(* This program is free software; you can redistribute it and/or      *)
(* modify it under the terms of the GNU Lesser General Public License *)
(* as published by the Free Software Foundation; either version 2.1   *)
(* of the License, or (at your option) any later version.             *)
(*                                                                    *)
(* This program is distributed in the hope that it will be useful,    *)
(* but WITHOUT ANY WARRANTY; without even the implied warranty of     *)
(* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the      *)
(* GNU General Public License for more details.                       *)
(*                                                                    *)
(* You should have received a copy of the GNU Lesser General Public   *)
(* License along with this program; if not, write to the Free         *)
(* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA *)
(* 02110-1301 USA                                                     *)
Require Export DistributedReferenceCounting.machine4.machine.
Require Export DistributedReferenceCounting.machine4.cardinal.
Require Export DistributedReferenceCounting.machine4.comm.
Unset Standard Proposition Elimination Names.
Section IN_Q_BEFORE.
Variable data : Set.
(* This predicate tells us if we can find a data d - before the first occurrence of d1, if d1 belongs to q, - otherwise it returns true when d1 does not belong to q. *)
Hypothesis eq_data_dec : eq_dec data.
Fixpoint In_queue_before_data (d d1 : data) (q : queue data) {struct q} :
Prop :=
match q with
| empty => True
| input d' q' =>
if eq_data_dec d' d1
then False
else d' = d \/ In_queue_before_data d d1 q'
end.
(* same except that I pass a predicate to recognise d1 *)
Fixpoint In_queue_before (d : data) (f1 : data -> bool)
(q : queue data) {struct q} : Prop :=
match q with
| empty => True
| input d' q' =>
if eq_bool_dec (f1 d')
then False
else d' = d \/ In_queue_before d f1 q'
end.
End IN_Q_BEFORE.
Section ALTERNATE.
Definition is_inc_dec (m : Message) :=
match m with
| inc_dec _ => true
| _ => false
end.
Inductive alternate : queue Message -> Prop :=
| alt_null : alternate (empty Message)
| alt_any_alt :
forall (qm : queue Message) (m : Message),
(forall s : Site, m <> inc_dec s) ->
alternate qm -> alternate (input Message m qm)
| alt_inc_dec :
forall (qm : queue Message) (s0 : Site),
alternate qm ->
In_queue_before Message dec is_inc_dec qm ->
alternate (input Message (inc_dec s0) qm).

(* Specifications: *)
Lemma dec_is_not_inc : forall s : Site, dec <> inc_dec s.
Inductive D_queue : queue Message -> Prop :=
| D_empty : D_queue (empty Message)
| D_dec :
forall qm : queue Message,
alternate qm -> In_queue_before Message dec is_inc_dec qm -> D_queue qm.
Lemma not_D_queue :
forall (q0 : queue Message) (m : Message),
~ D_queue q0 -> m <> dec -> ~ D_queue (input Message m q0).
Lemma D_queue_is_alternate :
forall q0 : queue Message, D_queue q0 -> alternate q0.
Lemma in_q_before_first_out :
forall q : queue Message,
In_queue_before Message dec is_inc_dec q ->
In_queue_before Message dec is_inc_dec (first_out Message q).
Lemma alt_first_out :
forall q0 : queue Message, alternate q0 -> alternate (first_out Message q0).
Lemma D_first_out :
forall q0 : queue Message, D_queue q0 -> D_queue (first_out Message q0).
Lemma D_input :
forall q : queue Message, D_queue (input Message copy q) -> D_queue q.