Go backward to Refining the Invariant Go up to Top Go forward to Designing the Server

Designing the Server

Server must maintain invariant and imply progress:

ServerC,R(server, client, counter) :<=>    exists i in [1,C]:       or          receivei(server, release)  /\              count' = count+1  /\              changed(server, count)          receivei(server, request)  /\ count > 0  /\              sendi(client, grant)  /\ count' = count-1  /\              changed(server, client, count)          receivei(server, request)  /\ count <=0  /\              ...

receive a release message and increase counter     send a grant message and decrease counter     what now?

Need possibility to defer grant messages.