(* This program is free software; you can redistribute it and/or      *)
(* modify it under the terms of the GNU Lesser General Public License *)
(* as published by the Free Software Foundation; either version 2.1   *)
(* of the License, or (at your option) any later version.             *)
(*                                                                    *)
(* This program is distributed in the hope that it will be useful,    *)
(* but WITHOUT ANY WARRANTY; without even the implied warranty of     *)
(* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the      *)
(* GNU General Public License for more details.                       *)
(*                                                                    *)
(* You should have received a copy of the GNU Lesser General Public   *)
(* License along with this program; if not, write to the Free         *)
(* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA *)
(* 02110-1301 USA                                                     *)


(* RECEIVE DEC *)

(*definit la transition receive dec et ses consequences*)

Require Export init.
Require Export table_act.
Require Export mess_act.

Unset Standard Proposition Elimination Names.

Section DEF_REC_DEC.

Definition rec_dec_trans (c : Config) (s1 s2 : Site) :=
  mkconfig (S (time c)) (dt c) (Dec_send_table (st c) s2) 
    (rt c) (Collect_message (bm c) s1 s2). 

End DEF_REC_DEC.

Section REC_DEC_EFFECT.

(* invariants *)

Variable c0 : Config.

Variable s0 s1 s2 : Site.

Lemma rdec_trans_le_dt_time :
 dt c0 s0 <= time c0 ->
 dt (rec_dec_trans c0 s1 s2) s0 <= time (rec_dec_trans c0 s1 s2).
Proof.
(* Goal: forall _ : le (dt c0 s0) (time c0), le (dt (rec_dec_trans c0 s1 s2) s0) (time (rec_dec_trans c0 s1 s2)) *)
 simpl in |- *; auto.
Qed.

Lemma rdec_trans_diff_site :
 forall s3 s4 : Site,
 (In_queue Message copy (bm c0 s3 s4) -> s3 <> s4) ->
 In_queue Message copy (bm (rec_dec_trans c0 s1 s2) s3 s4) -> s3 <> s4.
Proof.
(* Goal: forall (s3 s4 : Site) (_ : forall _ : parent c0 s3 s4, lt (dt c0 s3) (dt c0 s4)) (_ : parent (rec_dec_trans c0 s1 s2) s3 s4), lt (dt (rec_dec_trans c0 s1 s2) s3) (dt (rec_dec_trans c0 s1 s2) s4) *)
 simpl in |- *; intros; apply H.
(* Goal: In_queue Message copy (bm c0 s3 s4) *)
 apply in_collect with (s1 := s1) (s2 := s2); trivial.
Qed.

Lemma rdec_trans_st :
 st (rec_dec_trans c0 s1 s2) s0 =
 (if eq_site_dec s0 s2 then (st c0 s0 - 1)%Z else st c0 s0).
Proof.
(* Goal: @eq Z (st (rec_dec_trans c0 s1 s2) s0) (if eq_site_dec s0 s2 then Z.sub (st c0 s0) (Zpos xH) else st c0 s0) *)
 simpl in |- *; case (eq_site_dec s0 s2); intro.
(* Goal: @eq Z (Dec_send_table (st c0) s2 s0) (Z.sub (st c0 s0) (Zpos xH)) *)
(* Goal: @eq Z (Dec_send_table (st c0) s2 s0) (st c0 s0) *)
 rewrite e; apply pred_dec_send_table.

(* Goal: @eq Z (Dec_send_table (st c0) s2 s0) (st c0 s0) *)
 apply no_dec_send_table; auto.
Qed.

Lemma rdec_trans_in_queue :
 forall s3 s4 : Site,
 In_queue Message (inc_dec s0) (bm (rec_dec_trans c0 s1 s2) s3 s4) ->
 In_queue Message (inc_dec s0) (bm c0 s3 s4).
Proof.
(* Goal: forall (s3 s4 : Site) (_ : In_queue Message (inc_dec s0) (bm (rec_dec_trans c0 s1 s2) s3 s4)), In_queue Message (inc_dec s0) (bm c0 s3 s4) *)
 simpl in |- *; intros.
(* Goal: In_queue Message (inc_dec s0) (bm c0 s3 s4) *)
 apply in_collect with (s1 := s1) (s2 := s2); auto.
Qed.

Lemma rdec_trans_st_rt :
 ((st c0 s0 > 0)%Z -> rt c0 s0 = true) ->
 (st (rec_dec_trans c0 s1 s2) s0 > 0)%Z ->
 rt (rec_dec_trans c0 s1 s2) s0 = true.
Proof.
(* Goal: @eq Z (st (rec_dec_trans c0 s1 s2) s0) (if eq_site_dec s0 s2 then Z.sub (st c0 s0) (Zpos xH) else st c0 s0) *)
 rewrite rdec_trans_st; simpl in |- *; case (eq_site_dec s0 s2); intro.
(* Goal: forall (_ : forall _ : Z.gt (st c0 s0) Z0, @eq bool (rt c0 s0) true) (_ : Z.gt (Z.sub (st c0 s0) (Zpos xH)) Z0), @eq bool (rt c0 s0) true *)
(* Goal: forall (_ : forall _ : Z.gt (st c0 s0) Z0, @eq bool (rt c0 s0) true) (_ : Z.gt (st c0 s0) Z0), @eq bool (rt c0 s0) true *)
 intros; apply H; omega.

(* Goal: forall (_ : forall _ : Z.gt (st c0 s0) Z0, @eq bool (rt c0 s0) true) (_ : Z.gt (st c0 s0) Z0), @eq bool (rt c0 s0) true *)
 auto.
Qed.

End REC_DEC_EFFECT.

Section REC_DEC_CTRL.

(* decompte de messages *)

Variable c0 : Config.

Variable s0 s1 s2 : Site.

Hypothesis first_mess : first Message (bm c0 s1 s2) = value Message dec.

Lemma rdec_trans_ctrl_copy :
 forall s3 : Site,
 ctrl_copy s0 s3 (bm (rec_dec_trans c0 s1 s2)) = ctrl_copy s0 s3 (bm c0).
Proof.
(* Goal: forall s3 : Site, @eq Z (ctrl_copy s0 s3 (bm (rec_dec_trans c0 s1 s2))) (ctrl_copy s0 s3 (bm c0)) *)
 intros; unfold ctrl_copy in |- *; simpl in |- *.
(* Goal: @eq Z (card_mess (inc_dec s0) (Collect_message (bm c0) s1 s2 s3 owner)) (card_mess (inc_dec s0) (bm c0 s3 owner)) *)
 apply diff_collect_card_mess.
(* Goal: or (not (@eq (exc Message) (first Message (bm c0 s3 owner)) (value Message (inc_dec s0)))) (or (not (@eq Site s3 s1)) (not (@eq Site owner s2))) *)
 apply diff_or_elsewhere with (m := dec); [ trivial | discriminate ].
Qed.

Lemma rdec_trans_ctrl_dec :
 forall s3 : Site,
 ctrl_dec s0 s3 (bm (rec_dec_trans c0 s1 s2)) =
 (if eq_site_dec s0 s2
  then
  if eq_site_dec s3 s1
   then (ctrl_dec s0 s3 (bm c0) - 1)%Z
   else ctrl_dec s0 s3 (bm c0)
  else ctrl_dec s0 s3 (bm c0)).
Proof.
(* Goal: forall s3 : Site, @eq Z (ctrl_dec s0 s3 (bm (rec_dec_trans c0 s1 s2))) (if eq_site_dec s0 s2 then if eq_site_dec s3 s1 then Z.sub (ctrl_dec s0 s3 (bm c0)) (Zpos xH) else ctrl_dec s0 s3 (bm c0) else ctrl_dec s0 s3 (bm c0)) *)
 intros; unfold ctrl_dec in |- *; simpl in |- *.
(* Goal: @eq Z (sigma Site LS (fun si : Site => ctrl_dec s0 si (bm (rec_dec_trans c0 s1 s2)))) (if eq_site_dec s0 s2 then Z.sub (sigma Site LS (fun si : Site => ctrl_dec s0 si (bm c0))) (Zpos xH) else sigma Site LS (fun si : Site => ctrl_dec s0 si (bm c0))) *)
 case (eq_site_dec s0 s2); intro.
(* Goal: @eq Z (card_mess dec (Collect_message (bm c0) s1 s2 s3 s0)) (if eq_site_dec s3 s1 then Z.sub (card_mess dec (bm c0 s3 s0)) (Zpos xH) else card_mess dec (bm c0 s3 s0)) *)
(* Goal: @eq Z (card_mess dec (Collect_message (bm c0) s1 s2 s3 s0)) (card_mess dec (bm c0 s3 s0)) *)
 case (eq_site_dec s3 s1); intro.
(* Goal: @eq Z (card_mess dec (Collect_message (bm c0) s1 s2 s3 s0)) (Z.sub (card_mess dec (bm c0 s3 s0)) (Zpos xH)) *)
(* Goal: @eq Z (card_mess dec (Collect_message (bm c0) s1 s2 s3 s0)) (card_mess dec (bm c0 s3 s0)) *)
(* Goal: @eq Z (card_mess dec (Collect_message (bm c0) s1 s2 s3 s0)) (card_mess dec (bm c0 s3 s0)) *)
 rewrite e; rewrite e0; apply collect_card_mess; trivial.

(* Goal: forall (_ : forall _ : Z.gt (st c0 s0) Z0, @eq bool (rt c0 s0) true) (_ : Z.gt (st c0 s0) Z0), @eq bool (rt c0 s0) true *)
 apply diff_collect_card_mess; auto.

(* Goal: forall (_ : forall _ : Z.gt (st c0 s0) Z0, @eq bool (rt c0 s0) true) (_ : Z.gt (st c0 s0) Z0), @eq bool (rt c0 s0) true *)
 apply diff_collect_card_mess; auto.
Qed.

Lemma rdec_trans_ctrl_inc :
 forall s3 : Site,
 ctrl_inc s0 s3 (bm (rec_dec_trans c0 s1 s2)) = ctrl_inc s0 s3 (bm c0).
Proof.
(* Goal: forall s3 : Site, @eq Z (ctrl_inc s0 s3 (bm (rec_dec_trans c0 s1 s2))) (ctrl_inc s0 s3 (bm c0)) *)
 intros; unfold ctrl_inc in |- *; simpl in |- *.
(* Goal: @eq Z (card_mess (inc_dec s0) (Collect_message (bm c0) s1 s2 s3 owner)) (card_mess (inc_dec s0) (bm c0 s3 owner)) *)
 apply diff_collect_card_mess.
(* Goal: or (not (@eq (exc Message) (first Message (bm c0 s3 owner)) (value Message (inc_dec s0)))) (or (not (@eq Site s3 s1)) (not (@eq Site owner s2))) *)
 apply diff_or_elsewhere with (m := dec); [ trivial | discriminate ].
Qed.

Remark rdec_trans_sigma_copy :
 sigma_ctrl_copy s0 (bm (rec_dec_trans c0 s1 s2)) =
 sigma_ctrl_copy s0 (bm c0).
Proof.
(* Goal: @eq Z (sigma_ctrl_copy s0 (bm (rec_dec_trans c0 s1 s2))) (sigma_ctrl_copy s0 (bm c0)) *)
 intros; unfold sigma_ctrl_copy in |- *.
(* Goal: @eq Z (sigma Site LS (fun si : Site => ctrl_copy s0 si (bm (rec_dec_trans c0 s1 s2)))) (sigma Site LS (fun si : Site => ctrl_copy s0 si (bm c0))) *)
 apply sigma_simpl; intros; apply rdec_trans_ctrl_copy.
Qed.

Remark rdec_trans_sigma_dec :
 sigma_ctrl_dec s0 (bm (rec_dec_trans c0 s1 s2)) =
 (if eq_site_dec s0 s2
  then (sigma_ctrl_dec s0 (bm c0) - 1)%Z
  else sigma_ctrl_dec s0 (bm c0)).
Proof.
(* Goal: @eq Z (sigma_ctrl_dec s0 (bm (rec_dec_trans c0 s1 s2))) (if eq_site_dec s0 s2 then Z.sub (sigma_ctrl_dec s0 (bm c0)) (Zpos xH) else sigma_ctrl_dec s0 (bm c0)) *)
 intros; unfold sigma_ctrl_dec in |- *.
(* Goal: @eq Z (sigma Site LS (fun si : Site => ctrl_dec s0 si (bm (rec_dec_trans c0 s1 s2)))) (if eq_site_dec s0 s2 then Z.sub (sigma Site LS (fun si : Site => ctrl_dec s0 si (bm c0))) (Zpos xH) else sigma Site LS (fun si : Site => ctrl_dec s0 si (bm c0))) *)
 case (eq_site_dec s0 s2); intro.
(* Goal: @eq Z (sigma Site LS (fun s' : Site => xi (rec_dec_trans c0 s1 s2) s')) (Z.sub (sigma Site LS (fun s' : Site => xi c0 s')) (Zpos xH)) *)
(* Goal: @eq Z (sigma Site LS (fun s' : Site => xi (rec_dec_trans c0 s1 s2) s')) (sigma Site LS (fun s' : Site => xi c0 s')) *)
 apply sigma__pred with (eq_E_dec := eq_site_dec) (x0 := s1).
(* Goal: list_of_elements Site eq_site_dec LS *)
(* Goal: @eq Z (xi (rec_dec_trans c0 s1 s2) s1) (Z.sub (xi c0 s1) (Zpos xH)) *)
(* Goal: forall (x : Site) (_ : not (@eq Site x s1)), @eq Z (xi (rec_dec_trans c0 s1 s2) x) (xi c0 x) *)
(* Goal: @eq Z (sigma Site LS (fun s' : Site => xi (rec_dec_trans c0 s1 s2) s')) (sigma Site LS (fun s' : Site => xi c0 s')) *)
 exact finite_site.

(* Goal: @eq Z (Z.add (Z.add (Int (rt (rec_dec_trans c0 s1 s2) s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm (rec_dec_trans c0 s1 s2)))) (if eq_site_dec owner s2 then if eq_site_dec s0 s1 then Z.sub (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) (Zpos xH) else Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0)) else Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) *)
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 rewrite rdec_trans_ctrl_dec.
(* Goal: @eq Z (if eq_site_dec s0 s2 then if eq_site_dec s1 s1 then Z.sub (ctrl_dec s0 s1 (bm c0)) (Zpos xH) else ctrl_dec s0 s1 (bm c0) else ctrl_dec s0 s1 (bm c0)) (Z.sub (ctrl_dec s0 s1 (bm c0)) (Zpos xH)) *)
(* Goal: forall (x : Site) (_ : not (@eq Site x s1)), @eq Z (ctrl_dec s0 x (bm (rec_dec_trans c0 s1 s2))) (ctrl_dec s0 x (bm c0)) *)
(* Goal: @eq Z (sigma Site LS (fun si : Site => ctrl_dec s0 si (bm (rec_dec_trans c0 s1 s2)))) (sigma Site LS (fun si : Site => ctrl_dec s0 si (bm c0))) *)
 rewrite e; do 2 rewrite case_eq; trivial.

(* Goal: @eq Z (Z.add (Z.add (Int (rt (rec_dec_trans c0 s1 s2) s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm (rec_dec_trans c0 s1 s2)))) (if eq_site_dec owner s2 then if eq_site_dec s0 s1 then Z.sub (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) (Zpos xH) else Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0)) else Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) *)
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 intros; rewrite rdec_trans_ctrl_dec.
(* Goal: @eq Z (if eq_site_dec owner s2 then if eq_site_dec x s1 then Z.sub (xi c0 x) (Zpos xH) else xi c0 x else xi c0 x) (xi c0 x) *)
(* Goal: @eq Z (sigma Site LS (fun s' : Site => xi (rec_dec_trans c0 s1 s2) s')) (sigma Site LS (fun s' : Site => xi c0 s')) *)
 rewrite e; rewrite case_eq; apply case_ineq; trivial.

(* Goal: @eq Z (Z.add (Z.add (Int (rt (rec_dec_trans c0 s1 s2) s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm (rec_dec_trans c0 s1 s2)))) (if eq_site_dec owner s2 then if eq_site_dec s0 s1 then Z.sub (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) (Zpos xH) else Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0)) else Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) *)
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 apply sigma_simpl; intros; rewrite rdec_trans_ctrl_dec.
(* Goal: @eq Z (if eq_site_dec owner s2 then if eq_site_dec x s1 then Z.sub (xi c0 x) (Zpos xH) else xi c0 x else xi c0 x) (xi c0 x) *)
 apply case_ineq; trivial.
Qed.

Remark rdec_trans_sigma_inc :
 sigma_ctrl_inc s0 (bm (rec_dec_trans c0 s1 s2)) = sigma_ctrl_inc s0 (bm c0).
Proof.
(* Goal: @eq Z (sigma_ctrl_inc s0 (bm (rec_dec_trans c0 s1 s2))) (sigma_ctrl_inc s0 (bm c0)) *)
 intros; unfold sigma_ctrl_inc in |- *.
(* Goal: @eq Z (sigma Site LS (fun si : Site => ctrl_inc s0 si (bm (rec_dec_trans c0 s1 s2)))) (sigma Site LS (fun si : Site => ctrl_inc s0 si (bm c0))) *)
 apply sigma_simpl; intros; apply rdec_trans_ctrl_inc.
Qed.

Lemma rdec_trans_sigma_ctrl :
 sigma_ctrl s0 (bm (rec_dec_trans c0 s1 s2)) =
 (if eq_site_dec s0 s2
  then (sigma_ctrl s0 (bm c0) - 1)%Z
  else sigma_ctrl s0 (bm c0)).
Proof.
 intros; unfold sigma_ctrl in |- *.
 rewrite rdec_trans_sigma_copy.
 rewrite rdec_trans_sigma_dec.
 rewrite rdec_trans_sigma_inc.
(* Goal: @eq Z (sigma Site LS (fun si : Site => ctrl_dec s0 si (bm (rec_dec_trans c0 s1 s2)))) (if eq_site_dec s0 s2 then Z.sub (sigma Site LS (fun si : Site => ctrl_dec s0 si (bm c0))) (Zpos xH) else sigma Site LS (fun si : Site => ctrl_dec s0 si (bm c0))) *)
 case (eq_site_dec s0 s2); intro.
(* Goal: @eq Z (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (Z.sub (ctrl_dec owner s0 (bm c0)) (Zpos xH))) (Z.sub (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) (Zpos xH)) *)
(* Goal: @eq Z (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) *)
(* Goal: @eq Z (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) *)
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 omega.

(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 trivial.
Qed.

End REC_DEC_CTRL.

Section REC_DEC_XY.

Variable c0 : Config.

Variable s1 s2 : Site.

Hypothesis first_mess : first Message (bm c0 s1 s2) = value Message dec.

Remark rdec_trans_xi :
 forall s0 : Site,
 xi (rec_dec_trans c0 s1 s2) s0 =
 (if eq_site_dec owner s2
  then
   if eq_site_dec s0 s1 then (xi c0 s0 - 1)%Z else xi c0 s0
  else xi c0 s0).
Proof.
(* Goal: forall s0 : Site, @eq Z (xi (rec_dec_trans c0 s1 s2) s0) (if eq_site_dec owner s2 then if eq_site_dec s0 s1 then Z.sub (xi c0 s0) (Zpos xH) else xi c0 s0 else xi c0 s0) *)
 intro; unfold xi in |- *.
(* Goal: @eq Z (Z.add (Z.add (Int (rt (rec_dec_trans c0 s1 s2) s0)) (ctrl_copy owner s0 (bm (rec_dec_trans c0 s1 s2)))) (ctrl_dec owner s0 (bm (rec_dec_trans c0 s1 s2)))) (if eq_site_dec owner s2 then if eq_site_dec s0 s1 then Z.sub (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) (Zpos xH) else Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0)) else Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) *)
 rewrite rdec_trans_ctrl_copy.
(* Goal: @eq Z (Z.add (Z.add (Int (rt (rec_dec_trans c0 s1 s2) s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm (rec_dec_trans c0 s1 s2)))) (if eq_site_dec owner s2 then if eq_site_dec s0 s1 then Z.sub (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) (Zpos xH) else Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0)) else Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) *)
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 rewrite rdec_trans_ctrl_dec.
(* Goal: @eq Z (Z.add (Z.add (Int (rt (rec_dec_trans c0 s1 s2) s0)) (ctrl_copy owner s0 (bm c0))) (if eq_site_dec owner s2 then if eq_site_dec s0 s1 then Z.sub (ctrl_dec owner s0 (bm c0)) (Zpos xH) else ctrl_dec owner s0 (bm c0) else ctrl_dec owner s0 (bm c0))) (if eq_site_dec owner s2 then if eq_site_dec s0 s1 then Z.sub (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) (Zpos xH) else Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0)) else Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) *)
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 simpl in |- *; case (eq_site_dec owner s2); intro.
(* Goal: @eq Z (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (if eq_site_dec s0 s1 then Z.sub (ctrl_dec owner s0 (bm c0)) (Zpos xH) else ctrl_dec owner s0 (bm c0))) (if eq_site_dec s0 s1 then Z.sub (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) (Zpos xH) else Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) *)
(* Goal: @eq Z (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) *)
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 case (eq_site_dec s0 s1); intro.
(* Goal: @eq Z (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (Z.sub (ctrl_dec owner s0 (bm c0)) (Zpos xH))) (Z.sub (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) (Zpos xH)) *)
(* Goal: @eq Z (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) *)
(* Goal: @eq Z (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) (Z.add (Z.add (Int (rt c0 s0)) (ctrl_copy owner s0 (bm c0))) (ctrl_dec owner s0 (bm c0))) *)
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 omega.

(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 trivial.

(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 trivial.

(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 trivial.

(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 trivial.
Qed.

Remark rdec_trans_yi :
 forall s0 : Site, yi (rec_dec_trans c0 s1 s2) s0 = yi c0 s0.
Proof.
(* Goal: forall s0 : Site, @eq Z (yi (rec_dec_trans c0 s1 s2) s0) (yi c0 s0) *)
 intro; unfold yi in |- *; apply sigma_simpl.
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 intros; apply rdec_trans_ctrl_inc; trivial.
Qed.

Lemma rdec_trans_sigma_xi :
 sigma_xi (rec_dec_trans c0 s1 s2) =
 (if eq_site_dec owner s2
  then (sigma_xi c0 - 1)%Z
  else sigma_xi c0).
Proof.
(* Goal: @eq Z (sigma_xi (rec_dec_trans c0 s1 s2)) (if eq_site_dec owner s2 then Z.sub (sigma_xi c0) (Zpos xH) else sigma_xi c0) *)
 unfold sigma_xi in |- *; case (eq_site_dec owner s2); intro.
(* Goal: @eq Z (sigma Site LS (fun s' : Site => xi (rec_dec_trans c0 s1 s2) s')) (Z.sub (sigma Site LS (fun s' : Site => xi c0 s')) (Zpos xH)) *)
(* Goal: @eq Z (sigma Site LS (fun s' : Site => xi (rec_dec_trans c0 s1 s2) s')) (sigma Site LS (fun s' : Site => xi c0 s')) *)
 apply sigma__pred with (eq_E_dec := eq_site_dec) (x0 := s1).
(* Goal: list_of_elements Site eq_site_dec LS *)
(* Goal: @eq Z (xi (rec_dec_trans c0 s1 s2) s1) (Z.sub (xi c0 s1) (Zpos xH)) *)
(* Goal: forall (x : Site) (_ : not (@eq Site x s1)), @eq Z (xi (rec_dec_trans c0 s1 s2) x) (xi c0 x) *)
(* Goal: @eq Z (sigma Site LS (fun s' : Site => xi (rec_dec_trans c0 s1 s2) s')) (sigma Site LS (fun s' : Site => xi c0 s')) *)
 exact finite_site.

(* Goal: @eq Z (xi (rec_dec_trans c0 s1 s2) s1) (Z.sub (xi c0 s1) (Zpos xH)) *)
(* Goal: forall (x : Site) (_ : not (@eq Site x s1)), @eq Z (xi (rec_dec_trans c0 s1 s2) x) (xi c0 x) *)
(* Goal: @eq Z (sigma Site LS (fun s' : Site => xi (rec_dec_trans c0 s1 s2) s')) (sigma Site LS (fun s' : Site => xi c0 s')) *)
 rewrite rdec_trans_xi.
(* Goal: @eq Z (if eq_site_dec owner s2 then if eq_site_dec s1 s1 then Z.sub (xi c0 s1) (Zpos xH) else xi c0 s1 else xi c0 s1) (Z.sub (xi c0 s1) (Zpos xH)) *)
(* Goal: forall (x : Site) (_ : not (@eq Site x s1)), @eq Z (xi (rec_dec_trans c0 s1 s2) x) (xi c0 x) *)
(* Goal: @eq Z (sigma Site LS (fun s' : Site => xi (rec_dec_trans c0 s1 s2) s')) (sigma Site LS (fun s' : Site => xi c0 s')) *)
 rewrite e; rewrite case_eq; apply case_eq.

(* Goal: @eq Z (xi (rec_dec_trans c0 s1 s2) s1) (Z.sub (xi c0 s1) (Zpos xH)) *)
(* Goal: forall (x : Site) (_ : not (@eq Site x s1)), @eq Z (xi (rec_dec_trans c0 s1 s2) x) (xi c0 x) *)
(* Goal: @eq Z (sigma Site LS (fun s' : Site => xi (rec_dec_trans c0 s1 s2) s')) (sigma Site LS (fun s' : Site => xi c0 s')) *)
 intros; rewrite rdec_trans_xi.
(* Goal: @eq Z (if eq_site_dec owner s2 then if eq_site_dec x s1 then Z.sub (xi c0 x) (Zpos xH) else xi c0 x else xi c0 x) (xi c0 x) *)
(* Goal: @eq Z (sigma Site LS (fun s' : Site => xi (rec_dec_trans c0 s1 s2) s')) (sigma Site LS (fun s' : Site => xi c0 s')) *)
 rewrite e; rewrite case_eq; apply case_ineq; trivial.

(* Goal: @eq Z (sigma Site LS (fun s' : Site => xi (rec_dec_trans c0 s1 s2) s')) (sigma Site LS (fun s' : Site => xi c0 s')) *)
 apply sigma_simpl.
(* Goal: @eq Z (xi (rec_dec_trans c0 s1 s2) s1) (Z.sub (xi c0 s1) (Zpos xH)) *)
(* Goal: forall (x : Site) (_ : not (@eq Site x s1)), @eq Z (xi (rec_dec_trans c0 s1 s2) x) (xi c0 x) *)
(* Goal: @eq Z (sigma Site LS (fun s' : Site => xi (rec_dec_trans c0 s1 s2) s')) (sigma Site LS (fun s' : Site => xi c0 s')) *)
 intros; rewrite rdec_trans_xi.
(* Goal: @eq Z (if eq_site_dec owner s2 then if eq_site_dec x s1 then Z.sub (xi c0 x) (Zpos xH) else xi c0 x else xi c0 x) (xi c0 x) *)
 apply case_ineq; trivial.
Qed.

Lemma rdec_trans_sigma_yi : sigma_yi (rec_dec_trans c0 s1 s2) = sigma_yi c0.
Proof.
(* Goal: @eq Z (sigma_yi (rec_dec_trans c0 s1 s2)) (sigma_yi c0) *)
 unfold sigma_yi in |- *; apply sigma_simpl; intros; apply rdec_trans_yi.
Qed.

End REC_DEC_XY.

Section REC_DEC_ALT.

(* structure de file *)

Variable c0 : Config.

Variable s0 s1 s2 : Site.

Lemma rdec_trans_D :
 D_queue (bm c0 s0 owner) -> D_queue (bm (rec_dec_trans c0 s1 s2) s0 owner).
Proof.
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 simpl in |- *; intros; apply D_collect; trivial.
Qed.

Lemma rdec_trans_alt :
 alternate (bm c0 s0 owner) ->
 alternate (bm (rec_dec_trans c0 s1 s2) s0 owner).
Proof.
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 intros; simpl in |- *; apply alt_collect; trivial.
Qed.

End REC_DEC_ALT.

Section REC_DEC_RELAT.

(* relation parent *)

Variable c0 : Config.

Variable s1 s2 : Site.

Remark rdec_trans_parent :
 forall s3 s4 : Site,
 parent (rec_dec_trans c0 s1 s2) s4 s3 -> parent c0 s4 s3.
Proof.
(* Goal: forall (s3 s4 : Site) (_ : parent (rec_dec_trans c0 s1 s2) s4 s3), parent c0 s4 s3 *)
 intros; elim H.
(* Goal: forall (s3 s0 : Site) (_ : In_queue Message (inc_dec s3) (bm (rec_dec_trans c0 s1 s2) s0 owner)), parent c0 s3 s0 *)
 intros; apply parent_intro.
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 apply rdec_trans_in_queue with (s1 := s1) (s2 := s2); trivial.
Qed.

Lemma rdec_trans_parent_cr :
 forall s3 s4 : Site,
 (parent c0 s3 s4 -> dt c0 s3 < dt c0 s4) ->
 parent (rec_dec_trans c0 s1 s2) s3 s4 ->
 dt (rec_dec_trans c0 s1 s2) s3 < dt (rec_dec_trans c0 s1 s2) s4.
Proof.
(* Goal: forall (s3 s4 : Site) (_ : forall _ : parent c0 s3 s4, lt (dt c0 s3) (dt c0 s4)) (_ : parent (rec_dec_trans c0 s1 s2) s3 s4), lt (dt (rec_dec_trans c0 s1 s2) s3) (dt (rec_dec_trans c0 s1 s2) s4) *)
 simpl in |- *; intros; apply H.
(* Goal: @eq (exc Message) (first Message (bm c0 s1 s2)) (value Message dec) *)
 apply rdec_trans_parent; trivial.
Qed.

End REC_DEC_RELAT.
