Proving Vizing s Theorem with Rodin

Transcription

1 Proving Vizing s Theorem with Roin Joachim Breitner March 25, 2011 Proofs for Vizing s Theorem t to be unwiely unless presente in form a constructive algorithm with a proof of its correctness an termination. We implemente such an algorithm in the moelling formalism Event-B an performe a machine-checke correctness proof with the Roin tool. Contents 1. Vizing s Theorem 2 2. Event-B an Roin 2 3. Proof valiation 3 4. Refinement strategy 3 5. Roin impressions 5 6. Lessions learne 7 A. The moels 8 A.1. Input A.2. m00 Spec A.3. m01 Colorops A.4. m02 FixX A.5. m03 FixY A.6. m04 Fan A.7. m05 CDpath as path A.8. m06 CDpath builing A.9. m07 Event orering A.10.m08 Conv Fan Buil A.11.m09 Conv CDpath A.12.m10 Conv Fan Color A.13.m11 Conv Stages A.14.m12 Dealock Freeom

2 2. Event-B an Roin 1. Vizing s Theorem In this project, we prove Vizing s Theorem: For a finite unirecte graph without autoloops an without multiple eges, at vertex of which no more than N eges meet, N + 1 colours suffice for an ege coloring such that eges incient on the same vertex are of ifferent color. This theorem, although prove earlier as well, was consiere by Rao an Dijkstra in 1990, who gave an easier to unerstan proof by escribing a constructive algorithm that colors the eges correctly, along with a proof that this algorithm terminates an is correct [RD90]. This approach was simplifie an streamline by Misra an Gries [MG90]. They also introuce names such as fan an c-path for concepts occurring in the constructions. Their algorithm consists of consecutively executing these steps until all eges are colore: Let X Y be an uncolore ege. Let Y... l be a maximal fan. Let c be a color that is free on X, an a color that is free on l. Invert the c-path. Choose w such that Y... w is a prefix of the fan Y... l an is free on w. Rotate the fan Y... w an color the ege X w with the color. A fan is a list of istinct neighbours of X, starting at Y, such that the ege X fan(k + 1) is coloure an this color is free on the noe fan(k). The colors on such a fan can be rotate, e.g. move from the ege X fan(k +1) to X fan(k) without invaliating the coloring. The c-path is the largest sequence of noes starting at noe X an following the eges colore c or. The inversion of such a path changes the colors on these eges from c to an vica-versa. This is also a transformation that preserves valiness of a coloring. The proof given in the Misra an Gries paper establishes that the operations above inee preserve the valiness of the coloring. Furthermore, they prove that after the inversion of the c-path, a prefix of the path with the property given in the algorithm exists. This is one by case analysis: If no fan ege has color, the c-path was empty to begin with. If there was a fan ege with color, is free on the preceing vertex, say v, on the fan. Either v is in the c-path, the original fan suffices. Or v is no in the c-path, in which case the prefix Y... v is a suitable fan. In case, the inversion of the c-paths frees the color on X, which is preserve by rotation. After rotation, is free on X an the last ege of the fan w, so this ege can be colore. For more etails on the proof, refer to the implementation below or to the original paper. 2. Event-B an Roin Event-B is a formalism conceive by Jean-Raymon Abrial to moel an verify systems. The main characteristic of Event-B is the concept of refinement: An abstract specification is refine by a slightly more concrete moel, which is prove correct with regar to the specification. Then this moel is again refine by something more concrete, an again the correctness of the 2

3 new moel is prove, but not against the original specification, but only against the previous moel. This is iterate until the final, concrete implementation is reache. By transitivity of implication, the final moel is known to correctly implement the specification. Another important characteristic of Event-B is the use of events, which consist of logical preicates as guars, eciing an event may occur, an (possibly non-eterministic) actions, moifying the state of the moel. The expecte behaviour of the moel is formalize by preicates calle invariants, which have to be provably preserve by every event. Roin is an Eclipse base platform to perform moelling within this framework. It allows to efine the moels, calculates the proof obligations an either solves them automatically using external theorem provers or gives the user to manually perform the proof. It is extensible with plugins, for example to generate L A TEX ocuments escribing the moels (as use in this paper) or to generate aitional proof obligations such as the absence of ealocks. 3. Proof valiation A Roin moel is an unusual way of presenting a proof for a mathematical statement. So the question arises whether it is a vali one? It is soun given the following assumptions are mae or inepently verifie. Roin is soun, e.g. it woul reject invali automatic or manual proof. This is actually a strong assumption. Previous versions of Roin have containe sounness errors 1,an the Release Notes 2 for new versions contain a isclaimer: However, espite the total commitment of our teams to insure the sounness of the platform, some unexpecte an unknown sounness issues coul remain. In the case of Vizing s Theorem, the result is alreay well establishe. If this were some new result, relying only on the Roin platform for verifying the proof obligations woul not constitute a rigorous proof. Roin correctly generates all proof obligations require to ensure that an executable algorithm in the final refinement inee fulfills the specification given in he first refinement. Given that this is the core iea of the Event-B formalism, its theory an implementation is likely to be thoroughly reviewe. The formalisation of the graph an the guar of the finish event in the first refinement are faithful representations of the assumptions an conclusions of the theorem to be prove. Every event introuce in later refinements is, at one stage, shown to be convergent. 4. Refinement strategy Event-B is event base, so imperative algorithm cannot be reasone about irectly. The usual approach here is to have one particular event, here calle finish, which inicates the of the

4 4. Refinement strategy Moel POs auto. manual VizingTheorem Input m00 Spec m01 Colorops m02 FixX m03 FixY m04 Fan m05 CDpath as path m06 CDpath builing m07 Event orering m08 Conv Fan Buil m09 Conv CDpath m10 Conv Fan Color m11 Conv Stages m12 Dealock Freeom Table 1: Proof obligation statistics algorithm. In the very first moel, the guar of this event is set to the esire result of the algorithm. In further refinements new events are ae as require to reach this goal. Each of these events is eventually marke as convergent, thus ensuring that the program oes not run forever. If aitionally ealock freeom is prove for the very last moel, this implies that eventually, the finish event will be execute. At this point, we know that the program is correct an terminates. Our construction of the coloring algorithm consists of a context, which efines the constants of the problem (the vertexes, the graph an the available colors) together with our assumptions about them (represente as axioms of the system). An initial moel gives the abstract an non-executable specification of our problem, followe by 12 refinements. The last five of these o not moify the moel; their purpose is to house the convergence an ealock freeom proofs. The following list gives a quick overview of the refinements an lists each event occurs the first time. Table 1 gives an overview of the number of proof obligations in each refinement, an how m of them ha to be one manually. Input: Defines the input of the problem with the given assumptions. m00 Spec: Abstract specification of the algorithm. New events: INITIALISATION an finish. m01 Colorops: Defines the possible operations on the coloring of the graph an establishes their correctness. Inclues the proof of the convergence of color1. New events: color1, colormove, invertpath m02 FixX: Introuces the vertex variable X an moifies the events to only work with that vertex, an upate it appropriate. 4

5 m03 FixY: Introuces the vertex variable Y an moifies the events to only work with that vertex, an upate it appropriate. m04 Fan: Introuction of the concept of a fan. New events: ext fan, fan one. The event color1 is split into color1a an color1b. m05 CDpath as path: The set representation of the c-path is refine to refer to the image of a path, as require by the algorithm. m06 CDpath builing: The c-path is represente in a variable, the calculation of the c-path is implemente. New events: extcpath, noinvertpath. m07 Event orering: The event guars are moifie to ensure that they run in the esire orer. To this, a variable stage is introuce. m08 Conv Fan Buil: Proofs convergence of stage 3, the construction of the fan. m09 Conv CDpath: Proofs convergence of stage 2, the construction an inversion of the c-path.. m10 Conv Fan Color: Proofs convergence of stage 1, the re-coloring of eges on the fan. m11 Conv Stages: Completes convergence across all stages. m12 Dealock Freeom: Proofs the ealock freeom. 5. Roin impressions Roin is a moelling tool, an not a theorem prover. This is one conclusion of this project. Although we were able to obtain the proof we wante, an assuming sounness of Roin, the proof is a vali one, there were obstacles in the way. We will iscuss some of the ifficulties encountere. Note that we use Roin for the first time an without guiance, some of the ifficulties might be ue to ignorance on our sie an not limitations of the framework. There is no support to efine custom preicates, i.e. introuce abbreviations for formulas, in Roin itself. A plugin is available, the Theory plugin, to ext Roin s mathematical notation, but it only allows to efine preicates on a global level an not with regar to userintrouce axioms or even within the scope of one machine. As a work-aroun, we efine the axiom vali in the context, which is the set of all vali colorings, an use c vali to express that the preicate is true for the coloring c. This works, although it can become annoying as we ha to manually unroll this efinition to access the properties of a vali coloring. In hinsight it might have been easier if we ha, at least for the omnipresent variable coloring2, given these properties irectly as invariants. Roin has support to express statements about the carinality of finite sets, but the only few proof rules are available. Therefore, to transform car(a \ B) = car(a) car(b), 5

6 5. Roin impressions we know B A, we ha to first express it in terms of carinality of a union to be able to use the existing rule an continue from there. 3 car(a B) = car(a) + car(b) car(a B) Pulling the carinality operator across a function, e.g. car(ran(f)) car(om(f)), or the equality of omain an range of injective functions were not expressible at all (or we were not able to fin a workaroun). This is the reason for the introuction of axm13, a fact that shoul be provable given the other axioms. Occasionally, we were missing an inicator function, at least for natural numbers. We worke aroun it by using expressions such as (min({stage, 2}) 1), which worke well enough. Although Roin has rules to automatically replace an expression min({3, 2}) by 2, it woul leave an expression 3 2 in the goal. To solve this, the user has to a 3 2 = 1 as a hypotheses, prove this using the automatic provers, an manually apply the quality. In the action specification of an event, it is not possible to refer to the after-state x of a variable x set before. This causes repetition, for example in the event color1 of the moel FixY: In act1, we upate the variable coloring2 with some larger expression an have to repeat that expression in act2. Similarly, the non-eterministic assignment to X an Y in act3 of the initialisation causes a proof obligation of feasibility. Later refinements have to assign the variables fan an cpath in a manner that eterministically eps on the new values of X an Y. But as the assignment cannot refer to X an Y, so the action act3 has to be moifie to also set fan an cpath. This causes the same feasibility proof obligation to reoccur in later moels. In general, proofs within Roin are write-once, rea never. This is very ifferent from, for example, the structure proofs one with the theorem prover Isabelle[isa], an iscourages large proofs. We assume that this is intentional, as a very large proofs probably inicate that some refinement step was too large, an that using aitional events or invariants, the proof woul be smaller. Nevertheless, some large proofs were not avoiable in the course of this project. Although Roin seems to try har to retain proofs even if the unerlying moel is change, it oes not always succee an woul throw away the ol proof. Given the time spent on some proofs, this stoppe us from oing more clean-up of invariants an events after finishing the moelling. Even a simple change, such as removing the unnecessary variable coloring of the initial moel woul lose m proofs in later moels. There are few choices to extract the moels in a presentable way. Basically, there is only the L A TEX plugin, which is use in this report. It can export one moel at a time, which results in a lot of clicks exporting the whole evelopment, an prouces full L A TEX ocuments, which were to be mangle by bash an perl to obtain fragments that coul be inclue in this ocument. Because of the single-moel focus, it repeats guars an actions of refine events even the event is only exte. 3 Upcoming versions of Roin are likely to have a rule for the carinality of set ifferences. 6

7 6. Lessions learne If we woul o the same project again, we woul tackle it with slight moifications. Some of these changes shoul be possible to implement after finishing the project as well, if it were not for the problem mentione above that some changes cause too m proof obligations to be lost. The finish event of the first refinement only nees a guar. As our goal is to proof a theorem, an not to evelop a real-life system, we are not so much intereste in the final coloring but only in its existence. Therefore, the guar gr1 : c c graph C c vali is sufficient for our cause, an the variable coloring as well as the assignments to it an the invariants concering it coul be remove without loss. It woul have been cleaner to introuce the stages much earlier, possibly after the m01 Colorops refinement. This woul allow to efine invariants about the variable c an, the fan or the c path only they are actually vali. For example, we o not care about c an in stage 3, an the properties of the c-path are only relevant in stage 2. In the currenct way, some invariants about the c-path are preicate by pathl > 0, e.g. using the empty path ever the path variable is actually irrelevant. Aitionally, this woul allow to prove termination for the events of each stage inepently, therefore the work-arouns of the kin (min({stage, 2}) 1) woul be unnecessary an most variants coul be expresse as sets instea of natural numbers, avoiing the poorly supporte carinality operator. As mentione above, the introuction of the set vali for a vali coloring was less helpful than expecte. Especially if the first moel woul not contain an coloring variable, the properties of a vali coloring woul only occur in the guar of finish an the invariants of the first refinement, which is an acceptable level of repetition. References [isa] Isabelle: A Generic Theorem Proving Environment. Version [MG90] Misra, J ; Gries, Davi: A Constructive Proof of Vizing s Theorem. In: Information Processing Letters 41 (1990). [RD90] Rao, Josyula R. ; Dijkstra, Esger W.: Constructing the proof of Vizing s Theorem. Version: Februar

8 A. The moels A. The moels This appix contains the etails of the moels. The comments are part of the moel an inclue here by the L A TEX plugin. Information about the generate proof obligations is not available. A.1. Input CONTEXT Input This context efines the parameters of our algorithm, e.g. the graph for which we have to fin a suitable coloring. SETS V noes of the graph C available colors CONSTANTS graph The graph, represente as a relation over the noes N The maximum egree of the graph vali This is a convenience efinition, the set of all vali, possibly incomplete, colorings of the graph. This is require as Roin oes not allow for an easy way to efine custom preicates, especially not some that are efine with respect to an user-introuce constant. AXIOMS axm1 : finite(v ) We only consier finite graphs. axm2 : finite(c ) An the number of available colors is finite, too (otherwise we may not talk about its carinality). axm3 : graph (V V ) Type specification for the constant graph. axm4 : finite(graph) This woul follow from the previous two axioms. We inclue it for convenience. axm5 : graph 1 = graph Our graph is unirecte. We represent that as a irecte graph all inverte eges are present. axm6 : x car(graph[{x}]) N The egree of each noe is at most N,... axm7 : N N...which is a natural number. axm8 : x (x x) / graph The graph has no autoloops. axm9 : car(c ) = N + 1 The number of available colors is larger than the largest egree. axm10 : vali P(graph C ) We introuce a constant to be able to concisely write that a coloring is vali. 8

9 A.2. m00 Spec END axm11 : vali = {c c graph C ( x y z ((x y) ) c ((x z) ) c y = z) ( x y ((x y) ) c ((y x) ) c)} A coloring is vali if: (1) It is a partial function from the graph eges to the set of colors. (2) Different eges on one noe have ifferent colors. (3) It is consistent with the fact that we actually consier unirecte graphs. axm12 : graph Not part of the official specification, but otherwise we have nothing to prove ways, an we nee this to assign varibles later. axm13 : c c vali ( y z y z / c) This shoul be provable from the above efinitions. A.2. m00 Spec MACHINE m00 Spec The first moel gives the abstract specification of the problem. SEES Input VARIABLES coloring INVARIANTS inv1 : coloring graph C inv2 : coloring vali EVENTS Initialisation begin act1 : coloring := Event finish = When we know that there is a vali coloring that colors the whole graph, we are one. END gr1 : c c graph C c vali act1 : coloring : coloring graph C coloring vali A.3. m01 Colorops MACHINE m01 Colorops Definition of the operations on the coloring along the way. REFINES m00 Spec SEES Input 9

10 A. The moels VARIABLES coloring coloring2 This is the mutable coloring that we work on uring the execution of the program. INVARIANTS inv1 : coloring2 vali The coloring will always stay vali. EVENTS Initialisation exte We start with an empty coloring. begin act1 : coloring := act2 : coloring2 := Event finish = An we are one once all eges are colore. refines finish gr1 : om(coloring2 ) = graph act1 : coloring := coloring2 Event color1 = This event colors an ege that can be colore without invaliating the coloring. Status convergent x y gr1 : x y graph gr2 : x y / om(coloring2 ) gr3 : z (x z) / coloring2 gr4 : z (y z) / coloring2 act1 : coloring2 := coloring2 {x y, y x } Event colormove = An ege may be colore by simultanously uncoloring a neighboring ege, if the color is free on the other sie. x y 10

11 A.4. m02 FixX w gr1 : x y graph gr2 : x w graph gr3 : x y / om(coloring2 ) gr4 : x w om(coloring2 ) gr5 : z (y z coloring2 (x w)) coloring2 act1 : coloring2 := ({x w, w x} coloring2 ) {x y coloring2 (x w), y x coloring2 (x w)} Event invertpath = Two colors c an may be flippe in a region of the graph that is close with regar to those two colors. c path gr1 : c C gr2 : C gr4 : path V gr3 : y y path ( z ((y z c coloring2 y z coloring2 ) z path)) The path is close with regar to these colors. act1 : coloring2 := {(y z e ) e (y z e) coloring2 (((y path z path) ((e = e = c) (e = c e = ) (e e c e = e ))) (y / path z / path e = e)) } As one can guess, this efinition causes proofs to be come ifficult. VARIANT END car(graph) car(om(coloring2)) We never ecrease the number of colore eges, so this terminates eventually. A.4. m02 FixX MACHINE m02 FixX Fixes the variable X. Events are refine to remove X from the list of parameters. REFINES m01 Colorops SEES Input 11

12 A. The moels VARIABLES coloring coloring2 X This vertex is on one sie of the uncolore ege an is not altere uring recolorings. INVARIANTS inv1 : X V X is a vertex. inv2 : om(coloring2 ) = graph ( y (X y graph X y / om(coloring2 ))) Unless we are alreay one, there is an uncolore ege from this noe. EVENTS Initialisation exte begin act1 : coloring := act2 : coloring2 := act3 : X : y X y graph Event finish = exts finish gr1 : om(coloring2) = graph act1 : coloring := coloring2 Event color1 = refines color1 y gr1 : X y graph gr2 : X y / om(coloring2 ) gr3 : z (X z) / coloring2 gr4 : z (y z) / coloring2 with x : x = X act1 : coloring2 := coloring2 {X y, y X } act2 : X : om(coloring2 {X y, y X }) = graph ( z X z graph \ om(coloring2 {X y, y X })) After we colore the ege, we nee to fin a new uncolore X, at least unless the graph is fully colore. At this point it woul be nice to be able to refer to coloring2. 12

13 A.5. m03 FixY Event colormove = refines colormove y w gr1 : X y graph gr2 : X w graph gr3 : X y / om(coloring2 ) gr4 : X w om(coloring2 ) gr5 : z (y z coloring2 (X w)) coloring2 with x : x = X act1 : coloring2 := ({X w, w X } coloring2 ) {X y coloring2 (X w), y X coloring2 (X w)} Event invertpath = exts invertpath c path gr1 : c C gr2 : C gr4 : path V gr3 : y y path ( z ((y z c coloring2 y z coloring2) z path)) The path is close with regar to these colors. act1 : coloring2 := {(y z e ) e (y z e) coloring2 (((y path z path) ((e = e = c) (e = c e = ) (e e c e = e ))) (y / path z / path e = e)) } As one can guess, this efinition causes proofs to be come ifficult. END A.5. m03 FixY MACHINE m03 FixY Fixes the variable Y (which changes with color1 an colormove), an removes it from 13

14 A. The moels parameter lists. REFINES m02 FixX SEES Input VARIABLES coloring coloring2 X Y INVARIANTS inv1 : om(coloring2 ) = graph X Y graph \ om(coloring2 ) EVENTS Initialisation begin act1 : coloring := act2 : coloring2 := act3 : X, Y : X Y graph Event finish = exts finish gr1 : om(coloring2) = graph act1 : coloring := coloring2 Event color1 = refines color1 gr1 : X Y graph gr2 : X Y / om(coloring2 ) gr3 : z (X z) / coloring2 gr4 : z (Y z) / coloring2 with y : y = Y act1 : coloring2 := coloring2 {X Y, Y X } act2 : X, Y : om(coloring2 {X Y, Y X }) = graph X Y graph \ om(coloring2 {X Y, Y X }) Event colormove = refines colormove w 14

15 A.6. m04 Fan gr1 : X Y graph gr2 : X w graph gr3 : X Y / om(coloring2 ) gr4 : X w om(coloring2 ) gr5 : z (Y z coloring2 (X w)) coloring2 with y : y = Y act1 : coloring2 := ({X w, w X } coloring2 ) {X Y coloring2 (X w), Y X coloring2 (X w)} act2 : Y := w Event invertpath = exts invertpath END c path gr1 : c C gr2 : C gr4 : path V gr3 : y y path ( z ((y z c coloring2 y z coloring2) z path)) The path is close with regar to these colors. act1 : coloring2 := {(y z e ) e (y z e) coloring2 (((y path z path) ((e = e = c) (e = c e = ) (e e c e = e ))) (y / path z / path e = e)) } As one can guess, this efinition causes proofs to be come ifficult. A.6. m04 Fan MACHINE m04 Fan This machine introuces the concept of the fan. REFINES m03 FixY SEES Input VARIABLES coloring coloring2 15

16 A. The moels X Y fan l INVARIANTS The fan. The size of the fan. inv3 : X Y / om(coloring2 ) l N 1 Some of these things only hol if we are not alreay one, thus the implication in the invariants. inv9 : X Y om(coloring2 ) l = 0 If we are one, the fan shoul be the empty function. inv2 : fan 1.. l V inv1 : X Y / om(coloring2 ) (fan(1 ) = Y ) The fan always starts with Y. inv4 : n n 1.. l X fan(n) graph The fan contains neighbours of X. inv5 : n n 2.. l X fan(n) om(coloring2 ) All eges to fan vertices but the first are colore. inv6 : n n 1..(l 1 ) ( z (fan(n) z ) coloring2 (X fan(n +1 ) ) / coloring2 ) An the color of such an ege is free on the preceing vertex on the fan. EVENTS Initialisation begin act1 : coloring := act2 : coloring2 := act3 : X, Y, fan : (X Y graph fan = {1 Y }) act4 : l := 1 Event finish = exts finish gr1 : om(coloring2) = graph act1 : coloring := coloring2 Event color1a = At this point, the color1 event is split into one that finishes the algorithm, an one we have to continue. refines color1 gr1 : X Y graph gr2 : X Y / om(coloring2 ) gr3 : z (X z) / coloring2 16

17 A.6. m04 Fan gr4 : z (Y z) / coloring2 gr5 : om(coloring2 {X Y, Y X }) = graph This is the last uncolore ege. act1 : coloring2 := coloring2 {X Y, Y X } act4 : fan := We remove the fan. act3 : l := 0 Event color1b = This is not the last ege. refines color1 X2 So here is our next ege to be colore. Y2 gr1 : X Y graph gr2 : X Y / om(coloring2 ) gr3 : z (X z) / coloring2 gr4 : z (Y z) / coloring2 gr5 : X2 Y2 graph \ om(coloring2 {X Y, Y X }) act1 : coloring2 := coloring2 {X Y, Y X } act2 : X := X2 act3 : Y := Y2 act4 : fan := {1 Y2 } The fan is initialize with the new value of Y. act5 : l := 1 Event colormove = This refinement ensures that colormove is only applie to the first ege of the fan, thus removing one paramter. refines colormove gr1 : X Y graph gr3 : X Y / om(coloring2 ) gr4 : l 2 with w : w = fan(2) act1 : coloring2 := ({X fan(2 ), fan(2 ) X } coloring2 ) {X Y coloring2 (X fan(2 )), Y X coloring2 (X fan(2 ))} act2 : Y := fan(2 ) act3 : fan := (λn n 1.. l 1 fan(n + 1 )) The fan is upate afterwars. 17

18 A. The moels act4 : l := l 1 Event invertpath k = We only invert a c-path if there is an ege of color towars the fan (otherwise the c-path is empty ways). exts invertpath c path k Fan ege with color gr1 : c C gr2 : C gr4 : path V gr3 : y y path ( z ((y z c coloring2 y z coloring2) z path)) The path is close with regar to these colors. gr9 : l N 1 gr5 : X path gr7 : z (fan(l) z ) / coloring2 gr8 : z (X z c) / coloring2 gr11 : k 1.. l 1 gr10 : (X fan(k + 1 ) ) coloring2 act1 : coloring2 := {(y z e ) e (y z e) coloring2 (((y path z path) ((e = e = c) (e = c e = ) (e e c e = e ))) (y / path z / path e = e)) } As one can guess, this efinition causes proofs to be come ifficult. act2 : l, fan : (fan(k) path l = l fan = fan) (fan(k) / path l = k fan = 1.. k fan) We either use the ol path, or take a prefix thereof. Event extfan = This event buils up the fan by aing a new vertex, if possible. z gr4 : l N 1 gr1 : z / ran(fan) gr2 : X z om(coloring2 ) gr3 : w fan(l) w coloring2 coloring2 (X z) 18

19 A.7. m05 CDpath as path act1 : l := l + 1 act2 : fan := fan {l + 1 z} Event fan one = This event oes nothing in this refinement, but fires the fan is fully built. This will later be refine with some action. END gr1 : l N 1 gr2 : ( z (z / ran(fan) X z om(coloring2 ) w fan(l) w coloring2 coloring2 (X z))) skip A.7. m05 CDpath as path MACHINE m05 CDpath as path The c--path shoul be a path REFINES m04 Fan SEES Input VARIABLES coloring coloring2 X Y fan l length of fan EVENTS Initialisation exte begin act1 : coloring := act2 : coloring2 := act3 : X, Y, fan : (X Y graph fan = {1 Y }) act4 : l := 1 Event finish = exts finish gr1 : om(coloring2) = graph act1 : coloring := coloring2 19

20 A. The moels Event color1a = exts color1a gr1 : X Y graph gr2 : X Y / om(coloring2) gr3 : z (X z) / coloring2 gr4 : z (Y z) / coloring2 gr5 : om(coloring2 {X Y, Y X }) = graph act1 : coloring2 := coloring2 {X Y, Y X } act4 : fan := act3 : l := 0 Event color1b = exts color1b X2 Y2 gr1 : X Y graph gr2 : X Y / om(coloring2) gr3 : z (X z) / coloring2 gr4 : z (Y z) / coloring2 gr5 : X2 Y2 graph \ om(coloring2 {X Y, Y X }) act1 : coloring2 := coloring2 {X Y, Y X } act2 : X := X2 act3 : Y := Y2 act4 : fan := {1 Y2} act5 : l := 1 Event colormove = exts colormove gr1 : X Y graph gr3 : X Y / om(coloring2) gr4 : l 2 act1 : coloring2 := ({X fan(2), fan(2) X} coloring2) {X Y coloring2(x fan(2)), Y X coloring2(x fan(2))} act2 : Y := fan(2) 20

21 A.7. m05 CDpath as path act3 : fan := (λn n 1.. l 1 fan(n + 1)) act4 : l := l 1 Event invertpath k = refines invertpath k c cp k Fan ege with color pl path length gr13 : pl N gr12 : cp 0.. pl V gr1 : c C gr2 : C gr3 : i i 1.. pl 1 ( z (cp(i) z c coloring2 cp(i) z coloring2 ) (z = cp(i 1 ) z = cp(i + 1 ))) gr9 : l N 1 gr5 : cp(0 ) = X gr7 : z (fan(l) z ) / coloring2 gr8 : z (X z c) / coloring2 gr11 : k 1.. l 1 gr10 : (X fan(k + 1 ) ) coloring2 gr14 : z cp(0 ) z coloring2 (pl > 0 z = cp(1 )) gr15 : pl > 0 ( z (cp(pl) z c coloring2 cp(pl) z coloring2 ) (z = cp(pl 1 ))) with path : path = ran(cp) act1 : coloring2 := {(y z e ) e (y z e) coloring2 (((y ran(cp) z ran(cp)) ((e = e = c) (e = c e = ) (e e c e = e ))) (y / ran(cp) z / ran(cp) e = e))} act2 : l, fan : (fan(k) ran(cp) l = l fan = fan) (fan(k) / ran(cp) l = k fan = 1.. k fan) Event extfan = exts extfan z gr4 : l N 1 gr1 : z / ran(fan) gr2 : X z om(coloring2) gr3 : w fan(l) w coloring2 coloring2(x z) 21

22 A. The moels act1 : l := l + 1 act2 : fan := fan {l + 1 z} Event fan one = exts fan one END gr1 : l N 1 gr2 : ( z (z / ran(fan) X z om(coloring2) w fan(l) w coloring2 coloring2(x z))) skip A.8. m06 CDpath builing MACHINE m06 CDpath builing The c-path is being built up, similar to the fan before. REFINES m05 CDpath as path SEES Input VARIABLES coloring coloring2 X Y fan l cpath pathl c INVARIANTS length of fan The c-path (or a prefix of it, while it is being constructe). The length of the c-path. This color is free on the last vertex of the fan. This color is free on X. Together they efine the c-path. inv6 : C inv5 : c C inv1 : cpath 0.. pathl V inv2 : pathl N inv3 : cpath(0 ) = X The c-path always starts with X. inv4 : i i 1.. pathl 1 ( z (cpath(i) z c coloring2 cpath(i) z coloring2 ) (z = cpath(i 1 ) z = cpath(i + 1 ))) An ege with color c or causes that ege to enlargen the cpath. 22

23 A.8. m06 CDpath builing inv7 : pathl > 0 ( z cpath(0 ) z coloring2 z = cpath(1 )) From X, the c-path exts along eges of color, as c is free on X. inv8 : pathl > 0 ( z (X z c ) / coloring2 ) c is free on X, at least once we starte to buil up the c-path. inv9 : i i 1.. pathl (cpath(i) cpath(i 1 ) c coloring2 cpath(i) cpath(i 1 ) coloring2 ) Vertices on the c-path are connecte by an ege of color c or. inv10 : X Y / om(coloring2 ) ( z (fan(l) z ) / coloring2 ) Unless we are one, is free on the last vertex of the fan. EVENTS Initialisation begin act1 : coloring := act2 : coloring2 := act3 : X, Y, fan, cpath : X Y graph fan = {1 Y } cpath = {0 X } act4 : l := 1 act5 : pathl := 0 act6 : c : C act7 : : C Event finish = exts finish gr1 : om(coloring2) = graph act1 : coloring := coloring2 Event color1a = exts color1a gr1 : X Y graph gr2 : X Y / om(coloring2) gr3 : z (X z) / coloring2 gr4 : z (Y z) / coloring2 gr5 : om(coloring2 {X Y, Y X }) = graph This is the last uncolore ege. gr6 : pathl = 0 act1 : coloring2 := coloring2 {X Y, Y X } act4 : fan := We remove the fan. act3 : l := 0 23

24 A. The moels Event color1b = exts color1b X2 So here is our next ege to be colore. Y2 gr1 : X Y graph gr2 : X Y / om(coloring2) gr3 : z (X z) / coloring2 gr4 : z (Y z) / coloring2 gr5 : X2 Y2 graph \ om(coloring2 {X Y, Y X }) act1 : coloring2 := coloring2 {X Y, Y X } act2 : X := X2 act3 : Y := Y2 act4 : fan := {1 Y2} The fan is initialize with the new value of Y. act5 : l := 1 act6 : cpath := {0 X2 } act7 : pathl := 0 act8 : : z (Y2 z ) / coloring2 {X Y, Y X } We nee to fin a new. Event colormove = exts colormove gr1 : X Y graph gr3 : X Y / om(coloring2) gr4 : l 2 gr5 : pathl = 0 act1 : coloring2 := ({X fan(2), fan(2) X} coloring2) {X Y coloring2(x fan(2)), Y X coloring2(x fan(2))} act2 : Y := fan(2) act3 : fan := (λn n 1.. l 1 fan(n + 1)) The fan is upate afterwars. act4 : l := l 1 Event invertpath k = We want to use the calculate c path, of course, so the parameters are replace. refines invertpath k k Fan ege with color 24

25 A.8. m06 CDpath builing gr16 : pathl > 0 gr9 : l N 1 gr11 : k 1.. l 1 gr10 : (X fan(k + 1 ) ) coloring2 gr15 : z (cpath(pathl) z c coloring2 cpath(pathl) z coloring2 ) (z = cpath(pathl 1 )) This ensures that the c-path is alreay fully calculate. with : = c : c = c cp : cp = cpath pl : pl = pathl act1 : coloring2 := {(y z e ) e (y z e) coloring2 (((y ran(cpath) z ran(cpath)) ((e = e = c ) (e = c e = ) (e e c e = e ))) (y / ran(cpath) z / ran(cpath) e = e))} act2 : l, fan : (fan(k) ran(cpath) l = l fan = fan) (fan(k) / ran(cpath) l = k fan = 1.. k fan) act3 : cpath := {0 X } act4 : pathl := 0 act5 : c := Event no invertpath = gr2 : l N 1 gr4 : z X z / coloring2 is free on X, so no path to buil. gr5 : ( z (z / ran(fan) X z om(coloring2 ) ( w fan(l) w coloring2 coloring2 (X z)))) This ensures that the fan is maximal. act4 : c := If the fan is maximal an free on X, the c-path is empty an we conclue that is free on X. Event extfan = exts extfan z gr4 : l N 1 gr1 : z / ran(fan) gr2 : X z om(coloring2) gr3 : w fan(l) w coloring2 coloring2(x z) gr5 : pathl = 0 25

26 A. The moels act1 : l := l + 1 act2 : fan := fan {l + 1 z} act3 : : w z w / coloring2 We nee to upate, the free color of the last noe on the fan. Event extcpath = This buils the c-path by exting it along eges of color c or. z gr1 : z V gr2 : z / ran(cpath) gr3 : cpath(pathl) z c coloring2 cpath(pathl) z coloring2 gr4 : z X z c / coloring2 act1 : cpath := cpath {pathl + 1 z} act2 : pathl := pathl + 1 Event fan one = exts fan one END gr1 : l N 1 gr2 : ( z (z / ran(fan) X z om(coloring2) w fan(l) w coloring2 coloring2(x z))) gr3 : pathl = 0 act1 : c : z X z c / coloring2 A.9. m07 Event orering MACHINE m07 Event orering This refinement tightens the guars to run the events in the esire orer. REFINES m06 CDpath builing SEES Input VARIABLES coloring coloring2 X Y fan 26

27 A.9. m07 Event orering l length of fan cpath c-path (or prefix while builing) (I am running ot of names) pathl length of c path c stage stage 3: buiing fan, stage 2: builing c-path an inverting it, stage 1: moving color along path INVARIANTS inv1 : stage inv4 : stage = 3 pathl = 0 In strage three, the c-path stays empty. inv2 : stage = 2 l N 1 ( z (z / ran(fan) X z om(coloring2 ) w fan(l) w coloring2 coloring2 (X z))) In stage 2, the fan is fully calculate. inv5 : stage = 2 ( z X z c / coloring2 ) An c is free on X. inv3 : stage = 1 c = In stage one, we have free on both X an the of the fan. inv6 : stage = 1 pathl = 0 An in stage 1, the c-path has been flippe or was empty in the first place. inv7 : stage = 1 ( z X z c / coloring2 ) EVENTS Initialisation exte begin act1 : coloring := act2 : coloring2 := act3 : X, Y, fan, cpath : X Y graph fan = {1 Y } cpath = {0 X } act4 : l := 1 act5 : pathl := 0 act6 : c : C act7 : : C act8 : stage := 3 Event finish = exts finish gr1 : om(coloring2) = graph act1 : coloring := coloring2 Event color1a = exts color1a 27

28 A. The moels gr1 : X Y graph gr2 : X Y / om(coloring2) gr3 : z (X z) / coloring2 gr4 : z (Y z) / coloring2 gr5 : om(coloring2 {X Y, Y X }) = graph This is the last uncolore ege. gr6 : pathl = 0 gr7 : stage = 1 act1 : coloring2 := coloring2 {X Y, Y X } act4 : fan := We remove the fan. act3 : l := 0 act5 : stage := 3 Event color1b = exts color1b X2 So here is our next ege to be colore. Y2 gr1 : X Y graph gr2 : X Y / om(coloring2) gr3 : z (X z) / coloring2 gr4 : z (Y z) / coloring2 gr5 : X2 Y2 graph \ om(coloring2 {X Y, Y X }) gr6 : stage = 1 act1 : coloring2 := coloring2 {X Y, Y X } act2 : X := X2 act3 : Y := Y2 act4 : fan := {1 Y2} The fan is initialize with the new value of Y. act5 : l := 1 act6 : cpath := {0 X2} act7 : pathl := 0 act8 : : z (Y2 z ) / coloring2 {X Y, Y X } We nee to fin a new. act9 : stage := 3 Event colormove = exts colormove 28

29 A.9. m07 Event orering gr1 : X Y graph gr3 : X Y / om(coloring2) gr4 : l 2 gr5 : pathl = 0 gr6 : stage = 1 act1 : coloring2 := ({X fan(2), fan(2) X} coloring2) {X Y coloring2(x fan(2)), Y X coloring2(x fan(2))} act2 : Y := fan(2) act3 : fan := (λn n 1.. l 1 fan(n + 1)) The fan is upate afterwars. act4 : l := l 1 Event invertpath k = exts invertpath k k Fan ege with color gr16 : pathl > 0 gr9 : l N 1 gr11 : k 1.. l 1 gr10 : (X fan(k + 1) ) coloring2 gr15 : z (cpath(pathl) z c coloring2 cpath(pathl) z coloring2) (z = cpath(pathl 1)) This ensures that the c-path is alreay fully calculate. gr17 : stage = 2 act1 : coloring2 := {(y z e ) e (y z e) coloring2 (((y ran(cpath) z ran(cpath)) ((e = e = c ) (e = c e = ) (e e c e = e ))) (y / ran(cpath) z / ran(cpath) e = e))} act2 : l, fan : (fan(k) ran(cpath) l = l fan = fan) (fan(k) / ran(cpath) l = k fan = 1.. k fan) act3 : cpath := {0 X} act4 : pathl := 0 act5 : c := act6 : stage := 1 Event extfan = Fan is exte first, as long as is not c an it can be exte exts extfan z gr4 : l N 1 gr1 : z / ran(fan) 29

30 A. The moels gr2 : X z om(coloring2) gr3 : w fan(l) w coloring2 coloring2(x z) gr5 : pathl = 0 gr7 : stage = 3 act1 : l := l + 1 act2 : fan := fan {l + 1 z} act3 : : w z w / coloring2 We nee to upate, the free color of the last noe on the fan. Event extcpath = c-path is calculate if fan is maximal an c is not exts extcpath z gr1 : z V gr2 : z / ran(cpath) gr3 : cpath(pathl) z c coloring2 cpath(pathl) z coloring2 gr4 : z X z c / coloring2 gr7 : stage = 2 gr5 : c act1 : cpath := cpath {pathl + 1 z} act2 : pathl := pathl + 1 Event fan one = exts fan one gr1 : l N 1 gr2 : ( z (z / ran(fan) X z om(coloring2) w fan(l) w coloring2 coloring2(x z))) gr3 : pathl = 0 gr4 : stage = 3 act1 : c : z X z c / coloring2 act2 : stage := 2 Event noinvertpath = exts no invertpath gr2 : l N 1 30

31 A.10. m08 Conv Fan Buil END gr4 : z X z / coloring2 is free on X, so no path to buil. gr5 : ( z (z / ran(fan) X z om(coloring2) ( w fan(l) w coloring2 coloring2(x z)))) This ensures that the fan is maximal. gr1 : stage = 2 act4 : c := If the fan is maximal an free on X, the c-path is empty an we conclue that is free on X. act1 : stage := 1 A.10. m08 Conv Fan Buil MACHINE m08 Conv Fan Buil This refinement shows the convergence of fan builing. REFINES m07 Event orering SEES Input VARIABLES coloring coloring2 X Y fan l length of fan cpath c-path (or prefix while builing) (I am running ot of names) pathl length of c path c stage stage 3: buiing fan, stage 2: builing c-path an inverting it, stage 1: moving color along path EVENTS Initialisation exte begin act1 : coloring := act2 : coloring2 := act3 : X, Y, fan, cpath : X Y graph fan = {1 Y } cpath = {0 X } act4 : l := 1 act5 : pathl := 0 act6 : c : C act7 : : C act8 : stage := 3 31

32 A. The moels Event finish = exts finish gr1 : om(coloring2) = graph act1 : coloring := coloring2 Event color1a = exts color1a gr1 : X Y graph gr2 : X Y / om(coloring2) gr3 : z (X z) / coloring2 gr4 : z (Y z) / coloring2 gr5 : om(coloring2 {X Y, Y X }) = graph This is the last uncolore ege. gr6 : pathl = 0 gr7 : stage = 1 act1 : coloring2 := coloring2 {X Y, Y X } act4 : fan := We remove the fan. act3 : l := 0 act5 : stage := 3 Event color1b = exts color1b X2 So here is our next ege to be colore. Y2 gr1 : X Y graph gr2 : X Y / om(coloring2) gr3 : z (X z) / coloring2 gr4 : z (Y z) / coloring2 gr5 : X2 Y2 graph \ om(coloring2 {X Y, Y X }) gr6 : stage = 1 act1 : coloring2 := coloring2 {X Y, Y X } act2 : X := X2 act3 : Y := Y2 act4 : fan := {1 Y2} The fan is initialize with the new value of Y. 32

33 A.10. m08 Conv Fan Buil Event colormove = exts colormove act5 : l := 1 act6 : cpath := {0 X2} act7 : pathl := 0 act8 : : z (Y2 z ) / coloring2 {X Y, Y X } We nee to fin a new. act9 : stage := 3 gr1 : X Y graph gr3 : X Y / om(coloring2) gr4 : l 2 gr5 : pathl = 0 gr6 : stage = 1 act1 : coloring2 := ({X fan(2), fan(2) X} coloring2) {X Y coloring2(x fan(2)), Y X coloring2(x fan(2))} act2 : Y := fan(2) act3 : fan := (λn n 1.. l 1 fan(n + 1)) The fan is upate afterwars. act4 : l := l 1 Event invertpath k = exts invertpath k k Fan ege with color gr16 : pathl > 0 gr9 : l N 1 gr11 : k 1.. l 1 gr10 : (X fan(k + 1) ) coloring2 gr15 : z (cpath(pathl) z c coloring2 cpath(pathl) z coloring2) (z = cpath(pathl 1)) This ensures that the c-path is alreay fully calculate. gr17 : stage = 2 act1 : coloring2 := {(y z e ) e (y z e) coloring2 (((y ran(cpath) z ran(cpath)) ((e = e = c ) (e = c e = ) (e e c e = e ))) (y / ran(cpath) z / ran(cpath) e = e))} act2 : l, fan : (fan(k) ran(cpath) l = l fan = fan) (fan(k) / ran(cpath) l = k fan = 1.. k fan) act3 : cpath := {0 X} act4 : pathl := 0 act5 : c := 33

34 A. The moels act6 : stage := 1 Event extfan = Fan is exte first, as long as is not c an it can be exte Status convergent exts extfan z gr4 : l N 1 gr1 : z / ran(fan) gr2 : X z om(coloring2) gr3 : w fan(l) w coloring2 coloring2(x z) gr5 : pathl = 0 gr7 : stage = 3 act1 : l := l + 1 act2 : fan := fan {l + 1 z} act3 : : w z w / coloring2 We nee to upate, the free color of the last noe on the fan. Event extcpath = c-path is calculate if fan is maximal an c is not exts extcpath z gr1 : z V gr2 : z / ran(cpath) gr3 : cpath(pathl) z c coloring2 cpath(pathl) z coloring2 gr4 : z X z c / coloring2 gr7 : stage = 2 gr5 : c act1 : cpath := cpath {pathl + 1 z} act2 : pathl := pathl + 1 Event fan one = exts fan one gr1 : l N 1 gr2 : ( z (z / ran(fan) X z om(coloring2) w fan(l) w coloring2 coloring2(x z))) gr3 : pathl = 0 34

35 A.11. m09 Conv CDpath gr4 : stage = 3 act1 : c : z X z c / coloring2 act2 : stage := 2 Event noinvertpath = exts noinvertpath gr2 : l N 1 gr4 : z X z / coloring2 is free on X, so no path to buil. gr5 : ( z (z / ran(fan) X z om(coloring2) ( w fan(l) w coloring2 coloring2(x z)))) This ensures that the fan is maximal. gr1 : stage = 2 act4 : c := If the fan is maximal an free on X, the c-path is empty an we conclue that is free on X. act1 : stage := 1 VARIANT END max({stage 2, 0}) (car(v \ ran(fan))) The variant is zero unless in stage 3. it ecreases while the fan size increases. A.11. m09 Conv CDpath MACHINE m09 Conv CDpath This refinement show the convergence of c-path-builing. REFINES m08 Conv Fan Buil SEES Input VARIABLES coloring coloring2 X Y fan l length of fan cpath c-path (or prefix while builing) (I am running ot of names) pathl length of c path c 35

36 A. The moels stage stage 3: buiing fan, stage 2: builing c-path an inverting it, stage 1: moving color along path EVENTS Initialisation exte begin act1 : coloring := act2 : coloring2 := act3 : X, Y, fan, cpath : X Y graph fan = {1 Y } cpath = {0 X } act4 : l := 1 act5 : pathl := 0 act6 : c : C act7 : : C act8 : stage := 3 Event finish = exts finish gr1 : om(coloring2) = graph act1 : coloring := coloring2 Event color1a = exts color1a gr1 : X Y graph gr2 : X Y / om(coloring2) gr3 : z (X z) / coloring2 gr4 : z (Y z) / coloring2 gr5 : om(coloring2 {X Y, Y X }) = graph This is the last uncolore ege. gr6 : pathl = 0 gr7 : stage = 1 act1 : coloring2 := coloring2 {X Y, Y X } act4 : fan := We remove the fan. act3 : l := 0 act5 : stage := 3 Event color1b = exts color1b 36

37 A.11. m09 Conv CDpath X2 So here is our next ege to be colore. Y2 gr1 : X Y graph gr2 : X Y / om(coloring2) gr3 : z (X z) / coloring2 gr4 : z (Y z) / coloring2 gr5 : X2 Y2 graph \ om(coloring2 {X Y, Y X }) gr6 : stage = 1 act1 : coloring2 := coloring2 {X Y, Y X } act2 : X := X2 act3 : Y := Y2 act4 : fan := {1 Y2} The fan is initialize with the new value of Y. act5 : l := 1 act6 : cpath := {0 X2} act7 : pathl := 0 act8 : : z (Y2 z ) / coloring2 {X Y, Y X } We nee to fin a new. act9 : stage := 3 Event colormove = exts colormove gr1 : X Y graph gr3 : X Y / om(coloring2) gr4 : l 2 gr5 : pathl = 0 gr6 : stage = 1 act1 : coloring2 := ({X fan(2), fan(2) X} coloring2) {X Y coloring2(x fan(2)), Y X coloring2(x fan(2))} act2 : Y := fan(2) act3 : fan := (λn n 1.. l 1 fan(n + 1)) The fan is upate afterwars. act4 : l := l 1 Event invertpath k = exts invertpath k k Fan ege with color gr16 : pathl > 0 gr9 : l N 1 37

38 A. The moels gr11 : k 1.. l 1 gr10 : (X fan(k + 1) ) coloring2 gr15 : z (cpath(pathl) z c coloring2 cpath(pathl) z coloring2) (z = cpath(pathl 1)) This ensures that the c-path is alreay fully calculate. gr17 : stage = 2 act1 : coloring2 := {(y z e ) e (y z e) coloring2 (((y ran(cpath) z ran(cpath)) ((e = e = c ) (e = c e = ) (e e c e = e ))) (y / ran(cpath) z / ran(cpath) e = e))} act2 : l, fan : (fan(k) ran(cpath) l = l fan = fan) (fan(k) / ran(cpath) l = k fan = 1.. k fan) act3 : cpath := {0 X} act4 : pathl := 0 act5 : c := act6 : stage := 1 Event extfan = Fan is exte first, as long as is not c an it can be exte exts extfan z gr4 : l N 1 gr1 : z / ran(fan) gr2 : X z om(coloring2) gr3 : w fan(l) w coloring2 coloring2(x z) gr5 : pathl = 0 gr7 : stage = 3 act1 : l := l + 1 act2 : fan := fan {l + 1 z} act3 : : w z w / coloring2 We nee to upate, the free color of the last noe on the fan. Event extcpath = c-path is calculate if fan is maximal an c is not Status convergent exts extcpath z gr1 : z V gr2 : z / ran(cpath) gr3 : cpath(pathl) z c coloring2 cpath(pathl) z coloring2 gr4 : z X z c / coloring2 38

39 A.12. m10 Conv Fan Color gr7 : stage = 2 gr5 : c act1 : cpath := cpath {pathl + 1 z} act2 : pathl := pathl + 1 Event fan one = exts fan one gr1 : l N 1 gr2 : ( z (z / ran(fan) X z om(coloring2) w fan(l) w coloring2 coloring2(x z))) gr3 : pathl = 0 gr4 : stage = 3 act1 : c : z X z c / coloring2 act2 : stage := 2 Event noinvertpath = exts noinvertpath gr2 : l N 1 gr4 : z X z / coloring2 is free on X, so no path to buil. gr5 : ( z (z / ran(fan) X z om(coloring2) ( w fan(l) w coloring2 coloring2(x z)))) This ensures that the fan is maximal. gr1 : stage = 2 act4 : c := If the fan is maximal an free on X, the c-path is empty an we conclue that is free on X. act1 : stage := 1 VARIANT min({max({stage 1, 0}), 1}) (1 + car(v \ ran(cpath))) The variant is zero in stage 3 an otherwise ecreases while the size of the c-path increases. END A.12. m10 Conv Fan Color MACHINE m10 Conv Fan Color This refinement shows the convergence of fan estruction. 39

40 A. The moels REFINES m09 Conv CDpath SEES Input VARIABLES coloring coloring2 X Y fan l cpath pathl c length of fan c-path (or prefix while builing) (I am running ot of names) length of c path stage stage 3: buiing fan, stage 2: builing c-path an inverting it, stage 1: moving color along path EVENTS Initialisation exte begin act1 : coloring := act2 : coloring2 := act3 : X, Y, fan, cpath : X Y graph fan = {1 Y } cpath = {0 X } act4 : l := 1 act5 : pathl := 0 act6 : c : C act7 : : C act8 : stage := 3 Event finish = exts finish gr1 : om(coloring2) = graph act1 : coloring := coloring2 Event color1a = exts color1a gr1 : X Y graph gr2 : X Y / om(coloring2) gr3 : z (X z) / coloring2 gr4 : z (Y z) / coloring2 40

41 A.12. m10 Conv Fan Color gr5 : om(coloring2 {X Y, Y X }) = graph This is the last uncolore ege. gr6 : pathl = 0 gr7 : stage = 1 act1 : coloring2 := coloring2 {X Y, Y X } act4 : fan := We remove the fan. act3 : l := 0 act5 : stage := 3 Event color1b = exts color1b X2 So here is our next ege to be colore. Y2 gr1 : X Y graph gr2 : X Y / om(coloring2) gr3 : z (X z) / coloring2 gr4 : z (Y z) / coloring2 gr5 : X2 Y2 graph \ om(coloring2 {X Y, Y X }) gr6 : stage = 1 act1 : coloring2 := coloring2 {X Y, Y X } act2 : X := X2 act3 : Y := Y2 act4 : fan := {1 Y2} The fan is initialize with the new value of Y. act5 : l := 1 act6 : cpath := {0 X2} act7 : pathl := 0 act8 : : z (Y2 z ) / coloring2 {X Y, Y X } We nee to fin a new. act9 : stage := 3 Event colormove = Status convergent exts colormove gr1 : X Y graph gr3 : X Y / om(coloring2) gr4 : l 2 gr5 : pathl = 0 gr6 : stage = 1 41

42 A. The moels act1 : coloring2 := ({X fan(2), fan(2) X} coloring2) {X Y coloring2(x fan(2)), Y X coloring2(x fan(2))} act2 : Y := fan(2) act3 : fan := (λn n 1.. l 1 fan(n + 1)) The fan is upate afterwars. act4 : l := l 1 Event invertpath k = exts invertpath k k Fan ege with color gr16 : pathl > 0 gr9 : l N 1 gr11 : k 1.. l 1 gr10 : (X fan(k + 1) ) coloring2 gr15 : z (cpath(pathl) z c coloring2 cpath(pathl) z coloring2) (z = cpath(pathl 1)) This ensures that the c-path is alreay fully calculate. gr17 : stage = 2 act1 : coloring2 := {(y z e ) e (y z e) coloring2 (((y ran(cpath) z ran(cpath)) ((e = e = c ) (e = c e = ) (e e c e = e ))) (y / ran(cpath) z / ran(cpath) e = e))} act2 : l, fan : (fan(k) ran(cpath) l = l fan = fan) (fan(k) / ran(cpath) l = k fan = 1.. k fan) act3 : cpath := {0 X} act4 : pathl := 0 act5 : c := act6 : stage := 1 Event extfan = Fan is exte first, as long as is not c an it can be exte exts extfan z gr4 : l N 1 gr1 : z / ran(fan) gr2 : X z om(coloring2) gr3 : w fan(l) w coloring2 coloring2(x z) gr5 : pathl = 0 gr7 : stage = 3 act1 : l := l + 1 act2 : fan := fan {l + 1 z} 42

43 A.12. m10 Conv Fan Color act3 : : w z w / coloring2 We nee to upate, the free color of the last noe on the fan. Event extcpath = c-path is calculate if fan is maximal an c is not exts extcpath z gr1 : z V gr2 : z / ran(cpath) gr3 : cpath(pathl) z c coloring2 cpath(pathl) z coloring2 gr4 : z X z c / coloring2 gr7 : stage = 2 gr5 : c act1 : cpath := cpath {pathl + 1 z} act2 : pathl := pathl + 1 Event fan one = exts fan one gr1 : l N 1 gr2 : ( z (z / ran(fan) X z om(coloring2) w fan(l) w coloring2 coloring2(x z))) gr3 : pathl = 0 gr4 : stage = 3 act1 : c : z X z c / coloring2 act2 : stage := 2 Event noinvertpath = exts noinvertpath gr2 : l N 1 gr4 : z X z / coloring2 is free on X, so no path to buil. gr5 : ( z (z / ran(fan) X z om(coloring2) ( w fan(l) w coloring2 coloring2(x z)))) This ensures that the fan is maximal. gr1 : stage = 2 43