(* This program is free software; you can redistribute it and/or      *)
(* modify it under the terms of the GNU Lesser General Public License *)
(* as published by the Free Software Foundation; either version 2.1   *)
(* of the License, or (at your option) any later version.             *)
(*                                                                    *)
(* This program is distributed in the hope that it will be useful,    *)
(* but WITHOUT ANY WARRANTY; without even the implied warranty of     *)
(* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the      *)
(* GNU General Public License for more details.                       *)
(*                                                                    *)
(* You should have received a copy of the GNU Lesser General Public   *)
(* License along with this program; if not, write to the Free         *)
(* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA *)
(* 02110-1301 USA                                                     *)
Require Export DistributedReferenceCounting.machine2.invariant5.
Require Export DistributedReferenceCounting.machine2.invariant7.
Unset Standard Proposition Elimination Names.
(* changes: In safety1 and safety2, I had to use sigma_but_strictly_positive, instead of sigma_strictly_positive.  In safety2, the case ~s2=owner should not be isolated *)
Remark add_reduce : forall x : Z, (x > 0)%Z -> (x + 1 - 1 > 0)%Z.

Lemma safety2 :
forall c : Config,
legal c ->
forall s1 s2 : Site,
In_queue Message copy (bm c s1 s2) -> (st c owner > 0)%Z.