End REC_INC_EFFECT.
Section REC_INC_CTRL.
(* decomptes de messages *)
Variable c0 : Config.
Variable s1 s2 : Site.
Hypothesis
first_mess : first Message (bm c0 s1 owner) = value Message (inc_dec s2).

(* Specifications: *)
Lemma rinc_trans_ctrl_copy :
forall s0 s3 : Site,
ctrl_copy s0 s3 (bm (rec_inc_trans c0 s1 s2)) = ctrl_copy s0 s3 (bm c0).
Lemma rinc_trans_ctrl_dec :
forall s0 s3 : Site,
ctrl_dec s0 s3 (bm (rec_inc_trans c0 s1 s2)) =
(if eq_site_dec s0 s2
then
if eq_site_dec s3 owner
then (ctrl_dec s0 s3 (bm c0) + 1)%Z
else ctrl_dec s0 s3 (bm c0)
else ctrl_dec s0 s3 (bm c0)).
Lemma rinc_trans_ctrl_inc :
forall s0 s3 : Site,
ctrl_inc s0 s3 (bm (rec_inc_trans c0 s1 s2)) =
(if eq_site_dec s0 s2
then
if eq_site_dec s3 s1
then (ctrl_inc s0 s3 (bm c0) - 1)%Z
else ctrl_inc s0 s3 (bm c0)
else ctrl_inc s0 s3 (bm c0)).