End REC_COP3_EFFECT.
Section REC_COP3_CTRL.
(* decompte de messages *)
Variable c0 : Config.
Variable s0 s1 s2 : Site.
Hypothesis not_owner : s1 <> owner.
Hypothesis first_mess : first Message (bm c0 s1 s2) = value Message copy.

(* Specifications: *)
Lemma rcop3_trans_ctrl_copy :
forall s3 : Site,
ctrl_copy s0 s3 (bm (rec_copy3_trans c0 s1 s2)) =
(if eq_site_dec s0 s1
then
if eq_site_dec s3 s2
then  (ctrl_copy s0 s3 (bm c0) - 1)%Z
else  ctrl_copy s0 s3 (bm c0)
else  ctrl_copy s0 s3 (bm c0)).
Lemma rcop3_trans_ctrl_dec :
forall s3 : Site,
ctrl_dec s0 s3 (bm (rec_copy3_trans c0 s1 s2)) = ctrl_dec s0 s3 (bm c0).
Lemma rcop3_trans_ctrl_inc :
forall s3 : Site,
ctrl_inc s0 s3 (bm (rec_copy3_trans c0 s1 s2)) =
(if eq_site_dec s0 s1
then
if eq_site_dec s3 s2
then  (ctrl_inc s0 s3 (bm c0) + 1)%Z
else  ctrl_inc s0 s3 (bm c0)
else  ctrl_inc s0 s3 (bm c0)).