REFINEMENT ServerR_wrong
/* This is a proper B refinement of Server, but currently ProB creates traces for this machine while ignoring the
   precondition of the abstract machine. Hence this machine on its own is not a trace refinement of Server.mch */
/* To do refinement checking: Explore the entire state space of Server.mch (e.g. using
   model check and then "Save for Later Refinement Check" in ProB Tcl/Tk) and then
   use "Trace Refinement Check..." in the Verify menu and select the entry for Server */
REFINES Server

SETS
  SessionID = {sid1,sid2,sid3}
  
VARIABLES
  session
  
INVARIANT
  session : Process +-> SessionID &
  logged_in = dom(session)
  
INITIALISATION
  session := {}
  
OPERATIONS

  LogIn(pp) = // Abstract PRE pp: Process & pp /: logged_in
    PRE pp: Process /* & pp /: dom(session) */ THEN
     ANY sid WHERE sid: SessionID & sid /: ran(session) THEN
      session := ({pp} <<| session) \/ {pp |-> sid}
     END
    END;
    
  LogOut(pp) =
    PRE pp: Process & pp: dom(session) THEN
      session := {pp} <<| session 
    END
    
END
