(* This program is free software; you can redistribute it and/or      *)
(* modify it under the terms of the GNU Lesser General Public License *)
(* as published by the Free Software Foundation; either version 2.1   *)
(* of the License, or (at your option) any later version.             *)
(*                                                                    *)
(* This program is distributed in the hope that it will be useful,    *)
(* but WITHOUT ANY WARRANTY; without even the implied warranty of     *)
(* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the      *)
(* GNU General Public License for more details.                       *)
(*                                                                    *)
(* You should have received a copy of the GNU Lesser General Public   *)
(* License along with this program; if not, write to the Free         *)
(* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA *)
(* 02110-1301 USA                                                     *)
(* EVOLUTION *)
(* definit l'evolution de la machine au cours du temps et ses invariants *)
Require Export copy.
Require Export del.
Require Export rece_copy1.
Require Export rece_copy2.
Require Export rece_copy3.
Require Export rece_dec.
Require Export rece_inc.
Unset Standard Proposition Elimination Names.
Section EVOLUTION.
(* ou l'on trouvera successivement la definition des transitions avec les preconditions, puis l'action elle_meme, pour finir avec la definition d'un etat legal comme etant celui obtenu a partir de l'etat initial et d'un nombre quelconque de transitions *)
Inductive class_trans (c : Config) : Set :=
| make_copy :
forall s1 s2 : Site,
s1 <> s2 -> s2 <> owner -> access s1 (rt c) -> class_trans c
| receive_dec :
forall s1 s2 : Site,
first Message (bm c s1 s2) = value Message dec -> class_trans c
| receive_inc :
forall s1 s3 : Site,
first Message (bm c s1 owner) = value Message (inc_dec s3) ->
class_trans c
| receive_copy1 :
forall s1 s2 : Site,
rt c s2 = true ->
first Message (bm c s1 s2) = value Message copy -> class_trans c
| receive_copy2 :
forall s2 : Site,
rt c s2 = false ->
first Message (bm c owner s2) = value Message copy -> class_trans c
| receive_copy3 :
forall s1 s2 : Site,
rt c s2 = false ->
s1 <> owner ->
first Message (bm c s1 s2) = value Message copy -> class_trans c
| delete_entry :
forall s : Site,
st c s = 0%Z -> rt c s = true -> s <> owner -> class_trans c.
Definition transition (c : Config) (t : class_trans c) :=
match t with
| make_copy s1 s2 h1 h2 h3 => copy_trans c s1 s2
| receive_dec s1 s2 h1 => rec_dec_trans c s1 s2
| receive_inc s1 s3 h1 => rec_inc_trans c s1 s3
| receive_copy1 s1 s2 h1 h2 => rec_copy1_trans c s1 s2
| receive_copy2 s2 h1 h2 => rec_copy2_trans c s2
| receive_copy3 s1 s2 h1 h2 h3 => rec_copy3_trans c s1 s2
| delete_entry s h1 h2 h3 => delete_trans c s
end.
Inductive legal : Config -> Prop :=
| begin : legal config_init
| after :
forall (c : Config) (t : class_trans c),
legal c -> legal (transition c t).
End EVOLUTION.
Section M_INVARIANTS.
(* il s'agit d'invariants d'etat de la machine, leurs preuves suivant le meme schema, verification sur la situation initiale puis induction et etude par cas *)
(* l'estampille est inferieure au temps *)

(* Specifications: *)
Lemma le_dt_time :
forall (c0 : Config) (s0 : Site), legal c0 -> dt c0 s0 <= time c0.