SDL Specifications Verification
•Once the simulator is proved correct, we can prove properties of specifications w.r.t. the simulator •Our protocol is correct if sender and receiver agree on the id of the last successfully transmitted frame
•(defthm sender-receiver-agree-1
•  (<= (variable-value 'ackid
•   (instance 'receiver (simulate S O)))
•      (variable-value 'frameid
•                (instance 'sender (simulate S O)))))
•(defthm sender-receiver-agree-2
• (let ((v1 (variable-value
• 'ackid (instance 'receiver (simulate S O))))
•         (v2 (variable-value
• 'frameid (instance 'sender (simulate S O)))))
•    (implies (< v1 v2) (= (+ 1 v1) v2))))
•Defined access functions to extract variables and instances