•Once the simulator is proved correct, we can prove properties of specifications w.r.t. the simulator
•Our protocol is
correct if sender and receiver agree on the id of the last successfully transmitted frame
•(defthm
sender-receiver-agree-1
• (<= (variable-value 'ackid
•
(instance 'receiver (simulate S O)))
• (variable-value 'frameid
• (instance 'sender (simulate S O)))))
•(defthm
sender-receiver-agree-2
• (let ((v1 (variable-value
• 'ackid (instance 'receiver
(simulate S O))))
• (v2 (variable-value
• 'frameid (instance 'sender
(simulate S O)))))
• (implies (< v1 v2) (= (+ 1 v1)
v2))))
•Defined access
functions to extract variables and instances