From mathcomp.ssreflect
From mathcomp
From fcsl
From DiSeL
Set Implicit Arguments.
Unset Strict Implicit.
Unset Printing Implicit Defensive.
(* Rely-transitions of the network in the presence of the given world *)
Section Rely.
Variable w : world.
Variable this: nid.
Notation getl := (getLocal).
Notation gets := getStatelet.
Notation getp := (@getProtocol _ w).
(* The following is the "rely" relation *)
Fixpoint network_rely' n s1 s2 :=
if n is n'.+1
then exists z s3,
[/\ this != z, network_step w z s1 s3 & network_rely' n' s3 s2]
else s1 = s2 /\ s1 \In Coh w.
Definition network_rely s1 s2 := exists n, network_rely' n s1 s2.

(* Specifications: *)
(* Basic properties: reflexivity and transitifity *)
Lemma rely_refl s : s \In Coh w -> network_rely s s.
Lemma rely_coh' n s1 s2 :
network_rely' n s1 s2 -> Coh w s1 /\ Coh w s2.
Lemma rely_coh s1 s2 :
network_rely s1 s2 -> Coh w s1 /\ Coh w s2.
Lemma step_consume_other l s s' m tm from z:
this != z -> network_step w z s s' ->
find m (dsoup (gets s l)) = Some (Msg tm from this true) ->
find m (dsoup (gets s' l)) = Some (Msg tm from this true).
(* Nobody consumes my messages *)
Lemma rely_consume_other l s s' m tm from:
network_rely s s' ->
find m (dsoup (gets s l)) = Some (Msg tm from this true) ->
find m (dsoup (gets s' l)) = Some (Msg tm from this true).
Lemma step_send_other l s s' m tm to b z:
this != z -> network_step w z s s' ->
find m (dsoup (gets s' l)) = Some (Msg tm this to b) ->
exists b', find m (dsoup (gets s l)) = Some (Msg tm this to b') /\ (b -> b').
(* A backwards lemma: no one can send messages on my behalf, i.e., no new messages appear *)
Lemma rely_send_other l s s' m tm to b:
network_rely s s' ->
find m (dsoup (gets s' l)) = Some (Msg tm this to b) ->
exists b', find m (dsoup (gets s l)) = Some (Msg tm this to b') /\ (b -> b').
Lemma step_send_other' l s s' m tm to b z:
this != z -> network_step w z s s' ->
find m (dsoup (gets s l)) = Some (Msg tm this to b) ->
exists b', find m (dsoup (gets s' l)) = Some (Msg tm this to b') /\ (b' -> b).
(* A forward lemma: messages sent on my behalf don't disappear but might get consumed *)
Lemma rely_send_other' l s s' m tm to b:
network_rely s s' ->
find m (dsoup (gets s l)) = Some (Msg tm this to b) ->
exists b', find m (dsoup (gets s' l)) = Some (Msg tm this to b') /\ (b' -> b).