germanish4.cub

type req = Empty | Reqs | Reqe | Inv | Invack
type cstate = Invalid | Shared | Exclusive

var Exgntd : bool
var Curcmd : req
var Curptr : proc

array Cache[proc] : cstate
array Shrset[proc] : bool
array Chan1[proc] : req
array Chan3[proc] : req

init (z) { Cache[z] = Invalid && Shrset[z] = False &&
           Exgntd = False && Curcmd = Empty && 
	   Chan1[z]=Empty && Chan3[z]=Empty }

(*
invariant (z) { Cache[z] = Exclusive && Exgntd  = False }
invariant (z) { Cache[z] = Shared && Shrset[z] = False }
*)


unsafe (z1 z2) { Cache[z1] = Exclusive && Cache[z2] = Shared }

transition send_shared (n)
requires { Chan1[n] = Empty && Cache[n] = Invalid }
{ 
  Chan1[j] := case 
  	       | j = n : Reqs 
	       | _ : Chan1[j] 
}

transition recv_shared (n)
requires { Curcmd = Empty && Chan1[n] = Reqs }
{ 
  Curcmd := Reqs; 
  Curptr := n;
  Chan1[j] := case
    	       | j = n : Empty 
	       | _ : Chan1[j] 
}
    
transition send_exclusive (n)
requires { Chan1[n] = Empty && Cache[n] <> Exclusive }
{ 
  Chan1[j] := case
  	       | j = n : Reqe 
	       | _ : Chan1[j] 
}

transition recv_exclusive (n)
requires { Curcmd = Empty && Chan1[n] = Reqe }
{ 
  Curcmd := Reqe; 
  Curptr := n;
  Chan1[j] := case
  	       | j = n : Empty 
	       | _ : Chan1[j] 
}
    
transition sendinv_1 (n)
requires { Chan3[n] = Empty && Shrset[n]=True  &&  Curcmd = Reqe }
{ 
  Chan3[j] := case 
  	       | j = n : Inv 
	       | _ : Chan3[j] 
}


transition sendinv_2 (n)
requires { Chan3[n] = Empty && Shrset[n]=True  &&
	   Curcmd = Reqs && Exgntd=True }
{ 
  Chan3[j] := case 
  	       | j = n : Inv 
	       | _ : Chan3[j] 
}

transition recv_inv(n)
requires { Chan3[n] = Inv }
{ 
  Chan3[j] := case
  	       | j = n : Invack 
	       | _ : Chan3[j] ;
  Cache[j] := case 
  	       | j = n : Invalid 
	       | _ : Cache[j] 
}
    
transition recv_invack(n)
requires { Chan3[n] = Invack && Curcmd <> Empty }
{ 
  Exgntd := False;
  Chan3[j] := case 
  	       | j = n : Empty 
	       | _ : Chan3[j];
  Shrset[j] := case 
  	        | j = n : False 
		| _ : Shrset[j] 
}

transition gnt_shared (n)
requires { Curptr = n && Curcmd = Reqs && Exgntd = False }
{ 
  Curcmd := Empty;
  Shrset[j] := case 
  	        | j = n : True 
		| _ : Shrset[j];
  Cache[j] := case 
  	       | j = n : Shared 
	       | _ : Cache[j] 
}

transition gnt_exclusive (n)
requires { Shrset[n] = False && Curcmd = Reqe && Exgntd = False && 
	   Curptr = n && forall_other l. Shrset[l] = False }
{ 
  Curcmd := Empty; 
  Exgntd := True;
  Shrset[j] := case
  	        | j = n : True 
		| _ : Shrset[j];
  Cache[j] := case  
  	       | j = n : Exclusive 
	       | _ : Cache[j] 
}