(* This program is free software; you can redistribute it and/or      *)
(* modify it under the terms of the GNU Lesser General Public License *)
(* as published by the Free Software Foundation; either version 2.1   *)
(* of the License, or (at your option) any later version.             *)
(*                                                                    *)
(* This program is distributed in the hope that it will be useful,    *)
(* but WITHOUT ANY WARRANTY; without even the implied warranty of     *)
(* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the      *)
(* GNU General Public License for more details.                       *)
(*                                                                    *)
(* You should have received a copy of the GNU Lesser General Public   *)
(* License along with this program; if not, write to the Free         *)
(* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA *)
(* 02110-1301 USA                                                     *)
Unset Standard Proposition Elimination Names.
(**  Here, we study liveness of the algorithm. We prove  1. If there is a message in a queue, there always exists a transition that can consume that message.  2. We can define notion of measure and prove that every transition (except copy) decrease the mesure.  3. Then, the idea was to use the notion of well_found relation so a to prove that if we prevent copy transitions, we always reach a final configuration where no message can be processed.  There was a bit of 'coding' to use these well-founded relations.  I needed to talk about configuration which were legal.  So I defined a inductive type (a strong dependent sum), legal_config, which contains a configuration and a proof that it is legal.  I then reached two problems, one easy to solve (I think), and more difficult.  a.  I need to convert Z numbers into nat, and I don;t know how to do it. I had to assume the existence of the following axiom: Axiom Z_nat_axiom: (x,y:Z)  `0<=x` -> `0<=y` -> `y<x` -> (lt (convert_to_nat y) (convert_to_nat x)).  b.  Well founded relations must be decidable: Definition decidable_relation:= [E:Set] [R:E->E->Prop] (x:E){y:E | (R y x)}+{((y:E)~(R y x))}.  In order to prove that, I had to eliminate H in lemma decidable_no_copy_succ.  H : (EX t:(class_trans c) | ~(copy_p c t)/\(legal (transition c t))) \/((t:(class_trans c))(copy_p c t))  Unfortunately, H is a propositition and  and the Well founded relation is a set.  Therefore, we cannot perform an elimination.  So I assumed I has axioms ex_rec and or_rec. Why was legal defined as a Config->Prop and not a set? Why not do everything with set?   BUT, HAVE I PROVED that all no_copy sequences terminate?  There are still more things to prove: - what's happening when we introduce copy, can we say anything about infinite transitions?  *)

(* Specifications: *)
Lemma always_process_messages :
forall c : Config,
legal c ->
forall (s1 s2 : Site) (m : Message),
first Message (bm c s1 s2) = value Message m ->
exists t : class_trans c,
legal (transition c t) /\
bm (transition c t) s1 s2 = first_out Message (bm c s1 s2).