156
|
1 |
Sender = IOA + Action + Multiset + List + "Lemmas" +
|
|
2 |
|
|
3 |
types
|
|
4 |
|
|
5 |
'm sender_state = "'m list * bool multiset * bool multiset * bool * bool"
|
|
6 |
(* messages #sent #received header mode *)
|
|
7 |
|
|
8 |
consts
|
|
9 |
|
|
10 |
sender_asig :: "'m action signature"
|
|
11 |
sender_trans :: "('m action, 'm sender_state)transition set"
|
|
12 |
sender_ioa :: "('m action, 'm sender_state)ioa"
|
|
13 |
sq :: "'m sender_state => 'm list"
|
|
14 |
ssent,srcvd :: "'m sender_state => bool multiset"
|
|
15 |
sbit :: "'m sender_state => bool"
|
|
16 |
ssending :: "'m sender_state => bool"
|
|
17 |
|
|
18 |
rules
|
|
19 |
|
|
20 |
sq_def "sq == fst"
|
|
21 |
ssent_def "ssent == fst o snd"
|
|
22 |
srcvd_def "srcvd == fst o snd o snd"
|
|
23 |
sbit_def "sbit == fst o snd o snd o snd"
|
|
24 |
ssending_def "ssending == snd o snd o snd o snd"
|
|
25 |
|
|
26 |
sender_asig_def
|
|
27 |
"sender_asig == <(UN m. {S_msg(m)}) Un (UN b. {R_ack(b)}), \
|
|
28 |
\ UN pkt. {S_pkt(pkt)}, \
|
|
29 |
\ {C_m_s,C_r_s}>"
|
|
30 |
|
|
31 |
sender_trans_def "sender_trans == \
|
|
32 |
\ {tr. let s = fst(tr); \
|
|
33 |
\ t = snd(snd(tr)) \
|
|
34 |
\ in case fst(snd(tr)) \
|
|
35 |
\ of \
|
|
36 |
\ S_msg(m) => sq(t)=sq(s)@[m] & \
|
|
37 |
\ ssent(t)=ssent(s) & \
|
|
38 |
\ srcvd(t)=srcvd(s) & \
|
|
39 |
\ sbit(t)=sbit(s) & \
|
|
40 |
\ ssending(t)=ssending(s) | \
|
|
41 |
\ R_msg(m) => False | \
|
|
42 |
\ S_pkt(pkt) => hdr(pkt) = sbit(s) & \
|
|
43 |
\ (? Q. sq(s) = (msg(pkt)#Q)) & \
|
|
44 |
\ sq(t) = sq(s) & \
|
|
45 |
\ ssent(t) = addm(ssent(s),sbit(s)) & \
|
|
46 |
\ srcvd(t) = srcvd(s) & \
|
|
47 |
\ sbit(t) = sbit(s) & \
|
|
48 |
\ ssending(s) & \
|
|
49 |
\ ssending(t) | \
|
|
50 |
\ R_pkt(pkt) => False | \
|
|
51 |
\ S_ack(b) => False | \
|
|
52 |
\ R_ack(b) => sq(t)=sq(s) & \
|
|
53 |
\ ssent(t)=ssent(s) & \
|
|
54 |
\ srcvd(t) = addm(srcvd(s),b) & \
|
|
55 |
\ sbit(t)=sbit(s) & \
|
|
56 |
\ ssending(t)=ssending(s) | \
|
|
57 |
\ C_m_s => count(ssent(s),~sbit(s)) < count(srcvd(s),~sbit(s)) & \
|
|
58 |
\ sq(t)=sq(s) & \
|
|
59 |
\ ssent(t)=ssent(s) & \
|
|
60 |
\ srcvd(t)=srcvd(s) & \
|
|
61 |
\ sbit(t)=sbit(s) & \
|
|
62 |
\ ssending(s) & \
|
|
63 |
\ ~ssending(t) | \
|
|
64 |
\ C_m_r => False | \
|
|
65 |
\ C_r_s => count(ssent(s),sbit(s)) <= count(srcvd(s),~sbit(s)) & \
|
|
66 |
\ sq(t)=tl(sq(s)) & \
|
|
67 |
\ ssent(t)=ssent(s) & \
|
|
68 |
\ srcvd(t)=srcvd(s) & \
|
|
69 |
\ sbit(t) = (~sbit(s)) & \
|
|
70 |
\ ~ssending(s) & \
|
|
71 |
\ ssending(t) | \
|
|
72 |
\ C_r_r(m) => False}"
|
|
73 |
|
|
74 |
sender_ioa_def "sender_ioa == \
|
|
75 |
\ <sender_asig, {<[],{|},{|},False,True>}, sender_trans>"
|
|
76 |
|
|
77 |
end
|