Section LEGAL_NO_COPY.
(** this inductive definition defines legal_no_copy as a predicate over a configuration c, which is accessible with legal transitions from a legal config c0, without using any copy transition *)
Variable c0 : Config.
Inductive legal_no_copy : Config -> Prop :=
| no_copy_init : legal c0 -> legal_no_copy c0
| after_no_copy :
forall (c : Config) (t : class_trans c),
~ copy_p c t -> legal_no_copy c -> legal_no_copy (transition c t).
End LEGAL_NO_COPY.
Definition no_message (c : Config) :=
forall s1 s2 : Site, In s1 LS -> In s2 LS -> bm c s1 s2 = empty Message.
(**  Define a measure: for instance: 2 for inc_dec 1 for dec. 2 for rt=true Show that any legal_no_copy transition decreases the measure. By induction, there is a minimum. *)
Definition termination_count (m : Message) :=
match m with
| copy => 5%Z
| dec => 1%Z
| inc_dec s3 => 2%Z
end.
Definition termination_q_count (s1 s2 : Site) (q : queue Message) :=
reduce Message termination_count q.
Definition termination_q_measure (bm : Bag_of_message) :=
sigma2_table Site LS LS (queue Message) termination_q_count bm.
Definition termination_rt_count (b : bool) := if b then 2%Z else 0%Z.
Definition termination_rt_measure (t : Site -> bool) :=
sigma_table Site LS Z (Z_id Site)
(fun s : Site => termination_rt_count (t s)).
Definition termination_measure (c : Config) :=
(termination_rt_measure (rt c) + termination_q_measure (bm c))%Z.
Inductive legal_no_copy2 : Config -> Config -> Prop :=
| no_copy_init2 : forall c : Config, legal c -> legal_no_copy2 c c
| after_no_copy2 :
forall (c c0 : Config) (t : class_trans c),
~ copy_p c t ->
legal_no_copy2 c c0 -> legal_no_copy2 (transition c t) c0.

Lemma legal_no_copy_transitive2 :
forall c0 : Config,
legal c0 ->
forall c1 c2 : Config,
legal_no_copy2 c1 c0 -> legal_no_copy2 c2 c1 -> legal_no_copy2 c2 c0.