fact: Definition spec := ADTRep Z { Def Constructor "new"(trueLevel : Z) : rep := ret trueLevel, Def Method "update"(trueLevel : rep, sensor : Z) : unit := if Zabs (sensor - trueLevel) <? sensorAccuracy then ret (trueLevel, tt) else trueLevel' <- {_ | True}; ret (trueLevel', tt), Def Method "timestep"(trueLevel : rep, r : request) : action := act <- {act | match act with | Nothing => True | Fill => trueLevel + maxFill < tankMax | Empty => trueLevel - maxEmpty >= 0 end}; trueLevel' <- {trueLevel' | minFill <= FillRate r <= maxFill -> minEmpty <= EmptyRate r <= maxEmpty -> match act with | Nothing => trueLevel' = trueLevel | Fill => trueLevel' = trueLevel + FillRate r | Empty => trueLevel' = trueLevel - EmptyRate r end}; ret (trueLevel', act) }.
imports: Fiat.Common.Coq__8_4__8_5__Compat Ics