Definition rec_inc_trans (c : Config) (s1 s3 : Site) :=
  mkconfig (S (time c)) (dt c) (Inc_send_table (st c) owner) 
    (rt c) (Post_message dec (Collect_message (bm c) s1 owner) owner s3).

(* Specifications: *)
Lemma rinc_trans_le_dt_time : forall s0 : Site, dt c0 s0 <= time c0 -> dt (rec_inc_trans c0 s1 s2) s0 <= time (rec_inc_trans c0 s1 s2).
Lemma rinc_trans_diff_site : forall s3 s4 : Site, (In_queue Message copy (bm c0 s3 s4) -> s3 <> s4) -> In_queue Message copy (bm (rec_inc_trans c0 s1 s2) s3 s4) -> s3 <> s4.
Lemma rinc_trans_st : forall s0 : Site, st (rec_inc_trans c0 s1 s2) s0 = (if eq_site_dec s0 owner then (st c0 s0 + 1)%Z else st c0 s0).
Lemma rinc_trans_in_queue : forall s0 s3 s4 : Site, In_queue Message (inc_dec s0) (bm (rec_inc_trans c0 s1 s2) s3 s4) -> In_queue Message (inc_dec s0) (bm c0 s3 s4).
Lemma rinc_trans_st_rt : forall s0 : Site, s0 <> owner -> ((st c0 s0 > 0)%Z -> rt c0 s0 = true) -> (st (rec_inc_trans c0 s1 s2) s0 > 0)%Z -> rt (rec_inc_trans c0 s1 s2) s0 = true.
Lemma rinc_trans_ctrl_copy : forall s0 s3 : Site, ctrl_copy s0 s3 (bm (rec_inc_trans c0 s1 s2)) = ctrl_copy s0 s3 (bm c0).
Lemma rinc_trans_ctrl_dec : forall s0 s3 : Site, ctrl_dec s0 s3 (bm (rec_inc_trans c0 s1 s2)) = (if eq_site_dec s0 s2 then if eq_site_dec s3 owner then (ctrl_dec s0 s3 (bm c0) + 1)%Z else ctrl_dec s0 s3 (bm c0) else ctrl_dec s0 s3 (bm c0)).
Lemma rinc_trans_ctrl_inc : forall s0 s3 : Site, ctrl_inc s0 s3 (bm (rec_inc_trans c0 s1 s2)) = (if eq_site_dec s0 s2 then if eq_site_dec s3 s1 then (ctrl_inc s0 s3 (bm c0) - 1)%Z else ctrl_inc s0 s3 (bm c0) else ctrl_inc s0 s3 (bm c0)).