SDL Specifications Verification
Once the simulator is proved correct, we can prove
properties of specifications w.r.t. the simulator
Our protocol is correct if sender and receiver agree on the
id of the last successfully transmitted frame
(defthm sender-receiver-agree-1
  (<= (variable-value 'ackid
           (instance 'receiver (simulate S O)))
      (variable-value 'frameid
                    (instance 'sender (simulate S O)))))
(defthm sender-receiver-agree-2
   (let ((v1 (variable-value
       'ackid (instance 'receiver (simulate S O))))
         (v2 (variable-value
        'frameid (instance 'sender (simulate S O)))))
    (implies (< v1 v2) (= (+ 1 v1) v2))))
Defined access functions to extract variables and instances