 : Site, s1 <> s2 -> s1 <> s \/ s2 <> s.
Lemma not_owner_inc : forall (c : Config) (s1 s2 : Site), legal c -> ~ In_queue Message (inc_dec owner) (bm c s1 s2).
Lemma not_owner_inc2 : forall (c : Config) (s0 s1 s2 : Site), legal c -> In_queue Message (inc_dec s0) (bm c s1 s2) -> s0 <> owner.
Lemma not_owner_inc3 : forall (c : Config) (s1 s2 : Site), legal c -> forall s0 : Site, In_queue Message (inc_dec s0) (bm c s1 s2) -> s0 <> owner.
Lemma not_owner_inc4 : forall (c : Config) (s1 s2 : Site), legal c -> forall (m : Message) (s0 : Site), m = inc_dec s0 -> In_queue Message m (bm c s1 s2) -> s0 <> owner.
Lemma empty_q_to_me : forall c : Config, legal c -> forall s : Site, bm c s s = empty Message.
Lemma not_reflexive : forall c : Config, legal c -> forall s1 s5 : Site, In_queue Message (inc_dec s1) (bm c s5 owner) -> s1 <> s5.
Lemma not_in_queue_post : forall (b : Bag_of_message) (s1 s2 s3 s4 : Site) (m1 m2 : Message), m1 <> m2 -> ~ In_queue Message m1 (b s1 s2) -> ~ In_queue Message m1 (Post_message Message m2 b s3 s4 s1 s2).
Lemma not_in_queue_collect : forall (b : Bag_of_message) (s1 s2 s3 s4 : Site) (m1 : Message), ~ In_queue Message m1 (b s1 s2) -> ~ In_queue Message m1 (Collect_message Message b s3 s4 s1 s2).
Lemma inc_dec_owner : forall (c : Config) (s1 s2 : Site), legal c -> s1 = owner \/ s2 <> owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma inc_dec_owner2 : forall (c : Config) (s1 s2 : Site), legal c -> s1 <> owner -> s2 <> owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma inc_dec_owner3 : forall (c : Config) (s1 s2 : Site), legal c -> s2 <> owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma inc_dec_owner4 : forall (c : Config) (s1 s2 : Site), legal c -> s1 = owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma empty_queue1 : forall c : Config, legal c -> forall s1 s2 : Site, s1 = s2 -> bm c s1 s2 = empty Message.
Lemma empty_queue2 : forall c : Config, legal c -> forall s1 s2 s : Site, s1 = s -> s2 = s -> bm c s1 s2 = empty Message.
Lemma st_rt : forall (c0 : Config) (s0 : Site), legal c0 -> s0 <> owner -> (st c0 s0 > 0)%Z -> rt c0 s0 = true.
Lemma owner_rt_true : forall c : Config, legal c -> rt c owner = true.
Lemma cardinal_post_message : forall (m : Message) (s1 s2 : Site) (b : Bag_of_message), cardinal (Post_message Message m b s1 s2 s1 s2) = (cardinal (b s1 s2) + cardinal_count m)%Z.
Lemma cardinal_collect_message : forall (m : Message) (s1 s2 : Site) (b : Bag_of_message), first Message (b s1 s2) = value Message m -> cardinal (Collect_message Message b s1 s2 s1 s2) = (cardinal (b s1 s2) - cardinal_count m)%Z.
Lemma sigma_weight_post_message : forall (m : Message) (s1 s2 : Site) (b : Bag_of_message), sigma_weight (Post_message Message m b s1 s2) = (sigma_weight b + cardinal_count m)%Z.
Lemma sigma_weight_collect_message : forall (m : Message) (s1 s2 : Site) (b : Bag_of_message), first Message (b s1 s2) = value Message m -> sigma_weight (Collect_message Message b s1 s2) = (sigma_weight b - cardinal_count m)%Z.
Lemma invariant1_init : sigma_send_table send_init = (sigma_receive_table rec_init + sigma_weight bag_init - 1)%Z.
Lemma invariant1_inductive : forall (c : Config) (t : class_trans c), legal c -> sigma_send_table (st c) = (sigma_receive_table (rt c) + sigma_weight (bm c) - 1)%Z -> sigma_send_table (st (transition c t)) = (sigma_receive_table (rt (transition c t)) + sigma_weight (bm (transition c t)) - 1)%Z.
Lemma invariant1 : forall c : Config, legal c -> sigma_send_table (st c) = (sigma_receive_table (rt c) + sigma_weight (bm c) - 1)%Z.
Lemma false_rt_D_queue : forall (c : Config) (s : Site), legal c -> rt c s = false -> D_queue (bm c s owner).
Lemma legal_alternate : forall (s : Site) (c : Config), legal c -> alternate (bm c s owner).
Lemma count_inc_and_dec_alt_queue : forall q : queue Message, alternate q -> (reduce Message dec_count q + 1 >= reduce Message new_inc_count q)%Z.
Lemma count_inc_and_dec_D_queue : forall q : queue Message, alternate q -> D_queue q -> (reduce Message dec_count q >= reduce Message new_inc_count q)%Z.
Lemma copy_count_is_positive : forall q : queue Message, (reduce Message copy_count q >= 0)%Z.
Lemma dec_count_is_positive : forall q : queue Message, (reduce Message dec_count q >= 0)%Z.
Lemma invariant5 : forall c : Config, legal c -> forall s : Site, (Int (rt c s) + reduce Message dec_count (bm c s owner) + reduce Message copy_count (bm c owner s) - reduce Message new_inc_count (bm c s owner) >= 0)%Z.
Lemma other_definition_for_sigma_receive_table : forall t : Recv_T, sigma_receive_table t = sigma_table Site LS Z (Z_id Site) (fun s : Site => Int (t s)).
Lemma direct_son_is_positive : forall c : Config, legal c -> forall s : Site, direct_son c s -> (Int (rt c s) + reduce Message dec_count (bm c s owner) + reduce Message copy_count (bm c owner s) - reduce Message new_inc_count (bm c s owner) > 0)%Z.
Lemma sigma_rooted_fun2 : forall (s s1 s2 : Site) (d : Message), s2 <> owner -> s1 <> s -> s2 <> s -> rooted_fun s s1 s2 d = 0%Z.
Lemma sigma_rooted_fun3 : forall s1 : Site, sigma_but Site owner eq_site_dec LS (fun s : Site => rooted_fun s s1 owner dec) = 0%Z.
Lemma sigma_rooted_fun4 : forall (s s1 : Site) (l : list Site), ~ In s l -> sigma_but Site owner eq_site_dec l (fun s0 : Site => rooted_fun s0 s1 owner (inc_dec s)) = 0%Z.
Lemma sigma_rooted_fun6 : forall (s s1 : Site) (l : list Site), ~ In s l -> sigma_but Site owner eq_site_dec l (fun s0 : Site => rooted_fun s0 s owner copy) = 0%Z.
Lemma sigma_rooted_fun7 : forall (s : Site) (l : list Site), only_once Site eq_site_dec s l -> s <> owner -> sigma_but Site owner eq_site_dec l (fun s0 : Site => rooted_fun s0 s owner copy) = 1%Z.
Lemma sigma_rooted_fun8 : forall (s2 : Site) (l : list Site), ~ In s2 l -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s owner s2 dec) = 0%Z.
Lemma sigma_rooted_fun9 : forall (s2 : Site) (l : list Site), only_once Site eq_site_dec s2 l -> s2 <> owner -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s owner s2 dec) = 1%Z.
Lemma sigma_rooted_fun10 : forall s2 : Site, sigma_but Site owner eq_site_dec LS (fun s : Site => rooted_fun s owner s2 copy) = 0%Z.
Lemma sigma_rooted_fun11 : forall (s1 s2 : Site) (l : list Site), s2 <> owner -> s1 <> owner -> ~ In s2 l -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s s1 s2 dec) = 0%Z.
Lemma sigma_rooted_fun12 : forall s1 s2 : Site, s2 <> owner -> s1 <> owner -> only_once Site eq_site_dec s2 LS -> sigma_but Site owner eq_site_dec LS (fun s : Site => rooted_fun s s1 s2 dec) = 1%Z.
Lemma sigma_rooted_fun13 : forall (s1 s2 : Site) (l : list Site), s2 <> owner -> s1 <> owner -> ~ In s1 l -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s s1 s2 copy) = 0%Z.
Lemma sigma_rooted_fun14 : forall (s1 s2 : Site) (l : list Site), s2 <> owner -> s1 <> owner -> only_once Site eq_site_dec s1 l -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s s1 s2 copy) = 1%Z.
Lemma sigma_rooted_fun5 : forall s s1 : Site, only_once Site eq_site_dec s LS -> s <> owner -> sigma_but Site owner eq_site_dec LS (fun s0 : Site => rooted_fun s0 s1 owner (inc_dec s)) = 1%Z.
Lemma sigma_rooted_fun1 : forall (s s1 s2 : Site) (d : Message), s2 <> owner -> ~ In s1 LS -> ~ In s2 LS -> sigma_but Site owner eq_site_dec LS (fun s : Site => rooted_fun s s1 s2 d) = 0%Z.
Lemma add_reduce4 : forall x y z a : Z, (x + y)%Z = (z + a)%Z -> (x - a)%Z = (z - y)%Z.
Lemma add_reduce5 : forall x y z a : Z, (x - a)%Z = (z - y)%Z -> x = (a + z - y)%Z.
Lemma add_reduce6 : forall x y z : Z, x = (z + y)%Z -> (x - z)%Z = y.
Lemma parent_invariant_inductive : forall (c : Config) (t : class_trans c), legal c -> (legal c -> forall s : Site, indirect_son1 c s -> exists s1 : Site, direct_son c s1 /\ ancestor c s1 s) -> legal (transition c t) -> forall s : Site, indirect_son1 (transition c t) s -> exists s1 : Site, direct_son (transition c t) s1 /\ ancestor (transition c t) s1 s.
Lemma parent_invariant : forall c : Config, legal c -> forall s : Site, indirect_son1 c s -> exists s1 : Site, direct_son c s1 /\ ancestor c s1 s.
Lemma always_process_messages : forall c : Config, legal c -> forall (s1 s2 : Site) (m : Message), first Message (bm c s1 s2) = value Message m -> exists t : class_trans c, legal (transition c t) /\ bm (transition c t) s1 s2 = first_out Message (bm c s1 s2).
Lemma not_s1_s2 : forall s s1 s2 : Site, s1 <> s2 -> s1 <> s \/ s2 <> s.
Lemma not_owner_inc : forall (c : Config) (s1 s2 : Site), legal c -> ~ In_queue Message (inc_dec owner) (bm c s1 s2).
Lemma not_owner_inc2 : forall (c : Config) (s0 s1 s2 : Site), legal c -> In_queue Message (inc_dec s0) (bm c s1 s2) -> s0 <> owner.
Lemma not_owner_inc3 : forall (c : Config) (s1 s2 : Site), legal c -> forall s0 : Site, In_queue Message (inc_dec s0) (bm c s1 s2) -> s0 <> owner.
Lemma not_owner_inc4 : forall (c : Config) (s1 s2 : Site), legal c -> forall (m : Message) (s0 : Site), m = inc_dec s0 -> In_queue Message m (bm c s1 s2) -> s0 <> owner.
Lemma empty_q_to_me : forall c : Config, legal c -> forall s : Site, bm c s s = empty Message.
Lemma not_reflexive : forall c : Config, legal c -> forall s1 s5 : Site, In_queue Message (inc_dec s1) (bm c s5 owner) -> s1 <> s5.
Lemma not_in_queue_post : forall (b : Bag_of_message) (s1 s2 s3 s4 : Site) (m1 m2 : Message), m1 <> m2 -> ~ In_queue Message m1 (b s1 s2) -> ~ In_queue Message m1 (Post_message Message m2 b s3 s4 s1 s2).
Lemma not_in_queue_collect : forall (b : Bag_of_message) (s1 s2 s3 s4 : Site) (m1 : Message), ~ In_queue Message m1 (b s1 s2) -> ~ In_queue Message m1 (Collect_message Message b s3 s4 s1 s2).
Lemma inc_dec_owner : forall (c : Config) (s1 s2 : Site), legal c -> s1 = owner \/ s2 <> owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma inc_dec_owner2 : forall (c : Config) (s1 s2 : Site), legal c -> s1 <> owner -> s2 <> owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma inc_dec_owner3 : forall (c : Config) (s1 s2 : Site), legal c -> s2 <> owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma inc_dec_owner4 : forall (c : Config) (s1 s2 : Site), legal c -> s1 = owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma empty_queue1 : forall c : Config, legal c -> forall s1 s2 : Site, s1 = s2 -> bm c s1 s2 = empty Message.
Lemma empty_queue2 : forall c : Config, legal c -> forall s1 s2 s : Site, s1 = s -> s2 = s -> bm c s1 s2 = empty Message.
Lemma st_rt : forall (c0 : Config) (s0 : Site), legal c0 -> s0 <> owner -> (st c0 s0 > 0)%Z -> rt c0 s0 = true.
Lemma owner_rt_true : forall c : Config, legal c -> rt c owner = true.
Lemma cardinal_post_message : forall (m : Message) (s1 s2 : Site) (b : Bag_of_message), cardinal (Post_message Message m b s1 s2 s1 s2) = (cardinal (b s1 s2) + cardinal_count m)%Z.
Lemma cardinal_collect_message : forall (m : Message) (s1 s2 : Site) (b : Bag_of_message), first Message (b s1 s2) = value Message m -> cardinal (Collect_message Message b s1 s2 s1 s2) = (cardinal (b s1 s2) - cardinal_count m)%Z.
Lemma sigma_weight_post_message : forall (m : Message) (s1 s2 : Site) (b : Bag_of_message), sigma_weight (Post_message Message m b s1 s2) = (sigma_weight b + cardinal_count m)%Z.
Lemma sigma_weight_collect_message : forall (m : Message) (s1 s2 : Site) (b : Bag_of_message), first Message (b s1 s2) = value Message m -> sigma_weight (Collect_message Message b s1 s2) = (sigma_weight b - cardinal_count m)%Z.
Lemma invariant1_init : sigma_send_table send_init = (sigma_receive_table rec_init + sigma_weight bag_init)%Z.
Lemma invariant1_inductive : forall (c : Config) (t : class_trans c), legal c -> sigma_send_table (st c) = (sigma_receive_table (rt c) + sigma_weight (bm c))%Z -> sigma_send_table (st (transition c t)) = (sigma_receive_table (rt (transition c t)) + sigma_weight (bm (transition c t)))%Z.
Lemma invariant1 : forall c : Config, legal c -> sigma_send_table (st c) = (sigma_receive_table (rt c) + sigma_weight (bm c))%Z.
Lemma false_rt_D_queue : forall (c : Config) (s : Site), legal c -> rt c s = false -> D_queue (bm c s owner).
Lemma legal_alternate : forall (s : Site) (c : Config), legal c -> alternate (bm c s owner).
Lemma count_inc_and_dec_alt_queue : forall q : queue Message, alternate q -> (reduce Message dec_count q + 1 >= reduce Message new_inc_count q)%Z.
Lemma count_inc_and_dec_D_queue : forall q : queue Message, alternate q -> D_queue q -> (reduce Message dec_count q >= reduce Message new_inc_count q)%Z.
Lemma copy_count_is_positive : forall q : queue Message, (reduce Message copy_count q >= 0)%Z.
Lemma dec_count_is_positive : forall q : queue Message, (reduce Message dec_count q >= 0)%Z.
Lemma invariant5 : forall c : Config, legal c -> forall s : Site, (Int (rt c s) + reduce Message dec_count (bm c s owner) + reduce Message copy_count (bm c owner s) - reduce Message new_inc_count (bm c s owner) >= 0)%Z.
Lemma other_definition_for_sigma_receive_table : forall t : Recv_T, sigma_receive_table t = sigma_table Site LS Z (Z_id Site) (fun s : Site => Int (t s)).
Lemma owner_st_positive : forall c : Config, legal c -> (st c owner >= 0)%Z.
Lemma direct_son_is_positive : forall c : Config, legal c -> forall s : Site, direct_son c s -> (Int (rt c s) + reduce Message dec_count (bm c s owner) + reduce Message copy_count (bm c owner s) - reduce Message new_inc_count (bm c s owner) > 0)%Z.
Lemma safety1 : forall c : Config, legal c -> forall s : Site, s <> owner -> rt c s = true -> (st c owner > 0)%Z.
Lemma safety2 : forall c : Config, legal c -> forall s1 s2 : Site, In_queue Message copy (bm c s1 s2) -> (st c owner > 0)%Z.
Lemma sigma_rooted_fun2 : forall (s s1 s2 : Site) (d : Message), s2 <> owner -> s1 <> s -> s2 <> s -> rooted_fun s s1 s2 d = 0%Z.
Lemma sigma_rooted_fun3 : forall s1 : Site, sigma_but Site owner eq_site_dec LS (fun s : Site => rooted_fun s s1 owner dec) = 0%Z.
Lemma sigma_rooted_fun4 : forall (s s1 : Site) (l : list Site), ~ In s l -> sigma_but Site owner eq_site_dec l (fun s0 : Site => rooted_fun s0 s1 owner (inc_dec s)) = 0%Z.
Lemma sigma_rooted_fun6 : forall (s s1 : Site) (l : list Site), ~ In s l -> sigma_but Site owner eq_site_dec l (fun s0 : Site => rooted_fun s0 s owner copy) = 0%Z.
Lemma sigma_rooted_fun7 : forall (s : Site) (l : list Site), only_once Site eq_site_dec s l -> s <> owner -> sigma_but Site owner eq_site_dec l (fun s0 : Site => rooted_fun s0 s owner copy) = 1%Z.
Lemma sigma_rooted_fun8 : forall (s2 : Site) (l : list Site), ~ In s2 l -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s owner s2 dec) = 0%Z.
Lemma sigma_rooted_fun9 : forall (s2 : Site) (l : list Site), only_once Site eq_site_dec s2 l -> s2 <> owner -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s owner s2 dec) = 1%Z.
Lemma sigma_rooted_fun10 : forall s2 : Site, sigma_but Site owner eq_site_dec LS (fun s : Site => rooted_fun s owner s2 copy) = 0%Z.
Lemma sigma_rooted_fun11 : forall (s1 s2 : Site) (l : list Site), s2 <> owner -> s1 <> owner -> ~ In s2 l -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s s1 s2 dec) = 0%Z.
Lemma sigma_rooted_fun12 : forall s1 s2 : Site, s2 <> owner -> s1 <> owner -> only_once Site eq_site_dec s2 LS -> sigma_but Site owner eq_site_dec LS (fun s : Site => rooted_fun s s1 s2 dec) = 1%Z.
Lemma sigma_rooted_fun13 : forall (s1 s2 : Site) (l : list Site), s2 <> owner -> s1 <> owner -> ~ In s1 l -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s s1 s2 copy) = 0%Z.
Lemma sigma_rooted_fun14 : forall (s1 s2 : Site) (l : list Site), s2 <> owner -> s1 <> owner -> only_once Site eq_site_dec s1 l -> sigma_but Site owner eq_site_dec l (fun s : Site => rooted_fun s s1 s2 copy) = 1%Z.
Lemma sigma_rooted_fun5 : forall s s1 : Site, only_once Site eq_site_dec s LS -> s <> owner -> sigma_but Site owner eq_site_dec LS (fun s0 : Site => rooted_fun s0 s1 owner (inc_dec s)) = 1%Z.
Lemma sigma_rooted_fun1 : forall (s s1 s2 : Site) (d : Message), s2 <> owner -> ~ In s1 LS -> ~ In s2 LS -> sigma_but Site owner eq_site_dec LS (fun s : Site => rooted_fun s s1 s2 d) = 0%Z.
Lemma add_reduce4 : forall x y z a : Z, (x + y)%Z = (z + a)%Z -> (x - a)%Z = (z - y)%Z.
Lemma add_reduce5 : forall x y z a : Z, (x - a)%Z = (z - y)%Z -> x = (a + z - y)%Z.
Lemma add_reduce6 : forall x y z : Z, x = (z + y)%Z -> (x - z)%Z = y.
Lemma parent_invariant_inductive : forall (c : Config) (t : class_trans c), legal c -> (legal c -> forall s : Site, indirect_son1 c s -> exists s1 : Site, direct_son c s1 /\ ancestor c s1 s) -> legal (transition c t) -> forall s : Site, indirect_son1 (transition c t) s -> exists s1 : Site, direct_son (transition c t) s1 /\ ancestor (transition c t) s1 s.
Lemma parent_invariant : forall c : Config, legal c -> forall s : Site, indirect_son1 c s -> exists s1 : Site, direct_son c s1 /\ ancestor c s1 s.
Lemma not_s1_s2 : forall s s1 s2 : Site, s1 <> s2 -> s1 <> s \/ s2 <> s.
Lemma not_owner_inc : forall (c : Config) (s1 s2 : Site), legal c -> ~ In_queue Message (inc_dec owner) (bm c s1 s2).
Lemma not_owner_inc2 : forall (c : Config) (s0 s1 s2 : Site), legal c -> In_queue Message (inc_dec s0) (bm c s1 s2) -> s0 <> owner.
Lemma not_owner_inc3 : forall (c : Config) (s1 s2 : Site), legal c -> forall s0 : Site, In_queue Message (inc_dec s0) (bm c s1 s2) -> s0 <> owner.
Lemma not_owner_inc4 : forall (c : Config) (s1 s2 : Site), legal c -> forall (m : Message) (s0 : Site), m = inc_dec s0 -> In_queue Message m (bm c s1 s2) -> s0 <> owner.
Lemma no_copy_to_owner : forall c0 : Config, legal c0 -> forall s1 : Site, ~ In_queue Message copy (bm c0 s1 owner).
Lemma empty_q_to_me : forall c : Config, legal c -> forall s : Site, bm c s s = empty Message.
Lemma not_reflexive : forall c : Config, legal c -> forall s1 s5 : Site, In_queue Message (inc_dec s1) (bm c s5 owner) -> s1 <> s5.
Lemma not_in_queue_post : forall (b : Bag_of_message) (s1 s2 s3 s4 : Site) (m1 m2 : Message), m1 <> m2 -> ~ In_queue Message m1 (b s1 s2) -> ~ In_queue Message m1 (Post_message Message m2 b s3 s4 s1 s2).
Lemma not_in_queue_collect : forall (b : Bag_of_message) (s1 s2 s3 s4 : Site) (m1 : Message), ~ In_queue Message m1 (b s1 s2) -> ~ In_queue Message m1 (Collect_message Message b s3 s4 s1 s2).
Lemma inc_dec_owner : forall (c : Config) (s1 s2 : Site), legal c -> s1 = owner \/ s2 <> owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma inc_dec_owner2 : forall (c : Config) (s1 s2 : Site), legal c -> s1 <> owner -> s2 <> owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma inc_dec_owner3 : forall (c : Config) (s1 s2 : Site), legal c -> s2 <> owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma inc_dec_owner4 : forall (c : Config) (s1 s2 : Site), legal c -> s1 = owner -> forall s0 : Site, ~ In_queue Message (inc_dec s0) (bm c s1 s2).
Lemma empty_queue1 : forall c : Config, legal c -> forall s1 s2 : Site, s1 = s2 -> bm c s1 s2 = empty Message.
Lemma empty_queue2 : forall c : Config, legal c -> forall s1 s2 s : Site, s1 = s -> s2 = s -> bm c s1 s2 = empty Message.
Lemma st_rt : forall (c0 : Config) (s0 : Site), legal c0 -> s0 <> owner -> (st c0 s0 > 0)%Z -> rt c0 s0 = true.
Lemma cardinal_post_message : forall (m : Message) (s1 s2 : Site) (b : Bag_of_message), cardinal (Post_message Message m b s1 s2 s1 s2) = (cardinal (b s1 s2) + cardinal_count m)%Z.
Lemma cardinal_collect_message : forall (m : Message) (s1 s2 : Site) (b : Bag_of_message), first Message (b s1 s2) = value Message m -> cardinal (Collect_message Message b s1 s2 s1 s2) = (cardinal (b s1 s2) - cardinal_count m)%Z.
Lemma sigma_weight_post_message : forall (m : Message) (s1 s2 : Site) (b : Bag_of_message), sigma_weight (Post_message Message m b s1 s2) = (sigma_weight b + cardinal_count m)%Z.
Lemma sigma_weight_collect_message : forall (m : Message) (s1 s2 : Site) (b : Bag_of_message), first Message (b s1 s2) = value Message m -> sigma_weight (Collect_message Message b s1 s2) = (sigma_weight b - cardinal_count m)%Z.