--- Sending of agreed message followed by safe message followed by --- network partition. Agreed message gets lost, cannot be recovered --- and blocks delivery of safe message at c. Since c cannot deliver --- the safe message it does not send acks. Hence, a and b can only --- deliver the safe message in the smaller transitional --- configuration. Finally, c delivers the safe message in the --- transitional configuration as well, because gaps (here concerning --- the lost agreed message are admitted here). --- See delivered(proc,...) in the corresponding .out-file for the messages --- delivered to the upper layer at proc. in test.maude mod TEST13 is protecting TEST . eq allprocs = sProcSet(proc("a")) sProcSet(proc("b")) sProcSet(proc("c")) . --- initial state op start : -> State . eq start = network(allprocs) mkinitialconf(allprocs) mkinitialprocs(allprocs) multicast-req(proc("b"), agreed, data("test1")) multicast-req(proc("a"), safe, data("test2")) CONTROLLER( PERFORM(SEND(proc("b"),0)) ; PERFORM(RECEIVE(proc("a"),0)) ; PERFORM(RECEIVE(proc("b"),0)) ; PERFORM(SEND(proc("a"),1)) ; PERFORM(RECEIVE(proc("a"),1)) ; PERFORM(RECEIVE(proc("b"),1)) ; PERFORM(RECEIVE(proc("c"),1)) ; PERFORM(RECEIVE(proc("a"),2)) ; PERFORM(RECEIVE(proc("a"),3)) ; PERFORM(RECEIVE(proc("b"),3)) ; PERFORM(RECEIVE(proc("c"),3)) ; ( PERFORM(CHANGE(proc("a"),(sProcSet(proc("a")) sProcSet(proc("b"))))) || --- a receives conf change PERFORM(CHANGE(proc("b"),(sProcSet(proc("a")) sProcSet(proc("b"))))) || --- b receives conf change PERFORM(CHANGE(proc("c"),sProcSet(proc("c")))) --- c receives conf change ) ; PERFORM(LOSE(proc("c"),0)) ; --- lost ( PERFORM(EVS-START(proc("a"),true)) || PERFORM(EVS-START(proc("b"),true)) || PERFORM(EVS-START(proc("c"),true)) ) --- a, b finish sucessfully ) . endm rew start . --- search start =>! state:State .