This is a listing of all goals defined over the current specification. Axioms are marked yellow, proved theorems green and unproved theorems blue. Click on individual names to get more information on the proof.
| Name: | Sequent: | Type: |
|---|---|---|
| step-absstep-I17-I18-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I17, pcf0(tid) = I18, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n, ls.e, true) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, allslotsfull(gs0.ar, ls0.n0, ls0.n0, ls0.e, true) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I17, τ) ∧ gs0 = gstepf(gs, ls, I17, τ) ∧ ls0 = lstepf(gs, ls, I17, τ) ∧ I18 = pcstepf(gs, ls, I17, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I15-idle-retINSERT-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I15, pcf0(tid) = idle, apcf(tid) = apc, ls.e = gs.ar[ls.n] ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ls.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(ags, als, apc, ARetInsert(ls.tid, b)) → ags0 = gstepf(ags, als, apc, ARetInsert(ls.tid, b)) ∧ als0 = lstepf(ags, als, apc, ARetInsert(ls.tid, b)) ∧ apc0 = pcstepf(ags, als, apc, ARetInsert(ls.tid, b)), pre(gs, ls, I15, retINSERT(ls.tid, b)) ∧ gs0 = gstepf(gs, ls, I15, retINSERT(ls.tid, b)) ∧ ls0 = lstepf(gs, ls, I15, retINSERT(ls.tid, b)) ∧ idle = pcstepf(gs, ls, I15, retINSERT(ls.tid, b)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retInsert ∧ (als.lb ↔ ls.b) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ pre(ags, als, apc, ARetInsert(ls.tid, b)) ∧ absset(gs0.ar, ags0.set) ∧ ls0.tid = als0.tid ∧ apc0 = idle ∧ (apc0 = invMember ∨ apc0 = invInsert → ls0.e = als0.le) | A Proof Obligation |
| step-absstep-M12-idle-retMEMBER-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M12, pcf0(tid) = idle, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ ls.e ≠ ls.e0, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(ags, als, apc, ARetMember(ls.tid, b)) → ags0 = gstepf(ags, als, apc, ARetMember(ls.tid, b)) ∧ als0 = lstepf(ags, als, apc, ARetMember(ls.tid, b)) ∧ apc0 = pcstepf(ags, als, apc, ARetMember(ls.tid, b)), pre(gs, ls, M12, retMEMBER(ls.tid, b)) ∧ gs0 = gstepf(gs, ls, M12, retMEMBER(ls.tid, b)) ∧ ls0 = lstepf(gs, ls, M12, retMEMBER(ls.tid, b)) ∧ idle = pcstepf(gs, ls, M12, retMEMBER(ls.tid, b)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retMember ∧ (als.lb ↔ ls.b) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ pre(ags, als, apc, ARetMember(ls.tid, b)) ∧ absset(gs0.ar, ags0.set) ∧ ls0.tid = als0.tid ∧ apc0 = idle ∧ (apc0 = invMember ∨ apc0 = invInsert → ls0.e = als0.le) | A Proof Obligation |
| step-absstep-M1-M2-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M1, pcf0(tid) = M2, apcf(tid) = apc, ls.e ≠ ⊥, ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M1, τ) ∧ gs0 = gstepf(gs, ls, M1, τ) ∧ ls0 = lstepf(gs, ls, M1, τ) ∧ M2 = pcstepf(gs, ls, M1, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I18-I19-doINSERT-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I18, pcf0(tid) = I19, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n0, ls.e, true) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, allslotsfull(gs0.ar, ls0.n0, ls0.n0, ls0.e, true) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(ags, als, apc, ADoInsert(ls.tid, false)) → ags0 = gstepf(ags, als, apc, ADoInsert(ls.tid, false)) ∧ als0 = lstepf(ags, als, apc, ADoInsert(ls.tid, false)) ∧ apc0 = pcstepf(ags, als, apc, ADoInsert(ls.tid, false)), pre(gs, ls, I18, doINSERT(ls.tid, false)) ∧ gs0 = gstepf(gs, ls, I18, doINSERT(ls.tid, false)) ∧ ls0 = lstepf(gs, ls, I18, doINSERT(ls.tid, false)) ∧ I19 = pcstepf(gs, ls, I18, doINSERT(ls.tid, false)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ pre(ags, als, apc, ADoInsert(ls.tid, false)) ∧ absset(gs0.ar, ags0.set) ∧ ls0.tid = als0.tid ∧ apc0 = retInsert ∧ (als0.lb ↔ ls0.b) ∧ (apc0 = invMember ∨ apc0 = invInsert → ls0.e = als0.le) | A Proof Obligation |
| step-absstep-I21-idle-retINSERT-other | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I21, pcf0(tid) = idle, apcf(tid) = apc, false, SetLInv(ags, als, apc), tid ≠ tid0, lsf(tid0).tid = tid0, HashsetLInv(gs, lsf(tid0), pcf(tid0)), HashsetLInv(gs0, lsf(tid0), pcf(tid0)), SetLInv(ags, alsf(tid0), apcf(tid0)), ∀ tid1. tid1 ≠ tid ∧ tid1 ≠ tid0 → HashsetLInv(gs, lsf(tid1), pcf(tid1)) ∧ SetLInv(ags, alsf(tid1), apcf(tid1)) ∧ labs(gs, lsf(tid1), pcf(tid1), ags, alsf(tid1), apcf(tid1)), pre(ags, als, apc, ARetInsert(ls.tid, b)) → ags0 = gstepf(ags, als, apc, ARetInsert(ls.tid, b)) ∧ als0 = lstepf(ags, als, apc, ARetInsert(ls.tid, b)) ∧ apc0 = pcstepf(ags, als, apc, ARetInsert(ls.tid, b)), pre(gs, ls, I21, retINSERT(ls.tid, b)) ∧ gs0 = gstepf(gs, ls, I21, retINSERT(ls.tid, b)) ∧ ls0 = lstepf(gs, ls, I21, retINSERT(ls.tid, b)) ∧ idle = pcstepf(gs, ls, I21, retINSERT(ls.tid, b)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retInsert ∧ ¬ als.lb ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le), lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) ⊦ lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) | A Proof Obligation |
| step-absstep-I1-I2-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I1, pcf0(tid) = I2, apcf(tid) = apc, ls.e ≠ ⊥, ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I1, τ) ∧ gs0 = gstepf(gs, ls, I1, τ) ∧ ls0 = lstepf(gs, ls, I1, τ) ∧ I2 = pcstepf(gs, ls, I1, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-M4-M5-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M4, pcf0(tid) = M5, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ls.n = ls.n0 ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false), ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M4, τ) ∧ gs0 = gstepf(gs, ls, M4, τ) ∧ ls0 = lstepf(gs, ls, M4, τ) ∧ M5 = pcstepf(gs, ls, M4, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| gabs-def | ⊦ gabs(gs, lsf, pcf, ags, alsf, apcf) ↔ absset(gs.ar, ags.set) | An Axiom |
| ren-invINSERT | ⊦ ren(invINSERT(tid, e), ags, alsf) = AInvInsert(tid, e) | An Axiom |
| step-absstep-I8-I9-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I8, pcf0(tid) = I9, apcf(tid) = apc, ls.e = ls.e0 ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.e = gs.ar[ls.n] ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.e = gs0.ar[ls0.n] ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I8, τ) ∧ gs0 = gstepf(gs, ls, I8, τ) ∧ ls0 = lstepf(gs, ls, I8, τ) ∧ I9 = pcstepf(gs, ls, I8, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retInsert ∧ (ls.e = ls.e0 → als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = retInsert ∧ (als.lb ↔ ls0.b) ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I14-I15-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I14, pcf0(tid) = I15, apcf(tid) = apc, ls.e = ls.e0 ∧ ls.e = gs.ar[ls.n] ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, ls0.e = gs0.ar[ls0.n] ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I14, τ) ∧ gs0 = gstepf(gs, ls, I14, τ) ∧ ls0 = lstepf(gs, ls, I14, τ) ∧ I15 = pcstepf(gs, ls, I14, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retInsert ∧ (ls.e = ls.e0 → als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = retInsert ∧ (als.lb ↔ ls0.b) ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I13-I16-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I13, pcf0(tid) = I16, apcf(tid) = apc, (gs.ar[ls.n] ≠ ⊥ ∧ gs.ar[ls.n] = ls.e0) ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, (gs0.ar[ls0.n] ≠ ⊥ ∧ gs0.ar[ls0.n] ≠ ls0.e) ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I13, τ) ∧ gs0 = gstepf(gs, ls, I13, τ) ∧ ls0 = lstepf(gs, ls, I13, τ) ∧ I16 = pcstepf(gs, ls, I13, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = (ls.e = ls.e0 ⊃ retInsert;invInsert) ∧ (ls.e = ls.e0 → als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-M14-M17-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M14, pcf0(tid) = M17, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, true), ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n ≠ ls0.n0, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M14, τ) ∧ gs0 = gstepf(gs, ls, M14, τ) ∧ ls0 = lstepf(gs, ls, M14, τ) ∧ M17 = pcstepf(gs, ls, M14, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = (ls.n ≠ ls.n0 ⊃ invMember;retMember) ∧ (ls.n = ls.n0 → ¬ als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I18-I19-doINSERT-other | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I18, pcf0(tid) = I19, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n0, ls.e, true) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, allslotsfull(gs0.ar, ls0.n0, ls0.n0, ls0.e, true) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), tid ≠ tid0, lsf(tid0).tid = tid0, HashsetLInv(gs, lsf(tid0), pcf(tid0)), HashsetLInv(gs0, lsf(tid0), pcf(tid0)), SetLInv(ags, alsf(tid0), apcf(tid0)), ∀ tid1. tid1 ≠ tid ∧ tid1 ≠ tid0 → HashsetLInv(gs, lsf(tid1), pcf(tid1)) ∧ SetLInv(ags, alsf(tid1), apcf(tid1)) ∧ labs(gs, lsf(tid1), pcf(tid1), ags, alsf(tid1), apcf(tid1)), pre(ags, als, apc, ADoInsert(ls.tid, false)) → ags0 = gstepf(ags, als, apc, ADoInsert(ls.tid, false)) ∧ als0 = lstepf(ags, als, apc, ADoInsert(ls.tid, false)) ∧ apc0 = pcstepf(ags, als, apc, ADoInsert(ls.tid, false)), pre(gs, ls, I18, doINSERT(ls.tid, false)) ∧ gs0 = gstepf(gs, ls, I18, doINSERT(ls.tid, false)) ∧ ls0 = lstepf(gs, ls, I18, doINSERT(ls.tid, false)) ∧ I19 = pcstepf(gs, ls, I18, doINSERT(ls.tid, false)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le), lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) ⊦ lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) | A Proof Obligation |
| step-absstep-I4-I5-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I4, pcf0(tid) = I5, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ls.n = ls.n0, allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I4, τ) ∧ gs0 = gstepf(gs, ls, I4, τ) ∧ ls0 = lstepf(gs, ls, I4, τ) ∧ I5 = pcstepf(gs, ls, I4, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = (ls0.b ⊃ retInsert;invInsert) ∧ (ls0.b → ¬ als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-M18-idle-retMEMBER-other | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M18, pcf0(tid) = idle, apcf(tid) = apc, false, SetLInv(ags, als, apc), tid ≠ tid0, lsf(tid0).tid = tid0, HashsetLInv(gs, lsf(tid0), pcf(tid0)), HashsetLInv(gs0, lsf(tid0), pcf(tid0)), SetLInv(ags, alsf(tid0), apcf(tid0)), ∀ tid1. tid1 ≠ tid ∧ tid1 ≠ tid0 → HashsetLInv(gs, lsf(tid1), pcf(tid1)) ∧ SetLInv(ags, alsf(tid1), apcf(tid1)) ∧ labs(gs, lsf(tid1), pcf(tid1), ags, alsf(tid1), apcf(tid1)), pre(ags, als, apc, ARetMember(ls.tid, b)) → ags0 = gstepf(ags, als, apc, ARetMember(ls.tid, b)) ∧ als0 = lstepf(ags, als, apc, ARetMember(ls.tid, b)) ∧ apc0 = pcstepf(ags, als, apc, ARetMember(ls.tid, b)), pre(gs, ls, M18, retMEMBER(ls.tid, b)) ∧ gs0 = gstepf(gs, ls, M18, retMEMBER(ls.tid, b)) ∧ ls0 = lstepf(gs, ls, M18, retMEMBER(ls.tid, b)) ∧ idle = pcstepf(gs, ls, M18, retMEMBER(ls.tid, b)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le), lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) ⊦ lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) | A Proof Obligation |
| step-absstep-I15-idle-retINSERT-other | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I15, pcf0(tid) = idle, apcf(tid) = apc, ls.e = gs.ar[ls.n] ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ls.b, SetLInv(ags, als, apc), tid ≠ tid0, lsf(tid0).tid = tid0, HashsetLInv(gs, lsf(tid0), pcf(tid0)), HashsetLInv(gs0, lsf(tid0), pcf(tid0)), SetLInv(ags, alsf(tid0), apcf(tid0)), ∀ tid1. tid1 ≠ tid ∧ tid1 ≠ tid0 → HashsetLInv(gs, lsf(tid1), pcf(tid1)) ∧ SetLInv(ags, alsf(tid1), apcf(tid1)) ∧ labs(gs, lsf(tid1), pcf(tid1), ags, alsf(tid1), apcf(tid1)), pre(ags, als, apc, ARetInsert(ls.tid, b)) → ags0 = gstepf(ags, als, apc, ARetInsert(ls.tid, b)) ∧ als0 = lstepf(ags, als, apc, ARetInsert(ls.tid, b)) ∧ apc0 = pcstepf(ags, als, apc, ARetInsert(ls.tid, b)), pre(gs, ls, I15, retINSERT(ls.tid, b)) ∧ gs0 = gstepf(gs, ls, I15, retINSERT(ls.tid, b)) ∧ ls0 = lstepf(gs, ls, I15, retINSERT(ls.tid, b)) ∧ idle = pcstepf(gs, ls, I15, retINSERT(ls.tid, b)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retInsert ∧ (als.lb ↔ ls.b) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le), lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) ⊦ lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) | A Proof Obligation |
| step-absstep-M17-M5-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M17, pcf0(tid) = M5, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n ≠ ls.n0, ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M17, τ) ∧ gs0 = gstepf(gs, ls, M17, τ) ∧ ls0 = lstepf(gs, ls, M17, τ) ∧ M5 = pcstepf(gs, ls, M17, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-idle-M1-invMEMBER-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = idle, pcf0(tid) = M1, apcf(tid) = apc, ls0.e ≠ ⊥, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(ags, als, apc, AInvMember(ls.tid, e0)) → ags0 = gstepf(ags, als, apc, AInvMember(ls.tid, e0)) ∧ als0 = lstepf(ags, als, apc, AInvMember(ls.tid, e0)) ∧ apc0 = pcstepf(ags, als, apc, AInvMember(ls.tid, e0)), pre(gs, ls, idle, invMEMBER(ls.tid, e0)) ∧ gs0 = gstepf(gs, ls, idle, invMEMBER(ls.tid, e0)) ∧ ls0 = lstepf(gs, ls, idle, invMEMBER(ls.tid, e0)) ∧ M1 = pcstepf(gs, ls, idle, invMEMBER(ls.tid, e0)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = idle ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ pre(ags, als, apc, AInvMember(ls.tid, e0)) ∧ absset(gs0.ar, ags0.set) ∧ ls0.tid = als0.tid ∧ apc0 = invMember ∧ (apc0 = invMember ∨ apc0 = invInsert → ls0.e = als0.le) | A Proof Obligation |
| step-absstep-I9-idle-retINSERT-other | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I9, pcf0(tid) = idle, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.e = gs.ar[ls.n] ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ls.b, SetLInv(ags, als, apc), tid ≠ tid0, lsf(tid0).tid = tid0, HashsetLInv(gs, lsf(tid0), pcf(tid0)), HashsetLInv(gs0, lsf(tid0), pcf(tid0)), SetLInv(ags, alsf(tid0), apcf(tid0)), ∀ tid1. tid1 ≠ tid ∧ tid1 ≠ tid0 → HashsetLInv(gs, lsf(tid1), pcf(tid1)) ∧ SetLInv(ags, alsf(tid1), apcf(tid1)) ∧ labs(gs, lsf(tid1), pcf(tid1), ags, alsf(tid1), apcf(tid1)), pre(ags, als, apc, ARetInsert(ls.tid, b)) → ags0 = gstepf(ags, als, apc, ARetInsert(ls.tid, b)) ∧ als0 = lstepf(ags, als, apc, ARetInsert(ls.tid, b)) ∧ apc0 = pcstepf(ags, als, apc, ARetInsert(ls.tid, b)), pre(gs, ls, I9, retINSERT(ls.tid, b)) ∧ gs0 = gstepf(gs, ls, I9, retINSERT(ls.tid, b)) ∧ ls0 = lstepf(gs, ls, I9, retINSERT(ls.tid, b)) ∧ idle = pcstepf(gs, ls, I9, retINSERT(ls.tid, b)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retInsert ∧ (als.lb ↔ ls.b) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le), lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) ⊦ lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) | A Proof Obligation |
| step-absstep-I6-I7-doINSERT-same | ls.e = gs.ar[ls.n], # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I6, pcf0(tid) = I7, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, (ls0.e0 ≠ ⊥ → ls0.e0 = gs0.ar[ls0.n]) ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(ags, als, apc, ADoInsert(ls.tid, true)) → ags0 = gstepf(ags, als, apc, ADoInsert(ls.tid, true)) ∧ als0 = lstepf(ags, als, apc, ADoInsert(ls.tid, true)) ∧ apc0 = pcstepf(ags, als, apc, ADoInsert(ls.tid, true)), pre(gs, ls, I6, doINSERT(ls.tid, true)) ∧ gs0 = gstepf(gs, ls, I6, doINSERT(ls.tid, true)) ∧ ls0 = lstepf(gs, ls, I6, doINSERT(ls.tid, true)) ∧ I7 = pcstepf(gs, ls, I6, doINSERT(ls.tid, true)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ pre(ags, als, apc, ADoInsert(ls.tid, true)) ∧ absset(gs0.ar, ags0.set) ∧ ls0.tid = als0.tid ∧ apc0 = (ls0.e = ls0.e0 ⊃ retInsert;invInsert) ∧ (ls0.e = ls0.e0 → als0.lb) ∧ (apc0 = invMember ∨ apc0 = invInsert → ls0.e = als0.le) | A Proof Obligation |
| step-absstep-I6-I7-doINSERT-other | ls.e = gs.ar[ls.n], # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I6, pcf0(tid) = I7, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, (ls0.e0 ≠ ⊥ → ls0.e0 = gs0.ar[ls0.n]) ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), tid ≠ tid0, lsf(tid0).tid = tid0, HashsetLInv(gs, lsf(tid0), pcf(tid0)), HashsetLInv(gs0, lsf(tid0), pcf(tid0)), SetLInv(ags, alsf(tid0), apcf(tid0)), ∀ tid1. tid1 ≠ tid ∧ tid1 ≠ tid0 → HashsetLInv(gs, lsf(tid1), pcf(tid1)) ∧ SetLInv(ags, alsf(tid1), apcf(tid1)) ∧ labs(gs, lsf(tid1), pcf(tid1), ags, alsf(tid1), apcf(tid1)), pre(ags, als, apc, ADoInsert(ls.tid, true)) → ags0 = gstepf(ags, als, apc, ADoInsert(ls.tid, true)) ∧ als0 = lstepf(ags, als, apc, ADoInsert(ls.tid, true)) ∧ apc0 = pcstepf(ags, als, apc, ADoInsert(ls.tid, true)), pre(gs, ls, I6, doINSERT(ls.tid, true)) ∧ gs0 = gstepf(gs, ls, I6, doINSERT(ls.tid, true)) ∧ ls0 = lstepf(gs, ls, I6, doINSERT(ls.tid, true)) ∧ I7 = pcstepf(gs, ls, I6, doINSERT(ls.tid, true)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le), lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) ⊦ lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) | A Proof Obligation |
| step-absstep-idle-I1-invINSERT-other | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = idle, pcf0(tid) = I1, apcf(tid) = apc, ls0.e ≠ ⊥, SetLInv(ags, als, apc), tid ≠ tid0, lsf(tid0).tid = tid0, HashsetLInv(gs, lsf(tid0), pcf(tid0)), HashsetLInv(gs0, lsf(tid0), pcf(tid0)), SetLInv(ags, alsf(tid0), apcf(tid0)), ∀ tid1. tid1 ≠ tid ∧ tid1 ≠ tid0 → HashsetLInv(gs, lsf(tid1), pcf(tid1)) ∧ SetLInv(ags, alsf(tid1), apcf(tid1)) ∧ labs(gs, lsf(tid1), pcf(tid1), ags, alsf(tid1), apcf(tid1)), pre(ags, als, apc, AInvInsert(ls.tid, e0)) → ags0 = gstepf(ags, als, apc, AInvInsert(ls.tid, e0)) ∧ als0 = lstepf(ags, als, apc, AInvInsert(ls.tid, e0)) ∧ apc0 = pcstepf(ags, als, apc, AInvInsert(ls.tid, e0)), pre(gs, ls, idle, invINSERT(ls.tid, e0)) ∧ gs0 = gstepf(gs, ls, idle, invINSERT(ls.tid, e0)) ∧ ls0 = lstepf(gs, ls, idle, invINSERT(ls.tid, e0)) ∧ I1 = pcstepf(gs, ls, idle, invINSERT(ls.tid, e0)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = idle ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le), lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) ⊦ lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) | A Proof Obligation |
| step-absstep-I12-I13-doINSERT-other | gs.ar[ls.n] = ⊥ ∨ gs.ar[ls.n] = ls.e, # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I12, pcf0(tid) = I13, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, (gs0.ar[ls0.n] ≠ ⊥ ∧ gs0.ar[ls0.n] = ls0.e0) ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), tid ≠ tid0, lsf(tid0).tid = tid0, HashsetLInv(gs, lsf(tid0), pcf(tid0)), HashsetLInv(gs0, lsf(tid0), pcf(tid0)), SetLInv(ags, alsf(tid0), apcf(tid0)), ∀ tid1. tid1 ≠ tid ∧ tid1 ≠ tid0 → HashsetLInv(gs, lsf(tid1), pcf(tid1)) ∧ SetLInv(ags, alsf(tid1), apcf(tid1)) ∧ labs(gs, lsf(tid1), pcf(tid1), ags, alsf(tid1), apcf(tid1)), pre(ags, als, apc, ADoInsert(ls.tid, true)) → ags0 = gstepf(ags, als, apc, ADoInsert(ls.tid, true)) ∧ als0 = lstepf(ags, als, apc, ADoInsert(ls.tid, true)) ∧ apc0 = pcstepf(ags, als, apc, ADoInsert(ls.tid, true)), pre(gs, ls, I12, doINSERT(ls.tid, true)) ∧ gs0 = gstepf(gs, ls, I12, doINSERT(ls.tid, true)) ∧ ls0 = lstepf(gs, ls, I12, doINSERT(ls.tid, true)) ∧ I13 = pcstepf(gs, ls, I12, doINSERT(ls.tid, true)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le), lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) ⊦ lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) | A Proof Obligation |
| step-absstep-M14-M15-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M14, pcf0(tid) = M15, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, true), ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n0, ls0.e, true), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M14, τ) ∧ gs0 = gstepf(gs, ls, M14, τ) ∧ ls0 = lstepf(gs, ls, M14, τ) ∧ M15 = pcstepf(gs, ls, M14, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = (ls.n ≠ ls.n0 ⊃ invMember;retMember) ∧ (ls.n = ls.n0 → ¬ als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = retMember ∧ ¬ als.lb ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-M7-M8-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M7, pcf0(tid) = M8, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ (ls.e0 ≠ ⊥ → ls.e0 = gs.ar[ls.n]) ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false), ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ (∃ n. n < # gs0.ar ∧ gs0.ar[n] = ls0.e) ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M7, τ) ∧ gs0 = gstepf(gs, ls, M7, τ) ∧ ls0 = lstepf(gs, ls, M7, τ) ∧ M8 = pcstepf(gs, ls, M7, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = (ls.e0 ≠ ls.e ∧ ls.e0 ≠ ⊥ ∧ (ls.n + 1) % # gs.ar ≠ ls.n0 ⊃ invMember;retMember) ∧ (ls.e0 = ls.e ∨ ls.e0 = ⊥ ∨ (ls.n + 1) % # gs.ar = ls.n0 → (ls.e = ls.e0 ↔ als.lb)) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = retMember ∧ als.lb ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I11-I17-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I11, pcf0(tid) = I17, apcf(tid) = apc, ls.e ≠ ls.e0 ∧ (ls.e0 ≠ ⊥ ∧ ls.e0 = gs.ar[ls.n]) ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, true) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I11, τ) ∧ gs0 = gstepf(gs, ls, I11, τ) ∧ ls0 = lstepf(gs, ls, I11, τ) ∧ I17 = pcstepf(gs, ls, I11, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I7-I10-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I7, pcf0(tid) = I10, apcf(tid) = apc, (ls.e0 ≠ ⊥ → ls.e0 = gs.ar[ls.n]) ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, (ls0.e0 ≠ ⊥ → ls0.e0 = gs0.ar[ls0.n]) ∧ ls0.e ≠ ls0.e0 ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I7, τ) ∧ gs0 = gstepf(gs, ls, I7, τ) ∧ ls0 = lstepf(gs, ls, I7, τ) ∧ I10 = pcstepf(gs, ls, I7, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = (ls.e = ls.e0 ⊃ retInsert;invInsert) ∧ (ls.e = ls.e0 → als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I7-I8-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I7, pcf0(tid) = I8, apcf(tid) = apc, (ls.e0 ≠ ⊥ → ls.e0 = gs.ar[ls.n]) ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, ls0.e = ls0.e0 ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.e = gs0.ar[ls0.n] ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I7, τ) ∧ gs0 = gstepf(gs, ls, I7, τ) ∧ ls0 = lstepf(gs, ls, I7, τ) ∧ I8 = pcstepf(gs, ls, I7, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = (ls.e = ls.e0 ⊃ retInsert;invInsert) ∧ (ls.e = ls.e0 → als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = retInsert ∧ (ls0.e = ls0.e0 → als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I16-I17-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I16, pcf0(tid) = I17, apcf(tid) = apc, (gs.ar[ls.n] ≠ ⊥ ∧ gs.ar[ls.n] ≠ ls.e) ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, true) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I16, τ) ∧ gs0 = gstepf(gs, ls, I16, τ) ∧ ls0 = lstepf(gs, ls, I16, τ) ∧ I17 = pcstepf(gs, ls, I16, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I12-I13-tau-other | ¬(gs.ar[ls.n] = ⊥ ∨ gs.ar[ls.n] = ls.e), # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I12, pcf0(tid) = I13, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, (gs0.ar[ls0.n] ≠ ⊥ ∧ gs0.ar[ls0.n] = ls0.e0) ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), tid ≠ tid0, lsf(tid0).tid = tid0, HashsetLInv(gs, lsf(tid0), pcf(tid0)), HashsetLInv(gs0, lsf(tid0), pcf(tid0)), SetLInv(ags, alsf(tid0), apcf(tid0)), ∀ tid1. tid1 ≠ tid ∧ tid1 ≠ tid0 → HashsetLInv(gs, lsf(tid1), pcf(tid1)) ∧ SetLInv(ags, alsf(tid1), apcf(tid1)) ∧ labs(gs, lsf(tid1), pcf(tid1), ags, alsf(tid1), apcf(tid1)), pre(gs, ls, I12, τ) ∧ gs0 = gstepf(gs, ls, I12, τ) ∧ ls0 = lstepf(gs, ls, I12, τ) ∧ I13 = pcstepf(gs, ls, I12, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le), lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) ⊦ lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) | A Proof Obligation |
| step-absstep-I10-I11-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I10, pcf0(tid) = I11, apcf(tid) = apc, (ls.e0 ≠ ⊥ → ls.e0 = gs.ar[ls.n]) ∧ ls.e ≠ ls.e0 ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, ls0.e ≠ ls0.e0 ∧ (ls0.e0 ≠ ⊥ ∧ ls0.e0 = gs0.ar[ls0.n]) ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I10, τ) ∧ gs0 = gstepf(gs, ls, I10, τ) ∧ ls0 = lstepf(gs, ls, I10, τ) ∧ I11 = pcstepf(gs, ls, I10, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-M10-M13-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M10, pcf0(tid) = M13, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ (ls.e0 ≠ ⊥ → ls.e0 = gs.ar[ls.n]) ∧ ls.e ≠ ls.e0 ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false), ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b ∧ (gs0.ar[ls0.n] ≠ ⊥ ∧ gs0.ar[ls0.n] ≠ ls0.e) ∧ ls0.e ≠ ls0.e0 ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M10, τ) ∧ gs0 = gstepf(gs, ls, M10, τ) ∧ ls0 = lstepf(gs, ls, M10, τ) ∧ M13 = pcstepf(gs, ls, M10, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = (ls.e0 ≠ ⊥ ∧ (ls.n + 1) % # gs.ar ≠ ls.n0 ⊃ invMember;retMember) ∧ (ls.e0 = ⊥ ∨ (ls.n + 1) % # gs.ar = ls.n0 → ¬ als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = ((ls0.n + 1) % # gs0.ar ≠ ls0.n0 ⊃ invMember;retMember) ∧ ((ls0.n + 1) % # gs0.ar = ls0.n0 → ¬ als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-M9-idle-retMEMBER-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M9, pcf0(tid) = idle, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ls.b ∧ (∃ n. n < # gs.ar ∧ gs.ar[n] = ls.e) ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(ags, als, apc, ARetMember(ls.tid, b)) → ags0 = gstepf(ags, als, apc, ARetMember(ls.tid, b)) ∧ als0 = lstepf(ags, als, apc, ARetMember(ls.tid, b)) ∧ apc0 = pcstepf(ags, als, apc, ARetMember(ls.tid, b)), pre(gs, ls, M9, retMEMBER(ls.tid, b)) ∧ gs0 = gstepf(gs, ls, M9, retMEMBER(ls.tid, b)) ∧ ls0 = lstepf(gs, ls, M9, retMEMBER(ls.tid, b)) ∧ idle = pcstepf(gs, ls, M9, retMEMBER(ls.tid, b)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retMember ∧ (als.lb ↔ ls.b) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ pre(ags, als, apc, ARetMember(ls.tid, b)) ∧ absset(gs0.ar, ags0.set) ∧ ls0.tid = als0.tid ∧ apc0 = idle ∧ (apc0 = invMember ∨ apc0 = invInsert → ls0.e = als0.le) | A Proof Obligation |
| step-absstep-I17-I20-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I17, pcf0(tid) = I20, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n, ls.e, true) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n ≠ ls0.n0 ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I17, τ) ∧ gs0 = gstepf(gs, ls, I17, τ) ∧ ls0 = lstepf(gs, ls, I17, τ) ∧ I20 = pcstepf(gs, ls, I17, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-M12-idle-retMEMBER-other | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M12, pcf0(tid) = idle, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ ls.e ≠ ls.e0, SetLInv(ags, als, apc), tid ≠ tid0, lsf(tid0).tid = tid0, HashsetLInv(gs, lsf(tid0), pcf(tid0)), HashsetLInv(gs0, lsf(tid0), pcf(tid0)), SetLInv(ags, alsf(tid0), apcf(tid0)), ∀ tid1. tid1 ≠ tid ∧ tid1 ≠ tid0 → HashsetLInv(gs, lsf(tid1), pcf(tid1)) ∧ SetLInv(ags, alsf(tid1), apcf(tid1)) ∧ labs(gs, lsf(tid1), pcf(tid1), ags, alsf(tid1), apcf(tid1)), pre(ags, als, apc, ARetMember(ls.tid, b)) → ags0 = gstepf(ags, als, apc, ARetMember(ls.tid, b)) ∧ als0 = lstepf(ags, als, apc, ARetMember(ls.tid, b)) ∧ apc0 = pcstepf(ags, als, apc, ARetMember(ls.tid, b)), pre(gs, ls, M12, retMEMBER(ls.tid, b)) ∧ gs0 = gstepf(gs, ls, M12, retMEMBER(ls.tid, b)) ∧ ls0 = lstepf(gs, ls, M12, retMEMBER(ls.tid, b)) ∧ idle = pcstepf(gs, ls, M12, retMEMBER(ls.tid, b)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retMember ∧ (als.lb ↔ ls.b) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le), lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) ⊦ lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) | A Proof Obligation |
| step-absstep-M16-idle-retMEMBER-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M16, pcf0(tid) = idle, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ allslotsfull(gs.ar, ls.n0, ls.n0, ls.e, true), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(ags, als, apc, ARetMember(ls.tid, b)) → ags0 = gstepf(ags, als, apc, ARetMember(ls.tid, b)) ∧ als0 = lstepf(ags, als, apc, ARetMember(ls.tid, b)) ∧ apc0 = pcstepf(ags, als, apc, ARetMember(ls.tid, b)), pre(gs, ls, M16, retMEMBER(ls.tid, b)) ∧ gs0 = gstepf(gs, ls, M16, retMEMBER(ls.tid, b)) ∧ ls0 = lstepf(gs, ls, M16, retMEMBER(ls.tid, b)) ∧ idle = pcstepf(gs, ls, M16, retMEMBER(ls.tid, b)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retMember ∧ (als.lb ↔ ls.b) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ pre(ags, als, apc, ARetMember(ls.tid, b)) ∧ absset(gs0.ar, ags0.set) ∧ ls0.tid = als0.tid ∧ apc0 = idle ∧ (apc0 = invMember ∨ apc0 = invInsert → ls0.e = als0.le) | A Proof Obligation |
| step-absstep-M11-M12-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M11, pcf0(tid) = M12, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ ls.e ≠ ls.e0, ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b ∧ ls0.e ≠ ls0.e0, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M11, τ) ∧ gs0 = gstepf(gs, ls, M11, τ) ∧ ls0 = lstepf(gs, ls, M11, τ) ∧ M12 = pcstepf(gs, ls, M11, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retMember ∧ ¬ als.lb ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = retMember ∧ (als.lb ↔ ls0.b) ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I10-I12-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I10, pcf0(tid) = I12, apcf(tid) = apc, (ls.e0 ≠ ⊥ → ls.e0 = gs.ar[ls.n]) ∧ ls.e ≠ ls.e0 ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I10, τ) ∧ gs0 = gstepf(gs, ls, I10, τ) ∧ ls0 = lstepf(gs, ls, I10, τ) ∧ I12 = pcstepf(gs, ls, I10, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| ren-retMEMBER | ⊦ ren(retMEMBER(tid, b), ags, alsf) = ARetMember(tid, b) | An Axiom |
| step-absstep-I19-idle-retINSERT-other | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I19, pcf0(tid) = idle, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n0, ls.e, true) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, SetLInv(ags, als, apc), tid ≠ tid0, lsf(tid0).tid = tid0, HashsetLInv(gs, lsf(tid0), pcf(tid0)), HashsetLInv(gs0, lsf(tid0), pcf(tid0)), SetLInv(ags, alsf(tid0), apcf(tid0)), ∀ tid1. tid1 ≠ tid ∧ tid1 ≠ tid0 → HashsetLInv(gs, lsf(tid1), pcf(tid1)) ∧ SetLInv(ags, alsf(tid1), apcf(tid1)) ∧ labs(gs, lsf(tid1), pcf(tid1), ags, alsf(tid1), apcf(tid1)), pre(ags, als, apc, ARetInsert(ls.tid, b)) → ags0 = gstepf(ags, als, apc, ARetInsert(ls.tid, b)) ∧ als0 = lstepf(ags, als, apc, ARetInsert(ls.tid, b)) ∧ apc0 = pcstepf(ags, als, apc, ARetInsert(ls.tid, b)), pre(gs, ls, I19, retINSERT(ls.tid, b)) ∧ gs0 = gstepf(gs, ls, I19, retINSERT(ls.tid, b)) ∧ ls0 = lstepf(gs, ls, I19, retINSERT(ls.tid, b)) ∧ idle = pcstepf(gs, ls, I19, retINSERT(ls.tid, b)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retInsert ∧ (als.lb ↔ ls.b) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le), lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) ⊦ lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) | A Proof Obligation |
| step-absstep-M7-M10-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M7, pcf0(tid) = M10, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ (ls.e0 ≠ ⊥ → ls.e0 = gs.ar[ls.n]) ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false), ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b ∧ (ls0.e0 ≠ ⊥ → ls0.e0 = gs0.ar[ls0.n]) ∧ ls0.e ≠ ls0.e0 ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M7, τ) ∧ gs0 = gstepf(gs, ls, M7, τ) ∧ ls0 = lstepf(gs, ls, M7, τ) ∧ M10 = pcstepf(gs, ls, M7, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = (ls.e0 ≠ ls.e ∧ ls.e0 ≠ ⊥ ∧ (ls.n + 1) % # gs.ar ≠ ls.n0 ⊃ invMember;retMember) ∧ (ls.e0 = ls.e ∨ ls.e0 = ⊥ ∨ (ls.n + 1) % # gs.ar = ls.n0 → (ls.e = ls.e0 ↔ als.lb)) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = (ls0.e0 ≠ ⊥ ∧ (ls0.n + 1) % # gs0.ar ≠ ls0.n0 ⊃ invMember;retMember) ∧ (ls0.e0 = ⊥ ∨ (ls0.n + 1) % # gs0.ar = ls0.n0 → ¬ als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-M3-M4-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M3, pcf0(tid) = M4, apcf(tid) = apc, ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz), ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ls0.n = ls0.n0 ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M3, τ) ∧ gs0 = gstepf(gs, ls, M3, τ) ∧ ls0 = lstepf(gs, ls, M3, τ) ∧ M4 = pcstepf(gs, ls, M3, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I13-I14-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I13, pcf0(tid) = I14, apcf(tid) = apc, (gs.ar[ls.n] ≠ ⊥ ∧ gs.ar[ls.n] = ls.e0) ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, ls0.e = ls0.e0 ∧ ls0.e = gs0.ar[ls0.n] ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I13, τ) ∧ gs0 = gstepf(gs, ls, I13, τ) ∧ ls0 = lstepf(gs, ls, I13, τ) ∧ I14 = pcstepf(gs, ls, I13, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = (ls.e = ls.e0 ⊃ retInsert;invInsert) ∧ (ls.e = ls.e0 → als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = retInsert ∧ (ls0.e = ls0.e0 → als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-M6-M7-doMEMBER-same | gs.ar[ls.n] = ls.e ∨ gs.ar[ls.n] = ⊥ ∨ (ls.n + 1) % ls.sz = ls.n0, # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M6, pcf0(tid) = M7, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false), ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b ∧ (ls0.e0 ≠ ⊥ → ls0.e0 = gs0.ar[ls0.n]) ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(ags, als, apc, ADoMember(ls.tid)) → ags0 = gstepf(ags, als, apc, ADoMember(ls.tid)) ∧ als0 = lstepf(ags, als, apc, ADoMember(ls.tid)) ∧ apc0 = pcstepf(ags, als, apc, ADoMember(ls.tid)), pre(gs, ls, M6, doMEMBER(ls.tid)) ∧ gs0 = gstepf(gs, ls, M6, doMEMBER(ls.tid)) ∧ ls0 = lstepf(gs, ls, M6, doMEMBER(ls.tid)) ∧ M7 = pcstepf(gs, ls, M6, doMEMBER(ls.tid)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ pre(ags, als, apc, ADoMember(ls.tid)) ∧ absset(gs0.ar, ags0.set) ∧ ls0.tid = als0.tid ∧ apc0 = (ls0.e0 ≠ ls0.e ∧ ls0.e0 ≠ ⊥ ∧ (ls0.n + 1) % # gs0.ar ≠ ls0.n0 ⊃ invMember;retMember) ∧ (ls0.e0 = ls0.e ∨ ls0.e0 = ⊥ ∨ (ls0.n + 1) % # gs0.ar = ls0.n0 → (ls0.e = ls0.e0 ↔ als0.lb)) ∧ (apc0 = invMember ∨ apc0 = invInsert → ls0.e = als0.le) | A Proof Obligation |
| ren-doMEMBER | ⊦ ren(doMEMBER(tid), ags, alsf) = ADoMember(tid) | An Axiom |
| step-absstep-M16-idle-retMEMBER-other | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M16, pcf0(tid) = idle, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ allslotsfull(gs.ar, ls.n0, ls.n0, ls.e, true), SetLInv(ags, als, apc), tid ≠ tid0, lsf(tid0).tid = tid0, HashsetLInv(gs, lsf(tid0), pcf(tid0)), HashsetLInv(gs0, lsf(tid0), pcf(tid0)), SetLInv(ags, alsf(tid0), apcf(tid0)), ∀ tid1. tid1 ≠ tid ∧ tid1 ≠ tid0 → HashsetLInv(gs, lsf(tid1), pcf(tid1)) ∧ SetLInv(ags, alsf(tid1), apcf(tid1)) ∧ labs(gs, lsf(tid1), pcf(tid1), ags, alsf(tid1), apcf(tid1)), pre(ags, als, apc, ARetMember(ls.tid, b)) → ags0 = gstepf(ags, als, apc, ARetMember(ls.tid, b)) ∧ als0 = lstepf(ags, als, apc, ARetMember(ls.tid, b)) ∧ apc0 = pcstepf(ags, als, apc, ARetMember(ls.tid, b)), pre(gs, ls, M16, retMEMBER(ls.tid, b)) ∧ gs0 = gstepf(gs, ls, M16, retMEMBER(ls.tid, b)) ∧ ls0 = lstepf(gs, ls, M16, retMEMBER(ls.tid, b)) ∧ idle = pcstepf(gs, ls, M16, retMEMBER(ls.tid, b)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retMember ∧ (als.lb ↔ ls.b) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le), lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) ⊦ lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) | A Proof Obligation |
| step-absstep-I12-I13-doINSERT-same | gs.ar[ls.n] = ⊥ ∨ gs.ar[ls.n] = ls.e, # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I12, pcf0(tid) = I13, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, (gs0.ar[ls0.n] ≠ ⊥ ∧ gs0.ar[ls0.n] = ls0.e0) ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(ags, als, apc, ADoInsert(ls.tid, true)) → ags0 = gstepf(ags, als, apc, ADoInsert(ls.tid, true)) ∧ als0 = lstepf(ags, als, apc, ADoInsert(ls.tid, true)) ∧ apc0 = pcstepf(ags, als, apc, ADoInsert(ls.tid, true)), pre(gs, ls, I12, doINSERT(ls.tid, true)) ∧ gs0 = gstepf(gs, ls, I12, doINSERT(ls.tid, true)) ∧ ls0 = lstepf(gs, ls, I12, doINSERT(ls.tid, true)) ∧ I13 = pcstepf(gs, ls, I12, doINSERT(ls.tid, true)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ pre(ags, als, apc, ADoInsert(ls.tid, true)) ∧ absset(gs0.ar, ags0.set) ∧ ls0.tid = als0.tid ∧ apc0 = (ls0.e = ls0.e0 ⊃ retInsert;invInsert) ∧ (ls0.e = ls0.e0 → als0.lb) ∧ (apc0 = invMember ∨ apc0 = invInsert → ls0.e = als0.le) | A Proof Obligation |
| step-absstep-I3-I4-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I3, pcf0(tid) = I4, apcf(tid) = apc, ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz), allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ls0.n = ls0.n0, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I3, τ) ∧ gs0 = gstepf(gs, ls, I3, τ) ∧ ls0 = lstepf(gs, ls, I3, τ) ∧ I4 = pcstepf(gs, ls, I3, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-M6-M7-tau-same | ¬(gs.ar[ls.n] = ls.e ∨ gs.ar[ls.n] = ⊥ ∨ (ls.n + 1) % ls.sz = ls.n0), # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M6, pcf0(tid) = M7, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false), ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b ∧ (ls0.e0 ≠ ⊥ → ls0.e0 = gs0.ar[ls0.n]) ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M6, τ) ∧ gs0 = gstepf(gs, ls, M6, τ) ∧ ls0 = lstepf(gs, ls, M6, τ) ∧ M7 = pcstepf(gs, ls, M6, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = (ls0.e0 ≠ ls0.e ∧ ls0.e0 ≠ ⊥ ∧ (ls0.n + 1) % # gs0.ar ≠ ls0.n0 ⊃ invMember;retMember) ∧ (ls0.e0 = ls0.e ∨ ls0.e0 = ⊥ ∨ (ls0.n + 1) % # gs0.ar = ls0.n0 → (ls0.e = ls0.e0 ↔ als.lb)) ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I6-I7-tau-same | ls.e ≠ gs.ar[ls.n], # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I6, pcf0(tid) = I7, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, (ls0.e0 ≠ ⊥ → ls0.e0 = gs0.ar[ls0.n]) ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I6, τ) ∧ gs0 = gstepf(gs, ls, I6, τ) ∧ ls0 = lstepf(gs, ls, I6, τ) ∧ I7 = pcstepf(gs, ls, I6, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = (ls0.e = ls0.e0 ⊃ retInsert;invInsert) ∧ (ls0.e = ls0.e0 → als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I20-I5-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I20, pcf0(tid) = I5, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n ≠ ls.n0 ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I20, τ) ∧ gs0 = gstepf(gs, ls, I20, τ) ∧ ls0 = lstepf(gs, ls, I20, τ) ∧ I5 = pcstepf(gs, ls, I20, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = (ls0.b ⊃ retInsert;invInsert) ∧ (ls0.b → ¬ als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-M9-idle-retMEMBER-other | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M9, pcf0(tid) = idle, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ls.b ∧ (∃ n. n < # gs.ar ∧ gs.ar[n] = ls.e) ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false), SetLInv(ags, als, apc), tid ≠ tid0, lsf(tid0).tid = tid0, HashsetLInv(gs, lsf(tid0), pcf(tid0)), HashsetLInv(gs0, lsf(tid0), pcf(tid0)), SetLInv(ags, alsf(tid0), apcf(tid0)), ∀ tid1. tid1 ≠ tid ∧ tid1 ≠ tid0 → HashsetLInv(gs, lsf(tid1), pcf(tid1)) ∧ SetLInv(ags, alsf(tid1), apcf(tid1)) ∧ labs(gs, lsf(tid1), pcf(tid1), ags, alsf(tid1), apcf(tid1)), pre(ags, als, apc, ARetMember(ls.tid, b)) → ags0 = gstepf(ags, als, apc, ARetMember(ls.tid, b)) ∧ als0 = lstepf(ags, als, apc, ARetMember(ls.tid, b)) ∧ apc0 = pcstepf(ags, als, apc, ARetMember(ls.tid, b)), pre(gs, ls, M9, retMEMBER(ls.tid, b)) ∧ gs0 = gstepf(gs, ls, M9, retMEMBER(ls.tid, b)) ∧ ls0 = lstepf(gs, ls, M9, retMEMBER(ls.tid, b)) ∧ idle = pcstepf(gs, ls, M9, retMEMBER(ls.tid, b)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retMember ∧ (als.lb ↔ ls.b) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le), lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) ⊦ lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) | A Proof Obligation |
| abs-def | ⊦ abs(mkstate(gs, lsf, pcf), mkstate(ags, alsf, apcf)) ↔ gabs(gs, lsf, pcf, ags, alsf, apcf) ∧ (∀ tid. labs(gs, lsf(tid), pcf(tid), ags, alsf(tid), apcf(tid))) | An Axiom |
| step-absstep-I19-idle-retINSERT-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I19, pcf0(tid) = idle, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n0, ls.e, true) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(ags, als, apc, ARetInsert(ls.tid, b)) → ags0 = gstepf(ags, als, apc, ARetInsert(ls.tid, b)) ∧ als0 = lstepf(ags, als, apc, ARetInsert(ls.tid, b)) ∧ apc0 = pcstepf(ags, als, apc, ARetInsert(ls.tid, b)), pre(gs, ls, I19, retINSERT(ls.tid, b)) ∧ gs0 = gstepf(gs, ls, I19, retINSERT(ls.tid, b)) ∧ ls0 = lstepf(gs, ls, I19, retINSERT(ls.tid, b)) ∧ idle = pcstepf(gs, ls, I19, retINSERT(ls.tid, b)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retInsert ∧ (als.lb ↔ ls.b) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ pre(ags, als, apc, ARetInsert(ls.tid, b)) ∧ absset(gs0.ar, ags0.set) ∧ ls0.tid = als0.tid ∧ apc0 = idle ∧ (apc0 = invMember ∨ apc0 = invInsert → ls0.e = als0.le) | A Proof Obligation |
| ren-retINSERT | ⊦ ren(retINSERT(tid, b), ags, alsf) = ARetInsert(tid, b) | An Axiom |
| step-absstep-M13-M14-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M13, pcf0(tid) = M14, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ (gs.ar[ls.n] ≠ ⊥ ∧ gs.ar[ls.n] ≠ ls.e) ∧ ls.e ≠ ls.e0 ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false), ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, true), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M13, τ) ∧ gs0 = gstepf(gs, ls, M13, τ) ∧ ls0 = lstepf(gs, ls, M13, τ) ∧ M14 = pcstepf(gs, ls, M13, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = ((ls.n + 1) % # gs.ar ≠ ls.n0 ⊃ invMember;retMember) ∧ ((ls.n + 1) % # gs.ar = ls.n0 → ¬ als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = (ls0.n ≠ ls0.n0 ⊃ invMember;retMember) ∧ (ls0.n = ls0.n0 → ¬ als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-idle-M1-invMEMBER-other | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = idle, pcf0(tid) = M1, apcf(tid) = apc, ls0.e ≠ ⊥, SetLInv(ags, als, apc), tid ≠ tid0, lsf(tid0).tid = tid0, HashsetLInv(gs, lsf(tid0), pcf(tid0)), HashsetLInv(gs0, lsf(tid0), pcf(tid0)), SetLInv(ags, alsf(tid0), apcf(tid0)), ∀ tid1. tid1 ≠ tid ∧ tid1 ≠ tid0 → HashsetLInv(gs, lsf(tid1), pcf(tid1)) ∧ SetLInv(ags, alsf(tid1), apcf(tid1)) ∧ labs(gs, lsf(tid1), pcf(tid1), ags, alsf(tid1), apcf(tid1)), pre(ags, als, apc, AInvMember(ls.tid, e0)) → ags0 = gstepf(ags, als, apc, AInvMember(ls.tid, e0)) ∧ als0 = lstepf(ags, als, apc, AInvMember(ls.tid, e0)) ∧ apc0 = pcstepf(ags, als, apc, AInvMember(ls.tid, e0)), pre(gs, ls, idle, invMEMBER(ls.tid, e0)) ∧ gs0 = gstepf(gs, ls, idle, invMEMBER(ls.tid, e0)) ∧ ls0 = lstepf(gs, ls, idle, invMEMBER(ls.tid, e0)) ∧ M1 = pcstepf(gs, ls, idle, invMEMBER(ls.tid, e0)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = idle ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le), lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) ⊦ lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) | A Proof Obligation |
| ren-tau | ⊦ ren(τ, ags, alsf) = τ | An Axiom |
| step-absstep-M5-M18-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M5, pcf0(tid) = M18, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false), false, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M5, τ) ∧ gs0 = gstepf(gs, ls, M5, τ) ∧ ls0 = lstepf(gs, ls, M5, τ) ∧ M18 = pcstepf(gs, ls, M5, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I9-idle-retINSERT-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I9, pcf0(tid) = idle, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.e = gs.ar[ls.n] ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ls.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(ags, als, apc, ARetInsert(ls.tid, b)) → ags0 = gstepf(ags, als, apc, ARetInsert(ls.tid, b)) ∧ als0 = lstepf(ags, als, apc, ARetInsert(ls.tid, b)) ∧ apc0 = pcstepf(ags, als, apc, ARetInsert(ls.tid, b)), pre(gs, ls, I9, retINSERT(ls.tid, b)) ∧ gs0 = gstepf(gs, ls, I9, retINSERT(ls.tid, b)) ∧ ls0 = lstepf(gs, ls, I9, retINSERT(ls.tid, b)) ∧ idle = pcstepf(gs, ls, I9, retINSERT(ls.tid, b)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retInsert ∧ (als.lb ↔ ls.b) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ pre(ags, als, apc, ARetInsert(ls.tid, b)) ∧ absset(gs0.ar, ags0.set) ∧ ls0.tid = als0.tid ∧ apc0 = idle ∧ (apc0 = invMember ∨ apc0 = invInsert → ls0.e = als0.le) | A Proof Obligation |
| step-absstep-I21-idle-retINSERT-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I21, pcf0(tid) = idle, apcf(tid) = apc, false, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(ags, als, apc, ARetInsert(ls.tid, b)) → ags0 = gstepf(ags, als, apc, ARetInsert(ls.tid, b)) ∧ als0 = lstepf(ags, als, apc, ARetInsert(ls.tid, b)) ∧ apc0 = pcstepf(ags, als, apc, ARetInsert(ls.tid, b)), pre(gs, ls, I21, retINSERT(ls.tid, b)) ∧ gs0 = gstepf(gs, ls, I21, retINSERT(ls.tid, b)) ∧ ls0 = lstepf(gs, ls, I21, retINSERT(ls.tid, b)) ∧ idle = pcstepf(gs, ls, I21, retINSERT(ls.tid, b)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retInsert ∧ ¬ als.lb ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ pre(ags, als, apc, ARetInsert(ls.tid, b)) ∧ absset(gs0.ar, ags0.set) ∧ ls0.tid = als0.tid ∧ apc0 = idle ∧ (apc0 = invMember ∨ apc0 = invInsert → ls0.e = als0.le) | A Proof Obligation |
| step-absstep-M6-M7-doMEMBER-other | gs.ar[ls.n] = ls.e ∨ gs.ar[ls.n] = ⊥ ∨ (ls.n + 1) % ls.sz = ls.n0, # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M6, pcf0(tid) = M7, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false), ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b ∧ (ls0.e0 ≠ ⊥ → ls0.e0 = gs0.ar[ls0.n]) ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false), SetLInv(ags, als, apc), tid ≠ tid0, lsf(tid0).tid = tid0, HashsetLInv(gs, lsf(tid0), pcf(tid0)), HashsetLInv(gs0, lsf(tid0), pcf(tid0)), SetLInv(ags, alsf(tid0), apcf(tid0)), ∀ tid1. tid1 ≠ tid ∧ tid1 ≠ tid0 → HashsetLInv(gs, lsf(tid1), pcf(tid1)) ∧ SetLInv(ags, alsf(tid1), apcf(tid1)) ∧ labs(gs, lsf(tid1), pcf(tid1), ags, alsf(tid1), apcf(tid1)), pre(ags, als, apc, ADoMember(ls.tid)) → ags0 = gstepf(ags, als, apc, ADoMember(ls.tid)) ∧ als0 = lstepf(ags, als, apc, ADoMember(ls.tid)) ∧ apc0 = pcstepf(ags, als, apc, ADoMember(ls.tid)), pre(gs, ls, M6, doMEMBER(ls.tid)) ∧ gs0 = gstepf(gs, ls, M6, doMEMBER(ls.tid)) ∧ ls0 = lstepf(gs, ls, M6, doMEMBER(ls.tid)) ∧ M7 = pcstepf(gs, ls, M6, doMEMBER(ls.tid)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le), lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) ⊦ lsf(tid0).tid = alsf(tid0).tid ∧ (pcf(tid0) = idle → apcf(tid0) = idle) ∧ ( pcf(tid0) = I1 ∨ pcf(tid0) = I2 ∨ pcf(tid0) = I3 ∨ pcf(tid0) = I4 ∨ pcf(tid0) = I6 ∨ pcf(tid0) = I10 ∨ pcf(tid0) = I11 ∨ pcf(tid0) = I12 ∨ pcf(tid0) = I16 ∨ pcf(tid0) = I17 ∨ pcf(tid0) = I18 ∨ pcf(tid0) = I20 → apcf(tid0) = invInsert) ∧ (pcf(tid0) = I5 → apcf(tid0) = (lsf(tid0).b ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I13 → apcf(tid0) = (lsf(tid0).e = lsf(tid0).e0 ⊃ retInsert;invInsert)) ∧ (pcf(tid0) = I8 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I14 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 ∨ pcf(tid0) = I21 → apcf(tid0) = retInsert) ∧ (pcf(tid0) = I7 ∨ pcf(tid0) = I8 ∨ pcf(tid0) = I13 ∨ pcf(tid0) = I14 → lsf(tid0).e = lsf(tid0).e0 → alsf(tid0).lb) ∧ (pcf(tid0) = I9 ∨ pcf(tid0) = I15 ∨ pcf(tid0) = I19 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = I5 → lsf(tid0).b → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = I21 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M1 ∨ pcf(tid0) = M2 ∨ pcf(tid0) = M3 ∨ pcf(tid0) = M4 ∨ pcf(tid0) = M5 ∨ pcf(tid0) = M6 ∨ pcf(tid0) = M17 → apcf(tid0) = invMember) ∧ ( pcf(tid0) = M7 → apcf(tid0) = (lsf(tid0).e0 ≠ lsf(tid0).e ∧ lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M10 → apcf(tid0) = (lsf(tid0).e0 ≠ ⊥ ∧ (lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M13 → apcf(tid0) = ((lsf(tid0).n + 1) % # gs0.ar ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M14 → apcf(tid0) = (lsf(tid0).n ≠ lsf(tid0).n0 ⊃ invMember;retMember)) ∧ (pcf(tid0) = M8 ∨ pcf(tid0) = M9 ∨ pcf(tid0) = M11 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M15 ∨ pcf(tid0) = M16 → apcf(tid0) = retMember) ∧ ( pcf(tid0) = M7 → lsf(tid0).e0 = lsf(tid0).e ∨ lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → (lsf(tid0).e = lsf(tid0).e0 ↔ alsf(tid0).lb)) ∧ (pcf(tid0) = M10 → lsf(tid0).e0 = ⊥ ∨ (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M13 → (lsf(tid0).n + 1) % # gs0.ar = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M14 → lsf(tid0).n = lsf(tid0).n0 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M9 ∨ pcf(tid0) = M12 ∨ pcf(tid0) = M16 → (alsf(tid0).lb ↔ lsf(tid0).b)) ∧ (pcf(tid0) = M11 ∨ pcf(tid0) = M15 → ¬ alsf(tid0).lb) ∧ (pcf(tid0) = M8 → alsf(tid0).lb) ∧ (apcf(tid0) = invMember ∨ apcf(tid0) = invInsert → lsf(tid0).e = alsf(tid0).le) | A Proof Obligation |
| step-absstep-M2-M3-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M2, pcf0(tid) = M3, apcf(tid) = apc, ls.e ≠ ⊥ ∧ ls.sz = # gs.ar, ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M2, τ) ∧ gs0 = gstepf(gs, ls, M2, τ) ∧ ls0 = lstepf(gs, ls, M2, τ) ∧ M3 = pcstepf(gs, ls, M2, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-M18-idle-retMEMBER-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M18, pcf0(tid) = idle, apcf(tid) = apc, false, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(ags, als, apc, ARetMember(ls.tid, b)) → ags0 = gstepf(ags, als, apc, ARetMember(ls.tid, b)) ∧ als0 = lstepf(ags, als, apc, ARetMember(ls.tid, b)) ∧ apc0 = pcstepf(ags, als, apc, ARetMember(ls.tid, b)), pre(gs, ls, M18, retMEMBER(ls.tid, b)) ∧ gs0 = gstepf(gs, ls, M18, retMEMBER(ls.tid, b)) ∧ ls0 = lstepf(gs, ls, M18, retMEMBER(ls.tid, b)) ∧ idle = pcstepf(gs, ls, M18, retMEMBER(ls.tid, b)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ pre(ags, als, apc, ARetMember(ls.tid, b)) ∧ absset(gs0.ar, ags0.set) ∧ ls0.tid = als0.tid ∧ apc0 = idle ∧ (apc0 = invMember ∨ apc0 = invInsert → ls0.e = als0.le) | A Proof Obligation |
| ren-doINSERT | ⊦ ren(doINSERT(tid, b), ags, alsf) = ADoInsert(tid, b) | An Axiom |
| step-absstep-I2-I3-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I2, pcf0(tid) = I3, apcf(tid) = apc, ls.e ≠ ⊥ ∧ ls.sz = # gs.ar, ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I2, τ) ∧ gs0 = gstepf(gs, ls, I2, τ) ∧ ls0 = lstepf(gs, ls, I2, τ) ∧ I3 = pcstepf(gs, ls, I2, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-idle-I1-invINSERT-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = idle, pcf0(tid) = I1, apcf(tid) = apc, ls0.e ≠ ⊥, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(ags, als, apc, AInvInsert(ls.tid, e0)) → ags0 = gstepf(ags, als, apc, AInvInsert(ls.tid, e0)) ∧ als0 = lstepf(ags, als, apc, AInvInsert(ls.tid, e0)) ∧ apc0 = pcstepf(ags, als, apc, AInvInsert(ls.tid, e0)), pre(gs, ls, idle, invINSERT(ls.tid, e0)) ∧ gs0 = gstepf(gs, ls, idle, invINSERT(ls.tid, e0)) ∧ ls0 = lstepf(gs, ls, idle, invINSERT(ls.tid, e0)) ∧ I1 = pcstepf(gs, ls, idle, invINSERT(ls.tid, e0)), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = idle ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ pre(ags, als, apc, AInvInsert(ls.tid, e0)) ∧ absset(gs0.ar, ags0.set) ∧ ls0.tid = als0.tid ∧ apc0 = invInsert ∧ (apc0 = invMember ∨ apc0 = invInsert → ls0.e = als0.le) | A Proof Obligation |
| step-absstep-M5-M6-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M5, pcf0(tid) = M6, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false), ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M5, τ) ∧ gs0 = gstepf(gs, ls, M5, τ) ∧ ls0 = lstepf(gs, ls, M5, τ) ∧ M6 = pcstepf(gs, ls, M5, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invMember ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| abs-init | hashsetInit(mkstate(gs, lsf, pcf)), HashsetInv(gs, lsf, pcf) ⊦ ∃ ags, alsf, apcf. setInit(mkstate(ags, alsf, apcf)) ∧ abs(mkstate(gs, lsf, pcf), mkstate(ags, alsf, apcf)) | A Proof Obligation |
| step-absstep-M10-M11-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M10, pcf0(tid) = M11, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ (ls.e0 ≠ ⊥ → ls.e0 = gs.ar[ls.n]) ∧ ls.e ≠ ls.e0 ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false), ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b ∧ ls0.e ≠ ls0.e0, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M10, τ) ∧ gs0 = gstepf(gs, ls, M10, τ) ∧ ls0 = lstepf(gs, ls, M10, τ) ∧ M11 = pcstepf(gs, ls, M10, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = (ls.e0 ≠ ⊥ ∧ (ls.n + 1) % # gs.ar ≠ ls.n0 ⊃ invMember;retMember) ∧ (ls.e0 = ⊥ ∨ (ls.n + 1) % # gs.ar = ls.n0 → ¬ als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = retMember ∧ ¬ als.lb ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I5-I6-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I5, pcf0(tid) = I6, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I5, τ) ∧ gs0 = gstepf(gs, ls, I5, τ) ∧ ls0 = lstepf(gs, ls, I5, τ) ∧ I6 = pcstepf(gs, ls, I5, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = (ls.b ⊃ retInsert;invInsert) ∧ (ls.b → ¬ als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I5-I21-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I5, pcf0(tid) = I21, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, false, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I5, τ) ∧ gs0 = gstepf(gs, ls, I5, τ) ∧ ls0 = lstepf(gs, ls, I5, τ) ∧ I21 = pcstepf(gs, ls, I5, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = (ls.b ⊃ retInsert;invInsert) ∧ (ls.b → ¬ als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = retInsert ∧ ¬ als.lb ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| ren-invMEMBER | ⊦ ren(invMEMBER(tid, e), ags, alsf) = AInvMember(tid, e) | An Axiom |
| step-absstep-M8-M9-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M8, pcf0(tid) = M9, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ (∃ n. n < # gs.ar ∧ gs.ar[n] = ls.e) ∧ allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false), ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ls0.b ∧ (∃ n. n < # gs0.ar ∧ gs0.ar[n] = ls0.e) ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M8, τ) ∧ gs0 = gstepf(gs, ls, M8, τ) ∧ ls0 = lstepf(gs, ls, M8, τ) ∧ M9 = pcstepf(gs, ls, M8, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retMember ∧ als.lb ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = retMember ∧ (als.lb ↔ ls0.b) ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-I12-I13-tau-same | ¬(gs.ar[ls.n] = ⊥ ∨ gs.ar[ls.n] = ls.e), # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = I12, pcf0(tid) = I13, apcf(tid) = apc, allslotsfull(gs.ar, ls.n0, ls.n, ls.e, false) ∧ ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b, (gs0.ar[ls0.n] ≠ ⊥ ∧ gs0.ar[ls0.n] = ls0.e0) ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n, ls0.e, false) ∧ ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b, SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, I12, τ) ∧ gs0 = gstepf(gs, ls, I12, τ) ∧ ls0 = lstepf(gs, ls, I12, τ) ∧ I13 = pcstepf(gs, ls, I12, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = invInsert ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = (ls0.e = ls0.e0 ⊃ retInsert;invInsert) ∧ (ls0.e = ls0.e0 → als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| step-absstep-M15-M16-tau-same | # gs.ar ≠ 0 ∧ htok(gs.ar), # gs0.ar ≠ 0 ∧ htok(gs0.ar), lsf(tid) = ls, lsf0(tid) = ls0, alsf(tid) = als, alsf(tid).tid = tid, lsf(tid).tid = tid, ∀ tid0. tid0 ≠ tid → lsf(tid0).tid = tid0, ∀ tid0. tid0 ≠ tid → alsf(tid0).tid = tid0, pcf(tid) = M15, pcf0(tid) = M16, apcf(tid) = apc, ls.n < # gs.ar ∧ ls.e ≠ ⊥ ∧ ls.sz = # gs.ar ∧ (ls.n0 < # gs.ar ∧ ls.n0 = get_hash(ls.e, ls.sz)) ∧ ¬ ls.b ∧ allslotsfull(gs.ar, ls.n0, ls.n0, ls.e, true), ls0.n < # gs0.ar ∧ ls0.e ≠ ⊥ ∧ ls0.sz = # gs0.ar ∧ (ls0.n0 < # gs0.ar ∧ ls0.n0 = get_hash(ls0.e, ls0.sz)) ∧ ¬ ls0.b ∧ allslotsfull(gs0.ar, ls0.n0, ls0.n0, ls0.e, true), SetLInv(ags, als, apc), ∀ tid0. tid0 ≠ tid → HashsetLInv(gs, lsf(tid0), pcf(tid0)) ∧ SetLInv(ags, alsf(tid0), apcf(tid0)) ∧ labs(gs, lsf(tid0), pcf(tid0), ags, alsf(tid0), apcf(tid0)), pre(gs, ls, M15, τ) ∧ gs0 = gstepf(gs, ls, M15, τ) ∧ ls0 = lstepf(gs, ls, M15, τ) ∧ M16 = pcstepf(gs, ls, M15, τ), absset(gs.ar, ags.set), ls.tid = als.tid ∧ apc = retMember ∧ ¬ als.lb ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) ⊦ absset(gs0.ar, ags.set) ∧ ls0.tid = als.tid ∧ apc = retMember ∧ (als.lb ↔ ls0.b) ∧ (apc = invMember ∨ apc = invInsert → ls0.e = als.le) | A Proof Obligation |
| labs-def | ⊦ labs(gs, ls, pc, ags, als, apc) ↔ ls.tid = als.tid ∧ (pc = idle → apc = idle) ∧ (pc = I1 ∨ pc = I2 ∨ pc = I3 ∨ pc = I4 ∨ pc = I6 ∨ pc = I10 ∨ pc = I11 ∨ pc = I12 ∨ pc = I16 ∨ pc = I17 ∨ pc = I18 ∨ pc = I20 → apc = invInsert) ∧ (pc = I5 → apc = (ls.b ⊃ retInsert;invInsert)) ∧ (pc = I7 ∨ pc = I13 → apc = (ls.e = ls.e0 ⊃ retInsert;invInsert)) ∧ (pc = I8 → apc = retInsert) ∧ (pc = I9 ∨ pc = I14 ∨ pc = I15 ∨ pc = I19 ∨ pc = I21 → apc = retInsert) ∧ (pc = I7 ∨ pc = I8 ∨ pc = I13 ∨ pc = I14 → ls.e = ls.e0 → als.lb) ∧ (pc = I9 ∨ pc = I15 ∨ pc = I19 → (als.lb ↔ ls.b)) ∧ (pc = I5 → ls.b → ¬ als.lb) ∧ (pc = I21 → ¬ als.lb) ∧ (pc = M1 ∨ pc = M2 ∨ pc = M3 ∨ pc = M4 ∨ pc = M5 ∨ pc = M6 ∨ pc = M17 → apc = invMember) ∧ (pc = M7 → apc = (ls.e0 ≠ ls.e ∧ ls.e0 ≠ ⊥ ∧ (ls.n + 1) % # gs.ar ≠ ls.n0 ⊃ invMember;retMember)) ∧ (pc = M10 → apc = (ls.e0 ≠ ⊥ ∧ (ls.n + 1) % # gs.ar ≠ ls.n0 ⊃ invMember;retMember)) ∧ (pc = M13 → apc = ((ls.n + 1) % # gs.ar ≠ ls.n0 ⊃ invMember;retMember)) ∧ (pc = M14 → apc = (ls.n ≠ ls.n0 ⊃ invMember;retMember)) ∧ (pc = M8 ∨ pc = M9 ∨ pc = M11 ∨ pc = M12 ∨ pc = M15 ∨ pc = M16 → apc = retMember) ∧ (pc = M7 → ls.e0 = ls.e ∨ ls.e0 = ⊥ ∨ (ls.n + 1) % # gs.ar = ls.n0 → (ls.e = ls.e0 ↔ als.lb)) ∧ (pc = M10 → ls.e0 = ⊥ ∨ (ls.n + 1) % # gs.ar = ls.n0 → ¬ als.lb) ∧ (pc = M13 → (ls.n + 1) % # gs.ar = ls.n0 → ¬ als.lb) ∧ (pc = M14 → ls.n = ls.n0 → ¬ als.lb) ∧ (pc = M9 ∨ pc = M12 ∨ pc = M16 → (als.lb ↔ ls.b)) ∧ (pc = M11 ∨ pc = M15 → ¬ als.lb) ∧ (pc = M8 → als.lb) ∧ (apc = invMember ∨ apc = invInsert → ls.e = als.le) | An Axiom |
| abs-theorem | HashsetInv(gs, lsf, pcf), HashsetInv(gs0, lsf0, pcf0), SetInv(ags, alsf, apcf), hashsetStep(mkstate(gs, lsf, pcf), a, mkstate(gs0, lsf0, pcf0)), abs(mkstate(gs, lsf, pcf), mkstate(ags, alsf, apcf)), ren(a, ags, alsf) = aa ⊦ (aa = τ ⊃ abs(mkstate(gs0, lsf0, pcf0), mkstate(ags, alsf, apcf)) ;∃ ags0, alsf0, apcf0. setStep(mkstate(ags, alsf, apcf), aa, mkstate(ags0, alsf0, apcf0)) ∧ abs(mkstate(gs0, lsf0, pcf0), mkstate(ags0, alsf0, apcf0)) ) | An Axiom |