A Send Event of a Token Message Accounted for at U Cannot Happen, by the Code. a Receive Event of a Token Message at V (on Some Link) May Cause a Token Accounted for at a Proofs of Technical Lemmas

the counters of e to become nil: message tokense] is decremented by 1, but nil tokense] is incremented by 1. 2 Proof of Lemma 2: Let t be the time just before the token is sent from u, and t 0 the time just before it is received at v. Because the sum of message tokens and nil tokens can increment only when tokens arrive on the link, and because the links are FIFO, we have: message tokense] t 0 v + nil tokense] t 0 v message tokense] t v + nil tokense] t v + tokens t u!v : By Lemma 1, message tokense] t v + nil tokense] t v + tokens t u!v + 1 bounde] t u : Thus, message tokense] t 0 v + nil tokense] t 0 v + 1 bounde] t u : By the code i > bounde] t u and j = message tokense] t 0 v + nil tokense] t 0 v + 1, hence i > j. 2 Proof of Lemma 3: We prove the claim by contradiction. Assume bounde] t u > n for some t; u, and e = (u; v). Then a token must have been sent over e from u to v when bounde] u n. By the code, this can happen only if, for some e 0 2 E fIg, message tokense 0 ] u + nil tokense 0 ] u > n. However, for any e 0 , the value of message tokense 0 ] u + nil tokense 0 ] u is initialized to 0. Therefore, consider the rst time that, for some e 0 and u, message tokense 0 ] u + nil tokense 0 ] u > n. For the \virtual link" I at the sender this cannot happen by the code. For every e 0 = (u; v 0) 2 E, the value of message tokense 0 ] u +nil tokense 0 ] u increases only when a token is received at u over e 0. Consider the token that upon its receipt the value of message tokense 0 ] u +nil tokense 0 ] u became strictly larger than n, and denote by e 00 the link incident to v whose counters accounted for this token before it was sent from v. By Lemma 2, when the token was sent from v the value of message tokense …