Go backward to Solution Idea Go up to Top Go forward to Designing the Server

Refining the Invariant

• (4) violates invariant.

  R =

  counter +

  number i in [1,C]: pci = resource pci = release

• (3) violates invariant.

  R =

  counter +

  number i in [1,C]: pci = resource pci = release +

  number i in [1,C], j in N1i: clienti[j] = grant

• (5) violates invariant.

  R =

  counter +

  number i: pci = resource pci = release +

  number i in [1,C], j in N1i: clienti[j] = grant +

  number i in [1,C], j in N1i: serveri[j] = release

Refined invariant still implies safety property.