%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
%  New template code for TAMU Theses and Dissertations starting Fall 2012.  
%  For more info about this template or the 
%  TAMU LaTeX User's Group, see http://www.howdy.me/.
%
%  Author: Wendy Lynn Turner 
%	 Version 1.0 
%  Last updated 8/5/2012
%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%                           SECTION V
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


\chapter{\uppercase {Dining Philosophers with Bounded Waiting\\and Failure Locality 1}}
\label{chap:dp-fair}

In this section, we consider the dining philosophers problem, or simply dining, in an asynchronous message passing system where processes are subject to crash failures.  Choy and Singh \cite{choy:lfids} showed that any asynchronous message-passing dining
algorithm must have failure locality at least 2.
There are several existing algorithms that solve dining with failure locality 2, showing that failure locality 2 is a tight bound \cite{choy:eftafd,SPS00}.  To circumvent this lower bound, previous work \cite{SP07,SPS07,PSS08,SSW09,pike:dpwcl} has considered variations of dining along with utilizing failure detectors \cite{CT96}, system services that provide information about process crashes that need not always be correct.   

Following this line of research, we present a specification for the $BW$-$\square SX$-$FL1$ problem requiring the following ($BW$ and $\square SX$ stand for bounded waiting and perpetual strong exclusion, respectively, and failure locality 1 is abbreviated as $FL1$): 
\begin{compactitem}
\item \emph{Exclusion:} No two neighbors (in the conflict graph) access their corresponding critical sections simultaneously.
\item \emph{FL1-progress:} A correct process that is trying to enter its critical section eventually does so if it only has correct neighbors and no correct process stays in its critical section forever.
\item \emph{FL1-$BW$:} If correct process $p$ only has correct neighbors, then for any interval in which $p$ is trying to enter its critical section, no neighbor of $p$ enters its critical section more than a bounded\footnote{The bound may be different in different executions.  See Section \ref{sec:fl1dining:discuss}.} number of times.
%\item \emph{FL1-starvation:} A correct process eventually stops entering the CS if it has a crashed neighbor.
\end{compactitem}  
Recall from Section \ref{sec:intro:ftdp} that failure locality \cite{choy:eftafd, choy:lfids} is a metric that corresponds to the maximum distance in the conflict graph between a crashed process $p$ and any other process that is blocked from entering its critical section.  Thus, $FL1$ indicates that each correct process that is at least two hops away from any crashed process is not blocked from entering its critical section.  

We consider the local version of the well-known eventually perfect failure detector ($\Diamond P$)\footnote{The specification of $\Diamond P$ states that, eventually, (1) every crashed process is suspected by every correct process, and (2) no correct process is suspected by any correct process.} \cite{CT96} which repeatedly supplies each process $p$ with a set of neighboring processes suspected to have crashed.  We denote the local version of $\Diamond P$ as $\Diamond P^1$.  Roughly, $\Diamond P^1$ has the following properties:
\begin{compactitem}
\item \emph{Completeness:} From some time on, for each correct process $p$, every crashed neighboring process of $p$ is suspected by $p$.
\item \emph{Accuracy:} From some time on, for each correct process $p$, no correct neighboring process of $p$ is suspected by $p$.
\end{compactitem}
In this section, we consider that the output value of $\Diamond P^1$ is obtained via a query/response mechanism as in \cite{JT08}. 

The Exclusion and $FL1$-progress properties of $BW$-$\square SX$-$FL1$ prevent simultaneous access to the critical section and provide eventual guarantees in accessing the critical section, respectively.
Exclusion and $FL1$-progress constitute the problem statement in \cite{pike:dpwcl}.  In \cite{pike:dpwcl}, the authors show that the $\Diamond P$ failure detector \cite{CT96} is sufficient to solve their problem.  They also show that $\Diamond P$ is a weakest\footnote{Weakest with respect to the relationship defined in \cite{CT96} that is based on implementing one failure detector using another one.} failure detector among the specific failure detectors introduced in \cite{CT96} to solve their problem.  

In addition to the Exclusion and $FL1$-progress properties, $BW$-$\square SX$-$FL1$ includes an additional property.  The $FL1$-$BW$ property provides a level of fairness in accessing the critical section between correct neighboring nodes ($FL1$-$BW$ is a failure-locality-1 version of the bounded waiting property defined in \cite{SP07,SPS07}).  This is a desirable property for resource allocation when there is a need to prevent any process from dominating a shared resource by using it too frequently.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Needs to be modified.
Finding a weakest failure detector for a problem is a way to characterize the minimum information regarding crash failures that is required to solve the problem.    Mutual reducibility is a common proof technique used to identify a weakest failure detector.  Suppose that, given a failure detector $FD$ and a problem $Q$, we can solve $Q$ using $FD$ and we can also implement $FD$ with a solution to $Q$ (that is, $Q$ and $FD$ are mutually reducible).  Now, for the sake of contradiction, suppose that there exists a failure detector $FD'$ that is strictly weaker than $FD$ (that is, $FD'$ can be implemented using $FD$ but it is impossible to implement $FD$ using $FD'$) and $Q$ can be solved using $FD'$.  Since $FD'$ can be used to solve $Q$ and a solution to $Q$ can implement $FD$, by transitivity, $FD'$ can be used to implement $FD$.  This contradicts the assumption that $FD'$ is strictly weaker than $FD$.  So, $FD$ is indeed a weakest failure detector for $Q$. 

Now, a natural question arises: can we identify a weakest failure detector among all failure detectors for solving dining (or at least a variation of dining) with failure locality 1?  We provide the first step towards identifying a weakest failure detector for $BW$-$\square SX$-$FL1$ by showing that failure detector $\Diamond P^1$ and a solution to $BW$-$\square SX$-$FL1$ are mutually reducible without preserving the underlying conflict graph topology.  In our case, the conflict graph topology considered in one direction of the reduction is not necessarily the same in the other direction.  Specifically, we first show that $\Diamond P^1$ is sufficient to solve $BW$-$\square SX$-$FL1$  on any topology, and then we show the that using multiple instances of $BW$-$\square SX$-$FL1$ on a ``particular'' (virtual) conflict graph, we can extract $\Diamond P^1$.   This has the following implication: considering an arbitrary conflict graph $G$ and given $\Diamond P^1$, we can solve $BW$-$\square SX$-$FL1$ on $G$ but using ``this'' solution of $BW$-$\square SX$-$FL1$ on $G$ (the solution is tied with $G$), we may not be able to extract $\Diamond P^1$.  
Another implication is as follows: We have already shown that if a failure detector $FD$ and a problem $Q$ are mutually reducible, then $FD$ is a weakest failure detector to solve $Q$.  Considering a failure detector $FD'$ that is strictly weaker than $FD$ and can be used to solve $Q$, we have argued using transitivity through $Q$ to show that $FD$ is implementable using $FD'$ which provided the desired contradiction.  Now, if we substitute $FD$ and $Q$ with $\Diamond P^1$ and $BW$-$\square SX$-$FL1$, respectively, then we might not be able to use transitivity through $BW$-$\square SX$-$FL1$ to show that $\Diamond P^1$ is implementable using $FD'$.  This is again because we can solve $BW$-$\square SX$-$FL1$ using $FD'$ on an arbitrary conflict graph G, however, using this solution which is tied with $G$, we might not be able to implement $\Diamond P^1$ (since $G$ might not be the same as the particular graph used to extract $\Diamond P^1$).  The above two implications in turn implies that, in order to conform with the ``classical'' notion of a weakest failure detector, mutual reducibility must preserve the underlying topology.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Needs to be modified.
Previous work in \cite{SP07,SPS07,PSS08,SSW09} considered the dining philosophers problem with \emph{wait-freedom} and \emph{eventual weak exclusion}.  Wait-freedom corresponds to failure locality 0 and eventual weak exclusion states that \emph{eventually}, no two live\footnote{Live nodes are those nodes that have not yet crashed.} neighbors access the critical section simultaneously.   The difference between the work in \cite{SP07,SPS07} and \cite{PSS08,SSW09} is that the former consider bounded waiting in accessing the critical section in the problem statement and the latter do not.  Also, the results in \cite{PSS08,SSW09} show that $\Diamond P^1$ is a weakest failure detector which implies that wait-freedom and eventual weak exclusion themselves encapsulate bounded waiting, however, similar to our results, the results in \cite{SP07,SPS07} show that $\Diamond P^1$ and a solution to the corresponding dining problem are mutually reducible without preserving the underlying topology.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

We solve the $BW$-$\square SX$-$FL1$ problem by carefully combining the asynchronous doorway technique in \cite{SP07} and the concept of skepticism in \cite{pike:dpwcl}.  For a process to enter the critical section, it must first enter the doorway by obtaining permission from all of its neighbors.  Our solution satisfies the $FL1$-$BW$ property by manipulating permission requests to enter the doorway.  The concept of skepticism is used to satisfy all failure-locality-1 related properties:  a process $p$ becomes ``skeptical'' if \emph{some} process in $p$'s one-hop neighborhood is suspected by $p$'s local failure detector and, as long as $p$ is skeptical, $p$ satisfies all requests from its neighbors.  %Thus, the required information from the failure detector is whether there exists a failure, not who failed.  This motivated our definition of $\Diamond B$.  

In implementing $\Diamond P^1$, we use multiple instances of a solution to $BW$-$\square SX$-$FL1$ as subroutines.  
%The major novelty of this paper is in how these subroutines are designed and combined to satisfy the properties of $\Diamond P^1$.  
%We consider a set threads running on each process $p$.  
%node $p$ may directly detect a crash failure; also, $p$ may detect the crash failure by observing that some threads running on $p$ are not entering the CS properly (in some cases, failure detection is done in an indirect fashion).   
In \cite{SPS07}, the authors use a ping/ack protocol in conjunction with a dining subroutine for a correct process to directly detect crash failures; by direct detection, we mean that a correct node $p$ detects a faulty neighbor $q$ by directly exchanging messages with $q$.  
We use a similar ping/ack protocol to directly detect crash failures.  However, there is a situation where direct detection is impossible.  In that case, we use the ping/ack protocol to detect faulty processes by means of detecting starving\footnote{Roughly, a correct process starves if it stops entering its critical section.} processes.  Since our dining subroutine satisfies the $FL1$-progress property, the existence of a starving process corresponds to a crash failure in the neighborhood (see Section \ref{sec:fl1dining:ExtractB} for details).
%In our paper, we use a similar ping/ack protocol for (1) a group of threads, called hybrid threads, of a correct process $p$ to directly detect any crashed neighbors if hybrid threads do not starve\footnote{Roughly, a thread of a correct node $p$ starves if the thread stops entering the CS.}, and (2) another group of threads, called witness threads, of $p$ to detect whether or not hybrid threads are starving.  Since the subroutine satisfies the $FL1$-progress property, threads of process $p$ only starve due to a crash failure in $p$'s one-hop neighborhood. %After process $q$ detects that $p$ is starving, $q$ informs $p$ of a possible crash failure within $p$'s neighborhood.  

%Since the subroutine satisfies the $FL1$-starvation property, process $p$ starves due to a crash failure in its one-hop neighborhood.  After process $q$ detects that $p$ is starving, $q$ informs $p$ of a possible crash failure within $p$'s neighborhood.  

\section{Contributions}
%We present specifications for the DP problem and a failure detector, and showed mutual reducibility under mild assumptions in an asynchronous environment.
%Consider the dining philosophers problem with perpetual strong exclusion.  
We consider a dining philosophers problem with perpetual strong exclusion.  Since perpetual strong exclusion implies any other combination of  eventual and/or weak exclusion, our algorithm can be used to satisfy weaker exclusion guarantees.    We show that $\Diamond P^1$  is sufficient in solving the failure-locality-1 eventually bounded dining on any topology.   We also show that $\Diamond P^1$ can be implemented using multiple instances of $BW$-$\square SX$-$FL1$ on a particular conflict graph.  This serves as the first step towards identifying a weakest failure detector among all failure detectors for solving a dining problem with failure locality 1.

%To the best of our knowledge, our work is the first to identify a weakest failure detector among all failure detectors for solving a variation of the dining philosophers problem with perpetual strong exclusion and failure locality 1.

\section{System Model and Problem Specification}
\label{sec:fl1dining:sysmodel}

Given a set $\Pi$ of processes with unique ids and an undirected graph $G$ with vertex set
$\Pi$, we now define the $BW$-$\square SX$-$FL1$ problem for $G$.
%
The set of events $X$ (for ``exclusion'') is defined to be
\begin{center}
$X \triangleq \{${\it try}$_p$, {\it crit}$_p$, {\it exit}$_p$, {\it rem}$_p$,
{\it crash}$_p$ : $p \in \Pi \}$.
\end{center}
%
Given a sequence $\sigma$ over $X$, for any $p \in \Pi$,
define $p$ to be {\em faulty} in $\sigma$ if {\it crash}$_p$ appears
in $\sigma$ and {\em correct} otherwise.
For a finite sequence $\sigma$ over $X$ and any $p \in \Pi$, define
{\it last}$(\sigma,p)$ to be the latest event in $\sigma$
from $\{${\it try}$_p$, {\it crit}$_p$, {\it exit}$_p$, {\it rem}$_p\}$.
%
If {\it last}$(\sigma,p)$ is {\it rem}$_p$ (resp. {\it try}$_p$, {\it crit}$_p$, {\it exit}$_p$), then we say that $p$ is in its \emph{remainder} (resp. \emph{trying}, \emph{critical}, \emph{exiting}) section.
%
We say that \emph{Finite Eating holds} for a sequence $\sigma$ over $X$ if, for each correct $p\in \Pi$, $\sigma|p$ does not end with $crit_p$.  Also, for a sequence $\sigma$ over $X$, if $p\in\Pi$ is correct and all of $p$'s neighbors in $G$ are correct, then we say that $p$ is \emph{failure-insulated}. 
%
A sequence $\sigma$ over $X$ {\em satisfies the $BW$-$\square SX$-$FL1$ specification for $G$}
if it satisfies the following conditions:
\begin{compactitem}
\item {\em Well-formedness:} For each $p \in \Pi$, 
      if $\sigma|p$\footnote{$\sigma|p$ indicates the sequence of events in $\sigma$ that occurred at $p$.} is infinite, then it is the infinite repetition
      of {\it try}$_p$, {\it crit}$_p$, {\it exit}$_p$, {\it rem}$_p$;
      if $\sigma|p$ is finite, then it is either a prefix of this infinite
      repetition or it consists of a prefix of this infinite repetition
      followed by {\it crash}$_p$.
%\item {\em Finite Eating:}  For each correct $p \in \Pi$, $\sigma|p$ does not
%     end with {\it crit}$_p$.
\item {\em Exclusion:}  For each prefix $\sigma'$ of $\sigma$ and
     each edge $\{p,q\}$ in $G$, if {\it last}$(\sigma',p) =$ {\it crit}$_p$,
     then {\it last}$(\sigma',q) \neq$ {\it crit}$_q$.
%     and {\it last}$(\sigma',q) =$ {\it crit}$_q$, then $\sigma'$
%     includes either {\it crash}$_p$ or {\it crash}$_q$ (or both).
\item {\em Finite Exiting:} For each correct $p \in \Pi$, $\sigma|p$ does not end with $exit_p$.
\item {\em FL1-progress:} For each failure-insulated $p\in\Pi$, if Finite Eating holds for $\sigma$, then $\sigma|p$ does not end with $try_p$. 
%     For each correct $p \in \Pi$, if all of $p$'s
%     neighbors in $G$ are correct, then $\sigma|p$ does not end with
%     {\it try}$_p$ or {\it exit}$_p$.
%and if $\sigma|q$ does not end with $crit_q$ for all neighbors $q$ of $p$,     
%\item {\em FL1-starvation:}  For each correct $p \in \Pi$, if $p$ has a faulty 
%     neighbor in $G$, then $\sigma|p$ is finite.
\item {\em FL1-$BW$:} There exists an integer $k > 0$ such that for any two neighbors $p\in\Pi$ and $q\in\Pi$ where $p$ is failure-insulated, every infix of $\sigma$ that starts with $try_p$ and ends with the next occurrence of $crit_p$ contains at most $k$ occurrences of $crit_q$.     
%     Denote $\sigma_t$ as the suffix of $\sigma$ that begins at time $t$.  Then, there exists an integer $k>0$ and there exists a time $t$ such that for each correct
%     $p \in \Pi$, if all $p$'s neighbors in $G$ are correct, then
%    for every neighbor $q\in \Pi$ of $p$, every infix $\sigma'$ of $\sigma_t$ 
%     that starts with {\it try}$_p$ and contains exactly $k$ occurrences
%     of {\it crit}$_q$ must contain at least one occurrence of {\it crit}$_p$.
%     (*Since k is not fixed to be the same for every execution, I think we don't need the eventual*)
\end{compactitem}

%For any sequence $\sigma$ over $X$, we assume that for all correct $p\in\Pi$, $sigma|p$ does not end with {\it crit}$_p$ and we call this the \emph{Finite Eating} assumption.
For any sequence $\sigma$ over $X$, we say $\sigma$ is {\em user-correct
for} $X$ if the shortest prefix of $\sigma$ to violate Well-formedness
(if any) ends in either $rem_p$ or $crit_p$ for some $p \in \Pi$.
(The intuition is that the user of the $BW$-$\square SX$-$FL1$ module is not the first to violate Well-formedness; the user preserves Well-formedness)  
%Note that even if Finite Eating is not guaranteed, as long as user-correctness (preserving Well-formedness) holds, a correct algorithm cannot violate Exclusion or Finite Exiting. 

Given a set $\Pi$ of processes and an undirected graph $G$ with vertex
set $\Pi$, we now define the $\Diamond P^1$ failure detector problem for $G$.  
For each process $p\in\Pi$ on $G$, let $N_p$ be the set of neighboring processes of $p$.
The set of events $D$ (for ``detector'') is defined to be
\begin{center}
$D \triangleq \{${\it query}$_p$, 
{\it response}$(S)_p$, {\it crash}$_p :$\\$p \in \Pi, S \subseteq N_p\}$.
\end{center}
We use the same definitions of faulty and correct as above.

A sequence $\sigma$ over $D$ {\em satisfies the $\Diamond P^1$ specification}
if it satisfies the following conditions:
\begin{compactitem}
\item {\em Well-formedness:} For each $p \in \Pi$, if $\sigma|p$ is infinite,
   it consists of alternating {\it query}$_p$ and {\it response}$_p(.)$ 
   events, starting with {\it query}$_p$;
   if $\sigma|p$ is finite, then it is either a prefix of such an 
   infinite sequence or it consists of a prefix of such an infinite
   sequence followed by {\it crash}$_p$.
\item {\em Liveness:} For each correct $p \in \Pi$, $\sigma|p$
   does not end with {\it query}$_p$.
\item \emph{Completeness:} For each correct $p \in \Pi$, there is a suffix of $\sigma$ in which the parameter $S$ of each occurrence of {\it response}$(S)_p$ contains every faulty neighbor of $p$ in $G$.  
\item \emph{Accuracy:} For each correct $p \in \Pi$, there is a suffix of $\sigma$ in which the parameter $S$ of each occurrence of {\it response}$(S)_p$ does not contain any correct neighbor of $p$ in $G$.
%\item{\em Validity:} For each correct $p \in \Pi$, there is a suffix
%   of $\sigma$ in which every {\it response}$_p$ has the same parameter,
%   and this parameter is $T$ if and only if at least one of $p$'s neighbors 
%   in $G$ is faulty.
\end{compactitem}
For any sequence $\sigma$ over $D$, we say $\sigma$ is {\em user-correct
for} $D$ if the shortest prefix of $\sigma$ to violate Well-formedness
(if any) ends in {\it response}$_p(.)$ for some $p \in \Pi$.
(The intuition is that the user of the failure detector module is not the first to violate Well-formedness; the user preserves Well-formedness)

We model distributed algorithms as collections of state machines.
Let $\Pi$ be the set of nodes on which a distributed
algorithm is running, with one state machine (process) per node.
Each step of a process is triggered by an event and causes the
process to change its local state.
Events are partitioned into input and output events.
An {\em input} event can occur at any time (i.e., it is always enabled),
whereas an {\em output} event can only happen (be enabled) if certain 
preconditions are true in the state of the process.

We model a snapshot of the entire algorithm as a vector of states,
one per process, which is called a {\em configuration.}
In an {\em initial} configuration, each process is in an initial
state.
An {\em execution} of the algorithm is a sequence 
$C_0, e_1, C_1, e_2, C_2, \ldots$ of alternating
configurations and events, beginning with an initial configuration,
and if finite, ending with a configuration,
that satisfies the following properties for each $i \ge 1$.
Suppose event $e_i$ occurs at process $p$.
\begin{compactitem}
\item Event $e_i$ is enabled in the state of $p$ in the preceding
      configuration $C_{i-1}$.
\item The only difference between $C_{i-1}$ and $C_i$ is that the
     state of $p$ changes according to $p$'s transition function
     (local algorithm).
\end{compactitem}

Our algorithms execute in a system
in which the processes communicate through an asynchronous message passing
network, where the set of communication channels is described by an
undirected graph $G$.
If edge $\{p,q\}$ is in $G$, then there is a channel from $p$ to $q$
and a channel from $q$ to $p$.
The set of events for interacting with the message system is defined to be
\begin{center}
$N \triangleq \{${\it send}$_p(m,q)$, {\it recv}$_p(m,q)$, {\it crash}$_p :$\\ 
$\{p,q\} \in G$ and $m \in M\}$,
\end{center}
where $M$ is the set of messages.
A sequence over $N$ is said to {\em satisfy the message-passing specification}
if it captures the properties that 
each channel is reliable (does not duplicate,
alter, or inject messages, and does not lose messages sent to correct
processes), asynchronous (unbounded delays), and
FIFO (messages in each channel are delivered in the order in which they are 
sent).
In addition, no {\it recv}$_p$, {\it send}$_p$, or {\it crash}$_p$ event 
occurs in the sequence after a {\it crash}$_p$ event occurs.

We next define what it means to be an {\em algorithm for the $BW$-$\square SX$-$FL1$ 
problem for $G$} in a message-passing system augmented with a $\Diamond P^1$ failure detector.  
Note that the communication topology graph is the conflict graph.
The set of input events is
\begin{center}
$\{${\it try}$_p$,
{\it exit}$_p$,
{\it crash}$_p$,
{\it response}$_p(S)$,
{\it recv}$_p(m,q) :$\\
$\{p,q\} \in G, S \subseteq N_p, m \in M\}$.
\end{center}
The set of output events is
\begin{center}
$\{${\it crit}$_p$,
{\it rem}$_p$,
{\it query}$_p$,
{\it send}$_p(m,q) :$\\
$\{p,q\} \in G, m \in M\}$.
\end{center}
Every execution $E$ of the algorithm must satisfy the following property:
If $E$ satisfies the following three conditions:
\begin{compactenum}
\item $E|N$\footnote{$E|N$ indicates the sequence of events in $E$ with respect to set $N$.} satisfies the message-passing specification,
\item either $E|D$ is not user-correct for $D$ or $E|D$ satisfies the $\Diamond P^1$
      specification,
\item $E|X$ is user-correct for $X$,
\end{compactenum}
then $E|X$ satisfies the $BW$-$\square SX$-$FL1$ specification.

%For all executions $E$ of any algorithm for the $BW$-$\square SX$-$FL1$  problem for $G$, we assume that for all correct $p\in\Pi$, $(E|X)|p$ does not end with {\it crit}$_p$; we name this assumption as the \emph{Finite Eating} assumption.

%(*Here is why I modified the second condition.  In the previous version
%I sent you, the second condition just required that $E|D$ solves
%the $\Diamond$B problem.  But in this case, a lazy algorithm designer
%could simply have the algorithm interact incorrectly with the failure
%detector, for instance, by sending two queries in a row, and then, since
%$E|D$ would not solve the $\Diamond$B problem, the algorithm is under no
%obligation to solve the Exclusion problem.*)
% previous condition:
%\begin{itemize}
%\item If $E|N$ solves the message-passing problem,
%      $E|D$ solves the $\Diamond$B problem, and
%      $E|X$ is user-correct for $X$,
%      then $E|X$ solves the Exclusion problem.
%\end{itemize}

Now we define what it means to be an {\em algorithm for the $\Diamond P^1$ 
problem for $G$} in a message-passing system augmented with $BW$-$\square SX$-$FL1$ subroutines.
The algorithm uses some number, say $H$, of instances of a solution to the 
$BW$-$\square SX$-$FL1$ problem.
The $h$-th instance is for some undirected graph $G^h$ with vertex set $\Theta^h$ where there exists a function $f$ that maps $\Theta^h$ to $\Pi$; $\exists f:\Theta^h \rightarrow \Pi$. 
For the $h$-th instance, we denote the set of events
by
$X^h=\{${\it try}$_s$,
{\it crit}$_s$,
{\it exit}$_s$,
{\it rem}$_s$,
{\it crash}$_p :
s \in \Theta^h, p=f(s)\}$.
We note that for each $s \in \Theta^h$ where $f(s)=p$, $crash_{p}$ is a ``synonym'' for $crash_s$ with respect to the formal definition of the $BW$-$\square SX$-$FL1$ problem.

%The $h$-th instance is for some undirected graph $G_I^h$ where 
%\begin{itemize}
%\item vertex set $\Gamma^h$ consists of some number of \emph{threads}\footnote{A process may execute multiple threads.} being executed on some subgraph $G^h$ of $G$, and   
%\item edge set is $\{\{r, s\} : r \in \Gamma^h, s \in \Gamma^h, r \mbox{ is a thread on process } p, s \mbox{ is a thread on process } q, \{p,q\} \in G^h\}$.
%\end{itemize}
%For the $h$-th instance, we denote the 
%set of processes in $G^h$ by $\Pi^h$ and the set of events of this instance
%by $X^h = 
%\{${\it try}$_s^h$,
%{\it crit}$_s^h$,
%{\it exit}$_s^h$,
%{\it rem}$_s^h$,
%{\it crash}$_p :
%s \in \Gamma^h,
%p \in \Pi^h\}$.
%Note that the {\it crash} events are shared by all the instances.


The set of input events for the $\Diamond P^1$ algorithm is
\begin{center}
$\bigcup_{h=1}^H \{${\it crit}$_s$, {\it rem}$_s : s \in \Theta^h \}
\cup \{${\it crash}$_p$,
{\it query}$_p$,
{\it recv}$_p(m,q) :
\{p,q\} \in G, m \in M\}$.
\end{center}

The set of output events is
\begin{center}
$\bigcup_{h = 1}^H \{${\it try}$_s$, {\it exit}$_s : s \in \Theta^h\}
\cup \{${\it response}$_p(S)$,
{\it send}$_p(m,q) :
S \subseteq N_p, \{p,q\} \in G, m \in M\}$.
\end{center}

Every execution $E$ of the algorithm must satisfy the following property:
If $E$ satisfies the following three conditions:
\begin{compactenum}
\item $E|N$ satisfies the message-passing specification,
\item for each $h$, $1 \le h \le H$, either $E|X^h$ is not user-correct
      for $X^h$ or $E|X^h$ satisfies the $BW$-$\square SX$-$FL1$ specification for $G^h$,
\item $E|D$ is user-correct for $D$,
\end{compactenum}
then $E|D$ satisfies the $\Diamond P^1$ specification.

%(*Similarly to comment above, I changed one of the conditions to rule
%out the possibility of the algorithm deliberately interacting improperly
%with one of the Exclusion subroutines and thus being off the hook for
%solving the failure detector problem.*)
%For each node $p\in\Pi$, we denote $N_p$ as the set of neighboring nodes of $p$ in $G$.  For each node $p \in \Pi$, we call each time duration $[t,t')$ a \emph{remainder} (resp. \emph{trying}, \emph{critical}, \emph{exiting}) \emph{section} of node $p$ if $t$ is the time when event $rem_p$ (resp. $try_p$, $crit_p$, $exit_p$) occurs and $t'$ is the first time after $t$ when an event $e\in X$ occurs.   If time duration $[t,t')$ is a trying section and $[t',t'')$ is a critical section, then we call $[t,t'')$ a \emph{trying-critical} section.  We say that a node $p$ is in the remainder (resp. trying, critical, exiting) section at time $t$ if the latest event with respect to set $X$ that occurred at node $p$ before or at time $t$ is $rem_p$ (resp. $try_p$, $crit_p$, $exit_p$).   For node $p$, if no event in $X$ ever occurred before or at time $t$, then we also say that $p$ is in a remainder section at time $t$.

%We assume that each process $p \in \Pi$ is assigned a unique id.  Throughout this paper, we use the term ``process'' and ``node'' interchangeably.

\begin{comment}
Here we give an informal overview of the model and problem specification
due to space constraints; see Appendix \ref{appendix:sysmodel} for more details.

We model a distributed algorithm as collections of state machines, one
for each process in the set $\Pi$ of processes that make up the algorithm.
Each step of a process is triggered by an event and causes the process
to change its local state.
We assume that each process $p\in\Pi$ is assigned a unique id.
Events are partitioned into inputs and outputs; an input can occur
at any time, whereas an output can only happen if the state of the process
allows it.
An execution of the algorithm is a sequence of steps of the processes
that satisfies certain conditions.
One set of conditions is ``syntactic'':  these conditions include
beginning with each process in an initial state;
having each step follow properly from the previous step, taking into
account what events are enabled;
and not ending prematurely while processes still have steps they would
like to take.
Another set of conditions models the behavior of the communication network, and
a third set of conditions models proper behavior of subroutines called
by the algorithm as well as proper behavior of the user of the algorithm.
These conditions are described next.

We assume processes communicate through an asynchronous message-passing
network, in which there is a channel between every ordered pair of
processes $(p,q)$ such that $\{p,q\}$ is an edge in the communication topology
graph $G$.
Thus {\em send}$_p(m,q)$ is an output event of $p$, where $m$ is a message, 
while {\em recv}$_p(m,q)$ is an input event of $p$.
We denote $N_p$ as the set of neighboring processes of $p$ on $G$ ($N_p=\{q:\{p,q\}\in G\}$).
Each channel is reliable:  it does not duplicate, alter, or inject messages,
and does not lose messages sent to correct processes (processes that do
not experience a {\em crash} input event).
Each channel is also asynchronous and FIFO.

One of our algorithms solves the DP problem using failure detector 
$\Diamond P^1$ as a subroutine, while the other algorithm solves the 
$\Diamond P^1$ problem using multiple instances of a DP algorithm.
First, we specify the two problems (DP and failure detector) in terms
of events, without saying which are inputs and which are output, as
this will change depending on whether we are viewing a solution as
a subroutine or as the problem to be solved by the algorithm.

Let $X$ be the set
$\{${\it try}$_p$, {\it crit}$_p$, {\it exit}$_p$, {\it rem}$_p$,
{\it crash}$_p$ : $p \in \Pi \}$.  For a finite sequence $\sigma$ over $X$ and any $p\in \Pi$, we say that process $p$ is in its \emph{remainder}  (resp. \emph{trying}, \emph{critical}, \emph{exit}) section if the latest event in $\sigma$ from $X\backslash\{${\it crash}$_p\}$ is {\it rem}$_p$ (resp. {\it try}$_p$, {\it crit}$_p$, {\it exit}$_p$).
A sequence $\sigma$ over $X$ is said to {\em satisfy the 
$BW$-$\square SX$-$FL1$ specification} if it satisfies
the Exclusion, FL1-progress, FL1-starvation, and FL1-$BW$
properties from Section~\ref{sec:fl1dining:intro} as well as:
\begin{compactitem}
\item {\em Well-formedness:} For each $p \in \Pi$, $\sigma|p$ either is,
or is a prefix of, the infinite repetition of {\it try}$_p$, {\it crit}$_p$, 
{\it exit}$_p$, {\it rem}$_p$.
\item {\em Finite Exiting:} For each correct $p \in \Pi$, $\sigma|p$
does not end with {\em exit}$_p$.
\end{compactitem}

Let $D$ be the set $\{${\it query}$_p$, 
{\it response}$(S)_p$, {\it crash}$_p : p \in \Pi, S \subseteq N_p\}$.
A sequence $\sigma$ over $D$ is said to {\em satisfy the $\Diamond P^1$
specification} if it satisfies the Completeness and Accuracy conditions from 
Section~\ref{sec:fl1dining:intro} as well as:
\begin{compactitem}
\item {\em Well-formedness:}  For each $p \in \Pi$, $\sigma|p$ either
is, or is a prefix of, the infinite repetition of {\it query}$_p$,
{\em response}$_p(.)$.
\end{compactitem}

When considering an algorithm to solve $BW$-$\square SX$-$FL1$,
the inputs from the user are
of the form {\em try}$_p$ and {\em exit}$_p$ while the outputs to the
user are of the form {\em crit}$_p$ and {\em rem}$_p$.
If the algorithm uses $\Diamond P^1$ as a subroutine, then the outputs
to the subroutine are of the form {\em query}$_p$ while the inputs from
the subroutine are of the form {\em response}$_p(.)$.
The third set of conditions on executions is this:
If in an execution, 
(1) the user cooperates to ensure that, for each $p$, 
{\em try}$_p$, {\em crit}$_p$, {\em exit}$_p$, and {\em rem}$_p$
occur in sequence, and 
(2) the algorithm cooperates to ensure that, for each $p$,
{\em query}$_p$ and {\em response}$_p(.)$ occur in sequence, and
(3) the projection of the execution onto the set of events $D$
satisfies the $\Diamond P^1$ specification, then
the projection of the execution onto the set of events $X$
satisfies the $BW$-$\square SX$-$FL1$ specification.

When considering an algorithm to solve $\Diamond P^1$, the inputs from
the user are of the form {\em query}$_p$ while the outputs to the user
are of the form {\em response}$_p(.)$.
If the algorithm uses multiple instances of a solution to 
$BW$-$\square SW$-$FL1$ as subroutines, then the outputs
to the $h$-th subroutine are of the form {\em try}$_p^h$ and
{\em exit}$_p^h$ while the inputs from the $h$-th subroutine are of
the form {\em crit}$_p^h$ and {\em rem}$_p^h$.
The third set of conditions on executions is this:
If in an execution,
(1) the user cooperates to ensure that, for each $p$,
{\em query}$_p$ and {\em response}$_p(.)$ occur in sequence, and
(2) the algorithm cooperates to ensure that, for each $p$ and each $h$,
{\em try}$_p^h$, {\em crit}$_p^h$, {\em exit}$_p^h$, and {\em rem}$_p^h$
occur in sequence, and
(3) the projection of the execution onto the set of events for
each copy of the subroutine satisfies the $BW$-$\square SX$-$FL1$
specification, then
the projection of the execution onto the set of events $D$ satisfies
the $\Diamond P^1$ specification.
\end{comment}

\section{Solving $BW$-$\square SX$-$FL1$ using $\Diamond P^1$}
\label{sec:fl1dining:solveproblem}

The algorithm in Figures \ref{alg:fl1dining:solveproblem1}, \ref{alg:fl1dining:solveproblem2}, and \ref{alg:fl1dining:solveproblem3} solves the problem of $BW$-$\square SX$-$FL1$ using a solution to the $\Diamond P^1$ problem.  Roughly speaking, this algorithm uses a ping/ack protocol in conjunction with asynchronous doorways \cite{choy:eftafd} to provide fairness and uses a fork/request protocol to provide safety in entering a critical section.  A node has to first enter the doorway for it to enter its critical section.

The pseudocode in Figures \ref{alg:fl1dining:solveproblem1}, \ref{alg:fl1dining:solveproblem2},  \ref{alg:fl1dining:solveproblem3}, and the figures found on p. 45-48 uses the following conventions: 
\begin{compactitem}
\item An \emph{immediate} occurrence of an output event $e$ is indicated as ``generate $e$'' in the code.
\item When node $p$ crashes, we assume that $p$ simply stops its execution. 
%\item We assume that, at each node $p$, there exist a send queue $sendQ_{p,q}$ and a receive queue $recvQ_{p,q}$ for each neighbor $q$ of $p$.  
%\item Executing ``generate $send_p(m,q)$'' indicates the enqueuing of message $m$ to $sendQ_{p,q}$.  The channel from $p$ to $q$ dequeues each message from $sendQ_{p,q}$ (if it is nonempty) and eventually delivers them in FIFO order by enqueuing those messages to $recvQ_{q,p}$ at $q$ in the order they were sent.
%\item Action ``When $recv_p(m,q)$ occurs'' is enabled when $m$ is located at the head of receive queue $recvQ_{p,q}$.  Message $msg$ is dequeued from $recvQ_{p,q}$ and discarded after the entire action block has been executed.
\item  We assume that each action block is executed atomically.
\end{compactitem}   

%For Algorithms \ref{alg:fl1dining:solveproblem}, \ref{alg:fl1dining:extractFDsw}, and \ref{alg:fl1dining:extractFDd}, we assume that each action block in is executed atomically. 
% Also, we denote $N_p$ as the set of neighboring nodes of $p\in\Pi$ in the conflict graph $G$.

%We assume that variables $reqToken[\cdot]$ and $fork[\cdot]$ are initialized as follows: For each node $p \in \Pi$ and $q \in N_p$, $reqToken[p] = T$ if and only if $fork[q] = F$. 


\begin{figure}[tp]
\centering
\begin{framed}
\begin{algorithmic}[1]
  	\item[] $\langle$Variables and Initialization$\rangle$
  	\STATE $N_p$; \COMMENT{neighbor set of $p$}
  	\STATE $\forall q \in N_p : reqToken[q]$; \COMMENT{initialized as in Section \ref{subsec:fl1dining:solveproblemoverview}}
  	\STATE $\forall q \in N_p : fork[q]$; \COMMENT{initialized as in Section \ref{subsec:fl1dining:solveproblemoverview}}
  	\STATE $dining \leftarrow rem$; \COMMENT{dining state of $p$}
  	\STATE $inside \leftarrow F$;
  	\STATE $skeptical \leftarrow F$;
  	\STATE $\forall q \in N_p : ack[q] \leftarrow F$;
  	\STATE $\forall q \in N_p : replied[q] \leftarrow F$;
  	\STATE $\forall q \in N_p : deferred[q] \leftarrow F$;
	\STATE generate $query_p$; \label{line:fl1dining:initQueryEvent}
	\EMPTY \hrulefill
  	\EMPTY
  	\STATE $\langle${\bf When} $try_p$ occurs$\rangle$
  	\STATE $dining \leftarrow try$;
  	\FORALL{$q \in N_p$}
 		\STATE generate $send_p(\langle ping \rangle,q)$; \label{line:fl1dining:sendPing}
 	\ENDFOR
  	\EMPTY
  	\STATE $\langle${\bf When} $recv_p(\langle ping \rangle,q)$ occurs$\rangle$
  	\IF{$(inside \vee replied[q]) \wedge \neg skeptical$}
  		\STATE $deferred[q] \leftarrow T$; \label{line:fl1dining:deferAck}
  	\ELSE
  		\STATE send $ack$ to $q$; \label{line:fl1dining:sendAckbyRecvPing}
  		\IF{$dining = try$}
  			\STATE $replied[q] \leftarrow T$;
  		\ENDIF
  	\ENDIF
  	\EMPTY
  	\STATE $\langle${\bf When} $recv_p(\langle ack\rangle,q)$ occurs$\rangle$
  	\STATE $ack[q] \leftarrow T$; \label{line:fl1dining:setAcktoT}
  	\IF{$(\forall r \in N_p:ack[r]) \wedge (dining = try) \wedge \neg skeptical$}
  		\STATE EnterDoorway(); \label{line:fl1dining:enterDoorwayByRecvAck}
  	\ENDIF
\end{algorithmic}
\end{framed}
\caption{Solving $BW$-$\square SX$-$FL1$ with $\Diamond P^1$; code for node $p$ (part 1 of 3).}
\label{alg:fl1dining:solveproblem1}
\end{figure}
  	
  	
\begin{figure}[tp]
\centering
\begin{framed}
\begin{algorithmic}[1]
	\setalglineno{26}
  	\STATE $\langle${\bf When} $recv_p(\langle request\rangle,q)$ occurs$\rangle$
  	\STATE $reqToken[q] \leftarrow T$;
  	\IF{$\neg inside \vee ((dining = try) \wedge (p < q))$}
  		\STATE generate $send_p(\langle fork\rangle,q)$; \label{line:fl1dining:sendForkByRequest}
  		\STATE $fork[q] \leftarrow F$;
  		\IF{$inside$}
  			\STATE generate $send_p(\langle request\rangle,q)$;
  			\STATE $reqToken[q] \leftarrow F$;
  		\ENDIF
  	\ENDIF
  	\EMPTY
	\STATE $\langle${\bf When} $recv_p(\langle fork\rangle,q)$ occurs$\rangle$
  	\STATE $fork[q] \leftarrow T$; \label{line:fl1dining:setForkToT}
  	\IF{$(dining= try) \wedge inside$}
  		\STATE AllForks();  \label{line:fl1dining:checkCSbyRecvFork}
  	\ENDIF
	\EMPTY
  	\STATE $\langle${\bf When} $exit_p$ occurs$\rangle$ \label{line:fl1dining:exitEvent}
  	\STATE $dining \leftarrow exit$; \label{line:fl1dining:setDiningToExit}
 	\STATE SatisfyRequests(); \label{line:fl1dining:callSatisfyRequestsExitEvent}
 	\STATE generate $rem_p$; \label{line:fl1dining:remEvent}
  	\EMPTY
  	\STATE $\langle${\bf When} $response_p(S)$ occurs$\rangle$
  	%\STATE $skeptical \leftarrow b$;
  	\IF{$S\neq \emptyset$}
  		\STATE $skeptical \leftarrow T$;
  		\IF{$dining \neq crit$} \label{line:fl1dining:diningNeqCrit}
  			\STATE SatisfyRequests(); \label{line:fl1dining:callSatisfyRequestsFD}
  		\ENDIF
  	\ELSE
  		\STATE $skeptical \leftarrow F$;
  		\IF{$(dining = try) \wedge \neg inside \wedge (\forall q \in N_p:ack[q])$}
  			  \STATE EnterDoorway(); \label{line:fl1dining:enterDoorwayByFD}
  		\ENDIF
  	\ENDIF
  	\STATE generate $query_p$; \label{line:fl1dining:queryEvent}
\end{algorithmic}
\end{framed}
\caption{Solving $BW$-$\square SX$-$FL1$ with $\Diamond P^1$; code for node $p$ (part 2 of 3).}
\label{alg:fl1dining:solveproblem2}
\end{figure}

\begin{figure}[t]
\centering
\begin{framed}
\begin{algorithmic}[1]
	\setalglineno{52}
  	\PROC{AllForks()}
  		\IF{$\forall q \in N_p : fork[q]$}
  			\STATE $dining \leftarrow crit$; \label{line:fl1dining:setDiningToCrit}
  			\STATE generate $crit_p$; \label{line:fl1dining:critEvent}
  		\ENDIF
  	\ENDPROC
  	\EMPTY
  	\PROC{EnterDoorway()}
  		\STATE $inside \leftarrow T$; \label{line:fl1dining:setInsideToTEnterDoorway}
  		\FORALL{$q \in N_p$}
  			\STATE $ack[q] \leftarrow F$;
  			\STATE $replied[q] \leftarrow F$;
 			\IF{$(reqToken[q] \wedge \neg fork[q])$}
				\STATE generate $send_p(\langle request\rangle,q)$;
 				\STATE $reqToken[q] \leftarrow F$;
 			\ENDIF
  		\ENDFOR
  		\STATE AllForks();  \label{line:fl1dining:checkCSbyEnterDoorway}
  	\ENDPROC
  	\EMPTY
  	\PROC{SatisfyRequests()}
  		\STATE $inside \leftarrow F$; \label{line:fl1dining:exitDoorway}
  		\FORALL{$q \in N_p$ where $(reqToken[q] \wedge fork[q])$} \label{line:fl1dining:satisfyForkRequest}
  			\STATE generate $send_p(\langle fork\rangle,q)$; \label{line:fl1dining:sendForkByDeferred}
  			\STATE $fork[q] \leftarrow F$;
  		\ENDFOR
  		\FORALL{$q \in N_p$ where $deferred[q]$} \label{line:fl1dining:satisfyAckRequest}
  			\STATE generate $send_p(\langle ack\rangle,q)$; \label{line:fl1dining:sendAckbyDeferred}
  			\STATE $deferred[q] \leftarrow F$;
  		\ENDFOR
	\ENDPROC
\end{algorithmic}
\end{framed}
\caption{Solving $BW$-$\square SX$-$FL1$ with $\Diamond P^1$; code for node $p$ (part 3 of 3).}
\label{alg:fl1dining:solveproblem3}
\end{figure}

%\subsection{Local Variables of Algorithm \ref{alg:fl1dining:solveproblem}}

%Variable $dining$ keeps track of the most recent occurrence of $try$ and $crit$ events.  Variable $inside$ is used to indicate whether or not a node is inside the doorway.  The $skeptical$ variable stores the most recent response from $\Diamond B$ which is obtained through parameter $b$ of event $response(b)$; $skeptical=T$ indicates that the node suspects a neighbor is faulty.

%For a node to enter the doorway, it first sends \emph{ping} messages to all its neighbors requesting for each of its neighbor to send back an \emph{ack} message. Upon receiving ack messages from all its neighbors, the node then enters the doorway.  

%The value of $ack[q]$ tells whether node $p$ has received an ack message from its neighbor $q$; node $p$ enters the doorway only when node $p$ receives ack messages from all of its neighbors.  

%While node $p$ is in a trying section and $p$ receives a ping message from its neighbor $q$, it does not immediately send an ack message back to $q$ in some cases; this is to provide some level of fairness in entering a critical section between $p$ and its neighbors.  
%The value in $replied[q]$ is set to  $T$ when a node already sent an ack message to $q$ while $p$ is continuously in a trying section.  The value of $deferred[q]$ is used to indicate that node $p$ has received a ping message from $q$ but sending back the corresponding ack message has been deferred.  Arrays $replied[\cdot]$ and $deferred[\cdot]$ play a key role in providing fairness for neighboring nodes in entering the critical section. 

%Node $p$ uses array $fork[\cdot]$ to determine whether it can generate event $crit_p$ (enter the critical section). 
%if $p$ is inside the doorway and $fork[q]=T$ for all neighbors $q$ of $p$, then $p$ may enter a critical section. 
%For node $p$ to change the value of $fork[q]$ from $F$ to $T$, $p$ asks its neighbor $q$ to send back a notification message (called a $fork$ message) by sending a $request$ message to $q$.  
%When $fork[q]=F$ holds at node $p$, the value of $reqToken[q]$ is used to determine whether $p$ can send a request message to its neighbor $q$ ($reqToken[q] = T$) or not ($reqToken[q] = F$).  In the case when $fork[q] = T$ holds at node $p$, the value of $reqToken[q]$ is also used to determine whether there are pending requests for sending back a fork message ($reqToken[q]=T$) or not ($reqToken[q] = F$).  We assume that arrays $reqToken[\cdot]$ and $fork[\cdot]$ are initialized as follows: for each neighboring nodes $p \in \Pi$ and $q \in \Pi$, $reqToken[p] = T$ if and only if $fork[q] = F$. 

%For two neighboring nodes $p$ and $q$, we can consider that there exists a fork token (or simply fork) and a request token shared between $p$ and $q$ such that $fork[q] = T$ at $p$ (resp. $fork[p] = T$ at $q$) corresponds to node $p$ (resp. $q$) \emph{holding} the fork and $reqToken[q] = T$ at $p$ (resp. $reqToken[p] = T$ at $q$) corresponds to node $p$ (resp. $q$) \emph{holding} the request token. % Also, sending (resp. receiving) the fork corresponds to sending (resp. receiving) a fork message and  sending (resp. receiving) the request token corresponds to sending (resp. receiving) a request message.

\subsection{Algorithm Overview} 
\label{subsec:fl1dining:solveproblemoverview}

We first consider the case when a correct node $p\in \Pi$ does not have any faulty neighbors and $\Diamond P^1$ has stabilized such that $S=\emptyset$ for all events $response_p(S)$ thereafter.  In this case, $skeptical = F$ holds; this indicates that $p$ does not suspect any of its neighbors to be faulty.   When $p$ enters a trying section, it sets variable $dining$ to $try$ and sends ping messages to all its neighbors; variable $dining$ keeps track of the most recent occurrence of $try$ and $crit$ events.  Node $p$ then waits until it receives ack messages from all of its neighbors to enter the doorway; the value of $ack[q]$ tells whether node $p$ has received an ack message from its neighbor $q$ and variable $inside$ is used to indicate whether a node is inside the doorway. 

Upon receiving a ping message from a neighbor $q$, node $p$ does \emph{not} send an ack message back to $q$ if (1) $p$ is inside the doorway, or (2) $p$ already received a ping message from $q$ in the current trying section; otherwise $p$ immediately sends an ack message to $q$. Arrays $replied[\cdot]$ and $deferred[\cdot]$ handle this action of deferring an ack request which results in providing the $FL1$-$BW$ property:  no neighbor of $p$ enters a critical section more than \emph{two} times while $p$ is continuously in a trying section.

%This action of deferring an ack request provides property $FL1$-$BW$: no neighbor of $p$ enters a critical section more than \emph{two} times while $p$ continuously in a trying section.

Node $p$ uses array $fork[\cdot]$ to determine whether it can generate event $crit_p$ (enter the critical section).  Array $reqToken[\cdot]$ is used to keep track of $request$ messages exchanged between $p$ and its neighbors. For the algorithm in Figures \ref{alg:fl1dining:solveproblem1}, \ref{alg:fl1dining:solveproblem2}, and \ref{alg:fl1dining:solveproblem3}, we assume that arrays $reqToken[\cdot]$ and $fork[\cdot]$ are initialized as follows: for each pair of neighboring nodes $p \in \Pi$ and $q \in \Pi$, $reqToken[p] = T$ if and only if $fork[q] = F$.  Node $p$ sets $fork[q]$ to $T$ when it receives a $fork$ message and  $fork[q]$ to $F$ when it sends a $fork$ message.  Similarly, node $p$ sets $reqToken[q]$ to $T$ when it receives a $request$ message and $reqToken[q]$ to $F$ when it sends a $request$ message.  %We assume that arrays $reqToken[\cdot]$ and $fork[\cdot]$ are initialized as follows: for each neighboring nodes $p \in \Pi$ and $q \in \Pi$, $reqToken[p] = T$ if and only if $fork[q] = F$.

For two neighboring nodes $p$ and $q$, there exists a unique fork token (or simply fork) and a unique request token shared between $p$ and $q$ such that $fork[q] = T$ at $p$ (resp. $fork[p] = T$ at $q$) corresponds to node $p$ (resp. $q$) \emph{holding} the fork and $reqToken[q] = T$ at $p$ (resp. $reqToken[p] = T$ at $q$) corresponds to node $p$ (resp. $q$) \emph{holding} the request token.

When node $p$ enters the doorway, $p$ requests for the missing forks by sending request messages to its neighbors and if $p$ already holds all the forks, then $p$ enters its critical section.  When $p$ receives a request message from its neighbor $q$, $p$ determines whether it can immediately send the fork to $q$; node $p$ sends the fork to $q$ if (1) $p$ is outside the doorway, or (2) $p$ is in its trying section and the id of $q$ is greater than $p$'s id.  In the case when a fork request from node $q$ is deferred at node $p$, the value of $reqToken[q]$ will remain as $T$ until node $p$ exits the critical section.

At node $p$, whenever event $response_p(S)$ occurs with $S=\emptyset$, it checks the suitability of entering the doorway; if $p$ is in its trying section, outside of the doorway, and received ack messages from all of its neighbors, then $p$ enters the doorway. 

When node $p$ is in a trying section, inside the doorway, and holds all forks, then $p$ enters a critical section.  When event $exit_p$ occurs at node $p$ (when $p$ enters an exiting section), node $p$ goes outside of the doorway, sends forks to those neighbors that sent a request message to it, satisfies all deferred ack requests, and enters its remainder section.  This fork/request protocol basically provides the \emph{Exclusion} property.  Also, the combination of the ping/ack protocol and the fork/request protocol provides property $FL1$-$progress$. 
%The ping/ack protocol ensures that a node in a trying section eventually enters the doorway, and the fork/request protocol guarantees that a node that is in a trying section and also inside the doorway eventually enters a critical section. 

Now, we consider the case when a correct node $p \in \Pi$ has a faulty neighbor and $\Diamond P^1$ has stabilized such that $S \neq \emptyset$  for all events $response_p(S)$ thereafter.  In this case, $skeptical = T$ holds; this indicates that $p$ suspects it has a faulty neighbor. First note that whenever event $response_p(S)$ occurs with $S\neq \emptyset$ at node $p$, as long as $p$ is not in a critical section, $p$ exits the doorway and satisfies all deferred fork and ack requests.  Upon receiving a ping message sent by a neighboring node $q$, node $p$ will immediately send back an ack message to $q$.  Also, since $skeptical=T$ holds, node $p$ will \emph{not} enter the doorway even though it is in its trying section and received ack messages from all of its neighbors.  Note that $p$ does not need to enter its critical section if it has a crashed neighbor.  %Preventing those nodes that have a faulty neighbor from entering the doorway provides property $FL1$-$starvation$. 

\subsection{Proof Outline}

In this section, we only provide an outline of the proof of the algorithm in Figures \ref{alg:fl1dining:solveproblem1} \ref{alg:fl1dining:solveproblem2}, and \ref{alg:fl1dining:solveproblem3}.  
%The complete proof of correctness can be found in Appendix \ref{appendix:proofsolveproblem}.

The Finite Exiting property directly follows from the pseudocode.  Using the fact that the variable $dining$ correctly keeps track of the most recent occurrence of $try$ and $crit$ events (Lemma \ref{lem:fl1dining:dining-var}), we show that $crit$ and $rem$ events only happen after $try$ and $exit$, respectively, which proves the Well-formedness property (Lemma \ref{lem:fl1dining:excl-wf}).  To prove the Exclusion property (Lemma \ref{lem:fl1dining:excl}), we first identify invariants that are true in every configuration of any execution (Lemma \ref{lem:fl1dining:excl-invars}).   The key invariants used in showing the Exclusion property are: (a) the fork shared between any two neighbors is unique, and (b) if a node is in its critical section, then it is inside the doorway and holds all forks shared between itself and all of its neighbors.

%If node $p$ is correct and has at least one faulty neighbor, then, after $\Diamond B$ stabilizes, variable $skeptical$ is equal to $T$ thereafter.  This prevents $p$ from entering the doorway which shows that $p$ will starve (the $FL1$-starvation property holds; Lemma \ref{lem:fl1dining:starvation}).


The $FL1$-progress property (Lemma \ref{lem:fl1dining:progress}) is shown in two steps.  We first prove that for each correct node $p$ that only has correct neighbors, if $p$ is inside the doorway, then it eventually enters its critical section.  Then, we show that if $p$ is outside the doorway, then it eventually enters the doorway.  Both steps rely on the assumption that no correct process stays in its critical section forever and have a similar proof structure:  We first show that if there exists a node that is not making progress, then there is an array variable that stops changing its values (Lemmas \ref{lem:fl1dining:forkStopChange} and \ref{lem:fl1dining:ackStopChange}).  We then show by means of contradiction that the array variable cannot be stabilized, due to the total ordering of node ids and the total ordering of events in an execution (Lemmas \ref{lem:fl1dining:insideEventuallyCritical} and \ref{lem:fl1dining:outsideEventuallyInside}).       


The following facts are used to show that the $FL1$-$BW$ property holds (Lemma \ref{lem:fl1dining:fairness}): Suppose node $p$ is correct and only has correct neighbors.  While node $p$ is continuously in a trying section and outside the doorway, the use of array variable $replied[\cdot]$ shows that $p$ does not send an ack message more than one time to any neighboring node.  Also, notice that if $p$ is inside the doorway, then it does not send ack messages to its neighbors.  %We use these two facts to show that the $FL1$-$BW$ property holds (Lemma \ref{lem:fl1dining:fairness}).    

\subsection{Proof of Correctness}

Let $E$ be any execution of the algorithm in Figures \ref{alg:fl1dining:solveproblem1}, \ref{alg:fl1dining:solveproblem2}, and \ref{alg:fl1dining:solveproblem3} such that
$E|N$ satisfies the message-passing specification,
either $E|D$ is not user-correct for $D$ or $E|D$ satisfies the 
$\Diamond P^1$ specification, and
$E|X$ is user-correct for $X$.

%For all nodes $p\in \Pi$ and for all executions $E$ of Algorithm \ref{alg:fl1dining:solveproblem},
 After the initial generation of output event $query_p$ (line \ref{line:fl1dining:initQueryEvent}), subsequent $query_p$ events are generated only after event $response_p(b)$ is enabled (line \ref{line:fl1dining:queryEvent}).  Hence, $E|D$ is user-correct and we may assume that $E|D$ satisfies the $\Diamond P^1$ specification.

\subsubsection{Finite Exiting, Well-formedness, and Exclusion}

\begin{lemma}
\label{lem:fl1dining:finite-exit}
$E|X$ satisfies Finite Exiting.
\end{lemma}
\begin{proof}
This follows directly from the code (lines 38-41).
\end{proof}

\begin{lemma}
\label{lem:fl1dining:dining-var}
For every $p \in \Pi$ and every prefix $E'$ of $E$, 
if $dining_p = try$, then $last(E'|X,p) = try_p$, and
if $dining_p = crit$, then $last(E'|X,p) = crit_p$.
\end{lemma}
\begin{proof}
Initially $dining_p = rem$, so the lemma is vacuously true.
When $try_p$ occurs, $dining_p$ is set to $try$.
When $crit_p$ occurs, $dining_p$ is set to $crit$.
The only other time when $dining_p$ changes is when $exit_p$ occurs,
in which case $dining_p$ is set to $exit$.
\end{proof}

\begin{lemma}
\label{lem:fl1dining:excl-wf}
$E|X$ satisfies Well-formedness.
\end{lemma}
\begin{proof}
Suppose in contradiction $E|X$ does not satisfy Well-formedness.
By the assumption that $E|X$ is user-correct for $X$, the first error
is because the algorithm outputs $crit_p$ or $rem_p$ at a wrong time.
However, $rem_p$ is only generated immediately after $exit_p$ occurs (cf.\
lines 38--41), which is correct.

But $p$ only generates $crit_p$ in AllForks, which is called in two
places, line 37 and line 64.  Line 64 is part of EnterDoorway, which
is called in two places, line 25 and line 50.  In all cases, we see
from the code that $dining_p = try$ (lines 36, 24, 49) when $crit_p$ is
generated.  By Lemma~\ref{lem:fl1dining:dining-var}, the most recent preceding event 
in $X$ is $try_p$, which is correct, a contradiction.  

Thus $E|X$ satisfies Well-formedness.
\end{proof}

\begin{definition}
If $fork_p[q] = T$, then we say {\em $p$ has a $\{p,q\}$-fork};
if $fork_q[p] = T$, then we say {\em $q$ has a $\{p,q\}$-fork}; 
if a $fork$ message is in transit from $p$ to $q$, then we say {\em the 
channel from $p$ to $q$ has a $\{p,q\}$-fork}; and
if a $fork$ message is in transit from $q$ to $p$, then we say {\em the
channel from $q$ to $p$ has a $\{p,q\}$-fork}.
\end{definition}

\begin{definition}
If $reqToken_p[q] = T$, then we say {\em $p$ has a $\{p,q\}$-request};
if $reqToken_q[p] = T$, then we say {\em $q$ has a $\{p,q\}$-request};
if a $request$ message is in transit from $p$ to $q$, then we say {\em the 
channel from $p$ to $q$ has a $\{p,q\}$-request}; and
if a $request$ message is in transit from $q$ to $p$, then we say {\em the 
channel from $q$ to $p$ has a $\{p,q\}$-request}.
\end{definition}

\begin{lemma}
\label{lem:fl1dining:excl-invars}
The following are invariants (true in every configuration of $E$) 
for all neighbors $p$ and $q$.
\begin{itemize}
\item[(A)] There is exactly one $\{p,q\}$-fork.

\item[(B)] If $dining_p = crit$, then $fork_p[q] = T$ and $inside_p = T$.

\item[(C)] If a $request$ message is in transit from $p$ to $q$, then 
either a $fork$ message precedes the $request$ message in the channel or 
$q$ has the $\{p,q\}$-fork.

\item[(D)] If $reqToken_p[q] = T$, then a $fork$ message is not in transit 
from $q$ to $p$.

\item[(E)] There is exactly one $\{p,q\}$-request.
\end{itemize}
\end{lemma}

(Note:  (B) can be proved independently, as can (E).  (A), (C) and (D) need
to be proved all together, and they rely on (E).)

\begin{proof}
By induction on the configurations in $E$, which we denote $C_0, C_1, \ldots$.

--({\bf Base case})  By the initialization, (A) through (E) are true in $C_0$.

--({\bf Inductive case})  Suppose (A)-(E) are true in configuration $C_{t-1}$ and show
they are true in configuration $C_t$.  We consider every possibility for the
event taking the system from $C_{t-1}$ to $C_t$.  
When $try_p$ and $recv_p(ping,q)$ occur, no changes are made that affect
the truth of any of the predicates.  

{\em Case} 1:  The event is $recv_p(ack,q)$.

\begin{itemize}
\item[(A)] No changes affect $fork$ variables or $fork$ messages.  
By the inductive hypothesis, (A) is true in $C_{t-1}$ and thus it remains 
true in $C_t$.   

\item[(B)] The only change that can affect (B) is if $dining_p$ is set to
$crit$ in line 54 of AllForks, which is called from EnterDoorway.
The check in line 53 of AllForks ensures that $fork_p[q]$ is true,
and the assignment in line 56 of enterDoorway sets $inside_p$ to true.

\item[(C)] The only change that can affect (C) is if $p$ sends a $request$
message to $q$ in line 62 of EnterDoorway.  We must show that either
a $fork$ message precedes the $request$ message in the channel from $p$ to
$q$ or $q$ has the $\{p,q\}$-fork.  
Since $reqToken_p[q] = T$ in $C_{t-1}$, the inductive hypothesis (D) 
implies that a
$fork$ message is not in transit from $q$ to $p$.  Since $fork_p[q] = F$ 
in $C_{t-1}$, the inductive hypothesis (A) implies that either a $fork$ 
message is in transit from $p$ to $q$ or $q$ has the fork in $C_{t-1}$.  
Thus (C) is true in $C_t$.

\item[(D)] The only change relevant to (D) is if $reqToken_p[q]$ is set
to false in line 63 of EnterDoorway.  However, in this case (D) is
vacuously true in $C_t$.

\item[(E)] The only change relevant to (E) is if lines 61--63 are executed
in EnterDoorway and $p$ sends a request message to $q$.  In this case, 
the $\{p,q\}$-request moves from being (uniquely) at $p$ to being (uniquely)
in transit from $p$ to $q$.  Uniqueness follows from the inductive 
hypothesis (E).
\end{itemize}

{\em Case} 2: The event is $recv_p(request,q)$.

\begin{itemize}
\item[(A)] In $C_{t-1}$, a $request$ message is at the head of the channel 
from $q$ to $p$ (since channels are FIFO).  
By the inductive hypothesis (C), $fork_p[q] = T$ in $C_{t-1}$.
By the inductive hypothesis (A), in $C_{t-1}$, no $fork$ message is in 
transit from $p$ to $q$ or from $q$ to $p$, and $fork_q[p] = F$.
By the code, in $C_t$, either a $fork$ message is in transit from $p$ to $q$
and $fork_p[q] = F$, or no $fork$ message is in transit from $p$ to $q$
and $fork_p[q] = T$.  Thus (A) still holds.

\item[(B)] The only change that could affect (B) is setting $fork_p[q]$ 
to false in line 30.  But this only happens if $inside_p$ is false 
(cf.\ line 28).
By the inductive hypothesis (B), $dining_p \ne crit$ in $C_{t-1}$.  
Thus $dining_p$ is still not equal to $crit$ in $C_t$ and the change to 
$fork_p[q]$ does not invalidate (B) in $C_t$.

\item[(C)] If $p$ sends a $request$ message to $q$ in line 32, it previously 
sends a $fork$ message to $q$ in line 29.

\item[(D)] In $C_{t-1}$, a $request$ message is at the head of the channel 
from $q$ to $p$.
Thus by the inductive hypothesis (C), $p$ has the $\{p,q\}$-fork and no 
$fork$ message is in transit between $p$ and $q$ in either direction in 
$C_{t-1}$.
If $reqToken_p[q] =T$ in $C_t$ (i.e., line 33 is not executed), then 
there is still no $fork$ message in transit from $q$ to $p$.

Suppose $p$ sends the fork to $q$.  Then we must show that $reqToken_q[p] = F$.
This follows from the inductive hypothesis (E): since the $request$ message 
is in transit from $q$ to $p$ in $C_{t-1}$, it must be that $reqToken_q[p]
= F$.

\item[(E)] If lines 32--33 are not executed, then the $\{p,q\}$-request 
goes from being (uniquely) in transit from $q$ to $p$ to being (uniquely) at 
$p$.
If lines 32--33 are executed, then the $\{p,q\}$-request goes from being
(uniquely) in transit from $q$ to $p$ to being (uniquely) in transit
from $p$ to $q$ (The uniqueness follows from the inductive hypothesis (E)).
\end{itemize}

{\em Case} 3:  The event is $recv_p(fork,q)$.

\begin{itemize}
\item[(A)] In $C_{t-1}$, a $fork$ message is at the head of the channel 
from $q$ to $p$.
By the inductive hypothesis (A), in $C_{t-1}$, no $fork$ message is in 
transit from $p$ to $q$, and $fork_p[q]$ and $fork_q[p]$ are both false.
By the code, in $C_t$, no $fork$ message is in transit from $q$ to $p$ 
(since it is removed from the channel in order to be received) and 
$fork_p[q] = T$.

\item[(B)] The only change that can affect (B) is if $dining_p$ is set to
$crit$ in line 54 of AllForks, which is called from line 37.
The check in line 53 of AllForks ensures that $fork_p[q]$ is true,
and the check in line 36 ensures that $inside_p$ is true.

\item[(C)] No change affects the validity of (C) in $C_t$.

\item[(D)] No change affects the validity of (D) in $C_t$.

\item[(E)] No change affects the validity of (E) in $C_t$.
\end{itemize}

{\em Case} 4:  The event is $exit_p$.

\begin{itemize}
\item[(A)] The only changes that possibly affect (A) occur if lines 67--69 in
SatisfyRequests are executed.  In this case, the fork changes from
being (uniquely) at $p$ to being (uniquely) in transit from $p$ to $q$.
(The uniqueness is due to the inductive hypothesis (A).)

\item[(B)] Since $dining_p$ is set to a value other than $crit$, 
(B) is vacuously true in $C_t$.

\item[(C)] The only change that possibly affects (C) occurs if $p$ sends a 
$fork$ message to $q$ in line 68 of SatisfyRequests.  We must show that no 
$request$ message is in transit from $q$ to $p$.  
By the code, $reqToken_p[q] = T$ in $C_{t-1}$
(cf.\ line 67).  By the inductive hypothesis (E), there is no 
$request$ message in transit.

\item[(D)] The only change that possibly affects (D) occurs if $p$ sends a 
$fork$ message to $q$.  We must show that $reqToken_q[p] = F$.  
In $C_{t-1}$, if $p$ sends a $fork$ message to $q$, it must be that 
$reqToken_p[q] = T$.  So by the inductive hypothesis (E),
$reqToken_q[p] = F$.

\item[(E)] No change affects the validity of (E) in $C_t$.
\end{itemize}

{\em Case} 5:  The event is $response_p(S)$.

\begin{itemize}
\item[(A)] The only changes that possibly affect (A) are if lines 67--69 in
SatisfyRequests are executed.  The same argument as for $exit_p$ holds.

\item[(B)] Suppose $S \neq \emptyset$.  Then changes relevant to (B) are only  made
if $dining_p$ is not $crit$ (cf.\ line 45), and so (B) is vacuously true in 
$C_t$.

Suppose $S = \emptyset$.  The only change that can affect (B) is if $dining_p$ is 
set to $crit$ in line 54 of AllForks, which is called from EnterDoorway.
The check in line 53 of AllForks ensures that $fork_p[q]$ is true,
and the assignment in line 57 of EnterDoorway sets $inside_p$ to true.

\item[(C)] Suppose $S \neq \emptyset$.  The only change relevant to (C) is if $p$ sends a
$fork$ message to $q$ in line 68 of SatisfyRequests.  We must show that no
$request$ message is in transit from $q$ to $p$.  By the code, 
$reqToken_p[q]= T$ in $C_{t-1}$ (cf.\ line 67).  By the inductive hypothesis
(E), there is no $request$ message in transit.

Suppose $S = \emptyset$.  The only change relevant to (C) is if $p$ sends a
$request$ message to $q$ in line 62 of EnterDoorway.  We must show that
either a $fork$ message precedes the $request$ message in the channel from
$p$ to $q$, or $q$ has the $\{p,q\}$-fork.  Since $reqToken_p[q] = T$ in
$C_{t-1}$, the inductive hypothesis (D) implies that a $fork$ message is 
not in transit from $q$ to $p$.  Since $fork_p[q] = F$ in $C_{t-1}$, the
inductive hypothesis (A) implies that either a $fork$ message is in transit 
from $p$ to $q$, or $q$ has the $\{p,q\}$-fork in $C_{t-1}$.  
Thus (C) is true in $C_t$.

\item[(D)] Suppose $S \neq \emptyset$.  The only change relevant to (D) is if $p$
sends a $fork$ message to $q$ in line 68 of SatisfyRequests.  We must
show that $reqToken_q[p] = F$.  In $C_{t-1}$, if $p$ sends
a $fork$ message to $q$, it must be that $reqToken_p[q] = T$.  So by 
the inductive hypothesis (E), $reqToken_q[p] = F$.

Suppose $S = \emptyset$.  The only change relevant to (D) is if
$reqToken_p[q]$ is set to false in line 63 of EnterDoorway.  However, in
this case (D) is vacuously true in $C_t$.

\item[(E)] Suppose $S \neq \emptyset$.  Then no change relevant to (E) is made in $C_t$.

Suppose $S = \emptyset$.  The only change relevant to (E) occurs if lines
62--63 are executed in EnterDoorway and $p$ sends a $request$ message to $q$.
In this case, the $\{p,q\}$-request moves from being (uniquely) at $p$ to
being (uniquely) in transit from $p$ to $q$ (The uniqueness follows
from the inductive hypothesis (E)).
\end{itemize}

Therefore, (A), (B), (C), (D), and (E) are invariants for all neighbors $p$ and $q$. 
\end{proof}

\begin{lemma}
\label{lem:fl1dining:excl}
$E|X$ satisfies Exclusion.
\end{lemma}

\begin{proof}
Suppose $p$ and $q$ are two processes that are neighbors in
the conflict graph and $E'$ is a prefix of $E$ such that
$last((E'|X),p)$ is $crit_p$.
Consider the configuration at the end of $E'$.
By Lemma~\ref{lem:fl1dining:dining-var}, $dining_p = crit$.
By Lemma~\ref{lem:fl1dining:excl-invars}(B), $fork_p[q] = T$.
By Lemma~\ref{lem:fl1dining:excl-invars}(A), $fork_q[p] = F$.
By Lemma~\ref{lem:fl1dining:excl-invars}(B), $dining_q \ne crit$.
Thus, by Lemma~\ref{lem:fl1dining:dining-var}, Lemma \ref{lem:fl1dining:excl-wf}, and the fact that $dining_p=exit$ when $exit_p$ occurs, $last(E'|X,q)$ is not $crit_q$.
\end{proof}

\subsubsection{$FL1$-progress}



Once a node enters a trying section, that node must (1) acquire acks from all of its neighbors to enter the doorway and (2) when inside the doorway, acquire all forks shared between itself and all of its neighbors to enter its critical section.  We first show that for each correct node $p$, if (a) $p$ is in its trying section, (b) $p$ is inside the doorway, (c) all of $p$'s neighbors are correct, and (d) all correct neighbors of $p$ eventually exits their critical section, then $p$ eventually enters its critical section.

%The following two lemmas assist in proving the main lemma of this section.

\begin{lemma}
\label{lem:fl1dining:enterTryingInsideF}
For all nodes $p \in \Pi$, when $p$ enters a trying section, $inside=F$ holds.
\end{lemma}
\begin{proof}
Note that initially $inside=F$ at $p$.  Since user-correctness of $E|X$ is assumed ($try_p$ is the first event in $X$ that occurs at $p$), the first time $p$ enters a trying section, $inside=F$ holds.  By the Well-formedness property (Lemma \ref{lem:fl1dining:excl-wf}),for all future occurrences of event $try_p$, there exists a preceding occurrence of event $exit_p$ which calls SatisfyRequests() and sets $inside$ to $F$.  Since the value of $inside$ can only be modified to $T$ by calling EnterDoorway() and EnterDoorway() can be called only when $p$ is in a trying section (Lemma \ref{lem:fl1dining:dining-var} shows that $dining=trying$ at $p$ implies that $p$ is in a trying section), $inside=F$ holds when $p$ enters a trying section.
%For part (2), since for any $q\in N_p$, $deferred[q]$ can be modified to $T$ when $inside=T$, the proof of part (1) also shows that $deferred[q]=F$ holds when $p$ enters a trying section.     
\end{proof}

For all nodes $p\in\Pi$ and $q\in N_p$, we say that an ack message $\langle ack\rangle$ sent from $q$ to $p$ is a \emph{consequence} of a ping message $\langle ping \rangle$ sent from $p$ to $q$  if (1) $q$ sends $\langle ack\rangle$ by receiving $\langle ping\rangle$ from $p$ (line 19) or (2) $deferred[p]$ is modified from $F$ to $T$ at $q$ by receiving $\langle ping\rangle$ from $p$ which enabled $q$ to send $\langle ack\rangle$ by executing line 71.     

\begin{lemma}
\label{lem:fl1dining:onePendingPing}
For all nodes $p\in \Pi$ and $q\in N_p$ and for all occurrences of send events $send_p(\langle ping \rangle,q)$, (1) the next successive send event $send_p(\langle ping \rangle',q)$ (if any) occurs only after an occurrence of $recv_p(\langle ack \rangle,q)$ from $q$ at some point after the occurrenct of $send_p(\langle ping \rangle,q)$, and (2) this ack message $\langle ack \rangle$ is a  consequence of $\langle ping \rangle$ and it is the only ack message that $p$ receives in between the transmissions of $\langle ping \rangle$ and $\langle ping \rangle'$.   
%For all nodes $p\in \Pi$ and $q\in N_p$ and for all times $t$ when $p$ sends a ping message $msg_{ping1}$ to $q$, (1) node $p$ sends the next successive ping message $msg_{ping2}$ (if any) to $q$ only after receiving an ack message $msg_{ack}$ from $q$ at some time after time $t$, and (2) this ack message $msg_{ack}$ is a  consequence of $msg_{ping1}$ and it is the only ack message that $p$ receives in between the transmissions of $msg_{ping1}$ and $msg_{ping2}$.   
\end{lemma}
\begin{proof}
We first prove part (1).  Node $p$ only sends a ping message to $q$ when $p$ enters a trying section (line 14).  Also, when $p$ enters a trying section, $inside=F$ holds (Lemma \ref{lem:fl1dining:enterTryingInsideF}).  By the Well-formedness property (Lemma \ref{lem:fl1dining:excl-wf}), between any two trying sections, node $p$ must enter a critical section.  This implies that there exists a call to EnterDoorway() between any two ping message transmissions.  The reason for this is that for $p$ to enter a critical section, it must call AllForks(), and for AllForks() to be called, $inside=T$ must hold (the only way to set $inside=T$ is be calling EnterDoorway; line 57).  For EnterDoorway() to be called, $p$ must gather ack messages from all of its neighbors (lines 24 and 49)  which further implies that $p$ must receive an ack message from $q$.

For part (2), note that by receiving one ping message from $p$, exactly one ack message can be generated at $q$.  This is because executing line 19 at $q$ is a direct result of receiving a ping message from $p$ and executing line 71 at $q$ is a result of $deferred[p]$ being $T$ which is set by receiving a ping message from $p$ (and after executing line 71, $deferred[p]$ is reset to $F$).  Applying part (1) proves the lemma.
% this implies that $msg_{ack}$ is a consequence of $msg_{ping1}$ and it is the only ack message that $p$ receives between the send of $msg_{ping1}$ and $msg_{ping2}$. 
\end{proof}

%\begin{lemma}
%\label{lem:fl1dining:deferForkCondition}
%For all executions of Algorithm \ref{alg:fl1dining:solveproblem} for all correct nodes $p\in\Pi$ and $q\in\N_p$ where all of $p$'s neighbors are correct, if $p$ is in a trying section, $inside=T$ holds at $p$, and $p>q$, then eventually $fork[q]=T$ at $p$ continuously until after $p$ enters an exiting section.
%\end{lemma}
%\begin{proof}
%Lemma \ref{lem:fl1dining:critImpliesInside} and Lemma \ref{lem:fl1dining:enterTryingInsideF} imply that the request message sent by $p$ (if any) is deferred by $q$ only when $q$ is in a critical section.  
%\end{proof}

We next show that if a failure-insulated node $p \in \Pi$ does not enter its critical section even though it is in a trying section and inside the doorway, then the values in array $fork[\cdot]$ eventually stop changing.  

%For all configurations $C_t$ of $E$, let $fork_p^t[q]$ be the value of $fork[q]$ at $p$ in $C_t$.

\begin{lemma}
\label{lem:fl1dining:forkStopChange}
Suppose that there exists a failure-insulated node $p\in\Pi$.  Also, suppose that there exists a suffix $E_1$ of $E$ that begins with configuration $C_{t'}$ such that $p$ never enters its critical section even if $p$ is in a trying section and $inside=T$ holds at $p$.
Then, there exists a suffix of $E$ in which for all nodes $q \in N_p$, $fork[q]$ stops changing at $p$. 
%Then, even if Finite Eating holds for $E|X$, there exists a configuration  $C_{t_1}$ where $t_1 \geq t'$ such that for all configurations $C_{t_2}$ after $C_{t_1}$ and for all nodes $q \in N_p$, $fork_p^{t_1}[q]=fork_p^{t_2}[q]$.   
%Suppose that there exists a failure-insulated node $p\in\Pi$.  Also, suppose that there exists a time $t'$ such that  for all times $t'' \geq t'$, node $p$ does not enter a critical section even if $p$ is in a trying section and $inside=T$ at $p$.  For all times $t$, let $fork_t[q]$ be the value of $fork[q]$ at $p$ at time $t$.  Then, if Finite Eating holds for $E|X$, there exists a time $t_1 \geq t'$ such that for all times $t_2 \geq t_1$ and for all nodes $q \in N_p$, $fork_{t_1}[q]=fork_{t_2}[q]$ at $p$.   
\end{lemma}
\begin{proof}
Since $E|D$ satisfies the $\Diamond P^1$ specification, there exists a suffix $E_2$ of $E$ where for all nodes $r \in \Pi$, every occurrence of event $response_r(S)$ returns $S\neq\emptyset$ if and only if $r$ has a faulty neighbor.  
%Also, there exists a a suffix $E_2$ of $E_1$ such that for all nodes $r\in\Pi$, event $response_r(S)$ occurs at least once after the beginning of $E_1$.    
For our proof, we consider the suffix $E_1 \cap E_2$\footnote{For two suffixes $E_1$ and $E_2$ of an execution $E$, $E_1 \cap E_2$ corresponds to $E_1$ (resp. $E_2$) if $E_1$ (resp. $E_2$) begins later than $E_2$  (resp. $E_1$). If $E_1$ and $E_2$ are equivalent, then $E_1 \cap E_2$ corresponds to $E_1$.} of $E$.  

First note that whenever node $p$ sends a fork to its neighbor $q$, $fork_p[q]$ is set to $F$ and the only case that $fork_p[q]$ is set to $T$ is when $p$ receives a fork message from $q$.  If node $p$ ever sends a fork message to its neighbor $q$, and if $p$ ever receives a fork message back from $q$ (note that the fork is unique by Lemma \ref{lem:fl1dining:excl-invars}(A)), then there are four cases that node $q$ could have sent the fork message back to $p$:

--(\emph{Case} 1) $q$, which has a faulty neighbor, sent the fork by calling SatisfyRequests() on line 46: In this case, $skeptical=T$ holds at $q$ forever.  As a result, if $q$ is ever in a trying section, then EnterDoorway() is never called and thus $inside=F$ holds thereafter.  Hence, $q$ cannot send a request message to $p$ which proves that there exists a suffix of $E$ in which $fork_p[q]$ stops changing.

--(\emph{Case} 2) $q$, which is failure-insulated, sent the fork message by calling SatisfyRequests() on line 40: Since we only consider suffix $E_1 \cap E_2$ of $E$, SatisfyRequests() can only be called at $q$ when it enters an exiting section; every occurrence of $response_q(S)$ in $E_1 \cap E_2$ returns $S=\emptyset$.  At the time when $q$ sends the fork message, it must hold the request token (line 67).  For node $q$ to reacquire the fork it must send a request message to $p$ by calling EnterDoorway().  Lemma \ref{lem:fl1dining:onePendingPing} tells us that for node $q$ to call EnterDoorway(), it must send ping messages to all of its neighbors (by entering a trying section) and then gather ack messages from all of its neighbors that are consequences of those ping messages.  However, since $inside=T$ holds at node $p$, the ping message from $q$ will be deferred (line 16) and since $p$ never enters its critical section, the Well-formedness property (Lemma \ref{lem:fl1dining:excl-wf}) shows that $p$ never calls SatisfyRequests().  Note that, by Lemma \ref{lem:fl1dining:onePendingPing}, $p$ can only send an ack message back to $q$ by calling SatisfyRequests().   Hence, for Case 2, there exists a suffix of $E$ in which $fork_p[q]$ stops changing.

--(\emph{Case} 3) $q$, which is failure-insulated, sent the fork message (line 29) when $inside=F$ holds: First note that the fork shared between $p$ and $q$ is unique by Lemma \ref{lem:fl1dining:excl-invars}(A).  We further divide into two cases:
  
---(\emph{Case} 3a) Suppose $p>q$:  If $q$ ever calls EnterDoorway() and sets $inside$ to $T$ (for $q$ to send a request message to $p$, $inside=T$ must hold; see lines 31 and 57), and if $p$ ever receives a request message from $q$, then $p$ defers the fork request due to the condition on line 28.  The only case that node $p$ can send the fork is by calling SatisfyReqeust() which can only be called by entering an exiting section (since $p$ is failure-insulated, in $E_1 \cap E_2$, every occurrence of event $response_p(S)$ returns $S=\emptyset$ which prevents the call to SatisfyRequests() at line 46).  Since $p$ never enters a critical section by assumption, $p$ never enters an exiting section by the Well-formedness property (Lemma \ref{lem:fl1dining:excl-wf}).  Hence, $fork_p[q]=T$ holds in $E_1 \cap E_2$.

---(\emph{Case} 3b) Suppose $p<q$. If $q$ ever calls EnterDoorway() and sets $inside$ to $T$ and if $p$ ever receives a request message from $q$, then, different from Case 3a, $p$ sends the fork to $q$ and then $p$ immediately sends a request message to $q$ (by FIFO message delivery, $q$ will receive the fork prior to receiving the request message).  For $q$ to send back the fork to $p$, $inside$ must to be set to $F$ by calling SatisfyRequests() which can only be done by entering an exiting section.  This is because $q$ being failure-insulated ensures that, in $E_1 \cap E_2$,  every occurrence of event $response_q(S)$ returns $S=\emptyset$ which in turn prevents the call to SatisfyRequests() at line 46.  The rest of the proof is similar to Case 2.
 
--(\emph{Case} 4) $q$, which only has correct neighbors, sent the fork message (line 29) when $p>q$ and $inside=T$ holds while $q$ is in a trying section: The proof is similar to Case 3a.
\end{proof} 

\begin{lemma}
\label{lem:fl1dining:insideEventuallyCritical}
Consider each failure-insulated node $p\in\Pi$. If (1) Finite Eating holds for $E|X$, (2) $p$ is in a trying section, and (3) $inside=T$ holds at $p$, then $p$ eventually enters its critical section.
\end{lemma}
\begin{proof}
Suppose, in contradiction, that there exists a non-empty set $U\subseteq\Pi$ of failure-insulated nodes such that for all nodes $u \in U$, $u$ is in its trying section and $inside=T$ holds at $u$ but never enters its critical section.  Then, by Lemma \ref{lem:fl1dining:forkStopChange}, there exists a suffix $E_1$ of $E$ in which for all nodes in $U$, array $fork[\cdot]$ stops changing. 

Since $E|D$ satisfies the $\Diamond P^1$ specification, there exists a suffix $E_2$ of $E$ in which for all nodes $r \in \Pi$, every occurrence of event $response_r(S)$ returns $S\neq\emptyset$ if and only if $r$ has a faulty neighbor.  
%Also, there exists a time $t_s>t_{GST}$ such that for all nodes $r\in\Pi$, event $response_r(b)$ occurs at least once after time $t_{GST}$.      
We only consider suffix $E_1 \cap E_2$ of $E$ for our proof.

Since a node enters a critical section if it is in a trying section, inside the doorway, and holds all of the forks shared between itself and its neighbors, for each node $u \in U$, there exists a node $q \in N_u$ such that $fork[u]=T$ holds at $q$.  We first show that $q$ is in $U$ and $q>u$.  Suppose not.  First note that since $inside=T$ and $fork[q]=F$ holds at $u$, node $u$ sends a request message to $q$. We consider four cases: If $q$ has a faulty neighbor, then eventually SatisfyRequests() is called (line 46) which enables a fork message to be sent from $q$ to $u$ after $q$ receives the request message.  If $q$ is failure-insulated and if $q$ ever enters its critical section or exiting section, the Well-formedness property ensures that eventually SatisfyRequests() is called (line 40)  which enables a fork to be sent from $q$ to $u$ after $q$ receives the request message.  If $q$ is failure-insulated and if $inside=F$ holds at $q$, then upon receiving a request message from $u$, $q$ sends the fork to $u$ (line 29).  Finally, if $q$ is failure-insulated, $q$ is in its trying section, $inside=T$ holds at $q$, and $q<u$, then upon receiving a request messege from $u$ the condition on line 28 enables the fork to be sent from $q$ to $u$.  All of the above four cases contradict the fact that array $fork[\cdot]$ of $u$ stops changing. 

Consider the directed ``waits-for'' graph $W=(U,E_W)$ where vertices are nodes in $U$ and $(u,q)$ is in $E_W$ if and only if $fork[q]=F$ holds at $u$ in $E_1 \cap E_2$.  Since each node in $U$ is missing (waiting for) at least one fork, each vertex in $W$ has at least one outgoing edge, and thus there is a cycle in $W$ (basic fact from graph theory). This contradicts the total ordering of node ids since we just showed in the previous paragraph that $q>u$ holds for each edge $(u,q) \in E_W$.
%For analysis purpose, we represent the relationship between a node $s \in S$ and a node $s'$ which holds the fork shared between $s$ and $s'$ as a directed graph : there is an directed edge from $s$ to $s'$; note that $s'$ is also in $S$ and $s'>s$ by the previous paragraph.  Now, select any node $s_1$ from $S$.  Then, there exists a node $s_2\in S$ where there is a directed edge from $s_1$ to $s_2$.  Similarly, there exists a node $s_3\in S$ where there is a directed edge from $s_2$ to $s_3$ and so on.  We continue this process until the constructed directed path has a repeated node; since $S$ is finite such directed path must exists.  This implies that there exists a cycle along the directed path which contradicts the total ordering of node ids. 
\end{proof}

We now focus on showing that a node that is in a trying section but not inside the doorway eventually enters the doorway.  The structure of the proof is analogous to Lemma \ref{lem:fl1dining:forkStopChange} and Lemma \ref{lem:fl1dining:insideEventuallyCritical}.

%For all configurations $C_t$ of $E$, let $ack_p^t[q]$ be the value of $ack[q]$ at $p$ in $C_t$.

\begin{lemma}
\label{lem:fl1dining:ackStopChange}
Suppose that there exists a failure-insulated node $p\in\Pi$.  Also, suppose that there exists a suffix $E_1$ of $E$ in which $p$ does not set $inside$ to $T$ even if $p$ is in a trying section and $inside=F$ holds at $p$.  
Then, there exists a suffix of $E$ in which for all nodes $q\in N_p$, $ack[q]$ at $p$ stops changing.
%For all times $t$, let $ack_t[q]$ be the value of $ack[q]$ at $p$ at time $t$.  
%Then, even if Finite Eating holds for $E|X$, there exists a time $t_1 \geq t'$ such that for all times $t_2 \geq t_1$ and for all nodes $q\in N_p$, $ack_{t_1}[q]=ack_{t_2}[q]$ at $p$.
\end{lemma}
\begin{proof}
First note that, by Lemma \ref{lem:fl1dining:enterTryingInsideF}, $inside=F$ holds when $p$ entered the trying section and the only way to set $inside$ to $T$ is by calling EnterDoorway() (which requires that all ack messages from $p$'s neighbors to be gathered).  In $E_1$, if node $p$ ever receives an ack message from $q$, then $ack[q]$ remains as $T$ until EnterDoorway() is called which proves the lemma.  
%Hence, Lemma \ref{lem:fl1dining:ackStopChange} holds. 
\end{proof}

\begin{lemma}
\label{lem:fl1dining:outsideEventuallyInside}
Consider each failure-insulated node $p\in\Pi$.  If (1) Finite Eating holds for $E|X$, (2) $p$ is in a trying section, and (3) $inside=F$ holds at $p$, then $p$ eventually sets $inside$ to $T$.
\end{lemma}
\begin{proof}
Suppose, in contradiction, that there exists a non-empty set $U\subseteq \Pi$ of failure-insulated nodes such that for all nodes $u \in U$, $u$ is in its trying section and $inside=F$ holds at $u$ but $u$ never sets $inside$ to $T$.  Then, by Lemma \ref{lem:fl1dining:ackStopChange},  there exists a suffix $E_1$ of $E$ in which for all nodes in $U$, array $ack[\cdot]$ stops changing.
%For all nodes $s\in S$, we call the trying section in which $inside$ is never set to $T$ as the \emph{last trying section} of $s$.

Since $E|D$ satisfies the $\Diamond P^1$ specification, there exists a suffix $E_2$ of $E$ in which for all nodes $r \in \Pi$, every occurrence of event $response_r(S)$ returns $S\neq\emptyset$ if and only if $r$ has a faulty neighbor.  
%Also, there exists a time $t_s>t_{GST}$ such that for all nodes $r\in\Pi$, event $response_r(b)$ occurs at least once after time $t_{GST}$.      
We only consider suffix $E_1 \cap E_2$ of $E$ for our proof.

For each $u \in U$, there exists a node $q \in N_u$ in its trying section such that $deferred[u]=T$ holds at $q$; because otherwise all neighbors of $u$ must have executed line 19 or lines 71 to 72 which results in $u$ receiving ack messages from all of its neighbors. 
We show that $q$ is in $U$ and $last(E|X,q)$ occurs before $last(E|X,u)$.  Note that both $last(E|X,q)$ and $last(E|X,u)$ are $try$ events by assumption.
%$q$'s last trying section started earlier than the last trying section of $s$. 
We first show that $q\in U$. Suppose,in contradiction, that $q\notin U$.  If $q$ has a faulty neighbor, then eventually $q$ calls SatisfyRequests() which enables $q$ to send an ack message to $u$, a contradiction.  If $q$ is failure-insulated and if ever $q$ sets $inside$ to $T$, enters a critical section, or enters an exiting section, then by Lemma \ref{lem:fl1dining:insideEventuallyCritical} and the Well-formedness property (Lemma \ref{lem:fl1dining:excl-wf}), $q$ eventually calls SatisfyRequests() which again enables an ack message to be sent from $q$ to $u$, a contradiction.

Now we show that $last(E|X,q)$ occurs before $last(E|X,u)$.  Since $q\in U$, the only case that $q$ could have set $deferred[u]$ to $T$ for the last time is when $replied[u]=T$ (see the condition in line 16).  This implies that when $q$ sets $replied[u]$ to $T$ for the last time, node $q$ is in the trying section corresponding to $last(E|X,q)$.  Note that an ack message $\langle ack \rangle$ is sent from $q$ to $u$ when $q$ sets $replied[u]$ to $T$ for the last time.   By Lemma \ref{lem:fl1dining:onePendingPing}, $q$ must have set $deferred[u]$ to $T$ for the last time by receiving a ping message from $u$ that was generated after $u$ received message $\langle ack \rangle$.  Hence, since a ping message is transmitted only when a $try$ event occurs, $last(E|X,q)$ occurs before $last(E|X,u)$. 

Consider the directed ``waits-for'' graph $W=(U,E_W)$ where vertices are nodes in $U$ and $(u,q)$ is in $E_W$ if and only if $deferred[u]=T$ holds at $q$ in $E_1 \cap E_2$.  Since each node in $U$ is missing (waiting for) at least one ack, each vertex in $W$ has at least one outgoing edge, and thus there is a cycle in $W$ (basic fact from graph theory).  This contradicts the ordering of ($try$) events in $E$ since we just showed in the previous paragraph that $last(E|X,q)$ occurs before $last(E|X,u)$ for each $(u,q)\in E_W$.
%For analysis purpose, we represent the relationship between a node $s \in S$ and a node $s'$ which has $deferred[s]=T$ as a directed graph : there is an directed edge from $s$ to $s'$; note that $s'$ is also in $S$ and the last trying section of $s'$ starts earlier than the last  trying section of $s$ according to the previous paragraph.  Now, select any node $s_1$ from $S$.  Then, there exists a node $s_2\in S$ where there is a directed edge from $s_1$ to $s_2$.  Similarly, there exists a node $s_3\in S$ where there is a directed edge from $s_2$ to $s_3$ and so on.  We continue this process until the constructed directed path has a repeated node; since $S$ is finite such directed path must exists.  This implies that there exists a cycle along the directed path which contradicts the total ordering of time.
\end{proof}

Following lemma proves the $FL1$-progress property.

\begin{lemma}
\label{lem:fl1dining:progress}
$E|X$ satisfies \emph{FL1-progress}.
\end{lemma}
\begin{proof}
Lemma \ref{lem:fl1dining:outsideEventuallyInside} and Lemma \ref{lem:fl1dining:insideEventuallyCritical} directly provide the proof.
\end{proof}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


\subsubsection{$FL1$-$BW$}

The proof of Lemma \ref{lem:fl1dining:fairness} is similar to the proof of Theorem 3 in \cite{SP07}.

\begin{lemma}
\label{lem:fl1dining:fairness}
$E|X$ satisfies \emph{FL1}-$BW$.
\end{lemma}
\begin{proof}
%Suppose Finite Eating holds for $E|X$.  
%Since $E|D$ satisfies the $\Diamond B$ specification, there exists a time $t_{GST}$ such that for all times after or at $t_{GST}$ and for all nodes $r \in \Pi$, every occurrence of event $response_r(b)$ returns $b=T$ if and only if $r$ has a faulty neighbor.  Also, there exists a time $t_s>t_{GST}$ such that for all nodes $r\in\Pi$, event $response_r(b)$ occurs at least once after time $t_{GST}$.  Let $H$ be the set of nodes that are in a trying section at time $t_s$.  Then, by $FL1$-progress (Lemma \ref{lem:fl1dining:progress}), there exists a time $t_p>t_s$ such that all correct nodes in $H$ enter a critical section.  Hence, after time $t_p$, it holds that for all correct processes $s\in \Pi$, $s$ enters a trying section after time $t_s$.  We only consider the time after $t_p$ in our proof.
Since $E|D$ satisfies the $\Diamond P^1$ specification, there exists a suffix $E_1$ of $E$ in which for all nodes $r \in \Pi$, every occurrence of event $response_r(S)$ returns $S\neq \emptyset$ if and only if $r$ has a faulty neighbor.  Also, there exists a suffix $E_2$ of $E_1$ in which for all nodes $r\in\Pi$, event $response_r(S)$ occurs at least once.  Let $H$ be the set of nodes that are in a trying section at the beginning of $E_2$.  Then, by $FL1$-progress (Lemma \ref{lem:fl1dining:progress}), there exists a  suffix $E_3$ of $E_2$ in which all correct nodes in $H$ enter a critical section.  Hence, in $E_3$, it holds that for all correct processes $s\in \Pi$, $s$ enters a trying section.  We only consider $E_3$ in our proof.

Consider any two neighboring nodes $p\in \Pi$ and $q\in N_p$ where $p$ is failure-insulated.  First note that $skeptical=F$ holds at $p$ in $E_3$.   

%If $q$ has a faulty neighbor, then by the $FL1$-starvation property (Lemma \ref{lem:fl1dining:starvation}), there exists a time $t_1$ such that $(E|X)|q$ becomes finite and does not end with $crit_q$.  Hence, after time $max(t_1,t_p)$ the lemma holds since there is no occurrences of $crit_q$ after time $max(t_1,t_p)$.

%By $FL1$-progress (Lemma \ref{lem:fl1dining:progress}), Finite Eating, and the fact that $E|X$ is user-correct, $(E|X)|q$ is infinite; note that $(E|X)|p$ is also infinite.  
By the code, while $p$ is continuously in a trying section, node $p$ sends at most one ack message to $q$; this is because when $p$ receives a ping message from $q$ for the first time during the trying section,  $p$ may immediately send an ack message to $q$ (line 19) and set $replied[q]$ to $T$ (line 21), and when $p$ receives a ping message for the second time during the trying section, $p$ may set $deferred[q]$ to $T$ (line 17, since $replied[q]=T$ at $p$) instead of directly sending an ack message.  

From node $q$'s perspective, it may receive \emph{two} ack messages from $p$ while $p$ is in the trying section.  This may happen when $p$ sent an ack message just before $p$ enters the trying section; due to the assumption of unbounded message delay, this ack message is in transit when $p$ enters a trying section.   As a result, since receiving an ack message from $p$ is a requirement for setting $inside$ to $T$ at $q$ (by calling EnterDoorway()) and $inside=T$ is a requirement for $q$ to enter its critical section, $q$ may enter a critical section at most \emph{two} times while $p$ is in a trying section.  This implies that, after the occurrence of event $try_p$, there can be at most two occurrences of event $crit_q$ before event $crit_p$ happens. %Let $\sigma^E=E|X$ and denote $\sigma^E_t$ as the suffix of $\sigma^E$ that begins the earliest after time $t$.   Then, we can conclude that for every infix of the sequence of events in $\sigma^E_{t_p}$ that starts with $try_p$ and contains exactly \emph{three} ($k=3$) occurrences of $crit_q$ must contain at least one occurrence of $crit_p$.    
\end{proof}

Finally, we state the main theorem of this section.

\begin{theorem}
\label{thm:fl1dining:algorithm1}
The algorithm in Figures \ref{alg:fl1dining:solveproblem1}, \ref{alg:fl1dining:solveproblem2}, and \ref{alg:fl1dining:solveproblem3} is an algorithm for the $BW$-$\square SX$-$FL1$ problem.
\end{theorem}
\begin{proof}
Let $E$ be any execution of the algorithm in Figures \ref{alg:fl1dining:solveproblem1}, \ref{alg:fl1dining:solveproblem2}, and \ref{alg:fl1dining:solveproblem3} such that $E|N$ satisfies the message-passing specification,
either $E|D$ is not user-correct for $D$ or $E|D$ satisfies the 
$\Diamond P^1$ specification, and
$E|X$ is user-correct for $X$.
Then, $E|X$ satisfies the $BW$-$\square SX$-$FL1$ specification by Lemmas \ref{lem:fl1dining:excl-wf}, \ref{lem:fl1dining:finite-exit}, \ref{lem:fl1dining:excl}, \ref{lem:fl1dining:progress}, and \ref{lem:fl1dining:fairness}.
\end{proof}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Extracting $\Diamond P^1$ from a Solution to $BW$-$\square SX$-$FL1$}
\label{sec:fl1dining:ExtractB}

%For this section, we assume that, for each correct node $p \in \Pi$, there exists at least one correct neighboring node $q\in \Pi$ at all times.  We also assume that the topology of the communication graph $G$ is known in advance.

%For this section, we assume that the topology of the communication graph $G$ is known in advance.



%For each neighboring nodes $p\in\Pi$ and $q\in\Pi$, Algorithm \ref{alg:fl1dining:extractFDsw} uses instance $I(p,q)$ of problem $BW$-$\square SX$-$FL1$ on the following graph $G^{I(p,q)}$ (see Figure \ref{fig:fl1dining:instance}):
In this section, we present an algorithm that implements the $\Diamond P^1$ failure detector using multiple instances of $BW$-$\square SX$-$FL1$.
For each ordered pair $(p,q)$ of nodes in $\Pi$, the algorithm uses instance $I(p,q)$ of problem $BW$-$\square SX$-$FL1$ on the following graph $G^{I(p,q)}$ (see Figure \ref{fig:fl1dining:instance}):
\begin{compactitem}
\item The vertex set $\Theta^{I(p,q)}$ of $G^{I(p,q)}$ consists of three threads on $p$ and four threads on $q$.
\item Two threads on $p$ are called \emph{hybrid} threads, denoted $h_0$ and $h_1$, and the remaining  thread on $p$ is called the \emph{witness} thread, denoted $w$.
\item The four threads on $q$ that are in $\Theta^{I(p,q)} \backslash \{w,h_0,h_1\}$ are called \emph{subject} threads, denoted $s_{i,j}$ for all $i,j\in \{0,1\}$.
\item The edge set of $G^{I(p,q)}$ is $\{\{h_0,h_1\}, \{h_i,w\},$ $\{s_{i,0},s_{i,1}\}, \{h_i,s_{i.j}\}: i,j \in \{0,1\}\}$.
\end{compactitem}
For each instance, the witness thread (Figure \ref{alg:fl1dining:extractFDsw1}) monitors hybrid threads (Figure \ref{alg:fl1dining:extractFDsw2}) and subject threads (Figure \ref{alg:fl1dining:extractFDsw3}) are monitored by hybrid threads.
%Note that  if $I(p,q)$ solves $BW$-$\square SX$-$FL1$, then the Well-formedness property of $BW$-$\square SX$-$FL1$ ensures that dummy threads will never enter a critical section since they will not generate any $try$ event.

\begin{figure}[tp]
  \centering
  \includegraphics[scale=1.0]{figures/conflict5.pdf}
\caption{Instance $I(p,q)$ of $BW$-$\square SX$-$FL1$ and graph $G^{I(p,q)}$.}
\label{fig:fl1dining:instance}
\end{figure}

\begin{figure}[tp]
\centering
\begin{framed}
\begin{algorithmic}[1]
  \item[] {\bf Witness Thread $w$ at node $p$:}
  \EMPTY 
  \item[] {(Variables and Initialization):}
  \STATE $counter \leftarrow 0$;
  \STATE $val \leftarrow F$;
  \STATE $bound \leftarrow 1$;
  \STATE generate $try_w$;
  \EMPTY
  \STATE $\langle${\bf When} $rem_w$ occurs$\rangle$
  \STATE generate $try_w$;
  \EMPTY
	\STATE $\langle${\bf When} $crit_w$ occurs$\rangle$
	\STATE $counter \leftarrow counter + 1$;
	\IF{$counter > bound$}
		\STATE $bound \leftarrow counter$;
		%\STATE $val \leftarrow T$;
		\STATE $W[p][q] \leftarrow T$; \COMMENT{shared with $d$ on node $p$}
	\ELSE
		%\STATE $val \leftarrow F$;
		\STATE $W[p][q] \leftarrow F$; \COMMENT{shared with $d$ on node $p$}
	\ENDIF
  %\STATE generate $send_w(\langle skeptic(val)\rangle,d)$; \COMMENT{$d$ on node $p$}
  \STATE generate $exit_w$;
  \EMPTY
  \STATE $\langle${\bf When} $recv_w(\langle ping\rangle,h_i)$ occurs$\rangle$ \COMMENT{$h_i$ on node $p$}
  \STATE $counter \leftarrow 0$;
  \STATE generate $send_w(\langle ack \rangle,h_i)$; \COMMENT{$h_i$ on node $p$} 
\end{algorithmic}
\end{framed}
\caption{Extracting $\Diamond P^1$ from $BW$-$\square SX$-$FL1$; code for witness thread of instance $I(p,q)$ where $p\in \Pi$ and $q \in N_p$.}
\label{alg:fl1dining:extractFDsw1}
\end{figure}
  
\begin{figure}[tp]
\centering
\begin{framed}
\begin{algorithmic}[1]
   \item[] {\bf Hybrid Thread $h_{i \in \{0,1\}}$ at node $p$:}
  \EMPTY
  \item[] {(Variables and Initialization):}
  \STATE $counter_i \leftarrow 0$;
  \STATE $val_i \leftarrow F$;
  \STATE $bound_i \leftarrow 1$;
  \STATE $critical_i \leftarrow F$;
  %\STATE $ping_i \leftarrow F$; 
  \STATE $ack_{i} \leftarrow F$; \COMMENT{shared with $h_{1-i}$ on node $p$}
  \STATE generate $try_{h_i}$;
  \STATE generate $send_{h_i}(\langle ping\rangle,w)$; \COMMENT{$w$ on node $p$}
  %\STATE $ping_i \leftarrow T$;  
  \EMPTY
  \STATE $\langle${\bf When} $rem_{h_i}$ occurs$\rangle$
  \STATE generate $try_{h_i}$;
  \STATE generate $send_{h_i}(\langle ping\rangle,w)$; \COMMENT{$w$ on node $p$}
  %\STATE $ping_i \leftarrow T$;
  \EMPTY
  \STATE $\langle${\bf When} $crit_{h_i}$ occurs$\rangle$
  \STATE $critical_i \leftarrow T$;  
  \STATE $counter_i \leftarrow counter_i + 1$;
	\IF{$counter_i > bound_i$}
		\STATE $bound_i \leftarrow counter_i$;
		%\STATE $val_i \leftarrow T$;
		\STATE $H[p][q][i] \leftarrow T$; \COMMENT{shared with $d$ on node $p$}
	\ELSE
		%\STATE $val_i \leftarrow F$;
		\STATE $H[p][q][i] \leftarrow F$; \COMMENT{shared with $d$ on node $p$}
	\ENDIF
  %\STATE generate $send_w(\langle skeptic(val_i)\rangle,d)$; \COMMENT{$d$ on node $p$}
  \EMPTY
  \STATE $\langle${\bf When} $recv_{h_i}(\langle ack\rangle,w)$ occurs$\rangle$ \COMMENT{$w$ on node $p$}
  \STATE $ack_i \leftarrow T$;
  \EMPTY
  \STATE $\langle${\bf When} $recv_{h_i}(\langle ping\rangle,s_{i,j})$ occurs$\rangle$ \COMMENT{$s_{i,j}$ on node $q$}
  \STATE $counter_i \leftarrow 0$;
  \STATE generate $send_{h_i}(\langle ack \rangle,s_{i,j})$; \COMMENT{$s_{i,j}$ on node $q$}
  \EMPTY
  \STATE $\langle${\bf When} $critical_i \wedge ack_i \wedge ack_{1-i}\rangle$ \COMMENT{internal event}
  \STATE $ack_i \leftarrow F$;
  \STATE $critical_i \leftarrow F$;
  \STATE generate $exit_{h_i}$;
\end{algorithmic}
\end{framed}
\caption{Extracting $\Diamond P^1$ from $BW$-$\square SX$-$FL1$; code for hybrid threads of instance $I(p,q)$ where $p\in \Pi$ and $q \in N_p$.}
\label{alg:fl1dining:extractFDsw2}
\end{figure}  
  
\begin{figure}[t]
\centering
\begin{framed}
\begin{algorithmic}[1]
   \item[] {\bf Subject Thread $s_{i,j}$ at node $q$ where $i,j \in \{0,1\}$:}
  \EMPTY
  \item[] {(Variables and Initialization):}
  \STATE $critical_{i,j} \leftarrow F$;
  \STATE $ack_{i,j} \leftarrow F$; \COMMENT{shared with $s_{i,1-j}$ on node $q$}
  \STATE generate $try_{s_{i,j}}$;
  \STATE generate $send_{s_{i,j}}(\langle ping\rangle,h_i)$; \COMMENT{$h_i$ on node $p$}
  \EMPTY
  \STATE $\langle${\bf When} $rem_{s_{i,j}}$ occurs$\rangle$
  \STATE generate $try_{s_{i,j}}$;
  \STATE generate $send_{s_{i,j}}(\langle ping\rangle,h_i)$; \COMMENT{$h_i$ on node $p$}
  \EMPTY
  \STATE $\langle${\bf When} $crit_{s_{i,j}}$ occurs$\rangle$
  \STATE $critical_{i,j} \leftarrow T$;  
  \EMPTY
  \STATE $\langle${\bf When} $recv_{s_{i,j}}(\langle ack\rangle,h_i)$ occurs$\rangle$ \COMMENT{$h_i$ on node $p$}
  \STATE $ack_{i,j} \leftarrow T$;
  \EMPTY
  \STATE $\langle${\bf When} $critical_{i,j} \wedge ack_{i,j} \wedge ack_{i,1-j}\rangle$ \COMMENT{internal event}
  \STATE $ack_{i,j} \leftarrow F$;
  \STATE $critical_{i,j} \leftarrow F$;
  \STATE generate $exit_{s_{i,j}}$;
\end{algorithmic}
\end{framed}
\caption{Extracting $\Diamond P^1$ from $BW$-$\square SX$-$FL1$; code for subject threads of instance $I(p,q)$ where $p\in \Pi$ and $q \in N_p$.}
\label{alg:fl1dining:extractFDsw3}
\end{figure}

The number of instances used in our construction of $\Diamond P^1$ on the communication topology graph $G$ is $2|E|$ where $E$ is the set of undirected edges of $G$.

When necessary for disambiguation, we will use $I(p,q)$ as a superscript (e.g., $h_1^{I(p,q)}, w^{I(p,q)}, rem_{w}^{I(p,q)}$).  In the algorithm, the variables at the two hybrid threads on node $p$ and the four subject threads on node $q$ are disambiguated by subscripts.   Variables are shared\footnote{We assume atomic (linearizable) shared variables.} between the two hybrid threads $h_0$ and $h_1$.  Also, for all $i\in\{0,1\}$, the two subject threads $s_{i,0}$ and $s_{i,1}$ share variables.  

For convenience, we assume the following for the algorithm:fl1dining:  For each instance $I(p,q)$, there exists a FIFO channel between the witness thread and each hybrid thread. 

There is also a \emph{decision} thread, denoted as $d$, for each node $p\in \Pi$ (see Figure \ref{alg:fl1dining:extractFDd}). It is important to note that there exists exactly one decision thread per node, \emph{not} per instance.  The decision thread on node $p$ determines the parameter $S$ (the suspicion set) of the output event $response_p(S)$.  The decision thread at node $p$ shares (atomic) variables with the witness and hybrid threads of instance $I(p,q)$ for all neighbors $q$ of $p$. %The decision thread on node $p$ receives messages from witness threads $w^{I(p,q)}$ for all neighbors $q$ of $p$ and determines the parameter value $b$ of the output event $response_p(b)$.  %These messages assists in determining the parameter value $b$ of the output event $response_p(b)$.    

For any given instance $I(p,q)$, hybrid threads $h_0$ and $h_1$ on node $p$ monitor whether node $q$ crashed.  This monitoring activity of each hybrid thread is only possible if at least one of the hybrid threads does not starve.   In the case when both $h_0$ and $h_1$ starve, the monitoring activity of the witness thread $w$ detects the starvation of both hybrid threads.  Note that, if node $p$ is correct and the hybrid threads on $p$ starve, then the $FL1$-progress property tells us that $p$ has a faulty neighbor. 

%Algorithm \ref{alg:fl1dining:extractFDsw} uses the following convention: For each instance $I(p,q)$, we assume that there exists a FIFO channel between the witness thread and each hybrid thread. 

\begin{figure}[t]
\centering
\begin{framed}
\begin{algorithmic}[1]
	\item[] {\bf Decision Thread $d$ at node $p$:}
	\EMPTY
	\item[] {(Variables and Initialization):}
	\STATE $N_p$; \COMMENT{neighbor set of $p$}
	%\STATE $b \leftarrow T$;
	\STATE $S \leftarrow N_p$;
	\STATE $\forall q \in N_p: W[p][q] \leftarrow T$; \COMMENT{$W[p][q]$ is shared with $w$ of $I(p,q)$}
	\STATE $\forall q \in N_p, \forall i \in \{0,1\}: H[p][q][i] \leftarrow T$; \COMMENT{$H[p][q][i]$ is shared with $h_i$ of $I(p,q)$}	
	%\EMPTY
	%\STATE $\langle${\bf When} $recv_d(\langle skeptic(val)\rangle,w)$ occurs$\rangle$ \COMMENT{$w$ of $I(p,q,r)$}
	%\STATE $suspect_{ind}[q][r] \leftarrow val$;
	%\STATE $b \leftarrow ( \bigvee_{\forall u,v \in N_p, u \neq v} suspect_{ind}[u][v] ) \vee (\bigvee_{\forall k \in \{0,1\}} suspect_{dir} )$;
	%\EMPTY
	%\STATE $\langle${\bf When} $recv_d(\langle skeptic(val)\rangle,s_{i\in\{0,1\}})$ occurs$\rangle$ \COMMENT{$s_{i\in\{0,1\}}$ of $I(p,q,r)$}
	%\STATE $suspect_{dir}[i] \leftarrow val$;
	%\STATE $b \leftarrow ( \bigvee_{\forall u,v \in N_p, u \neq v} suspect_{ind}[u][v] ) \vee (\bigvee_{\forall k \in \{0,1\}} suspect_{dir} )$;
	\EMPTY
	\STATE $\langle${\bf When} $query_p$ occurs$\rangle$
	%\STATE $b \leftarrow ( \bigvee_{\forall q \in N_p} W[p][q] ) \vee (\bigvee_{\forall q \in N_p, \forall i \in \{0,1\}} H[p][q][i] )$;
	\STATE 	$S \leftarrow \{ q : q\in N_p, W[p][q]=T \}~\cup$ 
	\item[] ~~~~~~~~~~~~~~~$\{r : r\in N_p, H[p][r][i]=T, i\in\{0,1\}\}$;
	\STATE generate $response_p(S)$;
\end{algorithmic}
\end{framed}
\caption{Extracting $\Diamond P^1$ from $BW$-$\square SX$-$FL1$; code for decision thread at node $p$.}
\label{alg:fl1dining:extractFDd}
\end{figure}

%\subsection{Local Variables of Algo. \ref{alg:fl1dining:extractFDsw} and \ref{alg:fl1dining:extractFDd}}

%\subsubsection*{Witness Thread $w$ of $I(p,q)$ at node $q$}
%\paragraph{Witness Thread $w$ of $I(p,q)$ at node $q$\\}
%The $counter$ variable counts the number of times thread $w$ enters a critical section during the time in between the reception of two consecutive ping messages (sent by subject threads at node $p$).  Variable $val$ equal to $T$ indicates that thread $w$ is suspecting that node $p$ is starving.  Variable $bound$ keeps track of the maximum value of $counter$ since the beginning of the execution of the algorithm.  

%\subsubsection*{Subject Thread $s_i$ of $I(p,q)$ at node $p$}
%\paragraph{Subject Thread $s_i$ of $I(p,q)$ at node $p$\\}
%Variable $critical_i$ equal to $T$ indicates that thread $s_i$ is currently in a critical section.  Variable $ack_i$ is used to track whether thread $s_i$ received an ack message; an ack message is sent from thread $w$ to $s_i$ as a response to a ping message sent from $s_i$ to $w$.

%\subsubsection*{Decision Thread $d$ at node $p$}
%\paragraph{Decision Thread $d$ at node $p$\\}
%Variable $b$ is used as the parameter value for event $response_p(b)$.  Variable $suspect[q]$ equal to $T$ indicates that a neighboring node $q$ is suspecting that $p$ is starving.   

\subsection{Algorithm Overview}

%\subsubsection*{Witness Thread $w$ of $I(p,q)$ at node $q$}
%\paragraph{Witness Thread $w$ of $I(p,q)$ at node $q$\\}
%When witness thread $w$ enters a remainder section it immediately transits to a trying section by generating event $try_{w}$.  
%When $w$ enters a critical section, $counter$ is incremented.  If the value of $counter$ exceeds the value in $bound$, then $bound$ is set to the value of $counter$ and variable $val$ is set to %$T$; otherwise $val$ is simply set to $false$.  The value of $val$ is then sent to the decision thread $d$ at node $p$ (through message $skeptic(val)$) and $w$ enters a exiting section.

%When witness thread $w$ receives a ping message from the subject thread $s_i$, the $counter$ variable is reset to $0$ and an ack message is sent back to $s_i$.

%\subsubsection*{Subject Thread $s_i$ of $I(p,q)$ at node $p$}
\subsubsection{Hybrid Thread $h_{i\in\{0,1\}}$ and Subject Threads $s_{i,0}$ and $s_{i,1}$ of $I(p,q)$}

Subject thread $s_{i,j}$ sends a ping message to $h_i$ while it is in its trying section.   Note that after $s_{i,j}$ sends a ping message, it cannot send another ping message unless it enters its exit section.  Also, $s_{i,j}$ cannot enter its exit section unless $s_{i,j}$ enters its critical section and both $s_{i,j}$ and $s_{i,1-j}$ receive an ack message from $h_i$; variable $critical_{i,j}$ is used to keep track of whether $s_{i,j}$ is in its critical section and variable $ack_{i,j}$ is used to check whether $s_{i,j}$ received an ack message from hybrid thread $h_i$ as a response to a ping message sent from $s_{i,j}$ to $h_i$.  Moreover, just before entering its exiting section, $s_{i,j}$ sets $ack_{i,j}$ to $F$ which prevents $s_{i,1-j}$ from entering its exit section until $s_{i,j}$ receives an ack message from $h_i$.  This protocol guarantees that (1) at least one of $s_{i,0}$ or $s_{i,1}$ is in its trying or critical section when $h_i$ receives a ping message and (2) at least one of $s_{i,0}$ or $s_{i,1}$ stays in its trying or critical section until $h_i$ receives the next ping message.  

Now we explain how witness thread $h_i$ on node $p$ detects that $q$ crashed.  First note that when $q$ crashes, then all subject threads running on $q$ crash as well.  Each time $h_i$ enters its critical section, it checks whether $counter_i$ is growing without bound by comparing $counter_i$ with variable $bound_i$; variable $bound_i$ keeps track of the maximum value of $counter_i$ since the beginning of the execution of the algorithm and it never decreases. Note that variable $counter_i$ is incremented when $h_i$ enters a critical section.  Also, note that, when hybrid thread $h_i$ receives a ping message from a subject thread (either $s_{i,j}$ or $s_{i,1-j}$), it resets the $counter_i$ variable.   Suppose nodes $p$ and $q$ are both correct.  In this case, subject threads on $q$ do not starve due to $FL1$-progress.  Since there exists a subject thread that is continuously in its trying or critical section between any two consecutive ping message receptions at $h_i$, the $FL1$-$BW$ property guarantees that $counter_i$ will be  bounded.   As a result, element $H[p][q][i]$ will be set to $F$ from some time on.  Now, suppose $q$ is faulty.  In this case, \emph{if $h_i$ does not starve}\footnote{The $BW$-$\square SX$-$FL1$ specification only guarantees nodes that are at least two hops away from a failure to make progress; neighbors of a faulty thread may starve.}, then variable $counter_i$ grows without bound since subject threads will eventually stop sending ping messages to $h_i$.  Consequently, element $H[p][q][i]$ will be set to $T$ from some time on.  

\subsubsection{Witness Thread $w$ and Hybrid Threads $h_{0}$ and $h_{1}$ of $I(p,q)$}

The interaction between the witness thread and the hybrid threads is similar to the interaction between a hybrid thread and its subject threads except that, this time, witness thread $w$ monitors whether \emph{both} $h_0$ and $h_1$ starve or not; the monitoring is based on the fact that starving hybrid threads eventually stop sending ping messages to $w$.  By the $FL1$-progress property, the existence of a starving hybrid thread on node $p$ indicates that node $q$ is faulty.

%\paragraph{Witness Thread $w$ at node $q$ and Subject Threads $s_{i\in\{0,1\}}$ of $I(p,q)$ at node $p$\\}
%When thread $s_i$ enters a remainder section, it sends a ping message to the witness thread $w$ and enters a trying section. 
%Variables $critical_i$ and $ack_i$ are set to $T$ when $s_i$ enters a critical section and when $s_i$ receives an ack message from witness thread $w$, respectively.  If $s_i$ is in a critical section, and both $ack_i$ of $s_i$ and $ack_{1-i}$ of $s_{1-i}$ are set as $T$ (note that $s_i$ can access $ack_{1-i}$), then variables $ack_i$ and $critical_i$ of $s_i$ are both set to $F$ and $s_i$ enters an exiting section.  

%Subject thread $s_i$ sends a ping message to $w$ while it is in its trying section.   Note that after $s_i$ sends a ping message, it cannot send another ping message unless it enters its exit section.  Also, $s_i$ cannot enter its exit section unless $s_i$ enters its critical section and both $s_i$ and $s_{1-i}$ receive an ack message from $w$; variable $critical_i$ is used to keep track of whether or not $s_i$ is in its critical section and variable $ack_i$ is used check whether $s_i$ received an ack message from witness thread $w$ as a response to a ping message sent from $s_i$ to $w$.  Moreover, just before entering its exiting section, $s_i$ sets $ack_i$ to $F$ which prevents $s_{1-i}$ from entering its exit section until $s_i$ receives an ack message from $w$.  This protocol guarantees that when a ping message arrives at $w$, at least one subject thread is in its trying or critical section and at least one subject thread stays in its trying or critical section until $w$ receives the next ping message.  

%Now we explain how witness thread $w$ on node $p$ detects starving subject threads.  Each time $w$ enters its critical section, it checks whether or not $counter$ is growing without bound by comparing $counter$ with variable $bound$; variable $bound$ keeps track of the maximum value of $counter$ since the beginning of the execution of the algorithm and it never decreases. Note that variable $counter$ is incremented when $w$ enters a critical section.  Also, note that, when witness thread $w$ receives a ping message from a subject thread (either $s_i$ or $s_{i-1}$), it resets the $counter$ variable.   Suppose $p$ is correct and only has correct neighbors.  In this case, subject threads on $p$ do not starve due to $FL1$-progress.  Since there exists a subject thread that is continuously in its trying or critical section between any two consecutive ping message receptions at $w$, the $FL1$-$BW$ property guarantees that $counter$ will be  bounded.   As a result, the $val$ variable at $w$ will eventually and permanently be set to $F$.  Now, suppose $p$ has a faulty neighbor.  In this case, variable $counter$ grows without bound since subject threads will eventually stop sending ping messages to $w$.  This is because the subject threads are guaranteed to eventually starve due to the $FL1$-starvation property.  Consequently, the $val$ variable at $w$ will eventually and permanently be set to $T$.  

%This ping/ack protocol guarantees that eventually and permanently, the time duration between two consecutive ping message receptions at witness thread $w$ is encompassed by a trying-critical section of a subject thread (either $s_i$ or $s_{i-1}$).  This in turn ensures that eventually and permanently, between two consecutive ping message receptions at thread $w$, the $counter$ variable at $w$ is incremented only when at least one subject thread is continuously in a trying section.  In this way, the witness thread $w$ can detect whether the subject threads are starving or not (by $FL1$-starvation, a correct subject thread starves due to a failure in its neighborhood) and inform the decision thread at node $p$ of a possible faulty node in $p$'s neighborhood.

%\subsubsection*{Decision Thread $d$ at node $p$}
\subsubsection{Decision Thread $d$ at node $p$}

The decision thread $d$ at node $p$ simply identifies each neighbor $q$ of $p$ where either $W[p][q]=T$ or $H[p][q][i]=T$ holds for all $i\in\{0,1\}$, and passes the set of those identified neighbors of $p$, denoted $S$,  to event $response_p$ as a parameter.   %If at least one hybrid thread at node $p$ suspects that $q$ is faulty or at least one witness thread at node $p$ suspects that hybrid threads are starving, then $b$ is set to $T$; otherwise $b$ is set to $F$.

%The decision thread $d$ at node $p$ simply collects the most recent values of the $val$ variables from the witness threads of $p$'s neighbors, combines them, and sets the $b$ variable which serves as the parameter value of event $response_p(b)$.   If at least one witness thread of node $p$'s neighbors suspects that $p$ is starving, then $b$ is set to $T$ (which indicates that $p$ suspects that there exists a faulty node among $p$'s neighbors); otherwise $b$ is set to $F$.

\subsection{Proof Outline}

In this section, we provide an outline of the proof of the algorithm in Figures \ref{alg:fl1dining:extractFDsw1}, \ref{alg:fl1dining:extractFDsw2}, \ref{alg:fl1dining:extractFDsw3}, and \ref{alg:fl1dining:extractFDd}.

The code of Figure \ref{alg:fl1dining:extractFDd} shows that a response event immediately follows a query event (lines 5--7). Thus, the Well-formedness (Lemma \ref{lem:fl1dining:wellformednessD}) and Liveness (Lemma \ref{lem:fl1dining:liveness}) properties hold.  To assist in proving both the Completeness property and the Accuracy property, we first show that for all correct neighboring nodes $p$ and $q$, 
%(1) our algorithm cooperates with each subroutine such that the projection onto the set of events $X$ with respect to $I(p,q)$ occur in the proper sequence (Lemma \ref{lem:fl1dining:instanceUserCorrect}), 
(1) our algorithm interacts with the $I(p,q)$ subroutine properly (Lemma \ref{lem:fl1dining:instanceUserCorrect})
and (2) no thread in instance $I(p,q)$ stays in its corresponding critical sections forever (Lemma \ref{lem:fl1dining:instanceFiniteEating}).  For all correct neighboring nodes $p$ and $q$, part (1) implies that instance $I(p,q)$ satisfies the $BW$-$\square SX$-$FL1$ specification and part (2) implies that each thread in $I(p,q)$ that is in its trying section eventually enters its critical section.

The Completeness property is shown in the following way: Suppose a correct node $p$ has a faulty neighbor $q$ and consider instance $I(p,q)$.  The hybrid threads will eventually stop receiving ping messages from subject threads.  If at least one hybrid thread does not starve, then the non-starving hybrid thread can detect the failure using the $FL1$-$BW$ property (Case 1 of Lemma \ref{lem:fl1dining:completeness}).  However, there is no progress guarantee for the hybrid threads since their neighbor crashed.  In the case when both hybrid threads starve, the witness thread can detect that both of the hybrid threads are starving using the $FL1$-$BW$ property (Case 2 of Lemma \ref{lem:fl1dining:completeness}).  This is because each starving hybrid thread stops sending ping messages to the witness thread and it is guaranteed that the witness thread will progress by the the $FL1$-$progress$ property (the witness thread is two hops away from subject threads in the conflict graph).  Note that, by the $FL1$-$progress$ property, the starvation of any hybrid thread indicates that $q$ is faulty.

%The proof of the Validity property is divided into two parts: (a) we show that if a correct node $p$ has a faulty neighbor, then eventually every occurrence of $response_p(b)$ has $b=T$ (Lemma \ref{lem:fl1dining:completeness}), and then (b) we show that if a correct node $p$ only has correct neighbors, then eventually every occurrence of $response_p(b)$ has $b=F$ (Lemma \ref{lem:fl1dining:accuracy}).  First note that for each correct node $p$, there exists at least one correct neighbor $q$ by the assumption on $G$.  Thus, in the case of part (a), the correct node $p$ has a correct neighbor $q$ such that $I(p,q)$ satisfies the $BW$-$\square SX$-$FL1$ specification and all correct threads in $I(p,q)$ do not stay in their corresponding critical sections forever.  As a result, the $FL1$-starvation property holds for $I(p,q)$ which implies that the subject threads of $I(p,q)$, which are on node $p$,  eventually stop sending ping messages to the witness thread, which is on node $q$.  This serves as the basis for the proof of part (a).

The Accuracy property is shown using the following fact:  If two neighboring nodes $p$ and $q$ are both correct, then, at least one hybrid thread (resp. subject thread) of instance $I(p,q)$ is continuously in a trying section or a critical section during the time in between any two consecutive ping message receptions at the witness thread (resp. hybrid thread) of $I(p,q)$ (Lemmas \ref{lem:fl1dining:renewalInterval} and \ref{lem:fl1dining:renewalInterval2}).  This allows the witness thread and each hybrid thread to obtain a bound on the number of times it enters the critical section while at least one of its neighboring thread is continuously trying to enter the critical section (Lemma \ref{lem:fl1dining:accuracy}).  Note that such bounds exist due to the $FL1$-$BW$ property.

%In the case of part (b), since the correct node $p$ only has correct neighbors, for all neighbors $q$ of $p$, instance $I(p,q)$ satisfies the $BW$-$\square SX$-$FL1$ specification and all correct threads in $I(p,q)$ do not stay in their corresponding critical sections forever.  Thus, the $FL1$-progress and $FL1$-$BW$ properties hold for all threads in instance $I(p,q)$ for all neighbors $q$ of $p$.  Part (b) is proven basically by these two properties along with the fact that at least one subject thread of instance $I(p,q)$ is continuously in a trying section or a critical section during the time in between any two consecutive ping message receptions at the witness thread of $I(p,q)$ (Lemma \ref{lem:fl1dining:renewalInterval}).

\subsection{Proof of Correctness}
\label{subsec:fl1dining:correctExtractFD}

Let $E$ be any execution of the algorithm in Figures \ref{alg:fl1dining:extractFDsw1}, \ref{alg:fl1dining:extractFDsw2}, \ref{alg:fl1dining:extractFDsw3}, and \ref{alg:fl1dining:extractFDd} such that 
\begin{compactitem}
\item $E|N$ satisfies the message-passing specification,
\item for each $h$, $1\leq h \leq H$, either $E|X^h$ is not user-correct for $X^h$ or $E|X^h$ satisfies the $BW$-$\square SX$-$FL1$ specification, and
\item $E|D$ is user-correct for $D$.
\end{compactitem}

%For convenience, we use the term ``time'' to refer to points in the execution.

\subsubsection{Well-formedness and Liveness}

\begin{lemma}
\label{lem:fl1dining:wellformednessD}
$E|D$ satisfies \emph{Well-formedness}.
\end{lemma}
\begin{proof}
Since user-correctness is assumed for $E|D$, it is sufficient to show that for all nodes $p\in\Pi$, within $(E|D)|p$, event $query_p$ (if any) is the only event in $D\backslash \{crash_p\}$ that immediately follows event $response_p(\cdot)$.  By the code of Figure \ref{alg:fl1dining:extractFDd}, a $response_p(\cdot)$ event occurs only after the occurrence of a $query_p$ event (lines 5--7).  Hence, within $(E|X)|p$, event $response_p(\cdot)$ cannot immediately follow a $response_p(\cdot)$ event which proves the lemma.  
\end{proof}

\begin{lemma}
\label{lem:fl1dining:liveness}
$E|D$ satisfies \emph{Liveness}.
\end{lemma}
\begin{proof}
It is direct from the code of Figure \ref{alg:fl1dining:extractFDd}, that for all correct nodes $p\in \Pi$, whenever a $query_p$ event occurs, there is an immediate occurrence of $response_p(\cdot)$ (lines 5--7).
\end{proof}

\subsubsection{Completeness}


%\subsubsection{Validity}

%To prove that the Validity property holds, we show that for all correct nodes $p\in\Pi$ (1) if at least one neighbor of $p$ is faulty, then eventually and permanently, every occurrence of event $response_p(b)$ has $b=T$, and (2) if all neighbors of $p$ are correct, then eventually and permanently, every occurrence of event $response_p(b)$ has $b=F$.

%Before we prove part (1), we show that for all nodes $p\in\Pi$ and $q\in N_p$, if $p$ and $q$ are both correct, then $E|X^{I(p,q)}$ is user-correct.

Before we prove the Completeness property, we show that for all nodes $p\in\Pi$ and $q\in N_p$, $E|X^{I(p,q)}$ is user-correct.

\begin{lemma}
\label{lem:fl1dining:instanceUserCorrect}
Consider each pair of neighboring nodes $p\in\Pi$ and $q\in N_p$.  Then, $E|X^{I(p,q)}$ is user-correct.% and Finite Eating holds for $E|X^{I(p,q)}$. 
\end{lemma}
\begin{proof}
The proof requirement is to show that the shortest prefix of $E|X^{I(p,q)}$ to violate Well-formedness (if any) ends in either $rem_x$ or $crit_x$ for some $x\in\Theta^{I(p,q)}$.
%, and (2) $E|X^{I(p,q)}$ satisfies Finite Eating.  We first prove part (1).  
Consider witness thread $w$ at node $p$.  Directly from the code in Figure \ref{alg:fl1dining:extractFDsw1}, a $try_w$ (resp. $exit_w$) event only occurs immediately after the occurrence of a $rem_w$ (resp. $crit_w$) event. 

Consider hybrid thread $h_{i \in \{0,1\}}$ at node $p$.  Again, directly from the code, a $try_{h_i}$ event only occurs immediately after the occurrence of a $rem_{h_i}$ event which implies that a $try_{h_i}$ event does not immediately occur after a $crit_{h_i}$ event or an $exit_{h_i}$ event, and an $exit_{h_i}$ event does not immediately occur after a $rem_{h_i}$ event.  The proof requirement is to show that $exit_{h_i}$ does not immediately occur after an $exit_{h_i}$ event or a $try_{h_i}$ event.  Suppose, in contradiction, that an $exit_{h_i}$ event occurs immediately after an $exit_{h_i}$.  Then, when the former $exit_{h_i}$ event occurs, variable $critical_i$ is set to $F$.  For the latter $exit_{h_i}$ event to occur, $critical_i$ must be $T$.  The only case that the hybrid thread can set $critical_i$ to $T$ is by an occurrence of a $crit_{h_i}$ event.  This implies that there must have been an occurrence of a $crit_{h_i}$ event in between the two $exit_{h_i}$ events, a contradiction.  Now, suppose, in contradiction, that an $exit_{h_i}$ event occurs immediately after a $try_{h_i}$ event.  For an $exit_{h_i}$ event to occur, $critical_i=T$ must hold which shows that there exists an occurrence of a $crit_{h_i}$ event before the $exit_{h_i}$ event happens.  Let $crit'_{h_i}$ be the latest $crit_{h_i}$ event that happened before the occurrence of an $exit_{h_i}$ event.  Then, in between $crit'_{h_i}$ and the $exit_{h_i}$ event there must exist a $try_{h_i}$ event which immediately follows a $rem_{h_i}$ event.  If a $rem_{h_i}$ event did not happen immediately after $crit'_{h_i}$, the only event that can occur immediately after $crit'_{h_i}$ is a $try_{h_i}$ event which contradicts the fact that a $try_{h_i}$ event only occurs immediately after a $rem_{h_i}$ event.

The proof for the subject threads is similar to the proof for hybrid threads. 
%Since dummy threads at $N_p \backslash \{q\}$ do not generate any $try$ or $exit$ events with respect to instance $I(p,q)$, there will never be a case where the user violates Well-formedness.  
%Hence, we can conclude that $E|X^{I(p,q)}$ is user-correct.
% and as a result we may assume that $E|X^{I(p,q)}$ solves the $BW$-$\square SX$-$FL1$ problem for $G^{I(p,q)}$.
%We now prove part (2).  Consider witness thread $w$ at node $q$.  Directly from the code in Algorithm \ref{alg:fl1dining:extractFDsw}, there exists an immediate occurrence of an $exit$ event after a $crit$ event.  Since dummy threads at $N_p \backslash \{q\}$ do not generate any $try$ events with respect to instance $I(p,q)$, if a $crit$ event ever occurs at the dummy thread, then it directly indicates that Well-formedness is violated.
%Now, consider subject thread $s_{i \in \{0,1\}}$ at node $p$.  Note that even if Finite Eating is not guaranteed, as long as user-correctness (preserving Well-formedness) holds, a correct algorithm for solving $BW$-$\square SX$-$FL1$ cannot violate Exclusion or Finite Exiting.  Without loss of generality, suppose, in contradiction, subject thread $s_0$ is in a critical section forever.  Then, there exists a last $crit_{s_0}$ event that occurs.  Let $t_c$ be the time when the last $crit_{s_0}$ event occurs.  Then, from time $t_c$ and thereafter, $critical_0$ is always $T$ since the only case that variable $critical_0$ can be set to $T$ is when a $crit$ event occurs and the only case that $critical_0$ can be reset to $F$ is when an $exit$ event occurs (lines 27 and 32 of Algorithm \ref{alg:fl1dining:extractFDsw}).  Since $E|X$ is user-correct, there exists a latest $try_{s_0}$ event that occurs before the last $crit_{s_0}$ event.  By the code of Algorithm \ref{alg:fl1dining:extractFDsw}, immediately after $s_0$ enters a trying section, a ping message is sent to  the witness thread $w$ at node $q$.  By reliable message delivery, this ping message will arrive at $w$ and $w$ will immediately send back an ack message to $s_0$ (line 18 of Algorithm \ref{alg:fl1dining:extractFDsw}).  Again by reliable message delivery, $s_0$ will receive the ack message from $w$.  Let $t_0$ be the time when $s_0$ receives that ack message from $w$.   Then, from time $t_0$ and thereafter, variable $ack_0$ is forever $T$ since the only case that variable $ack_0$ can be set to $T$ is when $s_0$ receives an ack message and the only case that $ack_0$ can be reset to $F$ is when an $exit$ event occurs (lines 29 and 31 of Algorithm \ref{alg:fl1dining:extractFDsw}).
%Considering $s_1$, note that, by the previous paragraph, $s_1$ cannot enter a critical section infinitely often since Exclusion is violated.  Since $p$ is correct and $E|X$ is user-correct, $s_1$ must be in a certain section $sec_1$ forever.  Section $sec_1$ cannot be a critical section, as it violates Exclusion (since $s_0$ is in a critical section forever).  Section $sec_1$ cannot be in a exiting section, since Finite Exiting holds.  Section $sec_1$ cannot be in a remainder section since, by lines 23 and 24 of Algorithm \ref{alg:fl1dining:extractFDsw}, a $try$ event immediately follows a $rem$ event.  Thus, $sec_1$ must be a trying section.    
%By the code, when $s_1$ enters $sec_1$, it sends a ping message to $w$ and $w$ will send back an ack message (by reliable message delivery and line 18 of Algorithm \ref{alg:fl1dining:extractFDsw}).  Let $t_1$be the time when $s_1$ receives that ack message from $w$.  Then, from time $t_1$ and thereafter, variable $ack_1$ is forever $T$ since $ack_1$ can only be reset to $F$ when an $exit$ event occurs (lines 31 and 33 of Algorithm \ref{alg:fl1dining:extractFDsw}).  
%Hence, from time $\max(t_c, t_1, t_2)$, the precondition on line 30 of Algorithm \ref{alg:fl1dining:extractFDsw} for $s_0$ to exit a critical section (and enter an exiting section) is always $T$.  This contradicts the assumption that $s_0$ is in a critical section forever.
\end{proof}

Now, we show that for all nodes $p\in\Pi$ and $q\in N_p$, if $p$ and $q$ are both correct, then Finite Eating holds for $E|X^{I(p,q)}$.

\begin{lemma}
\label{lem:fl1dining:instanceFiniteEating}
Consider each pair of neighboring nodes $p\in\Pi$ and $q\in N_p$ where $p$ is correct.  Then, Finite Eating holds for $E|X^{I(p,q)}$. 
\end{lemma}
\begin{proof}
Consider witness thread $w$ at node $q$.  Directly from the code in Figure \ref{alg:fl1dining:extractFDsw1}, there exists an immediate occurrence of an $exit_w$ event after a $crit_w$ event.  
%Since dummy threads at $N_p \backslash \{q\}$ do not generate any $try$ events with respect to instance $I(p,q)$, if a $crit$ event ever occurs at the dummy thread, then it directly indicates that Well-formedness is violated.

Now, without loss of generality, consider hybrid thread $h_{0}$ at node $p$.  Note that as long as user-correctness (preserving Well-formedness) holds, a correct algorithm for solving $BW$-$\square SX$-$FL1$ cannot violate Exclusion or Finite Exiting.  Suppose, in contradiction, hybrid thread $h_0$ is in a critical section forever.  Then, there exists a last $crit_{h_0}$ event that occurs.  Let $E_1$ be the suffix of $E$ that begins with this event $crit_{h_0}$.  Then, in $E_1$, variable $critical_0$ of thread $h_0$ is always $T$ since the only case that variable $critical_0$ can be set to $T$ is when $h_0$ enters its critical section and the only case that $critical_0$ can be reset to $F$ is when $h_0$ enters an exiting section (lines 12 and 26 of Figure \ref{alg:fl1dining:extractFDsw2}).  Since $E|X^{I(p,q)}$ is user-correct by Lemma \ref{lem:fl1dining:instanceUserCorrect}, there exists a latest $try_{h_0}$ event that occurs before the event $crit_{h_0}$.  By the code of Figure \ref{alg:fl1dining:extractFDsw2}, immediately after $h_0$ enters a trying section, a ping message is sent to  the witness thread $w$.  By reliable message delivery, this ping message will arrive at $w$ and $w$ will immediately send back an ack message to $h_0$ (line 17 of Figure \ref{alg:fl1dining:extractFDsw1}).  Again by reliable message delivery, $h_0$ will receive the ack message from $w$.  Let $E_2$ be the suffix of $E$ that begins with the $recv$ event which corresponds to this ack message reception.   Then, in $E_2$, variable $ack_0$ is forever $T$ since the only case that variable $ack_0$ can be set to $T$ is when $h_0$ receives an ack message and the only case that $ack_0$ can be reset to $F$ is when $h_0$ enters an exiting section (lines 20 and 25 of Figure \ref{alg:fl1dining:extractFDsw2}).

%Now, consider subject thread $s_{i \in \{0,1\}}$ at node $p$.  Note that as long as user-correctness (preserving Well-formedness) holds, a correct algorithm for solving $BW$-$\square SX$-$FL1$ cannot violate Exclusion or Finite Exiting.  Without loss of generality, suppose, in contradiction, subject thread $s_0$ is in a critical section forever.  Then, there exists a last $crit_{s_0}$ event that occurs.  Let $t_c$ be the time when the last $crit_{s_0}$ event occurs.  Then, from time $t_c$ and thereafter, $critical_0$ is always $T$ since the only case that variable $critical_0$ can be set to $T$ is when a $crit$ event occurs and the only case that $critical_0$ can be reset to $F$ is when an $exit$ event occurs (lines 27 and 32 of Algorithm \ref{alg:fl1dining:extractFDsw}).  Since $E|X^{I(p,q)}$ is user-correct by Lemma \ref{lem:fl1dining:instanceUserCorrect}, there exists a latest $try_{s_0}$ event that occurs before the last $crit_{s_0}$ event.  By the code of Algorithm \ref{alg:fl1dining:extractFDsw}, immediately after $s_0$ enters a trying section, a ping message is sent to  the witness thread $w$ at node $q$.  By reliable message delivery, this ping message will arrive at $w$ and $w$ will immediately send back an ack message to $s_0$ (line 18 of Algorithm \ref{alg:fl1dining:extractFDsw}).  Again by reliable message delivery, $s_0$ will receive the ack message from $w$.  Let $t_0$ be the time when $s_0$ receives that ack message from $w$.   Then, from time $t_0$ and thereafter, variable $ack_0$ is forever $T$ since the only case that variable $ack_0$ can be set to $T$ is when $s_0$ receives an ack message and the only case that $ack_0$ can be reset to $F$ is when an $exit$ event occurs (lines 29 and 31 of Algorithm \ref{alg:fl1dining:extractFDsw}).

Considering hybrid thread $h_1$, note that, by the previous paragraph, $h_1$ cannot enter its critical section infinitely often because Exclusion will be violated (since $h_0$ is in its critical section forever).  
Since $p$ is correct and $E|X^{I(p,q)}$ is user-correct (by Lemma \ref{lem:fl1dining:instanceUserCorrect}), $h_1$ must be trapped in either a remainder, trying, critical, or exiting section forever.  Thread $h_1$ cannot be in its critical section forever, as it violates Exclusion (since $h_0$ is in a critical section forever).  Thread $h_1$ cannot be in its exiting section forever, since Finite Exiting holds.  Thread $h_1$ cannot be in its remainder section forever since, by lines 8--10 of Figure \ref{alg:fl1dining:extractFDsw2}, a $try_{h_1}$ event immediately follows a $rem_{h_1}$ event.  Thus, $h_1$ must be in its trying section forever.    
%Since $p$ is correct and $E|X^{I(p,q)}$ is user-correct (by Lemma \ref{lem:fl1dining:instanceUserCorrect}), $h_1$ must be in a certain section $sec \in \{try, crit, exit, rem\}$ forever.  Section $sec$ cannot be a critical section, as it violates Exclusion (since $h_0$ is in a critical section forever).  Section $sec$ cannot be in a exiting section, since Finite Exiting holds.  Section $sec$ cannot be in a remainder section since, by lines 25--27 of Algorithm \ref{alg:fl1dining:extractFDsw}, a $try$ event immediately follows a $rem$ event.  Thus, $sec$ must be a trying section.    

By the code, when the last $try_{h_1}$ event occurs at $h_1$, thread $h_1$ sends a ping message to $w$ and $w$ will send back an ack message $\langle ack\rangle$ (by reliable message delivery and line 17 of Figure \ref{alg:fl1dining:extractFDsw1}).  Let $E_3$ be the suffix of $E$ that begins with the $recv_{h_1}$ event that corresponds to the reception of $\langle ack\rangle$.  Then, in $E_3$, variable $ack_1$ is forever $T$ since $ack_1$ can only be reset to $F$ when an $exit_{h_1}$ event occurs (lines 25--27 of Figure \ref{alg:fl1dining:extractFDsw2}).  
%Let $E_4$ be a suffix of $E$ that is equal to a suffix among $E_1$, $E_2$, and $E_3$ that begins the latest in $E$.  
Hence, in $E_1 \cap E_2 \cap E_3$, the precondition on line 24 of Figure \ref{alg:fl1dining:extractFDsw2} for $h_0$ to exit a critical section (and enter an exiting section) is always $T$.  This contradicts the assumption that $h_0$ is in its critical section forever.

The proof for the subject threads is similar to the proof for hybrid threads. 
\end{proof}

The following lemma shows that if a correct node $p$ has faulty neighbor $q$, then from some time on, every occurrence of event $response_p(S)$ has $q\in S$.

\begin{lemma}
\label{lem:fl1dining:completeness}
%Consider each correct node $p\in\Pi$. If at least one neighbor of $p$ is faulty, then there exists a time $t$ such that for all times $t'\geq t$, every occurrence of event $response_p(b)$ has $b=T$.
Consider each correct node $p\in\Pi$. If neighbor $q$ of $p$ is faulty, then there exists a suffix of $E$ such that every occurrence of event $response_p(S)$ has $q\in S$.
\end{lemma}
\begin{proof}
%Note that for each correct node, there is a correct neighboring node by assumption.  Let $q\in \Pi$ be a correct neighboring node of $p$.  
By Lemma \ref{lem:fl1dining:instanceUserCorrect}, $E|X^{I(p,q)}$ is user-correct.  Thus, we may assume that $E|X^{I(p,q)}$ satisfies the $BW$-$\square SX$-$FL1$ specification for $G^{I(p,q)}$.% and we have the liveness properties.
Also, since Finite Eating holds for $E|X^{I(p,q)}$ by Lemma \ref{lem:fl1dining:instanceFiniteEating}, the $FL1$-progress property of the $BW$-$\square SX$-$FL1$ specification guarantees that, for all threads $\tau$ in $G^{I(p,q)}$ that are two hops away from a crashed thread in $G^{I(p,q)}$, if $\tau$ is in its trying section, then $\tau$ will eventually enter its critical section.

%We first show that $E|X^{I(p,q)}$ is user-correct.  
%The proof requirement is to show that for all threads $g$ that interact with instance $I(p,q)$, within $(E|X^{I(p,q)})|g$, (a) assuming that Well-formedness is not violated by an occurrence of either a $try$ event or an $exit$ event before a specific event $try_g$ occurs,  $try_g$ cannot immediately follow event $crit_g$ or $exit_g$ and event $exit_g$ cannot immediately follow event $rem_g$ or $try_g$.  

%Consider witness thread $w$ at node $q$.  Directly from the code in Algorithm \ref{alg:fl1dining:extractFDsw}, event $try_w$ (resp. $exit_w$) only occurs immediately after the occurrence of event $rem_w$ (resp. $crit_w$). 

%Now, consider subject thread $s_{i \in \{0,1\}}$ at node $p$.  Again, directly from the code, event $try_{s_i}$ only occurs immediately after the occurrence of event $rem_{s_i}$ which implies that event $try_{s_i}$ does not immediately occur after $crit_{s_i}$ or $exit_{s_i}$, and event $exit_{s_i}$ does not immediately occur after $rem_{s_i}$.  Suppose, in contradiction, that $exit_{s_i}$ occurs immediately after $try_{s_i}$.  For $exit_{s_i}$ to occur, $critical_i=T$ must hold which shows that there exists an occurrence of $crit_{s_i}$ before $exit_{s_i}$ happens.  Let $crit'_{s_i}$ be the latest $crit$ event that happened before the occurrence of $exit_{s_i}$.  Then, in between $crit'_{s_i}$ and $exit_{s_i}$ there must exist $try_{s_i}$ which immediately follows $rem_{s_i}$.  If a $rem$ event did not happen immediately after $crit'_{s_i}$, the only event that can occur immediately after $crit'_{s_i}$ is a $try$ event which contradicts the fact that $try$ events only occur immediately after a $rem$ event.

%Dummy threads at $N_p \backslash \{q\}$ do not generate any event with respect to instance $I(p,q)$.  Hence, we can conclude that $E|X^{I(p,q)}$ is user-correct and as a result we may assume that $E|X^{I(p,q)}$ solves the $BW$-$\square SX$-$FL1$ problem for $G^{I(p,q)}$.

For the proof, we only consider instance $I(p,q)$.  If $q$ is faulty, then there exists a suffix $E_1$ of $E$ such that each subject thread on $q$ stops sending ping messages to hybrid threads on $p$.  Consequently, there exists a suffix $E_2$ of $E$ such that each hybrid thread on $p$ stops receiving ping messages from subject threads on $q$.  Depending on the behavior of the hybrid threads, we divide into two cases.

--(\emph{Case} 1) At least one hybrid thread enters its critical section infinitely often:  Without loss of generality, let $h_0$ be the hybrid thread that enters it critical section infinitely often. Note that the only way to decrease the value of $counter_0$ at $h_0$ is by receiving a ping message from a subject thread which implies that, in $E_2$, $counter_0$ does not decrease. In $E_2$, whenever $crit_{h_0}$ occurs, $counter_0$ at $h_0$ is incremented by 1.  Thus, eventually, $counter_0$ will exceed $bound_0$ at $h_0$ since $counter_0$ never decreases in $E_2$.  

Let $E_3$ be a suffix of $E_2$ that begins with a $crit_{h_0}$ event where $counter_0$ exceeds $bound_0$ for the first time after the beginning of $E_2$.  Since variable $bound_0$ is set to the current value of $counter_0$ whenever $counter_0$ exceeds $bound_0$, variable $counter_0$ will exceed $bound_0$ whenever $crit_{h_0}$ occurs in $E_3$.  As a result, $H[p][q][0]$ will be set to $T$ whenever $crit_{h_0}$ happens in $E_3$.  Hence, in $E_3$, set $S$ of the decision thread $d$ on node $p$ will include $q$ permanently (line 6 of Figure \ref{alg:fl1dining:extractFDd}). Consequently, every occurrence of event $response_p(S)$ in $E_3$ will have $q\in S$.

--(\emph{Case} 2) Both hybrid threads of $I(p,q)$ starve: In this case, there exists a suffix $E_4$ of $E$ such that both hybrid threads $h_0$ and $h_1$ (1) remain in a certain non-critical section forever, and (2) do not send ping messages to the witness thread $w$. From $w$'s perspective, this means that there exists a suffix $E_5$ of $E$ such that it does not receive any ping messages from either $h_0$ or $h_1$.  As a result, $w$ does not reset $counter$ to $0$ in $E_5$ (line 16 of Figure \ref{alg:fl1dining:extractFDsw1}).  Note that the only way to decrease the value of $counter$ at $w$ is by receiving a ping message from a subject thread which implies that, in $E_5$, the value of $counter$ at $w$ does not decrease. 

Since $p$ is correct, by $FL1$-progress and Finite Exiting, and by the fact that event $try_w$ (resp. $exit_w$) occurs immediately after the occurrence of event $rem_w$ (resp. $crit_w$) (lines 6 and 14 of Figure \ref{alg:fl1dining:extractFDsw1}), event $crit_w$ occurs infinitely often at $w$.  In $E_5$, whenever $crit_w$ occurs, $counter$ at $w$ is incremented by 1.  Thus, eventually, $counter$ exceeds $bound$ since $counter$ never decreases in $E_5$.   The rest of the proof is similar to (Case 1) except that, in this case, $W[p][q]$ is set to $T$ from some time on.  
%Let $E_6$ be a suffix of $E_5$ that begins with a $crit_w$ event where $counter$ exceeds $bound$ for the first time after the beginning of $E_5$.  Since variable $bound$ is set to the current value of $counter$ whenever $counter$ exceeds $bound$, variable $counter$ will exceed $bound$ whenever $crit_w$ happens in $E_6$.  As a result, $W[p][q]$ will be set to $T$ whenever $crit_w$ happens in $E_5$.  Hence, in $E_6$, set $S$ of decision thread $d$ will include $q$ permanently (line 6 of Algorithm \ref{alg:fl1dining:extractFDd}). Consequently, every occurrence of event $response_p(S)$ in $E_6$ will have $q\in S$.
%By the $FL1$-starvation property and since Finite Eating holds, there exists a time $t_1$ such that for all times after $t_1$, both subject threads $s_0$ and $s_1$ (1) remain in a certain non-critical section forever, and (2) do not send ping messages to the witness thread $w$.  From $w$'s perspective, this means that there exists a time $t_2 \geq t_1$ such that it does not receive any ping messages from either $s_0$ ot $s_1$.  As a result, $w$ does not reset $counter$ to $0$ after time $t_2$ (line 17 of Algorithm \ref{alg:fl1dining:extractFDsw}).  Note that the only way to decrease the value of $counter$ at $w$ is by receiving a ping message from a subject thread which implies that for all times after $t_2$, the value of $counter$ at $w$ does not decrease. 
%Since $q$ is failure-insulated with respect to $I(p,q)$ ($p$ is the only neighbor of $q$ which is also correct), by the $FL1$-progress property and by the fact that event $try_w$ (resp. $exit_w$) occurs immediately after the occurrence of event $rem_w$ (resp. $crit_w$) (lines 6 and 15 of Algorithm \ref{alg:fl1dining:extractFDsw}), event $crit_w$ occurs infinitely often at $w$.  After time $t_2$, whenever $crit_w$ occurs, $counter$ at $w$ is incremented by 1.  Thus, eventually, $counter$ will exceed $bound$ since $counter$ never decreases after time $t_2$.  
%Let time $t_3$ be the first time after time $t_2$ that $counter$ exceeds $bound$.  Since, whenever $counter$ exceeds $bound$, variable $bound$ is set to the current value of $counter$, $counter$ will exceed $bound$ whenever $crit_w$ happens at all times after $t_3$.  As a result, a $skeptic(val)$ message with $val=T$ will be sent to the decision thread at node $p$ whenever $crit_w$ happens at all times after $t_3$.  Due to FIFO message delivery, eventually and permanently, the decision thread $d$ at node $p$ only receives $skeptic(val)$ messages with $val=T$ from witness thread $w$.  Hence, eventually and permanently, variable $b$ of decision thread $d$ will be $b=T$ (line 6 of Algorithm \ref{alg:fl1dining:extractFDd}).  Consequently, eventually and permanently, every occurrence of event $response_p(b)$ will have $b=T$ which proves the lemma. 
\end{proof}

The Completeness property directly follows from Lemma \ref{lem:fl1dining:completeness}.

\begin{lemma}
\label{lem:fl1dining:completeness2}
$E|D$ satisfies \emph{Completeness}.
\end{lemma}
%\begin{proof}
%The proof directly follows from Lemma \ref{lem:fl1dining:completeness}.
%\end{proof}

\subsubsection{Accuracy}

As in \cite{SPS07}, we define what is called a \emph{renewal interval}.   For all nodes $p\in\Pi$ and $q\in N_p$, let $W_n^{I(p,q)}$ be the $n$-th occurrence of a $ping$ message reception at witness thread $w^{I(p,q)}$.  Then, for $n \geq 1$, we denote $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$ as an execution segment of $E$ that begins with $W^{I(p,q)}_n$ and ends with $W^{I(p,q)}_{n+1}$ and we call this the $n$-th renewal interval of $w^{I(p,q)}$ in $E$ for instance $I(p,q)$.  

For a particular thread $\tau$ of instance $I(p,q)$, we call an execution segment $E_{\tau}$ of $E$ a \emph{trying-critical} section of $\tau$ if
\begin{itemize}
\item $E_{\tau}$ begins with a $try_{\tau}$ event,
\item $E_{\tau}$ ends with an $exit_{\tau}$ event,
\item exactly one $crit_{\tau}$ occurs in $E_{\tau}$, and
\item no event in $X^{I(p,q)}$ of $\tau$, except the above three events, occurs in $E_{\tau}$.
\end{itemize}

%that begins with $x$ entering its trying section followed by $x$ leaving its critical section as a \emph{trying-critical} section.  

Next we show that each renewal interval of a witness thread $w^{I(p,q)}$ is encompassed by a trying-critical section of a subject thread $h_{i\in\{0,1\}}^{I(p,q)}$ if nodes $p$ and $q$ are both correct and if $p$ has no faulty neighbors.  The proof of Lemma \ref{lem:fl1dining:renewalInterval} is similar to the proof of Lemma 1 in \cite{SPS07}.

\begin{lemma}
\label{lem:fl1dining:renewalInterval}
Consider each pair of correct neighboring nodes $p\in\Pi$ and $q\in N_p$. Then, for all $n\geq1$, (1) every renewal interval $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$ is encompassed by a trying-critical section of a hybrid thread $h_{i\in\{0,1\}}^{I(p,q)}$ which does not send the ping message that enables the occurrence of $W^{I(p,q)}_{n+1}$, and (2) for each renewal interval $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$, both hybrid threads $h_0^{I(p,q)}$ and $h_1^{I(p,q)}$ are in a trying-critical section when $W^{I(p,q)}_{n+1}$ occurs.  
%Consider each pair of correct neighboring nodes $p\in\Pi$ and $q\in N_p$ where $p$ has no faulty neighbors. Then, for all $n\geq1$, (1) every renewal interval $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$ is encompassed by a trying-critical section of a subject thread $s_{i\in\{0,1\}}^{I(p,q)}$ which does not send the ping message that enables the occurrence of $W^{I(p,q)}_{n+1}$, and (2) for each renewal interval $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$, both subject threads $s_0^{I(p,q)}$ and $s_1^{I(p,q)}$ are in a trying-critical section at time $t_{n+1}$.   
\end{lemma}
\begin{proof}
By Lemma \ref{lem:fl1dining:instanceUserCorrect}, $E|X^{I(p,q)}$ is user-correct.  Hence, we may assume that $E|X^{I(p,q)}$ satisfies the $BW$-$\square SX$-$FL1$ specification for $G^{I(p,q)}$.  %Now, let $t_n$ be the time when $W^{I(p,q)}_n$ occurs.   
Also, since Finite Eating holds for $E|X^{I(p,q)}$ by Lemma \ref{lem:fl1dining:instanceFiniteEating}, the $FL1$-progress property of the $BW$-$\square SX$-$FL1$ specification guarantees that, for all threads $\tau$ in $G^{I(p,q)}$ that are two hops away from a crashed thread in $G^{I(p,q)}$, if $\tau$ is in its trying section, then $\tau$ will eventually enter its critical section.
We prove by induction on $n$.

--({\bf Base case}; $n=1$) Without loss of generality, let $h_0$ be the hybrid thread that sent the ping message which enabled the occurrence of $W^{I(p,q)}_1$; note that a ping message is sent  immediately after entering a trying section.  Afterwards, $h_0$ does not leave its critical section until $h_0$ receives an ack message from $w$.  By the Well-formedness property, this implies that  $h_0$ is in a trying-critical section when $W^{I(p,q)}_1$ occurs .

For $h_0$ to leave the trying-critical section, $h_1$ must receive an ack message from $w$ and set $ack_1$ to $T$.  For $h_1$ to receive an ack message from $w$, $h_1$ must send a ping message to $w$ since $w$ sends an ack message only when it receives a ping message (lines 15--17 of Figure \ref{alg:fl1dining:extractFDsw1}).  This implies that the occurrence of $W^{I(p,q)}_{2}$ is a result of $w$ receiving a ping message from $h_1$.  Hence, $E[W^{I(p,q)}_1,W^{I(p,q)}_{2}]$ is encompassed by the trying-critical section of $h_0$ and $h_0$ did not send the ping message that enabled the occurrence of $W^{I(p,q)}_{2}$.  Also, since $h_1$ did not receive an ack message when $W^{I(p,q)}_{2}$ occurred, $h_1$ is also in a trying-critical section when $W^{I(p,q)}_{2}$ occurred. 

--({\bf Inductive case}) Suppose the lemma holds for the $n$-th renewal interval where $n\geq 1$.  We prove for the $n+1$-th renewal interval.  

Without loss of generality, let $h_0$ be the subject thread that sent the ping message which enabled the occurrence of $W^{I(p,q)}_n$.  Note that, by the inductive hypothesis, both $h_0$ and $h_1$ are in a trying-critical section when $W^{I(p,q)}_n$ occurred.  We first show that the occurrence of $W^{I(p,q)}_{n+1}$ exists.  Suppose, in contradiction, that the occurrence of $W^{I(p,q)}_{n+1}$ does not exist. Then, since the Well-formedness property of $E|X^{I(p,q)}$ holds, $h_{i\in\{0,1\}}$ must be trapped in either a remainder, trying, critical, or exiting section forever.  Thread $h_i$ cannot be in its remainder section forever because line 9 of Figure \ref{alg:fl1dining:extractFDsw2} directly shows that a $try_{h_i}$ event immediately follows a $rem_{h_i}$ event.  Thread $h_i$ cannot be in its critical, trying, or exiting section forever since Finite Eating, $FL1$-progress, and Finite Exiting holds.  Hence, we have a contradiction.

% This implies that the trying-critical sections of both $s_0$ and $s_1$ never ends.  By the $FL1$-progress property, it is guaranteed that if both $s_0$ and $s_1$ were in a trying section, then exactly one subject thread advances to a critical section (note that both subject threads cannot advance to a critical section since it will violate the Exclusion property).  This shows that exactly one subject thread is in a critical section forever and without loss of generality, let $s_0$ be the one.
% The condition of which $s_0$ generates an $exit_{s_0}$ event is $critical_0=T$, $ack_0=T$, and $ack_1=T$.  So, at least one of $critical_0$, $ack_0$, and $ack_1$ must be $F$.  When $s_0$ enters a critical section $critical_0$ is set to $T$ and the only case that $critical_0$ can be reset to $F$ is when the condition explained above holds.  Since $s_0$ (resp. $s_1$) has entered a trying section, it must have sent a ping message to $w$, and due to reliable message delivery, $w$ must receive that ping message from $s_0$ (resp. $s_1$) and $s_0$ (resp. $s_1$) must receive the corresponding ack message from $w$ and set $ack_0$ (resp. $ack_1$) to $T$).  The only case that $ack_0$ (resp. $ack_1$) can be reset to $F$ is also when the condition explained above holds.  Hence, we have a contradiction.

Since we know that the occurrence of $W^{I(p,q)}_{n+1}$ exists, there exists a hybrid thread that enters an exiting section during $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$.  Without loss of generality, during $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$, suppose $h_0$ enters an exiting section earlier than $h_1$ does.  Also, let $e'$ indicate the earliest $exit_{h_0}$ event during $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$.  Note that when $e'$ occurs, variable $ack_0$ is set to $F$ which prevents $h_1$ from entering an exiting section if it were in a critical section.  Also, note that after $ack_0$ is set to $F$, it cannot be reset to $T$ unless $h_0$ sends a ping message to $w$ and receives the corresponding ack message from $w$.  As a result, $h_0$ must have sent the ping message which enabled the occurrence of $W^{I(p,q)}_{n+1}$ and, in between the occurrences of $e'$ and $W^{I(p,q)}_{n+1}$, hybrid thread $h_1$ cannot enter an exiting section.  In addition, since $e'$ is the first $exit$ event in $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$, $h_1$ does not enter an exiting section in between the occurrence of $W^{I(p,q)}_n$ and the occurrence of $e'$.  Hence, $h_1$ remains in a trying-critical section during $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$ and it does not send the ping message that enables the occurrence of $W^{I(p,q)}_{n+1}$.  Also, since a ping message is sent when $h_0$ enters a trying section and since $h_0$ did not receive an ack message when $W^{I(p,q)}_{n+1}$ occurs, hybrid thread $h_0$ is also in a trying-critical section when $W^{I(p,q)}_{n+1}$ occurs.  Lemma \ref{lem:fl1dining:renewalInterval} holds. 
\end{proof}

Now, for all nodes $p\in\Pi$ and $q\in N_p$, let $H_{i,n}^{I(p,q)}$ be the $n$-th occurrence of a $ping$ message reception at hybrid thread $h^{I(p,q)}_{i}$ where $i\in\{0,1\}$.  For $n \geq 1$, we denote $E[H^{I(p,q)}_{i,n},H^{I(p,q)}_{i,n+1}]$ as an execution segment of $E$ that begins with $H^{I(p,q)}_{i,n}$ and ends with $H^{I(p,q)}_{i,n+1}$ and we call this the $n$-th renewal interval of $h^{I(p,q)}_{i}$ in $E$ for instance $I(p,q)$.  

Using similar arguments as in the proof of Lemma \ref{lem:fl1dining:renewalInterval}, we can show that the following lemma holds:

\begin{lemma}
\label{lem:fl1dining:renewalInterval2}
Consider each pair of correct neighboring nodes $p\in\Pi$ and $q\in N_p$. Then, for all $n\geq1$, (1) every renewal interval $E[H^{I(p,q)}_{i,n},H^{I(p,q)}_{i,n+1}]$ is encompassed by a trying-critical section of a subject thread $s_{i,j}^{I(p,q)}$ where $j\in\{0,1\}$ which does not send the ping message that enables the occurrence of $H^{I(p,q)}_{i,n+1}$, and (2) for each renewal interval $E[H^{I(p,q)}_{i,n},W^{I(p,q)}_{i,n+1}]$, both subject threads $h_{i,0}^{I(p,q)}$ and $h_{i,1}^{I(p,q)}$ are in a trying-critical section when $H^{I(p,q)}_{i,n+1}$ occurs.  
%Consider each pair of correct neighboring nodes $p\in\Pi$ and $q\in N_p$ where $p$ has no faulty neighbors. Then, for all $n\geq1$, (1) every renewal interval $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$ is encompassed by a trying-critical section of a subject thread $s_{i\in\{0,1\}}^{I(p,q)}$ which does not send the ping message that enables the occurrence of $W^{I(p,q)}_{n+1}$, and (2) for each renewal interval $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$, both subject threads $s_0^{I(p,q)}$ and $s_1^{I(p,q)}$ are in a trying-critical section at time $t_{n+1}$.   
\end{lemma}


Now, we prove that if neighboring nodes $p$ and $q$ are both correct, then from some time on, every occurrence of event $response_p(S)$ satisfies $q\not\in S$.  The proof of Lemma \ref{lem:fl1dining:accuracy} is similar to the proof of Theorem 2 in \cite{SPS07}.

\begin{lemma}
\label{lem:fl1dining:accuracy}
Consider each pair of correct neighboring nodes $p\in\Pi$ and $q\in N_p$. Then, there exists a suffix of $E$ in which every occurrence of event $response_p(S)$ satisfies $q\not\in S$.
\end{lemma}
\begin{proof}
By Lemma \ref{lem:fl1dining:instanceUserCorrect}, $E|X^{I(p,q)}$ is user-correct.  Hence, we may assume that $E|X^{I(p,q)}$ satisfies the $BW$-$\square SX$-$FL1$ specification for $G^{I(p,q)}$.  
Also, since Finite Eating holds for $E|X^{I(p,q)}$ by Lemma \ref{lem:fl1dining:instanceFiniteEating}, the $FL1$-progress property of the $BW$-$\square SX$-$FL1$ specification guarantees that, for all threads $\tau$ in $G^{I(p,q)}$ that are two hops away from a crashed thread in $G^{I(p,q)}$, if $\tau$ is in its trying section, then $\tau$ will eventually enter its critical section.
%By Lemmas \ref{lem:fl1dining:instanceUserCorrect} and \ref{lem:fl1dining:instanceFiniteEating} shows that $E|X^{I(p,q)}$ is user-correct and Finite Eating holds for $E|X^{I(p,q)}$.  Hence, we may assume that $E|X^{I(p,q)}$ satisfies the $BW$-$\square SX$-$FL1$ specification for $G^{I(p,q)}$.

By the $FL1$-$BW$ property, there exists an integer $k>0$ and there exists a suffix $E_1$ of $E$ such that every infix $\sigma_1$ of $E_1$ that (1) starts with $try_{h_{i\in\{0,1\}}}^{I(p,q)}$ and ends with $crit_{h_{i\in\{0,1\}}}^{I(p,q)}$ and (2) contains exactly one occurrence of $crit_{h_{i\in\{0,1\}}}^{I(p,q)}$, contains at most $k$ occurrences of $crit_w^{I(p,q)}$.  

Let $e_1$ and $e_2$ be the event that initiates the first renewal interval of $w^{I(p,q)}$ in $E_1$ and the first $try$ event of $s_{i\in\{0,1\}}^{I(p,q)}$ in $E_1$, respectively (since $FL1$-progress, Finite Eating, and Finite Exiting hold, events $e_1$ and $e_2$ exist).  Then, by Lemma \ref{lem:fl1dining:renewalInterval}, each renewal interval $RI$ of $w^{I(p,q)}$ that begins after the occurrence of both $e_1$ and $e_2$ is encompassed by a trying-critical section of $s_{i\in\{0,1\}}^{I(p,q)}$ and, within $RI$, $w^{I(p,q)}$ can enter a critical section at most $k$ times.  This implies that, within $RI$, $w^{I(p,q)}$ may enter an exiting section at most $k+1$ times which in turn implies that the value of $counter$ at $w^{I(p,q)}$ after the occurrence of both $e_1$ and $e_2$  is bounded by $k+1$.

%Let $\sigma^E=E|X^{I(p,q)}$ and denote $\sigma^E_t$ as the suffix of $\sigma^E$ that begins at time $t$.   By the $FL1$-$BW$ property, there exists an integer $k>0$ and there exists a time $t_m$ such that every infix $\sigma'$ of $\sigma^E_{t_m}$ that (1) starts with $try_{s_{i\in\{0,1\}}}^{I(p,q)}$ and ends with $crit_{s_{i\in\{0,1\}}}^{I(p,q)}$ and (2) contains exactly one occurrence of $crit_{s_{i\in\{0,1\}}}^{I(p,q)}$, contains at most $k$ occurrences of $crit_w^{I(p,q)}$.  Let $t_1$ and $t_2$ be the starting times of the first renewal interval of $w^{I(p,q)}$ after time $t_m$ and the first trying section of $s_{i\in\{0,1\}}^{I(p,q)}$ after time $t_m$, respectively (since $FL1$-progress, Finite Eating, and Finite Exiting hold, times $t_1$ and $t_2$ exist).  Then, by Lemma \ref{lem:fl1dining:renewalInterval}, each renewal interval $RI$ of $w^{I(p,q)}$ that started after time $\max(t_1,t_2)$ is encompassed by a trying-critical section of $s_{i\in\{0,1\}}^{I(p,q)}$ and within $RI$, $w^{I(p,q)}$ can enter a critical section at most $k$ times.  This implies that within $RI$, $w^{I(p,q)}$ may enter an exiting section at most $k+1$ times which in turn implies that the value of $counter$ at $w^{I(p,q)}$ after time $\max(t_1,t_2)$ is bounded by $k+1$.

Without loss of generality, suppose $e_2$ occurs after $e_1$.   Then, before the occurrence of $e_2$, there exists a maximum value $c_{m}$ of variable $counter$ at $w^{I(p,q)}$.  Thus, variable $counter$ at $w^{I(p,q)}$ is bounded by $\max(c_m,k+1)$ in $E$ and, due to lines 9 and 10 of Figure \ref{alg:fl1dining:extractFDsw1}, variable $bound$ at $w^{I(p,q)}$ is also bounded by $\max(c_m,k+1)$ in $E$.  Since variable $bound$ at $w^{I(p,q)}$ is bounded and never decreases and since we already know, from the proof of Lemma \ref{lem:fl1dining:completeness}, that $crit_w^{I(p,q)}$ occurs infinitely often, there exists a suffix $E_2$ of $E$ in which variable $W[p][q]$ on node $p$ is set to $F$ permanently.  

Using similar arguments as above along with Lemma \ref{lem:fl1dining:renewalInterval2}, we can show that there exists a suffix of $E$ in which, for all $i\in\{0,1\}$, variable $W[p][q][i]$ on node $p$ is set to $F$ permanently (in this case, a hybrid thread $h_i$ corresponds to the above witness thread and two subject threads $s_{i,0}$ and $s_{i,1}$ correspond to the above two hybrid threads).   

Hence, we can conclude that there exists a suffix $E'$ of $E$ such that set $S$ of the decision thread $d$ on node $p$ will \emph{not} include $q$ permanently (line 6 of Figure \ref{alg:fl1dining:extractFDd}). Consequently, every occurrence of event $response_p(S)$ in $E'$ satisfies $q\not\in S$ which proves the lemma.
%Again, since $crit_w^{I(p,q)}$ occurs infinitely often, there exist a time $t_4$ such that for all times after $t_4$, $skeptic(val)$ messages with $val=F$ are sent to the decision thread at node $p$ in FIFO order.  Since the channel is reliable, evenually and permanently, $suspect[q]$ at the decision thread on node $p$ is set to $F$.  By the fact that all neighbors of $p$ are correct, there exists a time $t_5$ such that for all times after $t_5$ and for all $r \in N_p$, $suspect[r]=F$ at the decision thread on node $p$.  Hence, variable $b$ is set to $F$ at all times after time $t_5$.  Lemma \ref{lem:fl1dining:accuracy} holds.
\end{proof}

%\begin{lemma}
%\label{lem:fl1dining:validity}
%$E|D$ satisfies \emph{Validity}.
%\end{lemma}
%\begin{proof}
%The proof is immediate from Lemmas \ref{lem:fl1dining:completeness} and \ref{lem:fl1dining:accuracy}.
%\end{proof}

The Accuracy property directly follows from Lemma \ref{lem:fl1dining:accuracy}.

\begin{lemma}
\label{lem:fl1dining:accuracy2}
$E|D$ satisfies \emph{Accuracy}.
\end{lemma}

Finally, we state the main theorem of this section.

\begin{theorem}
\label{thm:fl1dining:algorithm23}
The algorithm in Figures \ref{alg:fl1dining:extractFDsw1}, \ref{alg:fl1dining:extractFDsw2}, \ref{alg:fl1dining:extractFDsw3}, and \ref{alg:fl1dining:extractFDd} is an algorithm for the $\Diamond P^1$ problem.
\end{theorem}
\begin{proof}
Let $E$ be any execution of the algorithm in Figures \ref{alg:fl1dining:extractFDsw1}, \ref{alg:fl1dining:extractFDsw2}, \ref{alg:fl1dining:extractFDsw3}, and \ref{alg:fl1dining:extractFDd} such that 
\begin{compactitem}
\item $E|N$ satisfies the message-passing specification,
\item for each $h$, $1\leq h \leq H$, either $E|X^h$ is not user-correct for $X^h$ or $E|X^h$ satisfies the $BW$-$\square SX$-$FL1$ specification, and
\item $E|D$ is user-correct for $D$.
\end{compactitem}
Then, $E|D$ satisfies the $\Diamond P^1$ specification by Lemmas \ref{lem:fl1dining:wellformednessD}, \ref{lem:fl1dining:liveness}, \ref{lem:fl1dining:completeness2}, and \ref{lem:fl1dining:accuracy2}.
\end{proof}


\section{Discussion}
\label{sec:fl1dining:discuss}

\subsection{Failure Locality and Exclusion Guarantees}
As already mentioned, $\Diamond P^1$ is known to be a weakest failure detector for wait-free \emph{eventual} weak exclusion \cite{PSS08,SSW09}. The work in \cite{SSW09} discusses wait-free \emph{perpetual} weak exclusion and shows that the trusting failure detector $\mathcal{T}$ (refer to \cite{DFGK05,SSW09} for the specification) is necessary but not sufficient to solve wait-free perpetual weak exclusion.  It is known that $\Diamond P$ is strictly weaker than $\mathcal{T}$ \cite{DFGK05}.  From these two results, we can notice that it is more expensive to achieve wait-free perpetual weak exclusion than wait-free eventual weak exclusion since the former requires a more powerful failure detector.

Our result shows that $\Diamond P^1$ is sufficient to solve failure-locality-1 perpetual strong exclusion. Since perpetual strong exclusion implies perpetual weak exclusion, $\Diamond P^1$ is sufficient to solve \emph{failure-locality-1} perpetual weak exclusion.  If we compare this to the result for \emph{wait-free} perpetual weak exclusion, we can observe that  wait-freedom (i.e. failure-locality-0) is more expensive to achieve than failure-locality-1 when perpetual weak exclusion is considered.
%We can also notice a trade-off between failure locality and the exclusion guarantees by observing that $\Diamond P^1$ is a weakest failure detector for both failure-locality-1 perpetual strong exclusion and wait-free eventual weak exclusion.  

%From these three results, we can observe a trade-off between failure locality and a weakest failure detector for solving DP problems; wait-freedom is more expensive to achieve than failure-locality-1 since it requires a more powerful failure detector.

\subsection{Bounded Waiting}
The algorithm in Figures \ref{alg:fl1dining:solveproblem1}, \ref{alg:fl1dining:solveproblem2}, and \ref{alg:fl1dining:solveproblem3} actually satisfies a property stronger than $FL1$-$BW$ which we call $FL1$-$\Diamond k$-$BW$: there exists an integer $k>0$ that holds for \emph{all} executions such that  if process $p$ only has correct neighbors, then eventually, for any interval in which $p$ is trying to enter its critical section, no neighbor of $p$ enters its critical section more than $k$ times.  The algorithm satisfies $FL1$-$\Diamond k$-$BW$ with $k=2$.  Note that $FL1$-$\Diamond k$-$BW$ implies $FL1$-$BW$.  Since $\Diamond P^1$ can be extracted from multiple instances of any solution to our dining problem that satisfies $FL1$-$BW$ and since our dining algorithm uses $\Diamond P^1$ to solve $FL1$-$\Diamond k$-$BW$, $FL1$-$BW$ and $FL1$-$\Diamond k$-$BW$ are mutually reducible (without preserving the underlying topology) in our setting.

\subsection{Mapping from an Instance to Participating Processes}  
Consider process $p$ on $G$ and consider instance $I(p,q)$ and the conflict graph $G^{I(p,q)}$ for any $q\in N_p$.  Note that the algorithm in Figures \ref{alg:fl1dining:extractFDsw1}, \ref{alg:fl1dining:extractFDsw2}, \ref{alg:fl1dining:extractFDsw3} and \ref{alg:fl1dining:extractFDd} assume that all threads of $I(p,q)$ know which processes are participating in $I(p,q)$.  What if the threads of $I(p,q)$ do not know  which processes are participating in $I(p,q)$?  In other words, what if the witness thread and hybrid threads of $I(p,q)$ on process $p$ do not know that the subject threads of $I(p,q)$ are located at process $q$ and vice versa?
%Now, suppose the threads of instance $I(p,q)$ do not know which processes are participating in $I(p,q)$; the witness thread and hybrid threads of $I(p,q)$ on process $p$ do not know that the subject threads of $I(p,q)$ are located at process $q$ and vice versa.  
In this case, it might not be possible for the witness and hybrid threads to identify that $q$ has crashed.  However, it is still possible for the threads of $I(p,q)$ on process $p$ to identify that \emph{some} neighbor of $p$ has crashed.  This observation implies that the construction in Section \ref{sec:fl1dining:ExtractB} can be used to extract the following failure detector, named as the ``local anonymous eventually perfect failure detector'' and denoted as $?\Diamond P^1$, even when the threads of a certain instance do not know the participating processes of that instance:
\begin{compactitem}
\item From some time on, $?\Diamond P^1$ outputs \emph{true} if there exists a crashed neighboring process.
\item From some time on, $?\Diamond P^1$ outputs \emph{false} if all neighboring processes are correct.
\end{compactitem}
Note that $?\Diamond P^1$ is weaker than $\Diamond P^1$ ($?\Diamond P^1$ can be implemented with the use of $\Diamond P^1$) since it simply outputs a boolean (instead of process ids) regarding the existence of at least one crashed process within the neighborhood.  $?\Diamond P^1$, which is a variant of the anonymous perfect failure detector introduced in \cite{guer:02:nacadswfd}, falls into the category of identity-free failure detectors \cite{Bonnet13}.  The boolean-valued failure detectors in \cite{Bonnet13,BRS09,DFGT08} and \cite{guer:02:nacadswfd} provide system-wide information (e.g. am I the leader? \cite{Bonnet13}, am I the only correct process? \cite{BRS09,DFGT08}, is there a crashed process? \cite{guer:02:nacadswfd}) whereas $?\Diamond P^1$ provides \emph{local} information regarding the existence of a crashed neighbor.      

Now the question is ``can we use $?\Diamond P^1$ to solve $BW$-$\square SX$-$FL1$?''.  It is easy to verify that the answer is \emph{yes}: the concept of skepticism directly tells us that the required information from the failure detector is whether there exists a failure, not who failed.  Thus, we can conclude that $?\Diamond P^1$ and $BW$-$\square SX$-$FL1$ are mutually reducible (without preserving the underlying topology) when the mapping from an instance to the processes that participate in that instance is not given.

In Section \ref{chap:dp-stable}, we use the $?\Diamond P^1$ failure detector to design a failure-locality-1 dining algorithm that tolerates unexpected corruptions to the system states.
 
%there exists a \emph{fixed} integer $k > 0$
%and a suffix $\sigma'$ of $\sigma$ such that for any two failure-insulated processes $p$ and $q$ that are neighbors, if Finite Eating holds for $\sigma$, then in every infix $\sigma''$ of $\sigma'$ %that starts with $try_p$ and contains exactly $k$ occurrences of $crit_q$ must contain at least one occurrence of $crit_p$.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%\appendix

\begin{comment}
\section{Formal System Model and Problem Specification}
\label{appendix:sysmodel}

Given a set $\Pi$ of processes with unique ids and an undirected graph $G$ with vertex set
$\Pi$, we now define the $BW$-$\square SX$-$FL1$ problem for $G$.
%
The set of events $X$ is defined to be
\begin{center}
$X \triangleq \{${\it try}$_p$, {\it crit}$_p$, {\it exit}$_p$, {\it rem}$_p$,
{\it crash}$_p$ : $p \in \Pi \}$.
\end{center}
%
Given a sequence $\sigma$ over $X$, for any $p \in \Pi$,
define $p$ to be {\em faulty} in $\sigma$ if {\it crash}$_p$ appears
in $\sigma$ and {\em correct} otherwise.
For a finite sequence $\sigma$ over $X$ and any $p \in \Pi$, define
{\it last}$(\sigma,p)$ to be the latest event in $\sigma$
from $\{${\it try}$_p$, {\it crit}$_p$, {\it exit}$_p$, {\it rem}$_p\}$.
%
If {\it last}$(\sigma,p)$ is {\it rem}$_p$ (resp. {\it try}$_p$, {\it crit}$_p$, {\it exit}$_p$), then we say that $p$ is in its \emph{remainder} (resp. \emph{trying}, \emph{critical}, \emph{exiting}) section.
%
We say that \emph{Finite Eating holds} for a sequence $\sigma$ over $X$ if, for each correct $p\in \Pi$, $\sigma|p$ does not end with $crit_p$.  Also, for a sequence $\sigma$ over $X$, if $p\in\Pi$ is correct and all of $p$'s neighbors in $G$ are correct, then we say that $p$ is \emph{failure-insulated}. 
%
A sequence $\sigma$ over $X$ {\em satisfies the $BW$-$\square SX$-$FL1$ specification for $G$}
if it satisfies the following conditions:
\begin{compactitem}
\item {\em Well-formedness:} For each $p \in \Pi$, 
      if $\sigma|p$\footnote{$\sigma|p$ indicates the sequence of events in $\sigma$ that occurred at $p$.} is infinite, then it is the infinite repetition
      of {\it try}$_p$, {\it crit}$_p$, {\it exit}$_p$, {\it rem}$_p$;
      if $\sigma|p$ is finite, then it is either a prefix of this infinite
      repetition or it consists of a prefix of this infinite repetition
      followed by {\it crash}$_p$.
%\item {\em Finite Eating:}  For each correct $p \in \Pi$, $\sigma|p$ does not
%     end with {\it crit}$_p$.
\item {\em Exclusion:}  For each prefix $\sigma'$ of $\sigma$ and
     each edge $\{p,q\}$ in $G$, if {\it last}$(\sigma',p) =$ {\it crit}$_p$,
     then {\it last}$(\sigma',q) \neq$ {\it crit}$_q$.
%     and {\it last}$(\sigma',q) =$ {\it crit}$_q$, then $\sigma'$
%     includes either {\it crash}$_p$ or {\it crash}$_q$ (or both).
\item {\em Finite Exiting:} For each correct $p \in \Pi$, $\sigma|p$ does not end with $exit_p$.
\item {\em FL1-progress:} For each failure-insulated $p\in\Pi$, if Finite Eating holds for $\sigma$, then $\sigma|p$ does not end with $try_p$. 
%     For each correct $p \in \Pi$, if all of $p$'s
%     neighbors in $G$ are correct, then $\sigma|p$ does not end with
%     {\it try}$_p$ or {\it exit}$_p$.
%and if $\sigma|q$ does not end with $crit_q$ for all neighbors $q$ of $p$,     
%\item {\em FL1-starvation:}  For each correct $p \in \Pi$, if $p$ has a faulty 
%     neighbor in $G$, then $\sigma|p$ is finite.
\item {\em FL1-$BW$:} There exists an integer $k > 0$
and a suffix $\sigma'$ of $\sigma$ such that for any two neighbors $p\in\Pi$ and $q\in\Pi$ where $p$ is failure-insulated, every infix of $\sigma'$ that starts with $try_p$ and ends with the next occurrence of $crit_p$ contains at most $k$ occurrences of $crit_q$.     
%     Denote $\sigma_t$ as the suffix of $\sigma$ that begins at time $t$.  Then, there exists an integer $k>0$ and there exists a time $t$ such that for each correct
%     $p \in \Pi$, if all $p$'s neighbors in $G$ are correct, then
%    for every neighbor $q\in \Pi$ of $p$, every infix $\sigma'$ of $\sigma_t$ 
%     that starts with {\it try}$_p$ and contains exactly $k$ occurrences
%     of {\it crit}$_q$ must contain at least one occurrence of {\it crit}$_p$.
%     (*Since k is not fixed to be the same for every execution, I think we don't need the eventual*)
\end{compactitem}

%For any sequence $\sigma$ over $X$, we assume that for all correct $p\in\Pi$, $sigma|p$ does not end with {\it crit}$_p$ and we call this the \emph{Finite Eating} assumption.
For any sequence $\sigma$ over $X$, we say $\sigma$ is {\em user-correct
for} $X$ if the shortest prefix of $\sigma$ to violate Well-formedness
(if any) ends in either $rem_p$ or $crit_p$ for some $p \in \Pi$.
(The intuition is that the user of the $BW$-$\square SX$-$FL1$ module is not the first to violate Well-formedness; the user preserves Well-formedness)  
%Note that even if Finite Eating is not guaranteed, as long as user-correctness (preserving Well-formedness) holds, a correct algorithm cannot violate Exclusion or Finite Exiting. 

Given a set $\Pi$ of processes and an undirected graph $G$ with vertex
set $\Pi$, we now define the $\Diamond P^1$ failure detector problem for $G$.  
For each process $p\in\Pi$ on $G$, let $N_p$ be the set of neighboring processes of $p$.
The set of events $D$ is defined to be
\begin{center}
$D \triangleq \{${\it query}$_p$, 
{\it response}$(S)_p$, {\it crash}$_p :$\\$p \in \Pi, S \subseteq N_p\}$.
\end{center}
We use the same definitions of faulty and correct as above.

A sequence $\sigma$ over $D$ {\em satisfies the $\Diamond P^1$ specification}
if it satisfies the following conditions:
\begin{compactitem}
\item {\em Well-formedness:} For each $p \in \Pi$, if $\sigma|p$ is infinite,
   it consists of alternating {\it query}$_p$ and {\it response}$_p(.)$ 
   events, starting with {\it query}$_p$;
   if $\sigma|p$ is finite, then it is either a prefix of such an 
   infinite sequence or it consists of a prefix of such an infinite
   sequence followed by {\it crash}$_p$.
\item {\em Liveness:} For each correct $p \in \Pi$, $\sigma|p$
   does not end with {\it query}$_p$.
\item \emph{Completeness:} For each correct $p \in \Pi$, there is a suffix of $\sigma$ in which the parameter $S$ of each occurrence of {\it response}$(S)_p$ contains every faulty neighbor of $p$ in $G$.  
\item \emph{Accuracy:} For each correct $p \in \Pi$, there is a suffix of $\sigma$ in which the parameter $S$ of each occurrence of {\it response}$(S)_p$ does not contain any correct neighbor of $p$ in $G$.
%\item{\em Validity:} For each correct $p \in \Pi$, there is a suffix
%   of $\sigma$ in which every {\it response}$_p$ has the same parameter,
%   and this parameter is $T$ if and only if at least one of $p$'s neighbors 
%   in $G$ is faulty.
\end{compactitem}
For any sequence $\sigma$ over $D$, we say $\sigma$ is {\em user-correct
for} $D$ if the shortest prefix of $\sigma$ to violate Well-formedness
(if any) ends in {\it response}$_p(.)$ for some $p \in \Pi$.
(The intuition is that the user of the failure detector module is not the first to violate Well-formedness; the user preserves Well-formedness)

We model distributed algorithms as collections of state machines.
Let $\Pi$ be the set of nodes on which a distributed
algorithm is running, with one state machine (process) per node.
Each step of a process is triggered by an event and causes the
process to change its local state.
Events are partitioned into input and output events.
An {\em input} event can occur at any time (i.e., it is always enabled),
whereas an {\em output} event can only happen (be enabled) if certain 
preconditions are true in the state of the process.

We model a snapshot of the entire algorithm as a vector of states,
one per process, which is called a {\em configuration.}
In an {\em initial} configuration, each process is in an initial
state.
An {\em execution} of the algorithm is a sequence 
$C_0, e_1, C_1, e_2, C_2, \ldots$ of alternating
configurations and events, beginning with an initial configuration,
and if finite, ending with a configuration,
that satisfies the following properties for each $i \ge 1$.
Suppose event $e_i$ occurs at process $p$.
\begin{compactitem}
\item Event $e_i$ is enabled in the state of $p$ in the preceding
      configuration $C_{i-1}$.
\item The only difference between $C_{i-1}$ and $C_i$ is that the
     state of $p$ changes according to $p$'s transition function
     (local algorithm).
\end{compactitem}

Our algorithms execute in a system
in which the processes communicate through an asynchronous message passing
network, where the set of communication channels is described by an
undirected graph $G$.
If edge $\{p,q\}$ is in $G$, then there is a channel from $p$ to $q$
and a channel from $q$ to $p$.
The set of events for interacting with the message system is defined to be
\begin{center}
$N \triangleq \{${\it send}$_p(m,q)$, {\it recv}$_p(m,q)$, {\it crash}$_p :$\\ 
$\{p,q\} \in G$ and $m \in M\}$,
\end{center}
where $M$ is the set of messages.
A sequence over $N$ is said to {\em satisfy the message-passing specification}
if it captures the properties that 
each channel is reliable (does not duplicate,
alter, or inject messages, and does not lose messages sent to correct
processes), asynchronous (unbounded delays), and
FIFO (messages in each channel are delivered in the order in which they are 
sent).
In addition, no {\it recv}$_p$, {\it send}$_p$, or {\it crash}$_p$ event 
occurs in the sequence after a {\it crash}$_p$ event occurs.

We next define what it means to be an {\em algorithm for the $BW$-$\square SX$-$FL1$ 
problem for $G$} in a message-passing system augmented with a $\Diamond P^1$ failure detector.
The set of input events is
\begin{center}
$\{${\it try}$_p$,
{\it exit}$_p$,
{\it crash}$_p$,
{\it response}$_p(S)$,
{\it recv}$_p(m,q) :$\\
$\{p,q\} \in G, S \subseteq N_p, m \in M\}$.
\end{center}
The set of output events is
\begin{center}
$\{${\it crit}$_p$,
{\it rem}$_p$,
{\it query}$_p$,
{\it send}$_p(m,q) :$\\
$\{p,q\} \in G, m \in M\}$.
\end{center}
Every execution $E$ of the algorithm must satisfy the following property:
If $E$ satisfies the following three conditions:
\begin{compactenum}
\item $E|N$\footnote{$E|N$ indicates the sequence of events in $E$ with respect to set $N$.} satisfies the message-passing specification,
\item either $E|D$ is not user-correct for $D$ or $E|D$ satisfies the $\Diamond P^1$
      specification,
\item $E|X$ is user-correct for $X$,
\end{compactenum}
then $E|X$ satisfies the $BW$-$\square SX$-$FL1$ specification.

%For all executions $E$ of any algorithm for the $BW$-$\square SX$-$FL1$  problem for $G$, we assume that for all correct $p\in\Pi$, $(E|X)|p$ does not end with {\it crit}$_p$; we name this assumption as the \emph{Finite Eating} assumption.

%(*Here is why I modified the second condition.  In the previous version
%I sent you, the second condition just required that $E|D$ solves
%the $\Diamond$B problem.  But in this case, a lazy algorithm designer
%could simply have the algorithm interact incorrectly with the failure
%detector, for instance, by sending two queries in a row, and then, since
%$E|D$ would not solve the $\Diamond$B problem, the algorithm is under no
%obligation to solve the Exclusion problem.*)
% previous condition:
%\begin{itemize}
%\item If $E|N$ solves the message-passing problem,
%      $E|D$ solves the $\Diamond$B problem, and
%      $E|X$ is user-correct for $X$,
%      then $E|X$ solves the Exclusion problem.
%\end{itemize}

Now we define what it means to be an {\em algorithm for the $\Diamond P^1$ 
problem for $G$} in a message-passing system augmented with $BW$-$\square SX$-$FL1$ subroutines.
The algorithm uses some number, say $H$, of instances of a solution to the 
$BW$-$\square SX$-$FL1$ problem.
The $h$-th instance is for some undirected graph $G^h$ with vertex set $\Theta^h$ where there exists a function $f$ that maps $\Theta^h$ to $\Pi$; $\exists f:\Theta^h \rightarrow \Pi$. 
For the $h$-th instance, we denote the set of events
by
$X^h=\{${\it try}$_s$,
{\it crit}$_s$,
{\it exit}$_s$,
{\it rem}$_s$,
{\it crash}$_p :
s \in \Theta^h, p=f(s)\}$.
We note that for each $s \in \Theta^h$ where $f(s)=p$, $crash_{p}$ is a ``synonym'' for $crash_s$ with respect to the formal definition of the $BW$-$\square SX$-$FL1$ problem.

%The $h$-th instance is for some undirected graph $G_I^h$ where 
%\begin{itemize}
%\item vertex set $\Gamma^h$ consists of some number of \emph{threads}\footnote{A process may execute multiple threads.} being executed on some subgraph $G^h$ of $G$, and   
%\item edge set is $\{\{r, s\} : r \in \Gamma^h, s \in \Gamma^h, r \mbox{ is a thread on process } p, s \mbox{ is a thread on process } q, \{p,q\} \in G^h\}$.
%\end{itemize}
%For the $h$-th instance, we denote the 
%set of processes in $G^h$ by $\Pi^h$ and the set of events of this instance
%by $X^h = 
%\{${\it try}$_s^h$,
%{\it crit}$_s^h$,
%{\it exit}$_s^h$,
%{\it rem}$_s^h$,
%{\it crash}$_p :
%s \in \Gamma^h,
%p \in \Pi^h\}$.
%Note that the {\it crash} events are shared by all the instances.


The set of input events for the $\Diamond P^1$ algorithm is
\begin{center}
$\bigcup_{h=1}^H \{${\it crit}$_s$, {\it rem}$_s : s \in \Theta^h \}
\cup \{${\it crash}$_p$,
{\it query}$_p$,
{\it recv}$_p(m,q) :
\{p,q\} \in G, m \in M\}$.
\end{center}

The set of output events is
\begin{center}
$\bigcup_{h = 1}^H \{${\it try}$_s$, {\it exit}$_s : s \in \Theta^h\}
\cup \{${\it response}$_p(S)$,
{\it send}$_p(m,q) :
S \subseteq N_p, \{p,q\} \in G, m \in M\}$.
\end{center}

Every execution $E$ of the algorithm must satisfy the following property:
If $E$ satisfies the following three conditions:
\begin{compactenum}
\item $E|N$ satisfies the message-passing specification,
\item for each $h$, $1 \le h \le H$, either $E|X^h$ is not user-correct
      for $X^h$ or $E|X^h$ satisfies the $BW$-$\square SX$-$FL1$ specification for $G^h$,
\item $E|D$ is user-correct for $D$,
\end{compactenum}
then $E|D$ satisfies the $\Diamond P^1$ specification.

%(*Similarly to comment above, I changed one of the conditions to rule
%out the possibility of the algorithm deliberately interacting improperly
%with one of the Exclusion subroutines and thus being off the hook for
%solving the failure detector problem.*)
%For each node $p\in\Pi$, we denote $N_p$ as the set of neighboring nodes of $p$ in $G$.  For each node $p \in \Pi$, we call each time duration $[t,t')$ a \emph{remainder} (resp. \emph{trying}, \emph{critical}, \emph{exiting}) \emph{section} of node $p$ if $t$ is the time when event $rem_p$ (resp. $try_p$, $crit_p$, $exit_p$) occurs and $t'$ is the first time after $t$ when an event $e\in X$ occurs.   If time duration $[t,t')$ is a trying section and $[t',t'')$ is a critical section, then we call $[t,t'')$ a \emph{trying-critical} section.  We say that a node $p$ is in the remainder (resp. trying, critical, exiting) section at time $t$ if the latest event with respect to set $X$ that occurred at node $p$ before or at time $t$ is $rem_p$ (resp. $try_p$, $crit_p$, $exit_p$).   For node $p$, if no event in $X$ ever occurred before or at time $t$, then we also say that $p$ is in a remainder section at time $t$.

%We assume that each process $p \in \Pi$ is assigned a unique id.  Throughout this paper, we use the term ``process'' and ``node'' interchangeably.
\end{comment}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{comment}
\section{Proof of Correctness}

\subsection{Proof of Section \ref{sec:fl1dining:solveproblem}}
\label{appendix:proofsolveproblem}

Let $E$ be any execution of Algorithm \ref{alg:fl1dining:solveproblem} such that
$E|N$ satisfies the message-passing specification,
either $E|D$ is not user-correct for $D$ or $E|D$ satisfies the 
$\Diamond P^1$ specification, and
$E|X$ is user-correct for $X$.

%For all nodes $p\in \Pi$ and for all executions $E$ of Algorithm \ref{alg:fl1dining:solveproblem},
 After the initial generation of output event $query_p$ (Line \ref{line:fl1dining:initQueryEvent}), subsequent $query_p$ events are generated only after event $response_p(b)$ is enabled (Line \ref{line:fl1dining:queryEvent}).  Hence, $E|D$ is user-correct and we may assume that $E|D$ satisfies the $\Diamond P^1$ specification.

\subsubsection{Finite Exiting, Well-formedness, and Exclusion}

\begin{lemma}
\label{lem:fl1dining:finite-exit}
$E|X$ satisfies Finite Exiting.
\end{lemma}

\begin{proof}
This follows from the code (lines 38-41).
\end{proof}

\begin{lemma}
\label{lem:fl1dining:dining-var}
For every $p \in \Pi$ and every prefix $E'$ of $E$, 
if $dining_p = try$, then $last(E'|X,p) = try_p$, and
if $dining_p = crit$, then $last(E'|X,p) = crit_p$.
\end{lemma}

\begin{proof}
Initially $dining_p = rem$, so the lemma is vacuously true.
When $try_p$ occurs, $dining_p$ is set to $try$.
When $crit_p$ occurs, $dining_p$ is set to $crit$.
The only other time when $dining_p$ changes is when $exit_p$ occurs,
in which case $dining_p$ is set to $exit$.
\end{proof}

\begin{lemma}
\label{lem:fl1dining:excl-wf}
$E|X$ satisfies Well-formedness.
\end{lemma}

\begin{proof}
Suppose in contradiction $E|X$ does not satisfy Well-formedness.
By the assumption that $E|X$ is user-correct for $X$, the first error
is because the algorithm outputs $crit_p$ or $rem_p$ at a wrong time.
However, $rem_p$ is only generated immediately after $exit_p$ occurs (cf.\
Lines 38--41), which is correct.

But $p$ only generates $crit_p$ in AllForks, which is called in two
places, Line 37 and Line 64.  Line 64 is part of EnterDoorway, which
is called in two places, Line 25 and Line 50.  In all cases, we see
from the code that $dining_p = try$ (Lines 36, 24, 49) when $crit_p$ is
generated.  By Lemma~\ref{lem:fl1dining:dining-var}, the most recent preceding event 
in $X$ is $try_p$, which is correct, a contradiction.  

Thus $E|X$ satisfies Well-formedness.
\end{proof}
\vspace{3 mm}
\noindent
{\bf Definition:}
If $fork_p[q] = T$, then we say {\em $p$ has a $\{p,q\}$-fork};
if $fork_q[p] = T$, then we say {\em $q$ has a $\{p,q\}$-fork}; 
if a $fork$ message is in transit from $p$ to $q$, then we say {\em the 
channel from $p$ to $q$ has a $\{p,q\}$-fork}; and
if a $fork$ message is in transit from $q$ to $p$, then we say {\em the
channel from $q$ to $p$ has a $\{p,q\}$-fork}.

\vspace{3 mm}
\noindent
{\bf Definition:}
If $reqToken_p[q] = T$, then we say {\em $p$ has a $\{p,q\}$-request};
if $reqToken_q[p] = T$, then we say {\em $q$ has a $\{p,q\}$-request};
if a $request$ message is in transit from $p$ to $q$, then we say {\em the 
channel from $p$ to $q$ has a $\{p,q\}$-request}; and
if a $request$ message is in transit from $q$ to $p$, then we say {\em the 
channel from $q$ to $p$ has a $\{p,q\}$-request}.

\begin{lemma}
\label{lem:fl1dining:excl-invars}
The following are invariants (true in every configuration of $E$) 
for all neighbors $p$ and $q$.
\begin{itemize}
\item[(A)] There is exactly one $\{p,q\}$-fork.

\item[(B)] If $dining_p = crit$, then $fork_p[q] = T$ and $inside_p = T$.

\item[(C)] If a $request$ message is in transit from $p$ to $q$, then 
either a $fork$ message precedes the $request$ message in the channel or 
$q$ has the $\{p,q\}$-fork.

\item[(D)] If $reqToken_p[q] = T$, then a $fork$ message is not in transit 
from $q$ to $p$.

\item[(E)] There is exactly one $\{p,q\}$-request.
\end{itemize}
\end{lemma}

(Note:  (B) can be proved independently, as can (E).  (A), (C) and (D) need
to be proved all together, and they rely on (E).)

\begin{proof}
By induction on the configurations in $E$, which we denote $C_0, C_1, \ldots$.

--({\bf Base case})  By the initialization, (A) through (E) are true in $C_0$.

--({\bf Inductive case})  Suppose (A)-(E) are true in configuration $C_{t-1}$ and show
they are true in configuration $C_t$.  We consider every possibility for the
event taking the system from $C_{t-1}$ to $C_t$.  
When $try_p$ and $recv_p(ping,q)$ occur, no changes are made that affect
the truth of any of the predicates.  

{\em Case 1:}  The event is $recv_p(ack,q)$.

\begin{itemize}
\item[(A)] No changes affect $fork$ variables or $fork$ messages.  
By the inductive hypothesis, (A) is true in $C_{t-1}$ and thus it remains 
true in $C_t$.   

\item[(B)] The only change that can affect (B) is if $dining_p$ is set to
$crit$ in Line 54 of AllForks, which is called from EnterDoorway.
The check in Line 53 of AllForks ensures that $fork_p[q]$ is true,
and the assignment in Line 56 of enterDoorway sets $inside_p$ to true.

\item[(C)] The only change that can affect (C) is if $p$ sends a $request$
message to $q$ in Line 62 of EnterDoorway.  We must show that either
a $fork$ message precedes the $request$ message in the channel from $p$ to
$q$ or $q$ has the $\{p,q\}$-fork.  
Since $reqToken_p[q] = T$ in $C_{t-1}$, the inductive hypothesis (D) 
implies that a
$fork$ message is not in transit from $q$ to $p$.  Since $fork_p[q] = F$ 
in $C_{t-1}$, the inductive hypothesis (A) implies that either a $fork$ 
message is in transit from $p$ to $q$ or $q$ has the fork in $C_{t-1}$.  
Thus (C) is true in $C_t$.

\item[(D)] The only change relevant to (D) is if $reqToken_p[q]$ is set
to false in Line 63 of EnterDoorway.  However, in this case (D) is
vacuously true in $C_t$.

\item[(E)] The only change relevant to (E) is if Lines 61--63 are executed
in EnterDoorway and $p$ sends a request message to $q$.  In this case, 
the $\{p,q\}$-request moves from being (uniquely) at $p$ to being (uniquely)
in transit from $p$ to $q$.  Uniqueness follows from the inductive 
hypothesis (E).
\end{itemize}

{\em Case 2:} The event is $recv_p(request,q)$.

\begin{itemize}
\item[(A)] In $C_{t-1}$, a $request$ message is at the head of the channel 
from $q$ to $p$ (since channels are FIFO).  
By the inductive hypothesis (C), $fork_p[q] = T$ in $C_{t-1}$.
By the inductive hypothesis (A), in $C_{t-1}$, no $fork$ message is in 
transit from $p$ to $q$ or from $q$ to $p$, and $fork_q[p] = F$.
By the code, in $C_t$, either a $fork$ message is in transit from $p$ to $q$
and $fork_p[q] = F$, or no $fork$ message is in transit from $p$ to $q$
and $fork_p[q] = T$.  Thus (A) still holds.

\item[(B)] The only change that could affect (B) is setting $fork_p[q]$ 
to false in Line 30.  But this only happens if $inside_p$ is false 
(cf.\ Line 28).
By the inductive hypothesis (B), $dining_p \ne crit$ in $C_{t-1}$.  
Thus $dining_p$ is still not equal to $crit$ in $C_t$ and the change to 
$fork_p[q]$ does not invalidate (B) in $C_t$.

\item[(C)] If $p$ sends a $request$ message to $q$ in Line 32, it previously 
sends a $fork$ message to $q$ in Line 29.

\item[(D)] In $C_{t-1}$, a $request$ message is at the head of the channel 
from $q$ to $p$.
Thus by the inductive hypothesis (C), $p$ has the $\{p,q\}$-fork and no 
$fork$ message is in transit between $p$ and $q$ in either direction in 
$C_{t-1}$.
If $reqToken_p[q] =T$ in $C_t$ (i.e., Line 33 is not executed), then 
there is still no $fork$ message in transit from $q$ to $p$.

Suppose $p$ sends the fork to $q$.  Then we must show that $reqToken_q[p] = F$.
This follows from the inductive hypothesis (E): since the $request$ message 
is in transit from $q$ to $p$ in $C_{t-1}$, it must be that $reqToken_q[p]
= F$.

\item[(E)] If Lines 32--33 are not executed, then the $\{p,q\}$-request 
goes from being (uniquely) in transit from $q$ to $p$ to being (uniquely) at 
$p$.
If Lines 32--33 are executed, then the $\{p,q\}$-request goes from being
(uniquely) in transit from $q$ to $p$ to being (uniquely) in transit
from $p$ to $q$ (The uniqueness follows from the inductive hypothesis (E)).
\end{itemize}

{\em Case 3:}  The event is $recv_p(fork,q)$.

\begin{itemize}
\item[(A)] In $C_{t-1}$, a $fork$ message is at the head of the channel 
from $q$ to $p$.
By the inductive hypothesis (A), in $C_{t-1}$, no $fork$ message is in 
transit from $p$ to $q$, and $fork_p[q]$ and $fork_q[p]$ are both false.
By the code, in $C_t$, no $fork$ message is in transit from $q$ to $p$ 
(since it is removed from the channel in order to be received) and 
$fork_p[q] = T$.

\item[(B)] The only change that can affect (B) is if $dining_p$ is set to
$crit$ in Line 54 of AllForks, which is called from Line 37.
The check in Line 53 of AllForks ensures that $fork_p[q]$ is true,
and the check in Line 36 ensures that $inside_p$ is true.

\item[(C)] No change affects the validity of (C) in $C_t$.

\item[(D)] No change affects the validity of (D) in $C_t$.

\item[(E)] No change affects the validity of (E) in $C_t$.
\end{itemize}

{\em Case 4:}  The event is $exit_p$.

\begin{itemize}
\item[(A)] The only changes that possibly affect (A) occur if Lines 67--69 in
SatisfyRequests are executed.  In this case, the fork changes from
being (uniquely) at $p$ to being (uniquely) in transit from $p$ to $q$.
(The uniqueness is due to the inductive hypothesis (A).)

\item[(B)] Since $dining_p$ is set to a value other than $crit$, 
(B) is vacuously true in $C_t$.

\item[(C)] The only change that possibly affects (C) occurs if $p$ sends a 
$fork$ message to $q$ in Line 68 of SatisfyRequests.  We must show that no 
$request$ message is in transit from $q$ to $p$.  
By the code, $reqToken_p[q] = T$ in $C_{t-1}$
(cf.\ Line 67).  By the inductive hypothesis (E), there is no 
$request$ message in transit.

\item[(D)] The only change that possibly affects (D) occurs if $p$ sends a 
$fork$ message to $q$.  We must show that $reqToken_q[p] = F$.  
In $C_{t-1}$, if $p$ sends a $fork$ message to $q$, it must be that 
$reqToken_p[q] = T$.  So by the inductive hypothesis (E),
$reqToken_q[p] = F$.

\item[(E)] No change affects the validity of (E) in $C_t$.
\end{itemize}

{\em Case 5:}  The event is $response_p(S)$.

\begin{itemize}
\item[(A)] The only changes that possibly affect (A) are if Lines 67--69 in
SatisfyRequests are executed.  The same argument as for $exit_p$ holds.

\item[(B)] Suppose $S \neq \emptyset$.  Then changes relevant to (B) are only  made
if $dining_p$ is not $crit$ (cf.\ Line 45), and so (B) is vacuously true in 
$C_t$.

Suppose $S = \emptyset$.  The only change that can affect (B) is if $dining_p$ is 
set to $crit$ in Line 54 of AllForks, which is called from EnterDoorway.
The check in Line 53 of AllForks ensures that $fork_p[q]$ is true,
and the assignment in Line 57 of EnterDoorway sets $inside_p$ to true.

\item[(C)] Suppose $S \neq \emptyset$.  The only change relevant to (C) is if $p$ sends a
$fork$ message to $q$ in Line 68 of SatisfyRequests.  We must show that no
$request$ message is in transit from $q$ to $p$.  By the code, 
$reqToken_p[q]= T$ in $C_{t-1}$ (cf.\ Line 67).  By the inductive hypothesis
(E), there is no $request$ message in transit.

Suppose $S = \emptyset$.  The only change relevant to (C) is if $p$ sends a
$request$ message to $q$ in Line 62 of EnterDoorway.  We must show that
either a $fork$ message precedes the $request$ message in the channel from
$p$ to $q$, or $q$ has the $\{p,q\}$-fork.  Since $reqToken_p[q] = T$ in
$C_{t-1}$, the inductive hypothesis (D) implies that a $fork$ message is 
not in transit from $q$ to $p$.  Since $fork_p[q] = F$ in $C_{t-1}$, the
inductive hypothesis (A) implies that either a $fork$ message is in transit 
from $p$ to $q$, or $q$ has the $\{p,q\}$-fork in $C_{t-1}$.  
Thus (C) is true in $C_t$.

\item[(D)] Suppose $S \neq \emptyset$.  The only change relevant to (D) is if $p$
sends a $fork$ message to $q$ in Line 68 of SatisfyRequests.  We must
show that $reqToken_q[p] = F$.  In $C_{t-1}$, if $p$ sends
a $fork$ message to $q$, it must be that $reqToken_p[q] = T$.  So by 
the inductive hypothesis (E), $reqToken_q[p] = F$.

Suppose $S = \emptyset$.  The only change relevant to (D) is if
$reqToken_p[q]$ is set to false in Line 63 of EnterDoorway.  However, in
this case (D) is vacuously true in $C_t$.

\item[(E)] Suppose $S \neq \emptyset$.  Then no change relevant to (E) is made in $C_t$.

Suppose $S = \emptyset$.  The only change relevant to (E) occurs if Lines
62--63 are executed in EnterDoorway and $p$ sends a $request$ message to $q$.
In this case, the $\{p,q\}$-request moves from being (uniquely) at $p$ to
being (uniquely) in transit from $p$ to $q$ (The uniqueness follows
from the inductive hypothesis (E)).
\end{itemize}
\end{proof}

\begin{lemma}
\label{lem:fl1dining:excl}
$E|X$ satisfies Exclusion.
\end{lemma}

\begin{proof}
Suppose $p$ and $q$ are two processes that are neighbors in
the conflict graph and $E'$ is a prefix of $E$ such that
$last((E'|X),p)$ is $crit_p$.
Consider the configuration at the end of $E'$.
By Lemma~\ref{lem:fl1dining:dining-var}, $dining_p = crit$.
By Lemma~\ref{lem:fl1dining:excl-invars}(B), $fork_p[q] = T$.
By Lemma~\ref{lem:fl1dining:excl-invars}(A), $fork_q[p] = F$.
By Lemma~\ref{lem:fl1dining:excl-invars}(B), $dining_q \ne crit$.
Thus, by Lemma~\ref{lem:fl1dining:dining-var}, Lemma \ref{lem:fl1dining:excl-wf}, and the fact that $dining_p=exit$ when $exit_p$ occurs, $last(E'|X,q)$ is not $crit_q$.
\end{proof}
\end{comment}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{comment}  
\subsubsection{Well-formedness}

\begin{lemma}
\label{lem:fl1dining:wellformednessX}
For all executions $E$ of Algorithm \ref{alg:fl1dining:solveproblem}, $E|X$ satisfies \emph{Well-formedness}.
\end{lemma}
\begin{proof}
Since user-correctness is assumed for $E|X$, it is sufficient to show that, for all nodes $p\in \Pi$, within $(E|X)|p$, (1) event $rem_p$ (if any) is the only event that immediately follows event $exit_p$, and (2) event $crit_p$ (if any) is the only event that immediately follows event $try_p$.  For part (1), Line \ref{line:fl1dining:remEvent} ensures an immediate occurrence of $rem_p$ only after the occurrence of $exit_p$.  For part (2), since the only remaining output event that can be generated after the occurrence of $try_p$ is $crit_p$ (Line \ref{line:fl1dining:critEvent}), it holds that if $try_p$ ever occurs, then the successive event $e \in X$ is $crit_p$.  It is left to show that if $try_p$ never occurred, then $crit_p$ does not occur.

Suppose, in contradiction, that $crit_p$ occurs even if $try_p$ never occurred.   For $crit_p$ to be generated, procedure AllForks() must have been called by either (a) calling procedure EnterDoorway() (Line \ref{line:fl1dining:checkCSbyEnterDoorway}), or (b) by satisfying $inside=T$ (Line \ref{line:fl1dining:checkCSbyRecvFork}).  For part (a) to happen, $ack[q]=T$ must hold for all $q \in N_p$.  In order for node $p$ to satisfy $ack[q]=T$, it is required for $p$ to receive an ack message from $q \in N_p$ (Line \ref{line:fl1dining:setAcktoT}) since initially $ack[q]=F$.  For node $q$ to send an ack message to $p$, $q$ must have first received a ping message from $p$ since an ack is sent immediately after the reception of a ping (Line \ref{line:fl1dining:sendAckbyRecvPing}) or it is sent when $deferred[p]=T$ ($deferred[p]$ is initially $F$ and the only case to set $defered[p]$ to $T$ is by receiving a ping message; Lines \ref{line:fl1dining:deferAck}, \ref{line:fl1dining:satisfyAckRequest}, and \ref{line:fl1dining:sendAckbyDeferred}).  However, the only case when a ping message is sent is when event $try_p$ is enabled (Line \ref{line:fl1dining:sendPing}), a contradiction.

For part (b), note that variable $inside$ is initially $F$ and it is set to $T$ only by calling EnterDoorway().  This leads to the same situation as in part (a) which provides the necessary contradiction.
\end{proof} 

\subsubsection{Finite Exiting}

\begin{lemma}
\label{lem:fl1dining:finite-exit}
For all executions $E$ of Algorithm \ref{alg:fl1dining:solveproblem}, $E|X$ satisfies \emph{Finite Exiting}.
\end{lemma}
\begin{proof}
By the code, for each correct node $p\in\Pi$, whenever an $exit_p$ event occurs there is an immediate occurrence of a $rem_p$ event (Lines 38 and 41).  Hence, the lemma holds.
\end{proof}

%For all executions $E$ of Algorithm \ref{alg:fl1dining:solveproblem}, the Finite Eating property is simply implied by the assumption that $E|X$ is user-correct for $X$.

\subsubsection{Exclusion}

We first prove that, for all nodes $p \in \Pi$, if $dining$ variable is set to $try$ (resp. $crit$), then $p$ must be in a trying (resp. critical) section.

\begin{lemma}
\label{lem:fl1dining:dining-var}
For all nodes $p \in \Pi$, for all executions $E$ of Algorithm \ref{alg:fl1dining:solveproblem}, and for all times $t$, if $dining=try$ (resp. $dining=crit$) at node $p$ at time $t$, then $p$ is in a trying (resp. critical) section at time $t$.
\end{lemma}  
\begin{proof}
We only show that if $dining=try$ at node $p$ at time $t$, then $p$ is in a trying section; the case of $dining=crit$ only if $p$ is in a critical section will be analogous.  Note that initially $dining=rem$.  The only case that variable $dining$ can be set to $try$ is when $p$ enters a trying section. The only other cases that the $dining$ variable is modified is when (1) $p$ enters a critical section (Lines \ref{line:fl1dining:setDiningToCrit} and \ref{line:fl1dining:critEvent}), and (2) $p$ enters a exiting section (Lines \ref{line:fl1dining:exitEvent} and \ref{line:fl1dining:setDiningToExit}).  Thus, the value of $dining$ remains as $try$ during a trying section.  By the Well-formedness property (Lemma \ref{lem:fl1dining:excl-wf}), if an event $e \in X$ occurs after a $try_p$ event, it must be $crit_p$.  When $crit_p$ occurs, the $dining$ variable is guaranteed to be set to $crit$ (Lines \ref{line:fl1dining:setDiningToCrit} and \ref{line:fl1dining:critEvent}).  Hence, $dining=try$ at $p$ only if $p$ is in a trying section.  
%
%We now show that if $dining=crit$ at node $p$ at time $t$, then $p$ must be in a critical section.  The only case that variable $dining$ can be set to $crit$ is when $p$ enters a critical section; note that the assignment of $crit$ to $dining$ and the generation of event $crit_p$ occurs in the same action block.  The only other cases that the $dining$ variable is modified is when (1) $p$ enters a trying section (Lines \ref{} and \ref{}), and (2) $p$ enters a exiting section (Lines \ref{} and \ref{}).  So. $dining=crit$ during acritical section.  If any event $e \in X$ occurs after $crit_p$, then it must be $exit_p$ due to the Well-formedness property.  When $exit_p$ occurs, $exit$ is assigned $dining$ guaranteeing that $dinning \neq crit$.  Hence, $dining=crit$ at $p$ only if $p$ is in a critical section.   
\end{proof}

We next prove that, for all times during a critical section, $inside=T$ holds.

\begin{lemma}
\label{lem:fl1dining:critImpliesInside}
For all nodes $p \in \Pi$, for all executions $E$ of Algorithm \ref{alg:fl1dining:solveproblem}, and for all times $t$, if node $p$ is in a critical section at time $t$, then $inside=T$ at $p$ at time $t$. 
\end{lemma}
\begin{proof}
Note that, by the code, node $p$ sets $inside$ to $T$ only by calling procedure EnterDoorway() (Line \ref{line:fl1dining:setInsideToTEnterDoorway}) and sets $inside$ to $F$ by calling procedure SatisfyRequests() (Line \ref{line:fl1dining:exitDoorway}).  Also, note that initially $inside=F$ and $p$ is in a remainder section.  A condition to call EnterDoorway() is $dining=try$ which, by Lemma \ref{lem:fl1dining:dining-var}, means that $T$ is assigned to $inside$ only when $p$ is in a trying section.  Variable $inside$ will stay $T$ until SatisfyRequests() is called.  Procedure SatisfyRequests() can only be called when $p$ enters an exiting section (Line \ref{line:fl1dining:callSatisfyRequestsExitEvent}) or by executing Line \ref{line:fl1dining:callSatisfyRequestsFD}.  

After calling EnterDoorway(), if SatisfyRequests() is called by entering an exiting section, then there must exist a critical section in between the call to EnterDoorway() and the call to SatisfyRequests() by the Well-formdness property (Lemma \ref{lem:fl1dining:excl-wf}).  Thus, all times during this critical section, $inside=T$ holds.

After calling EnterDoorway() and before entering an exiting section, if SatisfyRequests() is called executing by Line \ref{line:fl1dining:callSatisfyRequestsFD}, then this call to SatisfyRequests() must have been done during the same trying section in which EnterDoorway() was called.  This is because a critical section can only come in between a trying section and an exiting section (by Well-formedness) and the condition $dining\neq crit$ (Line \ref{line:fl1dining:diningNeqCrit}) prevents SatisfyRequests() to be called during a critical section (by Lemma \ref{lem:fl1dining:dining-var}).  For node $p$ to enter the critical section, procedure AllForks() must be called (Line \ref{line:fl1dining:critEvent}) and for AllForks() to be called $inside=T$ must hold which requires EnterDoorway() to be called again.  Since node $p$ enters a critical section when $inside=T$ and since $p$ cannot call SatisfyRequests() while it is in a critical section, $inside=T$ holds all times during a critical section.
\end{proof}

The following lemma shows that the fork shared between any two neighboring nodes is never lost.

\begin{lemma}
\label{lem:fl1dining:forkNeverLost}
For all nodes $p \in \Pi$ and $q\in N_p$, and for all executions of Algorithm \ref{alg:fl1dining:solveproblem}, at all times the algorithm satisfies $fork[p]=T$ at $q$, $fork[q]=T$ at $p$, a fork message is in transit from $p$ to $q$, or a fork message is in transit from $q$ to $p$.
\end{lemma}
\begin{proof}
Initially, $fork[p]=T$ at $q$ or $fork[q]=T$ at $p$ by assumption.  Whenever node $p$ (resp. $q$) sets $fork[q]$ (resp. $fork[p]$) to $F$ there is a preceding transmission of a fork message (Lines \ref{line:fl1dining:sendForkByRequest} and \ref{line:fl1dining:sendForkByDeferred}) within the same action block.  Also, whenever node $p$ (resp. $q$) receives a fork message from $q$ (resp. $p$), it sets $fork[q]$ (resp. $fork[p]$) to $T$ (Line \ref{line:fl1dining:setForkToT}).  Hence, the lemma is proven.  
\end{proof}

Next we show that the request token shared between any two neighbors is unique and never lost.

\begin{lemma}
\label{lem:fl1dining:uniqueReqToken}
For all nodes $p \in \Pi$ and $q \in N_p$, and for all executions of Algorithm \ref{alg:fl1dining:solveproblem}, at all times exactly one of the following holds: (1) $reqToken[p] = T$ at $q$, (2) $reqToken[q] = T$ at $p$, (3) a request message is in transit from $p$ to $q$, or (4) a request message is in transit from $q$ to $p$.
\end{lemma}
\begin{proof}
Initially, $reqToken[p]=T$ at $q$ or $reqToken[q]=T$ at $p$ but not both by assumption.  Whenever node $p$ (resp. node $q$) sets $reqToken[q]$ (resp. $reqToken[p]$) to $F$ there is a preceding transmission of a request message within the same action block and only in the case where $reqToken[q]=T$ (resp. $reqToken[p]=T$) such transmission occurs.  Also, whenever node $p$ (resp. node $q$) receives a request message from $q$ (resp. node $p$), it sets $reqToken[q]$ (resp. $reqToken[p]$) to $T$.  Hence, the lemma is proven.
\end{proof}

%The following lemma shows that for two neighboring nodes $p$ and $q$, when $p$ receives a fork message sent by $q$, node $p$ must not hold the request token.

%\begin{lemma}
%For all nodes $p \in \Pi$ and $q \in N_p$, and for all executions of Algorithm \ref{alg:fl1dining:solveproblem}, when $p$ receives a fork message from $q$, it must be that $reqToken[q]=F$ at $p$.
%\end{lemma}
%\begin{proof}
%Let $t$ be the time when $p$ receives a fork message from $q$ and let $t'$ be the latest time before time $t$ when $q$ sent the fork message.  At time $t'$, it must hold that $reqToken[p]=T$ at %$q$ due to Lines \ref{}, \ref{}, \ref{}, and \ref{}.  Applying Lemma \ref{lem:fl1dining:uniqueReqToken} shows that, at time $t'$, $reqToken[q]=F$ at $p$ and there is no request message in transit between %$p$ and $q$.   The only case that $p$ can set $reqToken[q]$ to $T$ is by receiving a request message (Line \ref{}).  Even though $q$ immediately sends a request message after sending the fork %message, channels being FIFO ensures that the request message will arrive later than the fork message at $p$.  Hence, at time $t$, the value of $reqToken[q]$ at $p$ remains as $F$.  
%\end{proof} 

In proving the Exclusion property, it is important to show that the fork shared between any two neighbors is unique.  Before we do so, we first show that when a node, say $p$, receives a request message from its neighbor $q$, node $p$ must be holding the fork shared between $p$ and $q$. 

\begin{lemma}
\label{lem:fl1dining:whenRecvReqTokenHasFork}
For all nodes $p \in \Pi$ and $q \in N_p$, and for all executions of Algorithm \ref{alg:fl1dining:solveproblem}, when $p$ receives a request message from $q$, $fork[q]=T$ at $p$ holds. 
\end{lemma}
\begin{proof}
Let $t$ be the time when $p$ receives a request message from $q$ and let $t'$ be the latest time before time $t$ when $q$ sent the request message.  Suppose, in contradiction, that $fork[q]=F$ at $p$ at time $t$.  Due to Lemma \ref{lem:fl1dining:forkNeverLost}, it must be that, at time $t$, (1) a fork message is in transit from $p$ to $q$, (2) a fork message is in transit from $q$ to $p$, or (3) $fork[p]=T$ at $q$.

For part (1), $p$ must have sent the fork message at some time $t''<t'$ due to Lemma \ref{lem:fl1dining:uniqueReqToken} and since a fork message is sent by $p$ only when $reqToken[q]=T$ (Lines 27, 29, 67, and 68).  Note that $reqToken[p]=T$ at $q$ at time $t'$  (Lines 27, 32, 61, and 62).  Since there exists a time $t''<t'$ such that $reqToken[q]=T$ at $p$, the only case when node $q$ can set $reqToken[p]$ to $T$ is by receiving a request message from $p$ and this must happen some time during $(t'',t]$ due to Lemma \ref{lem:fl1dining:uniqueReqToken}.  In addition, node $p$ may only send that request message to $q$ after time $t''$ (since $reqToken[q]=T$ at time $t''$).  However, since the fork message sent from node $p$ at time $t''$ did not arrive at node $q$ at time $t$,  any message (including the request message) sent after time $t''$ cannot arrive at $q$ by time $t$ due to FIFO message delivery, which contradicts the requirement that $q$ must receive a request message from $p$ some time during $(t'',t]$.

For part (2), $q$ must have sent the fork message at some time during $[t',t]$ due to FIFO message delivery.  Since $q$ sends a fork message only when $reqToken[p]=T$, Lemma \ref{lem:fl1dining:uniqueReqToken} and the fact that the request message is in transit from $q$ to $p$ during $[t',t]$ provides the contradiction.

For part (3), $q$ must have set $fork[p]$ to $T$ at some time $t_1 >t'$ since for $q$ to send a request message at time $t'$, $fork[p]=F$ must hold at $q$ (Lines 30, 32, 61, and 62).  Since there exists a time $t'<t_1$ where $fork[p]=F$ at $q$, node $q$ must have set $fork[p]$ to $T$ at time $t'$ by receiving a fork message from $p$.  This fork message must have been sent by $p$ some time before $t'$ due to Lemma \ref{lem:fl1dining:uniqueReqToken} and since a fork message is sent by $p$ only when $reqToken[q]=T$ (Lines 27, 29, 67, and 68).  The rest is similar to the proof of part (1).
\end{proof}

The following lemma shows that the fork shared between any two neighbors is unique.

\begin{lemma}
\label{lem:fl1dining:uniqueFork}
For all nodes $p \in \Pi$ and $q \in N_p$, and for all executions of Algorithm \ref{alg:fl1dining:solveproblem}, at all times exactly one of the following holds: (1) $fork[p] = T$ at $q$, (2) $fork[q] = T$ at $p$, (3) a fork message is in transit from $p$ to $q$, or (4) a fork message is in transit from $q$ to $p$.
\end{lemma}
\begin{proof}
We have already shown in Lemma \ref{lem:fl1dining:forkNeverLost} that the fork shared between $p$ and $q$ is never lost.  The remaining is to show that the fork shared between $p$ and $q$ is never duplicated.  For node $p$, note that, in the code, $fork[q]$ changes from $F$ to $T$ only when $p$ receives a fork message from $q$.  Thus, the only case the fork can be duplicated by node $p$ is when $p$ sends a fork message; the same applies to node $q$.

The proof requirement is to show that only when $fork[q]=T$ holds, node $p$ sends a fork message.  The fork message transmission at Line 68 is directly conditioned by $fork[q]=T$.  By Lemma \ref{lem:fl1dining:whenRecvReqTokenHasFork}, $fork[q]=T$ holds when $p$ receives a request message from $q$.  Hence, $fork[q]=T$ holds when $p$ sends a fork message at Line 29.   
\end{proof}

We now prove the Exclusion property.

\begin{lemma}
\label{lem:fl1dining:excl}
For all executions $E$ of Algorithm \ref{alg:fl1dining:solveproblem}, $E|X$ satisfies \emph{Exclusion}.
\end{lemma}
\begin{proof}
Since for all nodes $p\in \Pi$ and $q\in N_p$, the fork shared between $p$ and $q$ is unique (by Lemma \ref{lem:fl1dining:excl-invars}) and since for all nodes $p\in \Pi$, node $p$ must hold all the forks shared between itself and all of its neighbors to enter a critical section (Line 53),  it is sufficient to so that for all nodes $p\in\Pi$, if node $p$ is in a critical section, it does not send any fork message.  Suppose, in contradiction, that $p$ sent a fork message while it was in a critical section.  A fork message can be sent by executing (1) Line 29 or (2) Line 68.  For part (1) or part (2) to happen at $p$ while it is in a critical section, $inside=F$ must hold (Lines 28 and 66).   However, Lemma \ref{lem:fl1dining:critImpliesInside} shows that $inside=T$ holds at all times while $p$ is in a critical section, a contradiction.   
\end{proof}
\end{comment}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%\subsubsection{$FL1$-starvation}

%In the remainder of Appendix \ref{appendix:proofsolveproblem}, we use the term ``time'' to refer to points in the execution for convenience. 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{comment}
\begin{lemma}
\label{lem:fl1dining:starvation}
$E|X$ satisfies \emph{FL1-starvation}.
\end{lemma}
\begin{proof}
%For all nodes $q \in \Pi$ that are faulty in $E$, $(E|X)|q$ is finite by definition.  We prove for all correct nodes that have at least one faulty neighbor.  
%
Consider each correct node $p \in \Pi$ that has at least one faulty neighbor.  Then, since $E|D$ satisfies the $\Diamond P^1$ specification, there exists a time $t$ such that every occurrence of event $response_p(b)$ returns $b=T$ thereafter.  This implies that from time $t$ and thereafter, for all occurrences of event $response_p(b)$, $skeptical=T$ holds.  Let $t'$ be the first time that event $response_p(b)$ occurs after time $t$.  At time $t'$, unless $p$ is in a critical section (Line 45; Lemma \ref{lem:fl1dining:dining-var} shows that $dining=crit$ at $p$ indicates that $p$ is in a critical section), SatisfyRequests() is called.  If $p$ was in a critical section and Finite Eating holds, the Well-formedness property (Lemma \ref{lem:fl1dining:excl-wf}) ensures that event $exit_p$ happens at some time $t''>t'$ and as a result SatisfyRequests() is called (Line 40).  Note that when SatisfyRequests() is called variable $inside$ is set to $F$.  

For node $p$ to enter a critical section, it must call AllForks() and for AllForks() to be called, $inside=T$ must hold (Lines 36 and 56).  Also, for $inside$ to be set to $T$, EnterDoorway() must be called.  However, after time $t''$, EnterDoorway cannot be called since (1) $skeptical=T$ (Line 24) and (2) event $response_p(b)$ will happen with $b=T$ at all times after $t'<t''$ (Lines 47 to 49 will \emph{not} be executed).  Hence, after time $t''$ node $p$ never enters a critical section.  This fact along with the Well-formedness property proves that $(E|X)|p$ is finite.  
%Also, by the Finite Eating assumption, $(E|X)|p$ does not end with $crit_p$.
\end{proof}
\end{comment}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{comment}
\subsubsection{$FL1$-progress}

\begin{lemma}
\label{lem:fl1dining:progress-inv1}
The following are invariants (true in every configuration of $E$) 
for all neighbors $p$ and $q$.
\begin{itemize}
\item[(A)] If $inside_p = T$, then exactly one of the following is true:
	\begin{itemize}
	\item $fork_p[q] = T$,
	\item request message is in transit from $p$ to $q$,
	\item $reqToken_q[p] = T$, or
	\item fork message is in transit from $q$ to $p$.
	\end{itemize}
\item[(B)] If $inside_p=T$, $reqToken_q[p]=T$, and $fork_q[p]=T$, then either $dining_q = crit$ or ($inside_q$ and $q>p$).
\end{itemize}
\end{lemma}
\begin{proof}
By induction on the configurations in $E$, which we denote $C_0, C_1, \ldots$.

{\em Basis:}  By the initialization, we have $inside_p=F$.  Thus, (A) and (B) are vacuously true in $C_0$.

{\em Induction:}  Suppose (A) and (B) are true in configuration $C_{t-1}$ and show
they are true in configuration $C_t$.  We consider every possibility for the
event taking the system from $C_{t-1}$ to $C_t$.  
When $try_p$, $recv_p(ping,q)$ and $recv_q(ping,p)$ occur, no changes are made that affect
the truth of any of the predicates. \\

{\em Case 1:}  The event is $try_q$.

\begin{itemize}
\item[(A)] No change affects the validity of (A) in $C_t$.
\item[(B)] The only change relevant to (B) is if $dining_q$ is set to $try$ in Line 12.  The Well-formedness property (Lemma \ref{lem:fl1dining:excl-wf}) tells us that $dining_q$ is either $rem$ or $exit$ in $C_{t-1}$.  Thus, if (B) was valid in $C_{t-1}$, then (B) is also valid in $C_t$.
\end{itemize}

{\em Case 2:} The event is $recv_p(ack,q)$.

\begin{itemize}
\item[(A)] The only changes relevant to (A) are if $inside_p$ is set to $T$ in Line 57 and if a request message is sent from $p$ to $q$ in Line 62.  Note that the request message is sent to $q$ only when $reqToken_p[q]=T$ and $fork_p[q]=F$
\item[(B)]
\end{itemize}

{\em Case 3:} The event is $recv_q(ack,p)$.

\begin{itemize}
\item[(A)]
\item[(B)]
\end{itemize}


{\em Case 4:} The event is $recv_p(request,q)$.

\begin{itemize}
\item[(A)] The changes relevant to (A) are if $fork_p[q]$ is set to $F$ in Line 30 and if a request message is sent from $p$ to $q$ in Line 32.  Suppose $inside_p = T$ in $C_{t-1}$.  Then, it is guaranteed by the condition in Line 31 that the request message is sent to $q$ only if $fork_p[q]$ is set to $F$.  Thus, (A) is true in $C_t$.
\item[(B)] No change affects the validity of (B) in $C_t$.
\end{itemize}

{\em Case 5:} The event is $recv_q(request,p)$.

\begin{itemize}
\item[(A)] The changes relevant to (A) are $request_q[p]$ being set to $T$ in Line 27 and if a fork message is sent from $q$ to $p$ in Line 29.  First suppose that $request_q[p]=F$ on 
\item[(B)]
\end{itemize}

\begin{itemize}
\item[(A)]
\item[(B)]
\end{itemize}

\begin{itemize}
\item[(A)]
\item[(B)]
\end{itemize}

\begin{itemize}
\item[(A)]
\item[(B)]
\end{itemize}

\begin{itemize}
\item[(A)]
\item[(B)]
\end{itemize}

\begin{itemize}
\item[(A)]
\item[(B)]
\end{itemize}

\end{proof}
\end{comment}

% OLD PROGRESS PROOF
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%\begin{comment}
%In the remainder of Appendix \ref{appendix:proofsolveproblem}, we use the term ``time'' to refer to points in the execution for convenience. 

\begin{comment}

Once a node enters a trying section, that node must (1) acquire acks from all of its neighbors to enter the doorway and (2) when inside the doorway, acquire all forks shared between itself and all of its neighbors to enter its critical section.  We first show that for each correct node $p$, if (a) $p$ is in its trying section, (b) $p$ is inside the doorway, (c) all of $p$'s neighbors are correct, and (d) all correct neighbors of $p$ eventually exits their critical section, then $p$ eventually enters its critical section.

%The following two lemmas assist in proving the main lemma of this section.

\begin{lemma}
\label{lem:fl1dining:enterTryingInsideF}
For all nodes $p \in \Pi$, when $p$ enters a trying section, $inside=F$ holds.
\end{lemma}
\begin{proof}
Note that initially $inside=F$ at $p$.  Since user-correctness of $E|X$ is assumed ($try_p$ is the first event in $X$ that occurs at $p$), the first time $p$ enters a trying section, $inside=F$ holds.  By the Well-formedness property (Lemma \ref{lem:fl1dining:excl-wf}),for all future occurrences of event $try_p$, there exists a preceding occurrence of event $exit_p$ which calls SatisfyRequests() and sets $inside$ to $F$.  Since the value of $inside$ can only be modified to $T$ by calling EnterDoorway() and EnterDoorway() can be called only when $p$ is in a trying section (Lemma \ref{lem:fl1dining:dining-var} shows that $dining=trying$ at $p$ implies that $p$ is in a trying section), $inside=F$ holds when $p$ enters a trying section.
%For part (2), since for any $q\in N_p$, $deferred[q]$ can be modified to $T$ when $inside=T$, the proof of part (1) also shows that $deferred[q]=F$ holds when $p$ enters a trying section.     
\end{proof}

For all nodes $p\in\Pi$ and $q\in N_p$, we say that an ack message $\langle ack\rangle$ sent from $q$ to $p$ is a \emph{consequence} of a ping message $\langle ping \rangle$ sent from $p$ to $q$  if (1) $q$ sends $\langle ack\rangle$ by receiving $\langle ping\rangle$ from $p$ (Line 19) or (2) $deferred[p]$ is modified from $F$ to $T$ at $q$ by receiving $\langle ping\rangle$ from $p$ which enabled $q$ to send $\langle ack\rangle$ by executing Line 71.     

\begin{lemma}
\label{lem:fl1dining:onePendingPing}
For all nodes $p\in \Pi$ and $q\in N_p$ and for all occurrences of send events $send_p(\langle ping \rangle,q)$, (1) the next successive send event $send_p(\langle ping \rangle',q)$ (if any) occurs only after an occurrence of $recv_p(\langle ack \rangle,q)$ from $q$ at some point after the occurrenct of $send_p(\langle ping \rangle,q)$, and (2) this ack message $\langle ack \rangle$ is a  consequence of $\langle ping \rangle$ and it is the only ack message that $p$ receives in between the transmissions of $\langle ping \rangle$ and $\langle ping \rangle'$.   
%For all nodes $p\in \Pi$ and $q\in N_p$ and for all times $t$ when $p$ sends a ping message $msg_{ping1}$ to $q$, (1) node $p$ sends the next successive ping message $msg_{ping2}$ (if any) to $q$ only after receiving an ack message $msg_{ack}$ from $q$ at some time after time $t$, and (2) this ack message $msg_{ack}$ is a  consequence of $msg_{ping1}$ and it is the only ack message that $p$ receives in between the transmissions of $msg_{ping1}$ and $msg_{ping2}$.   
\end{lemma}
\begin{proof}
We first prove part (1).  Node $p$ only sends a ping message to $q$ when $p$ enters a trying section (Line 14).  Also, when $p$ enters a trying section, $inside=F$ holds (Lemma \ref{lem:fl1dining:enterTryingInsideF}).  By the Well-formedness property (Lemma \ref{lem:fl1dining:excl-wf}), between any two trying sections, node $p$ must enter a critical section.  This implies that there exists a call to EnterDoorway() between any two ping message transmissions.  The reason for this is that for $p$ to enter a critical section, it must call AllForks(), and for AllForks() to be called, $inside=T$ must hold (the only way to set $inside=T$ is be calling EnterDoorway; Line 57).  For EnterDoorway() to be called, $p$ must gather ack messages from all of its neighbors (Lines 24 and 49)  which further implies that $p$ must receive an ack message from $q$.

For part (2), note that by receiving one ping message from $p$, exactly one ack message can be generated at $q$.  This is because executing Line 19 at $q$ is a direct result of receiving a ping message from $p$ and executing Line 71 at $q$ is a result of $deferred[p]$ being $T$ which is set by receiving a ping message from $p$ (and after executing Line 71, $deferred[p]$ is reset to $F$).  Applying part (1) proves the lemma.
% this implies that $msg_{ack}$ is a consequence of $msg_{ping1}$ and it is the only ack message that $p$ receives between the send of $msg_{ping1}$ and $msg_{ping2}$. 
\end{proof}

%\begin{lemma}
%\label{lem:fl1dining:deferForkCondition}
%For all executions of Algorithm \ref{alg:fl1dining:solveproblem} for all correct nodes $p\in\Pi$ and $q\in\N_p$ where all of $p$'s neighbors are correct, if $p$ is in a trying section, $inside=T$ holds at $p$, and $p>q$, then eventually $fork[q]=T$ at $p$ continuously until after $p$ enters an exiting section.
%\end{lemma}
%\begin{proof}
%Lemma \ref{lem:fl1dining:critImpliesInside} and Lemma \ref{lem:fl1dining:enterTryingInsideF} imply that the request message sent by $p$ (if any) is deferred by $q$ only when $q$ is in a critical section.  
%\end{proof}

We next show that if a failure-insulated node $p \in \Pi$ does not enter its critical section even though it is in a trying section and inside the doorway, then the values in array $fork[\cdot]$ eventually stop changing.  

%For all configurations $C_t$ of $E$, let $fork_p^t[q]$ be the value of $fork[q]$ at $p$ in $C_t$.

\begin{lemma}
\label{lem:fl1dining:forkStopChange}
Suppose that there exists a failure-insulated node $p\in\Pi$.  Also, suppose that there exists a suffix $E_1$ of $E$ that begins with configuration $C_{t'}$ such that $p$ never enters its critical section even if $p$ is in a trying section and $inside=T$ holds at $p$.
Then, there exists a suffix of $E$ in which for all nodes $q \in N_p$, $fork[q]$ stops changing at $p$. 
%Then, even if Finite Eating holds for $E|X$, there exists a configuration  $C_{t_1}$ where $t_1 \geq t'$ such that for all configurations $C_{t_2}$ after $C_{t_1}$ and for all nodes $q \in N_p$, $fork_p^{t_1}[q]=fork_p^{t_2}[q]$.   
%Suppose that there exists a failure-insulated node $p\in\Pi$.  Also, suppose that there exists a time $t'$ such that  for all times $t'' \geq t'$, node $p$ does not enter a critical section even if $p$ is in a trying section and $inside=T$ at $p$.  For all times $t$, let $fork_t[q]$ be the value of $fork[q]$ at $p$ at time $t$.  Then, if Finite Eating holds for $E|X$, there exists a time $t_1 \geq t'$ such that for all times $t_2 \geq t_1$ and for all nodes $q \in N_p$, $fork_{t_1}[q]=fork_{t_2}[q]$ at $p$.   
\end{lemma}
\begin{proof}
Since $E|D$ satisfies the $\Diamond P^1$ specification, there exists a suffix $E_2$ of $E$ where for all nodes $r \in \Pi$, every occurrence of event $response_r(S)$ returns $S\neq\emptyset$ if and only if $r$ has a faulty neighbor.  
%Also, there exists a a suffix $E_2$ of $E_1$ such that for all nodes $r\in\Pi$, event $response_r(S)$ occurs at least once after the beginning of $E_1$.    
For our proof, we consider the suffix $E_1 \cap E_2$\footnote{For two suffixes $E_1$ and $E_2$ of an execution $E$, $E_1 \cap E_2$ corresponds to $E_1$ (resp. $E_2$) if $E_1$ (resp. $E_2$) begins later than $E_2$  (resp. $E_1$). If $E_1$ and $E_2$ are equivalent, then $E_1 \cap E_2$ corresponds to $E_1$.} of $E$.  

First note that whenever node $p$ sends a fork to its neighbor $q$, $fork_p[q]$ is set to $F$ and the only case that $fork_p[q]$ is set to $T$ is when $p$ receives a fork message from $q$.  If node $p$ ever sends a fork message to its neighbor $q$, and if $p$ ever receives a fork message back from $q$ (note that the fork is unique by Lemma \ref{lem:fl1dining:excl-invars}(A)), then there are four cases that node $q$ could have sent the fork message back to $p$:

--(\emph{Case} 1) $q$, which has a faulty neighbor, sent the fork by calling SatisfyRequests() on Line 46: In this case, $skeptical=T$ holds at $q$ forever.  As a result, if $q$ is ever in a trying section, then EnterDoorway() is never called and thus $inside=F$ holds thereafter.  Hence, $q$ cannot send a request message to $p$ which proves that there exists a suffix of $E$ in which $fork_p[q]$ stops changing.

--(\emph{Case} 2) $q$, which is failure-insulated, sent the fork message by calling SatisfyRequests() on Line 40: Since we only consider suffix $E_1 \cap E_2$ of $E$, SatisfyRequests() can only be called at $q$ when it enters an exiting section; every occurrence of $response_q(S)$ in $E_1 \cap E_2$ returns $S=\emptyset$.  At the time when $q$ sends the fork message, it must hold the request token (Line 67).  For node $q$ to reacquire the fork it must send a request message to $p$ by calling EnterDoorway().  Lemma \ref{lem:fl1dining:onePendingPing} tells us that for node $q$ to call EnterDoorway(), it must send ping messages to all of its neighbors (by entering a trying section) and then gather ack messages from all of its neighbors that are consequences of those ping messages.  However, since $inside=T$ holds at node $p$, the ping message from $q$ will be deferred (Line 16) and since $p$ never enters its critical section, the Well-formedness property (Lemma \ref{lem:fl1dining:excl-wf}) shows that $p$ never calls SatisfyRequests().  Note that, by Lemma \ref{lem:fl1dining:onePendingPing}, $p$ can only send an ack message back to $q$ by calling SatisfyRequests().   Hence, for Case 2, there exists a suffix of $E$ in which $fork_p[q]$ stops changing.

--(\emph{Case} 3) $q$, which is failure-insulated, sent the fork message (Line 29) when $inside=F$ holds: First note that the fork shared between $p$ and $q$ is unique by Lemma \ref{lem:fl1dining:excl-invars}(A).  We further divide into two cases:
  
---(\emph{Case} 3a) Suppose $p>q$:  If $q$ ever calls EnterDoorway() and sets $inside$ to $T$ (for $q$ to send a request message to $p$, $inside=T$ must hold; see Lines 31 and 57), and if $p$ ever receives a request message from $q$, then $p$ defers the fork request due to the condition on Line 28.  The only case that node $p$ can send the fork is by calling SatisfyReqeust() which can only be called by entering an exiting section (since $p$ is failure-insulated, in $E_1 \cap E_2$, every occurrence of event $response_p(S)$ returns $S=\emptyset$ which prevents the call to SatisfyRequests() at Line 46).  Since $p$ never enters a critical section by assumption, $p$ never enters an exiting section by the Well-formedness property (Lemma \ref{lem:fl1dining:excl-wf}).  Hence, $fork_p[q]=T$ holds in $E_1 \cap E_2$.

---(\emph{Case} 3b) Suppose $p<q$. If $q$ ever calls EnterDoorway() and sets $inside$ to $T$ and if $p$ ever receives a request message from $q$, then, different from Case 3a, $p$ sends the fork to $q$ and then $p$ immediately sends a request message to $q$ (by FIFO message delivery, $q$ will receive the fork prior to receiving the request message).  For $q$ to send back the fork to $p$, $inside$ must to be set to $F$ by calling SatisfyRequests() which can only be done by entering an exiting section.  This is because $q$ being failure-insulated ensures that, in $E_1 \cap E_2$,  every occurrence of event $response_q(S)$ returns $S=\emptyset$ which in turn prevents the call to SatisfyRequests() at Line 46.  The rest of the proof is similar to Case 2.
 
--(\emph{Case} 4) $q$, which only has correct neighbors, sent the fork message (Line 29) when $p>q$ and $inside=T$ holds while $q$ is in a trying section: The proof is similar to Case 3a.
\end{proof} 

\begin{lemma}
\label{lem:fl1dining:insideEventuallyCritical}
Consider each failure-insulated node $p\in\Pi$. If (1) Finite Eating holds for $E|X$, (2) $p$ is in a trying section, and (3) $inside=T$ holds at $p$, then $p$ eventually enters its critical section.
\end{lemma}
\begin{proof}
Suppose, in contradiction, that there exists a non-empty set $U\subseteq\Pi$ of failure-insulated nodes such that for all nodes $u \in U$, $u$ is in its trying section and $inside=T$ holds at $u$ but never enters its critical section.  Then, by Lemma \ref{lem:fl1dining:forkStopChange}, there exists a suffix $E_1$ of $E$ in which for all nodes in $U$, array $fork[\cdot]$ stops changing. 

Since $E|D$ satisfies the $\Diamond P^1$ specification, there exists a suffix $E_2$ of $E$ in which for all nodes $r \in \Pi$, every occurrence of event $response_r(S)$ returns $S\neq\emptyset$ if and only if $r$ has a faulty neighbor.  
%Also, there exists a time $t_s>t_{GST}$ such that for all nodes $r\in\Pi$, event $response_r(b)$ occurs at least once after time $t_{GST}$.      
We only consider suffix $E_1 \cap E_2$ of $E$ for our proof.

Since a node enters a critical section if it is in a trying section, inside the doorway, and holds all of the forks shared between itself and its neighbors, for each node $u \in U$, there exists a node $q \in N_u$ such that $fork[u]=T$ holds at $q$.  We first show that $q$ is in $U$ and $q>u$.  Suppose not.  First note that since $inside=T$ and $fork[q]=F$ holds at $u$, node $u$ sends a request message to $q$. We consider four cases: If $q$ has a faulty neighbor, then eventually SatisfyRequests() is called (Line 46) which enables a fork message to be sent from $q$ to $u$ after $q$ receives the request message.  If $q$ is failure-insulated and if $q$ ever enters its critical section or exiting section, the Well-formedness property ensures that eventually SatisfyRequests() is called (Line 40)  which enables a fork to be sent from $q$ to $u$ after $q$ receives the request message.  If $q$ is failure-insulated and if $inside=F$ holds at $q$, then upon receiving a request message from $u$, $q$ sends the fork to $u$ (Line 29).  Finally, if $q$ is failure-insulated, $q$ is in its trying section, $inside=T$ holds at $q$, and $q<u$, then upon receiving a request messege from $u$ the condition on Line 28 enables the fork to be sent from $q$ to $u$.  All of the above four cases contradict the fact that array $fork[\cdot]$ of $u$ stops changing. 

Consider the directed ``waits-for'' graph $W=(U,E_W)$ where vertices are nodes in $U$ and $(u,q)$ is in $E_W$ if and only if $fork[q]=F$ holds at $u$ in $E_1 \cap E_2$.  Since each node in $U$ is missing (waiting for) at least one fork, each vertex in $W$ has at least one outgoing edge, and thus there is a cycle in $W$ (basic fact from graph theory). This contradicts the total ordering of node ids since we just showed in the previous paragraph that $q>u$ holds for each edge $(u,q) \in E_W$.
%For analysis purpose, we represent the relationship between a node $s \in S$ and a node $s'$ which holds the fork shared between $s$ and $s'$ as a directed graph : there is an directed edge from $s$ to $s'$; note that $s'$ is also in $S$ and $s'>s$ by the previous paragraph.  Now, select any node $s_1$ from $S$.  Then, there exists a node $s_2\in S$ where there is a directed edge from $s_1$ to $s_2$.  Similarly, there exists a node $s_3\in S$ where there is a directed edge from $s_2$ to $s_3$ and so on.  We continue this process until the constructed directed path has a repeated node; since $S$ is finite such directed path must exists.  This implies that there exists a cycle along the directed path which contradicts the total ordering of node ids. 
\end{proof}

We now focus on showing that a node that is in a trying section but not inside the doorway eventually enters the doorway.  The structure of the proof is analogous to Lemma \ref{lem:fl1dining:forkStopChange} and Lemma \ref{lem:fl1dining:insideEventuallyCritical}.

%For all configurations $C_t$ of $E$, let $ack_p^t[q]$ be the value of $ack[q]$ at $p$ in $C_t$.

\begin{lemma}
\label{lem:fl1dining:ackStopChange}
Suppose that there exists a failure-insulated node $p\in\Pi$.  Also, suppose that there exists a suffix $E_1$ of $E$ in which $p$ does not set $inside$ to $T$ even if $p$ is in a trying section and $inside=F$ holds at $p$.  
Then, there exists a suffix of $E$ in which for all nodes $q\in N_p$, $ack[q]$ at $p$ stops changing.
%For all times $t$, let $ack_t[q]$ be the value of $ack[q]$ at $p$ at time $t$.  
%Then, even if Finite Eating holds for $E|X$, there exists a time $t_1 \geq t'$ such that for all times $t_2 \geq t_1$ and for all nodes $q\in N_p$, $ack_{t_1}[q]=ack_{t_2}[q]$ at $p$.
\end{lemma}
\begin{proof}
First note that, by Lemma \ref{lem:fl1dining:enterTryingInsideF}, $inside=F$ holds when $p$ entered the trying section and the only way to set $inside$ to $T$ is by calling EnterDoorway() (which requires that all ack messages from $p$'s neighbors to be gathered).  In $E_1$, if node $p$ ever receives an ack message from $q$, then $ack[q]$ remains as $T$ until EnterDoorway() is called which proves the lemma.  
%Hence, Lemma \ref{lem:fl1dining:ackStopChange} holds. 
\end{proof}

\begin{lemma}
\label{lem:fl1dining:outsideEventuallyInside}
Consider each failure-insulated node $p\in\Pi$.  If (1) Finite Eating holds for $E|X$, (2) $p$ is in a trying section, and (3) $inside=F$ holds at $p$, then $p$ eventually sets $inside$ to $T$.
\end{lemma}
\begin{proof}
Suppose, in contradiction, that there exists a non-empty set $U\subseteq \Pi$ of failure-insulated nodes such that for all nodes $u \in U$, $u$ is in its trying section and $inside=F$ holds at $u$ but $u$ never sets $inside$ to $T$.  Then, by Lemma \ref{lem:fl1dining:ackStopChange},  there exists a suffix $E_1$ of $E$ in which for all nodes in $U$, array $ack[\cdot]$ stops changing.
%For all nodes $s\in S$, we call the trying section in which $inside$ is never set to $T$ as the \emph{last trying section} of $s$.

Since $E|D$ satisfies the $\Diamond P^1$ specification, there exists a suffix $E_2$ of $E$ in which for all nodes $r \in \Pi$, every occurrence of event $response_r(S)$ returns $S\neq\emptyset$ if and only if $r$ has a faulty neighbor.  
%Also, there exists a time $t_s>t_{GST}$ such that for all nodes $r\in\Pi$, event $response_r(b)$ occurs at least once after time $t_{GST}$.      
We only consider suffix $E_1 \cap E_2$ of $E$ for our proof.

For each $u \in U$, there exists a node $q \in N_u$ in its trying section such that $deferred[u]=T$ holds at $q$; because otherwise all neighbors of $u$ must have executed Line 19 or Lines 71 to 72 which results in $u$ receiving ack messages from all of its neighbors. 
We show that $q$ is in $U$ and $last(E|X,q)$ occurs before $last(E|X,u)$.  Note that both $last(E|X,q)$ and $last(E|X,u)$ are $try$ events by assumption.
%$q$'s last trying section started earlier than the last trying section of $s$. 
We first show that $q\in U$. Suppose,in contradiction, that $q\notin U$.  If $q$ has a faulty neighbor, then eventually $q$ calls SatisfyRequests() which enables $q$ to send an ack message to $u$, a contradiction.  If $q$ is failure-insulated and if ever $q$ sets $inside$ to $T$, enters a critical section, or enters an exiting section, then by Lemma \ref{lem:fl1dining:insideEventuallyCritical} and the Well-formedness property (Lemma \ref{lem:fl1dining:excl-wf}), $q$ eventually calls SatisfyRequests() which again enables an ack message to be sent from $q$ to $u$, a contradiction.

Now we show that $last(E|X,q)$ occurs before $last(E|X,u)$.  Since $q\in U$, the only case that $q$ could have set $deferred[u]$ to $T$ for the last time is when $replied[u]=T$ (see the condition in Line 16).  This implies that when $q$ sets $replied[u]$ to $T$ for the last time, node $q$ is in the trying section corresponding to $last(E|X,q)$.  Note that an ack message $\langle ack \rangle$ is sent from $q$ to $u$ when $q$ sets $replied[u]$ to $T$ for the last time.   By Lemma \ref{lem:fl1dining:onePendingPing}, $q$ must have set $deferred[u]$ to $T$ for the last time by receiving a ping message from $u$ that was generated after $u$ received message $\langle ack \rangle$.  Hence, since a ping message is transmitted only when a $try$ event occurs, $last(E|X,q)$ occurs before $last(E|X,u)$. 

Consider the directed ``waits-for'' graph $W=(U,E_W)$ where vertices are nodes in $U$ and $(u,q)$ is in $E_W$ if and only if $deferred[u]=T$ holds at $q$ in $E_1 \cap E_2$.  Since each node in $U$ is missing (waiting for) at least one ack, each vertex in $W$ has at least one outgoing edge, and thus there is a cycle in $W$ (basic fact from graph theory).  This contradicts the ordering of ($try$) events in $E$ since we just showed in the previous paragraph that $last(E|X,q)$ occurs before $last(E|X,u)$ for each $(u,q)\in E_W$.
%For analysis purpose, we represent the relationship between a node $s \in S$ and a node $s'$ which has $deferred[s]=T$ as a directed graph : there is an directed edge from $s$ to $s'$; note that $s'$ is also in $S$ and the last trying section of $s'$ starts earlier than the last  trying section of $s$ according to the previous paragraph.  Now, select any node $s_1$ from $S$.  Then, there exists a node $s_2\in S$ where there is a directed edge from $s_1$ to $s_2$.  Similarly, there exists a node $s_3\in S$ where there is a directed edge from $s_2$ to $s_3$ and so on.  We continue this process until the constructed directed path has a repeated node; since $S$ is finite such directed path must exists.  This implies that there exists a cycle along the directed path which contradicts the total ordering of time.
\end{proof}

Following lemma proves the $FL1$-progress property.

\begin{lemma}
\label{lem:fl1dining:progress}
$E|X$ satisfies \emph{FL1-progress}.
\end{lemma}
\begin{proof}
%For all correct nodes $p\in\Pi$ that only have correct neighbors, event $rem_p$ happens immediately after the occurrence of event $exit_p$, by the code. 
Lemma \ref{lem:fl1dining:outsideEventuallyInside} and Lemma \ref{lem:fl1dining:insideEventuallyCritical} directly provide the proof.
\end{proof}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


\subsubsection{$FL1$-$BW$}

The proof of Lemma \ref{lem:fl1dining:fairness} is similar to the proof of Theorem 3 in \cite{SP07}.

\begin{lemma}
\label{lem:fl1dining:fairness}
$E|X$ satisfies \emph{FL1}-$BW$.
\end{lemma}
\begin{proof}
%Suppose Finite Eating holds for $E|X$.  
%Since $E|D$ satisfies the $\Diamond B$ specification, there exists a time $t_{GST}$ such that for all times after or at $t_{GST}$ and for all nodes $r \in \Pi$, every occurrence of event $response_r(b)$ returns $b=T$ if and only if $r$ has a faulty neighbor.  Also, there exists a time $t_s>t_{GST}$ such that for all nodes $r\in\Pi$, event $response_r(b)$ occurs at least once after time $t_{GST}$.  Let $H$ be the set of nodes that are in a trying section at time $t_s$.  Then, by $FL1$-progress (Lemma \ref{lem:fl1dining:progress}), there exists a time $t_p>t_s$ such that all correct nodes in $H$ enter a critical section.  Hence, after time $t_p$, it holds that for all correct processes $s\in \Pi$, $s$ enters a trying section after time $t_s$.  We only consider the time after $t_p$ in our proof.
Since $E|D$ satisfies the $\Diamond P^1$ specification, there exists a suffix $E_1$ of $E$ in which for all nodes $r \in \Pi$, every occurrence of event $response_r(S)$ returns $S\neq \emptyset$ if and only if $r$ has a faulty neighbor.  Also, there exists a suffix $E_2$ of $E_1$ in which for all nodes $r\in\Pi$, event $response_r(S)$ occurs at least once.  Let $H$ be the set of nodes that are in a trying section at the beginning of $E_2$.  Then, by $FL1$-progress (Lemma \ref{lem:fl1dining:progress}), there exists a  suffix $E_3$ of $E_2$ in which all correct nodes in $H$ enter a critical section.  Hence, in $E_3$, it holds that for all correct processes $s\in \Pi$, $s$ enters a trying section.  We only consider $E_3$ in our proof.

Consider any two neighboring nodes $p\in \Pi$ and $q\in N_p$ where $p$ is failure-insulated.  First note that $skeptical=F$ holds at $p$ in $E_3$.   

%If $q$ has a faulty neighbor, then by the $FL1$-starvation property (Lemma \ref{lem:fl1dining:starvation}), there exists a time $t_1$ such that $(E|X)|q$ becomes finite and does not end with $crit_q$.  Hence, after time $max(t_1,t_p)$ the lemma holds since there is no occurrences of $crit_q$ after time $max(t_1,t_p)$.

%By $FL1$-progress (Lemma \ref{lem:fl1dining:progress}), Finite Eating, and the fact that $E|X$ is user-correct, $(E|X)|q$ is infinite; note that $(E|X)|p$ is also infinite.  
By the code, while $p$ is continuously in a trying section, node $p$ sends at most one ack message to $q$; this is because when $p$ receives a ping message from $q$ for the first time during the trying section,  $p$ may immediately send an ack message to $q$ (Line 19) and set $replied[q]$ to $T$ (Line 21), and when $p$ receives a ping message for the second time during the trying section, $p$ may set $deferred[q]$ to $T$ (Line 17, since $replied[q]=T$ at $p$) instead of directly sending an ack message.  

From node $q$'s perspective, it may receive \emph{two} ack messages from $p$ while $p$ is in the trying section.  This may happen when $p$ sent an ack message just before $p$ enters the trying section; due to the assumption of unbounded message delay, this ack message is in transit when $p$ enters a trying section.   As a result, since receiving an ack message from $p$ is a requirement for setting $inside$ to $T$ at $q$ (by calling EnterDoorway()) and $inside=T$ is a requirement for $q$ to enter its critical section, $q$ may enter a critical section at most \emph{two} times while $p$ is in a trying section.  This implies that, after the occurrence of event $try_p$, there can be at most two occurrences of event $crit_q$ before event $crit_p$ happens. %Let $\sigma^E=E|X$ and denote $\sigma^E_t$ as the suffix of $\sigma^E$ that begins the earliest after time $t$.   Then, we can conclude that for every infix of the sequence of events in $\sigma^E_{t_p}$ that starts with $try_p$ and contains exactly \emph{three} ($k=3$) occurrences of $crit_q$ must contain at least one occurrence of $crit_p$.    
\end{proof}

Finally, we state the main theorem of this section.

\begin{theorem}
\label{thm:fl1dining:algorithm1}
Algorithm \ref{alg:fl1dining:solveproblem} is an algorithm for the $BW$-$\square SX$-$FL1$ problem.
\end{theorem}
\begin{proof}
Let $E$ be any execution of Algorithm \ref{alg:fl1dining:solveproblem} such that $E|N$ satisfies the message-passing specification,
either $E|D$ is not user-correct for $D$ or $E|D$ satisfies the 
$\Diamond P^1$ specification, and
$E|X$ is user-correct for $X$.
Then, $E|X$ satisfies the $BW$-$\square SX$-$FL1$ specification by Lemmas \ref{lem:fl1dining:excl-wf}, \ref{lem:fl1dining:finite-exit}, \ref{lem:fl1dining:excl}, \ref{lem:fl1dining:progress}, and \ref{lem:fl1dining:fairness}.
\end{proof}
\end{comment}

\begin{comment}
\subsection{Proof of Section \ref{sec:fl1dining:ExtractB}}
\label{appendix:proofextractB}

Let $E$ be any execution of Algorithm \ref{alg:fl1dining:extractFDsw}-\ref{alg:fl1dining:extractFDd} such that 
\begin{compactitem}
\item $E|N$ satisfies the message-passing specification,
\item for each $h$, $1\leq h \leq H$, either $E|X^h$ is not user-correct for $X^h$ or $E|X^h$ satisfies the $BW$-$\square SX$-$FL1$ specification, and
\item $E|D$ is user-correct for $D$.
\end{compactitem}

%For convenience, we use the term ``time'' to refer to points in the execution.

\subsubsection{Well-formedness and Liveness}

\begin{lemma}
\label{lem:fl1dining:wellformednessD}
$E|D$ satisfies \emph{Well-formedness}.
\end{lemma}
\begin{proof}
Since user-correctness is assumed for $E|D$, it is sufficient to show that for all nodes $p\in\Pi$, within $(E|D)|p$, event $query_p$ (if any) is the only event in $D\backslash \{crash_p\}$ that immediately follows event $response_p(\cdot)$.  By the code of Algorithm \ref{alg:fl1dining:extractFDd}, a $response_p(\cdot)$ event occurs only after the occurrence of a $query_p$ event (Lines 5--7).  Hence, within $(E|X)|p$, event $response_p(\cdot)$ cannot immediately follow a $response_p(\cdot)$ event which proves the lemma.  
\end{proof}

\begin{lemma}
\label{lem:fl1dining:liveness}
$E|D$ satisfies \emph{Liveness}.
\end{lemma}
\begin{proof}
It is direct from the code of Algorithm \ref{alg:fl1dining:extractFDd}, that for all correct nodes $p\in \Pi$, whenever a $query_p$ event occurs, there is an immediate occurrence of $response_p(\cdot)$ (Lines 5--7).
\end{proof}

\subsubsection{Completeness}


%\subsubsection{Validity}

%To prove that the Validity property holds, we show that for all correct nodes $p\in\Pi$ (1) if at least one neighbor of $p$ is faulty, then eventually and permanently, every occurrence of event $response_p(b)$ has $b=T$, and (2) if all neighbors of $p$ are correct, then eventually and permanently, every occurrence of event $response_p(b)$ has $b=F$.

%Before we prove part (1), we show that for all nodes $p\in\Pi$ and $q\in N_p$, if $p$ and $q$ are both correct, then $E|X^{I(p,q)}$ is user-correct.

Before we prove the Completeness property, we show that for all nodes $p\in\Pi$ and $q\in N_p$, $E|X^{I(p,q)}$ is user-correct.

\begin{lemma}
\label{lem:fl1dining:instanceUserCorrect}
Consider each pair of neighboring nodes $p\in\Pi$ and $q\in N_p$.  Then, $E|X^{I(p,q)}$ is user-correct.% and Finite Eating holds for $E|X^{I(p,q)}$. 
\end{lemma}
\begin{proof}
The proof requirement is to show that the shortest prefix of $E|X^{I(p,q)}$ to violate Well-formedness (if any) ends in either $rem_x$ or $crit_x$ for some $x\in\Theta^{I(p,q)}$.
%, and (2) $E|X^{I(p,q)}$ satisfies Finite Eating.  We first prove part (1).  
Consider witness thread $w$ at node $p$.  Directly from the code in Algorithm \ref{alg:fl1dining:extractFDsw}, a $try_w$ (resp. $exit_w$) event only occurs immediately after the occurrence of a $rem_w$ (resp. $crit_w$) event. 

Consider hybrid thread $h_{i \in \{0,1\}}$ at node $p$.  Again, directly from the code, a $try_{h_i}$ event only occurs immediately after the occurrence of a $rem_{h_i}$ event which implies that a $try_{h_i}$ event does not immediately occur after a $crit_{h_i}$ event or an $exit_{h_i}$ event, and an $exit_{h_i}$ event does not immediately occur after a $rem_{h_i}$ event.  The proof requirement is to show that $exit_{h_i}$ does not immediately occur after an $exit_{h_i}$ event or a $try_{h_i}$ event.  Suppose, in contradiction, that an $exit_{h_i}$ event occurs immediately after an $exit_{h_i}$.  Then, when the former $exit_{h_i}$ event occurs, variable $critical_i$ is set to $F$.  For the latter $exit_{h_i}$ event to occur, $critical_i$ must be $T$.  The only case that the hybrid thread can set $critical_i$ to $T$ is by an occurrence of a $crit_{h_i}$ event.  This implies that there must have been an occurrence of a $crit_{h_i}$ event in between the two $exit_{h_i}$ events, a contradiction.  Now, suppose, in contradiction, that an $exit_{h_i}$ event occurs immediately after a $try_{h_i}$ event.  For an $exit_{h_i}$ event to occur, $critical_i=T$ must hold which shows that there exists an occurrence of a $crit_{h_i}$ event before the $exit_{h_i}$ event happens.  Let $crit'_{h_i}$ be the latest $crit_{h_i}$ event that happened before the occurrence of an $exit_{h_i}$ event.  Then, in between $crit'_{h_i}$ and the $exit_{h_i}$ event there must exist a $try_{h_i}$ event which immediately follows a $rem_{h_i}$ event.  If a $rem_{h_i}$ event did not happen immediately after $crit'_{h_i}$, the only event that can occur immediately after $crit'_{h_i}$ is a $try_{h_i}$ event which contradicts the fact that a $try_{h_i}$ event only occurs immediately after a $rem_{h_i}$ event.

The proof for the subject threads is similar to the proof for hybrid threads. 
%Since dummy threads at $N_p \backslash \{q\}$ do not generate any $try$ or $exit$ events with respect to instance $I(p,q)$, there will never be a case where the user violates Well-formedness.  
%Hence, we can conclude that $E|X^{I(p,q)}$ is user-correct.
% and as a result we may assume that $E|X^{I(p,q)}$ solves the $BW$-$\square SX$-$FL1$ problem for $G^{I(p,q)}$.
%We now prove part (2).  Consider witness thread $w$ at node $q$.  Directly from the code in Algorithm \ref{alg:fl1dining:extractFDsw}, there exists an immediate occurrence of an $exit$ event after a $crit$ event.  Since dummy threads at $N_p \backslash \{q\}$ do not generate any $try$ events with respect to instance $I(p,q)$, if a $crit$ event ever occurs at the dummy thread, then it directly indicates that Well-formedness is violated.
%Now, consider subject thread $s_{i \in \{0,1\}}$ at node $p$.  Note that even if Finite Eating is not guaranteed, as long as user-correctness (preserving Well-formedness) holds, a correct algorithm for solving $BW$-$\square SX$-$FL1$ cannot violate Exclusion or Finite Exiting.  Without loss of generality, suppose, in contradiction, subject thread $s_0$ is in a critical section forever.  Then, there exists a last $crit_{s_0}$ event that occurs.  Let $t_c$ be the time when the last $crit_{s_0}$ event occurs.  Then, from time $t_c$ and thereafter, $critical_0$ is always $T$ since the only case that variable $critical_0$ can be set to $T$ is when a $crit$ event occurs and the only case that $critical_0$ can be reset to $F$ is when an $exit$ event occurs (Lines 27 and 32 of Algorithm \ref{alg:fl1dining:extractFDsw}).  Since $E|X$ is user-correct, there exists a latest $try_{s_0}$ event that occurs before the last $crit_{s_0}$ event.  By the code of Algorithm \ref{alg:fl1dining:extractFDsw}, immediately after $s_0$ enters a trying section, a ping message is sent to  the witness thread $w$ at node $q$.  By reliable message delivery, this ping message will arrive at $w$ and $w$ will immediately send back an ack message to $s_0$ (Line 18 of Algorithm \ref{alg:fl1dining:extractFDsw}).  Again by reliable message delivery, $s_0$ will receive the ack message from $w$.  Let $t_0$ be the time when $s_0$ receives that ack message from $w$.   Then, from time $t_0$ and thereafter, variable $ack_0$ is forever $T$ since the only case that variable $ack_0$ can be set to $T$ is when $s_0$ receives an ack message and the only case that $ack_0$ can be reset to $F$ is when an $exit$ event occurs (Lines 29 and 31 of Algorithm \ref{alg:fl1dining:extractFDsw}).
%Considering $s_1$, note that, by the previous paragraph, $s_1$ cannot enter a critical section infinitely often since Exclusion is violated.  Since $p$ is correct and $E|X$ is user-correct, $s_1$ must be in a certain section $sec_1$ forever.  Section $sec_1$ cannot be a critical section, as it violates Exclusion (since $s_0$ is in a critical section forever).  Section $sec_1$ cannot be in a exiting section, since Finite Exiting holds.  Section $sec_1$ cannot be in a remainder section since, by Lines 23 and 24 of Algorithm \ref{alg:fl1dining:extractFDsw}, a $try$ event immediately follows a $rem$ event.  Thus, $sec_1$ must be a trying section.    
%By the code, when $s_1$ enters $sec_1$, it sends a ping message to $w$ and $w$ will send back an ack message (by reliable message delivery and Line 18 of Algorithm \ref{alg:fl1dining:extractFDsw}).  Let $t_1$be the time when $s_1$ receives that ack message from $w$.  Then, from time $t_1$ and thereafter, variable $ack_1$ is forever $T$ since $ack_1$ can only be reset to $F$ when an $exit$ event occurs (Lines 31 and 33 of Algorithm \ref{alg:fl1dining:extractFDsw}).  
%Hence, from time $\max(t_c, t_1, t_2)$, the precondition on Line 30 of Algorithm \ref{alg:fl1dining:extractFDsw} for $s_0$ to exit a critical section (and enter an exiting section) is always $T$.  This contradicts the assumption that $s_0$ is in a critical section forever.
\end{proof}

Now, we show that for all nodes $p\in\Pi$ and $q\in N_p$, if $p$ and $q$ are both correct, then Finite Eating holds for $E|X^{I(p,q)}$.

\begin{lemma}
\label{lem:fl1dining:instanceFiniteEating}
Consider each pair of neighboring nodes $p\in\Pi$ and $q\in N_p$ where $p$ is correct.  Then, Finite Eating holds for $E|X^{I(p,q)}$. 
\end{lemma}
\begin{proof}
Consider witness thread $w$ at node $q$.  Directly from the code in Algorithm \ref{alg:fl1dining:extractFDsw}, there exists an immediate occurrence of an $exit_w$ event after a $crit_w$ event.  
%Since dummy threads at $N_p \backslash \{q\}$ do not generate any $try$ events with respect to instance $I(p,q)$, if a $crit$ event ever occurs at the dummy thread, then it directly indicates that Well-formedness is violated.

Now, without loss of generality, consider hybrid thread $h_{0}$ at node $p$.  Note that as long as user-correctness (preserving Well-formedness) holds, a correct algorithm for solving $BW$-$\square SX$-$FL1$ cannot violate Exclusion or Finite Exiting.  Suppose, in contradiction, hybrid thread $h_0$ is in a critical section forever.  Then, there exists a last $crit_{h_0}$ event that occurs.  Let $E_1$ be the suffix of $E$ that begins with this event $crit_{h_0}$.  Then, in $E_1$, variable $critical_0$ of thread $h_0$ is always $T$ since the only case that variable $critical_0$ can be set to $T$ is when $h_0$ enters its critical section and the only case that $critical_0$ can be reset to $F$ is when $h_0$ enters an exiting section (Lines 29 and 43 of Algorithm \ref{alg:fl1dining:extractFDsw}).  Since $E|X^{I(p,q)}$ is user-correct by Lemma \ref{lem:fl1dining:instanceUserCorrect}, there exists a latest $try_{h_0}$ event that occurs before the event $crit_{h_0}$.  By the code of Algorithm \ref{alg:fl1dining:extractFDsw}, immediately after $h_0$ enters a trying section, a ping message is sent to  the witness thread $w$.  By reliable message delivery, this ping message will arrive at $w$ and $w$ will immediately send back an ack message to $h_0$ (Line 17 of Algorithm \ref{alg:fl1dining:extractFDsw}).  Again by reliable message delivery, $h_0$ will receive the ack message from $w$.  Let $E_2$ be the suffix of $E$ that begins with the $recv$ event which corresponds to this ack message reception.   Then, in $E_2$, variable $ack_0$ is forever $T$ since the only case that variable $ack_0$ can be set to $T$ is when $h_0$ receives an ack message and the only case that $ack_0$ can be reset to $F$ is when $h_0$ enters an exiting section (Lines 37 and 42 of Algorithm \ref{alg:fl1dining:extractFDsw}).

%Now, consider subject thread $s_{i \in \{0,1\}}$ at node $p$.  Note that as long as user-correctness (preserving Well-formedness) holds, a correct algorithm for solving $BW$-$\square SX$-$FL1$ cannot violate Exclusion or Finite Exiting.  Without loss of generality, suppose, in contradiction, subject thread $s_0$ is in a critical section forever.  Then, there exists a last $crit_{s_0}$ event that occurs.  Let $t_c$ be the time when the last $crit_{s_0}$ event occurs.  Then, from time $t_c$ and thereafter, $critical_0$ is always $T$ since the only case that variable $critical_0$ can be set to $T$ is when a $crit$ event occurs and the only case that $critical_0$ can be reset to $F$ is when an $exit$ event occurs (Lines 27 and 32 of Algorithm \ref{alg:fl1dining:extractFDsw}).  Since $E|X^{I(p,q)}$ is user-correct by Lemma \ref{lem:fl1dining:instanceUserCorrect}, there exists a latest $try_{s_0}$ event that occurs before the last $crit_{s_0}$ event.  By the code of Algorithm \ref{alg:fl1dining:extractFDsw}, immediately after $s_0$ enters a trying section, a ping message is sent to  the witness thread $w$ at node $q$.  By reliable message delivery, this ping message will arrive at $w$ and $w$ will immediately send back an ack message to $s_0$ (Line 18 of Algorithm \ref{alg:fl1dining:extractFDsw}).  Again by reliable message delivery, $s_0$ will receive the ack message from $w$.  Let $t_0$ be the time when $s_0$ receives that ack message from $w$.   Then, from time $t_0$ and thereafter, variable $ack_0$ is forever $T$ since the only case that variable $ack_0$ can be set to $T$ is when $s_0$ receives an ack message and the only case that $ack_0$ can be reset to $F$ is when an $exit$ event occurs (Lines 29 and 31 of Algorithm \ref{alg:fl1dining:extractFDsw}).

Considering hybrid thread $h_1$, note that, by the previous paragraph, $h_1$ cannot enter its critical section infinitely often because Exclusion will be violated (since $h_0$ is in its critical section forever).  
Since $p$ is correct and $E|X^{I(p,q)}$ is user-correct (by Lemma \ref{lem:fl1dining:instanceUserCorrect}), $h_1$ must be trapped in either a remainder, trying, critical, or exiting section forever.  Thread $h_1$ cannot be in its critical section forever, as it violates Exclusion (since $h_0$ is in a critical section forever).  Thread $h_1$ cannot be in its exiting section forever, since Finite Exiting holds.  Thread $h_1$ cannot be in its remainder section forever since, by Lines 25--27 of Algorithm \ref{alg:fl1dining:extractFDsw}, a $try_{h_1}$ event immediately follows a $rem_{h_1}$ event.  Thus, $h_1$ must be in its trying section forever.    
%Since $p$ is correct and $E|X^{I(p,q)}$ is user-correct (by Lemma \ref{lem:fl1dining:instanceUserCorrect}), $h_1$ must be in a certain section $sec \in \{try, crit, exit, rem\}$ forever.  Section $sec$ cannot be a critical section, as it violates Exclusion (since $h_0$ is in a critical section forever).  Section $sec$ cannot be in a exiting section, since Finite Exiting holds.  Section $sec$ cannot be in a remainder section since, by Lines 25--27 of Algorithm \ref{alg:fl1dining:extractFDsw}, a $try$ event immediately follows a $rem$ event.  Thus, $sec$ must be a trying section.    

By the code, when the last $try_{h_1}$ event occurs at $h_1$, thread $h_1$ sends a ping message to $w$ and $w$ will send back an ack message $\langle ack\rangle$ (by reliable message delivery and Line 17 of Algorithm \ref{alg:fl1dining:extractFDsw}).  Let $E_3$ be the suffix of $E$ that begins with the $recv_{h_1}$ event that corresponds to the reception of $\langle ack\rangle$.  Then, in $E_3$, variable $ack_1$ is forever $T$ since $ack_1$ can only be reset to $F$ when an $exit_{h_1}$ event occurs (Lines 42--44 of Algorithm \ref{alg:fl1dining:extractFDsw}).  
%Let $E_4$ be a suffix of $E$ that is equal to a suffix among $E_1$, $E_2$, and $E_3$ that begins the latest in $E$.  
Hence, in $E_1 \cap E_2 \cap E_3$, the precondition on Line 41 of Algorithm \ref{alg:fl1dining:extractFDsw} for $h_0$ to exit a critical section (and enter an exiting section) is always $T$.  This contradicts the assumption that $h_0$ is in its critical section forever.

The proof for the subject threads is similar to the proof for hybrid threads. 
\end{proof}

The following lemma shows that if a correct node $p$ has faulty neighbor $q$, then from some time on, every occurrence of event $response_p(S)$ has $q\in S$.

\begin{lemma}
\label{lem:fl1dining:completeness}
%Consider each correct node $p\in\Pi$. If at least one neighbor of $p$ is faulty, then there exists a time $t$ such that for all times $t'\geq t$, every occurrence of event $response_p(b)$ has $b=T$.
Consider each correct node $p\in\Pi$. If neighbor $q$ of $p$ is faulty, then there exists a suffix of $E$ such that every occurrence of event $response_p(S)$ has $q\in S$.
\end{lemma}
\begin{proof}
%Note that for each correct node, there is a correct neighboring node by assumption.  Let $q\in \Pi$ be a correct neighboring node of $p$.  
By Lemma \ref{lem:fl1dining:instanceUserCorrect}, $E|X^{I(p,q)}$ is user-correct.  Thus, we may assume that $E|X^{I(p,q)}$ satisfies the $BW$-$\square SX$-$FL1$ specification for $G^{I(p,q)}$.% and we have the liveness properties.
Also, since Finite Eating holds for $E|X^{I(p,q)}$ by Lemma \ref{lem:fl1dining:instanceFiniteEating}, the $FL1$-progress property of the $BW$-$\square SX$-$FL1$ specification guarantees that, for all threads $\tau$ in $G^{I(p,q)}$ that are two hops away from a crashed thread in $G^{I(p,q)}$, if $\tau$ is in its trying section, then $\tau$ will eventually enter its critical section.

%We first show that $E|X^{I(p,q)}$ is user-correct.  
%The proof requirement is to show that for all threads $g$ that interact with instance $I(p,q)$, within $(E|X^{I(p,q)})|g$, (a) assuming that Well-formedness is not violated by an occurrence of either a $try$ event or an $exit$ event before a specific event $try_g$ occurs,  $try_g$ cannot immediately follow event $crit_g$ or $exit_g$ and event $exit_g$ cannot immediately follow event $rem_g$ or $try_g$.  

%Consider witness thread $w$ at node $q$.  Directly from the code in Algorithm \ref{alg:fl1dining:extractFDsw}, event $try_w$ (resp. $exit_w$) only occurs immediately after the occurrence of event $rem_w$ (resp. $crit_w$). 

%Now, consider subject thread $s_{i \in \{0,1\}}$ at node $p$.  Again, directly from the code, event $try_{s_i}$ only occurs immediately after the occurrence of event $rem_{s_i}$ which implies that event $try_{s_i}$ does not immediately occur after $crit_{s_i}$ or $exit_{s_i}$, and event $exit_{s_i}$ does not immediately occur after $rem_{s_i}$.  Suppose, in contradiction, that $exit_{s_i}$ occurs immediately after $try_{s_i}$.  For $exit_{s_i}$ to occur, $critical_i=T$ must hold which shows that there exists an occurrence of $crit_{s_i}$ before $exit_{s_i}$ happens.  Let $crit'_{s_i}$ be the latest $crit$ event that happened before the occurrence of $exit_{s_i}$.  Then, in between $crit'_{s_i}$ and $exit_{s_i}$ there must exist $try_{s_i}$ which immediately follows $rem_{s_i}$.  If a $rem$ event did not happen immediately after $crit'_{s_i}$, the only event that can occur immediately after $crit'_{s_i}$ is a $try$ event which contradicts the fact that $try$ events only occur immediately after a $rem$ event.

%Dummy threads at $N_p \backslash \{q\}$ do not generate any event with respect to instance $I(p,q)$.  Hence, we can conclude that $E|X^{I(p,q)}$ is user-correct and as a result we may assume that $E|X^{I(p,q)}$ solves the $BW$-$\square SX$-$FL1$ problem for $G^{I(p,q)}$.

For the proof, we only consider instance $I(p,q)$.  If $q$ is faulty, then there exists a suffix $E_1$ of $E$ such that each subject thread on $q$ stops sending ping messages to hybrid threads on $p$.  Consequently, there exists a suffix $E_2$ of $E$ such that each hybrid thread on $p$ stops receiving ping messages from subject threads on $q$.  Depending on the behavior of the hybrid threads, we divide into two cases.

--(\emph{Case} 1) At least one hybrid thread enters its critical section infinitely often:  Without loss of generality, let $h_0$ be the hybrid thread that enters it critical section infinitely often. Note that the only way to decrease the value of $counter_0$ at $h_0$ is by receiving a ping message from a subject thread which implies that, in $E_2$, $counter_0$ does not decrease. In $E_2$, whenever $crit_{h_0}$ occurs, $counter_0$ at $h_0$ is incremented by 1.  Thus, eventually, $counter_0$ will exceed $bound_0$ at $h_0$ since $counter_0$ never decreases in $E_2$.  

Let $E_3$ be a suffix of $E_2$ that begins with a $crit_{h_0}$ event where $counter_0$ exceeds $bound_0$ for the first time after the beginning of $E_2$.  Since variable $bound_0$ is set to the current value of $counter_0$ whenever $counter_0$ exceeds $bound_0$, variable $counter_0$ will exceed $bound_0$ whenever $crit_{h_0}$ occurs in $E_3$.  As a result, $H[p][q][0]$ will be set to $T$ whenever $crit_{h_0}$ happens in $E_3$.  Hence, in $E_3$, set $S$ of the decision thread $d$ on node $p$ will include $q$ permanently (Line 6 of Algorithm \ref{alg:fl1dining:extractFDd}). Consequently, every occurrence of event $response_p(S)$ in $E_3$ will have $q\in S$.

--(\emph{Case} 2) Both hybrid threads of $I(p,q)$ starve: In this case, there exists a suffix $E_4$ of $E$ such that both hybrid threads $h_0$ and $h_1$ (1) remain in a certain non-critical section forever, and (2) do not send ping messages to the witness thread $w$. From $w$'s perspective, this means that there exists a suffix $E_5$ of $E$ such that it does not receive any ping messages from either $h_0$ or $h_1$.  As a result, $w$ does not reset $counter$ to $0$ in $E_5$ (Line 16 of Algorithm \ref{alg:fl1dining:extractFDsw}).  Note that the only way to decrease the value of $counter$ at $w$ is by receiving a ping message from a subject thread which implies that, in $E_5$, the value of $counter$ at $w$ does not decrease. 

Since $p$ is correct, by $FL1$-progress and Finite Exiting, and by the fact that event $try_w$ (resp. $exit_w$) occurs immediately after the occurrence of event $rem_w$ (resp. $crit_w$) (Lines 6 and 14 of Algorithm \ref{alg:fl1dining:extractFDsw}), event $crit_w$ occurs infinitely often at $w$.  In $E_5$, whenever $crit_w$ occurs, $counter$ at $w$ is incremented by 1.  Thus, eventually, $counter$ exceeds $bound$ since $counter$ never decreases in $E_5$.   The rest of the proof is similar to (Case 1) except that, in this case, $W[p][q]$ is set to $T$ from some time on.  
%Let $E_6$ be a suffix of $E_5$ that begins with a $crit_w$ event where $counter$ exceeds $bound$ for the first time after the beginning of $E_5$.  Since variable $bound$ is set to the current value of $counter$ whenever $counter$ exceeds $bound$, variable $counter$ will exceed $bound$ whenever $crit_w$ happens in $E_6$.  As a result, $W[p][q]$ will be set to $T$ whenever $crit_w$ happens in $E_5$.  Hence, in $E_6$, set $S$ of decision thread $d$ will include $q$ permanently (Line 6 of Algorithm \ref{alg:fl1dining:extractFDd}). Consequently, every occurrence of event $response_p(S)$ in $E_6$ will have $q\in S$.
%By the $FL1$-starvation property and since Finite Eating holds, there exists a time $t_1$ such that for all times after $t_1$, both subject threads $s_0$ and $s_1$ (1) remain in a certain non-critical section forever, and (2) do not send ping messages to the witness thread $w$.  From $w$'s perspective, this means that there exists a time $t_2 \geq t_1$ such that it does not receive any ping messages from either $s_0$ ot $s_1$.  As a result, $w$ does not reset $counter$ to $0$ after time $t_2$ (Line 17 of Algorithm \ref{alg:fl1dining:extractFDsw}).  Note that the only way to decrease the value of $counter$ at $w$ is by receiving a ping message from a subject thread which implies that for all times after $t_2$, the value of $counter$ at $w$ does not decrease. 
%Since $q$ is failure-insulated with respect to $I(p,q)$ ($p$ is the only neighbor of $q$ which is also correct), by the $FL1$-progress property and by the fact that event $try_w$ (resp. $exit_w$) occurs immediately after the occurrence of event $rem_w$ (resp. $crit_w$) (Lines 6 and 15 of Algorithm \ref{alg:fl1dining:extractFDsw}), event $crit_w$ occurs infinitely often at $w$.  After time $t_2$, whenever $crit_w$ occurs, $counter$ at $w$ is incremented by 1.  Thus, eventually, $counter$ will exceed $bound$ since $counter$ never decreases after time $t_2$.  
%Let time $t_3$ be the first time after time $t_2$ that $counter$ exceeds $bound$.  Since, whenever $counter$ exceeds $bound$, variable $bound$ is set to the current value of $counter$, $counter$ will exceed $bound$ whenever $crit_w$ happens at all times after $t_3$.  As a result, a $skeptic(val)$ message with $val=T$ will be sent to the decision thread at node $p$ whenever $crit_w$ happens at all times after $t_3$.  Due to FIFO message delivery, eventually and permanently, the decision thread $d$ at node $p$ only receives $skeptic(val)$ messages with $val=T$ from witness thread $w$.  Hence, eventually and permanently, variable $b$ of decision thread $d$ will be $b=T$ (Line 6 of Algorithm \ref{alg:fl1dining:extractFDd}).  Consequently, eventually and permanently, every occurrence of event $response_p(b)$ will have $b=T$ which proves the lemma. 
\end{proof}

The Completeness property directly follows from Lemma \ref{lem:fl1dining:completeness}.

\begin{lemma}
\label{lem:fl1dining:completeness2}
$E|D$ satisfies \emph{Completeness}.
\end{lemma}
%\begin{proof}
%The proof directly follows from Lemma \ref{lem:fl1dining:completeness}.
%\end{proof}

\subsubsection{Accuracy}

As in \cite{SPS07}, we define what is called a \emph{renewal interval}.   For all nodes $p\in\Pi$ and $q\in N_p$, let $W_n^{I(p,q)}$ be the $n$-th occurrence of a $ping$ message reception at witness thread $w^{I(p,q)}$.  Then, for $n \geq 1$, we denote $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$ as an execution segment of $E$ that begins with $W^{I(p,q)}_n$ and ends with $W^{I(p,q)}_{n+1}$ and we call this the $n$-th renewal interval of $w^{I(p,q)}$ in $E$ for instance $I(p,q)$.  

For a particular thread $\tau$ of instance $I(p,q)$, we call an execution segment $E_{\tau}$ of $E$ a \emph{trying-critical} section of $\tau$ if
\begin{itemize}
\item $E_{\tau}$ begins with a $try_{\tau}$ event,
\item $E_{\tau}$ ends with an $exit_{\tau}$ event,
\item exactly one $crit_{\tau}$ occurs in $E_{\tau}$, and
\item no event in $X^{I(p,q)}$ of $\tau$, except the above three events, occurs in $E_{\tau}$.
\end{itemize}

%that begins with $x$ entering its trying section followed by $x$ leaving its critical section as a \emph{trying-critical} section.  

Next we show that each renewal interval of a witness thread $w^{I(p,q)}$ is encompassed by a trying-critical section of a subject thread $h_{i\in\{0,1\}}^{I(p,q)}$ if nodes $p$ and $q$ are both correct and if $p$ has no faulty neighbors.  The proof of Lemma \ref{lem:fl1dining:renewalInterval} is similar to the proof of Lemma 1 in \cite{SPS07}.

\begin{lemma}
\label{lem:fl1dining:renewalInterval}
Consider each pair of correct neighboring nodes $p\in\Pi$ and $q\in N_p$. Then, for all $n\geq1$, (1) every renewal interval $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$ is encompassed by a trying-critical section of a hybrid thread $h_{i\in\{0,1\}}^{I(p,q)}$ which does not send the ping message that enables the occurrence of $W^{I(p,q)}_{n+1}$, and (2) for each renewal interval $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$, both hybrid threads $h_0^{I(p,q)}$ and $h_1^{I(p,q)}$ are in a trying-critical section when $W^{I(p,q)}_{n+1}$ occurs.  
%Consider each pair of correct neighboring nodes $p\in\Pi$ and $q\in N_p$ where $p$ has no faulty neighbors. Then, for all $n\geq1$, (1) every renewal interval $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$ is encompassed by a trying-critical section of a subject thread $s_{i\in\{0,1\}}^{I(p,q)}$ which does not send the ping message that enables the occurrence of $W^{I(p,q)}_{n+1}$, and (2) for each renewal interval $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$, both subject threads $s_0^{I(p,q)}$ and $s_1^{I(p,q)}$ are in a trying-critical section at time $t_{n+1}$.   
\end{lemma}
\begin{proof}
By Lemma \ref{lem:fl1dining:instanceUserCorrect}, $E|X^{I(p,q)}$ is user-correct.  Hence, we may assume that $E|X^{I(p,q)}$ satisfies the $BW$-$\square SX$-$FL1$ specification for $G^{I(p,q)}$.  %Now, let $t_n$ be the time when $W^{I(p,q)}_n$ occurs.   
Also, since Finite Eating holds for $E|X^{I(p,q)}$ by Lemma \ref{lem:fl1dining:instanceFiniteEating}, the $FL1$-progress property of the $BW$-$\square SX$-$FL1$ specification guarantees that, for all threads $\tau$ in $G^{I(p,q)}$ that are two hops away from a crashed thread in $G^{I(p,q)}$, if $\tau$ is in its trying section, then $\tau$ will eventually enter its critical section.
We prove by induction on $n$.

--({\bf Base case}; $n=1$) Without loss of generality, let $h_0$ be the hybrid thread that sent the ping message which enabled the occurrence of $W^{I(p,q)}_1$; note that a ping message is sent  immediately after entering a trying section.  Afterwards, $h_0$ does not leave its critical section until $h_0$ receives an ack message from $w$.  By the Well-formedness property, this implies that  $h_0$ is in a trying-critical section when $W^{I(p,q)}_1$ occurs .

For $h_0$ to leave the trying-critical section, $h_1$ must receive an ack message from $w$ and set $ack_1$ to $T$.  For $h_1$ to receive an ack message from $w$, $h_1$ must send a ping message to $w$ since $w$ sends an ack message only when it receives a ping message (Lines 15--17 of Algorithm \ref{alg:fl1dining:extractFDsw}).  This implies that the occurrence of $W^{I(p,q)}_{2}$ is a result of $w$ receiving a ping message from $h_1$.  Hence, $E[W^{I(p,q)}_1,W^{I(p,q)}_{2}]$ is encompassed by the trying-critical section of $h_0$ and $h_0$ did not send the ping message that enabled the occurrence of $W^{I(p,q)}_{2}$.  Also, since $h_1$ did not receive an ack message when $W^{I(p,q)}_{2}$ occurred, $h_1$ is also in a trying-critical section when $W^{I(p,q)}_{2}$ occurred. 

--({\bf Inductive case}) Suppose the lemma holds for the $n$-th renewal interval where $n\geq 1$.  We prove for the $n+1$-th renewal interval.  

Without loss of generality, let $h_0$ be the subject thread that sent the ping message which enabled the occurrence of $W^{I(p,q)}_n$.  Note that, by the inductive hypothesis, both $h_0$ and $h_1$ are in a trying-critical section when $W^{I(p,q)}_n$ occurred.  We first show that the occurrence of $W^{I(p,q)}_{n+1}$ exists.  Suppose, in contradiction, that the occurrence of $W^{I(p,q)}_{n+1}$ does not exist. Then, since the Well-formedness property of $E|X^{I(p,q)}$ holds, $h_{i\in\{0,1\}}$ must be trapped in either a remainder, trying, critical, or exiting section forever.  Thread $h_i$ cannot be in its remainder section forever because Line 26 of Algorithm \ref{alg:fl1dining:extractFDsw} directly shows that a $try_{h_i}$ event immediately follows a $rem_{h_i}$ event.  Thread $h_i$ cannot be in its critical, trying, or exiting section forever since Finite Eating, $FL1$-progress, and Finite Exiting holds.  Hence, we have a contradiction.

% This implies that the trying-critical sections of both $s_0$ and $s_1$ never ends.  By the $FL1$-progress property, it is guaranteed that if both $s_0$ and $s_1$ were in a trying section, then exactly one subject thread advances to a critical section (note that both subject threads cannot advance to a critical section since it will violate the Exclusion property).  This shows that exactly one subject thread is in a critical section forever and without loss of generality, let $s_0$ be the one.
% The condition of which $s_0$ generates an $exit_{s_0}$ event is $critical_0=T$, $ack_0=T$, and $ack_1=T$.  So, at least one of $critical_0$, $ack_0$, and $ack_1$ must be $F$.  When $s_0$ enters a critical section $critical_0$ is set to $T$ and the only case that $critical_0$ can be reset to $F$ is when the condition explained above holds.  Since $s_0$ (resp. $s_1$) has entered a trying section, it must have sent a ping message to $w$, and due to reliable message delivery, $w$ must receive that ping message from $s_0$ (resp. $s_1$) and $s_0$ (resp. $s_1$) must receive the corresponding ack message from $w$ and set $ack_0$ (resp. $ack_1$) to $T$).  The only case that $ack_0$ (resp. $ack_1$) can be reset to $F$ is also when the condition explained above holds.  Hence, we have a contradiction.

Since we know that the occurrence of $W^{I(p,q)}_{n+1}$ exists, there exists a hybrid thread that enters an exiting section during $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$.  Without loss of generality, during $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$, suppose $h_0$ enters an exiting section earlier than $h_1$ does.  Also, let $e'$ indicate the earliest $exit_{h_0}$ event during $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$.  Note that when $e'$ occurs, variable $ack_0$ is set to $F$ which prevents $h_1$ from entering an exiting section if it were in a critical section.  Also, note that after $ack_0$ is set to $F$, it cannot be reset to $T$ unless $h_0$ sends a ping message to $w$ and receives the corresponding ack message from $w$.  As a result, $h_0$ must have sent the ping message which enabled the occurrence of $W^{I(p,q)}_{n+1}$ and, in between the occurrences of $e'$ and $W^{I(p,q)}_{n+1}$, hybrid thread $h_1$ cannot enter an exiting section.  In addition, since $e'$ is the first $exit$ event in $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$, $h_1$ does not enter an exiting section in between the occurrence of $W^{I(p,q)}_n$ and the occurrence of $e'$.  Hence, $h_1$ remains in a trying-critical section during $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$ and it does not send the ping message that enables the occurrence of $W^{I(p,q)}_{n+1}$.  Also, since a ping message is sent when $h_0$ enters a trying section and since $h_0$ did not receive an ack message when $W^{I(p,q)}_{n+1}$ occurs, hybrid thread $h_0$ is also in a trying-critical section when $W^{I(p,q)}_{n+1}$ occurs.  Lemma \ref{lem:fl1dining:renewalInterval} holds. 
\end{proof}

Now, for all nodes $p\in\Pi$ and $q\in N_p$, let $H_{i,n}^{I(p,q)}$ be the $n$-th occurrence of a $ping$ message reception at hybrid thread $h^{I(p,q)}_{i}$ where $i\in\{0,1\}$.  For $n \geq 1$, we denote $E[H^{I(p,q)}_{i,n},H^{I(p,q)}_{i,n+1}]$ as an execution segment of $E$ that begins with $H^{I(p,q)}_{i,n}$ and ends with $H^{I(p,q)}_{i,n+1}$ and we call this the $n$-th renewal interval of $h^{I(p,q)}_{i}$ in $E$ for instance $I(p,q)$.  

Using similar arguments as in the proof of Lemma \ref{lem:fl1dining:renewalInterval}, we can show that the following lemma holds:

\begin{lemma}
\label{lem:fl1dining:renewalInterval2}
Consider each pair of correct neighboring nodes $p\in\Pi$ and $q\in N_p$. Then, for all $n\geq1$, (1) every renewal interval $E[H^{I(p,q)}_{i,n},H^{I(p,q)}_{i,n+1}]$ is encompassed by a trying-critical section of a subject thread $s_{i,j}^{I(p,q)}$ where $j\in\{0,1\}$ which does not send the ping message that enables the occurrence of $H^{I(p,q)}_{i,n+1}$, and (2) for each renewal interval $E[H^{I(p,q)}_{i,n},W^{I(p,q)}_{i,n+1}]$, both subject threads $h_{i,0}^{I(p,q)}$ and $h_{i,1}^{I(p,q)}$ are in a trying-critical section when $H^{I(p,q)}_{i,n+1}$ occurs.  
%Consider each pair of correct neighboring nodes $p\in\Pi$ and $q\in N_p$ where $p$ has no faulty neighbors. Then, for all $n\geq1$, (1) every renewal interval $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$ is encompassed by a trying-critical section of a subject thread $s_{i\in\{0,1\}}^{I(p,q)}$ which does not send the ping message that enables the occurrence of $W^{I(p,q)}_{n+1}$, and (2) for each renewal interval $E[W^{I(p,q)}_n,W^{I(p,q)}_{n+1}]$, both subject threads $s_0^{I(p,q)}$ and $s_1^{I(p,q)}$ are in a trying-critical section at time $t_{n+1}$.   
\end{lemma}


Now, we prove that if neighboring nodes $p$ and $q$ are both correct, then from some time on, every occurrence of event $response_p(S)$ satisfies $q\not\in S$.  The proof of Lemma \ref{lem:fl1dining:accuracy} is similar to the proof of Theorem 2 in \cite{SPS07}.

\begin{lemma}
\label{lem:fl1dining:accuracy}
Consider each pair of correct neighboring nodes $p\in\Pi$ and $q\in N_p$. Then, there exists a suffix of $E$ in which every occurrence of event $response_p(S)$ satisfies $q\not\in S$.
\end{lemma}
\begin{proof}
By Lemma \ref{lem:fl1dining:instanceUserCorrect}, $E|X^{I(p,q)}$ is user-correct.  Hence, we may assume that $E|X^{I(p,q)}$ satisfies the $BW$-$\square SX$-$FL1$ specification for $G^{I(p,q)}$.  
Also, since Finite Eating holds for $E|X^{I(p,q)}$ by Lemma \ref{lem:fl1dining:instanceFiniteEating}, the $FL1$-progress property of the $BW$-$\square SX$-$FL1$ specification guarantees that, for all threads $\tau$ in $G^{I(p,q)}$ that are two hops away from a crashed thread in $G^{I(p,q)}$, if $\tau$ is in its trying section, then $\tau$ will eventually enter its critical section.
%By Lemmas \ref{lem:fl1dining:instanceUserCorrect} and \ref{lem:fl1dining:instanceFiniteEating} shows that $E|X^{I(p,q)}$ is user-correct and Finite Eating holds for $E|X^{I(p,q)}$.  Hence, we may assume that $E|X^{I(p,q)}$ satisfies the $BW$-$\square SX$-$FL1$ specification for $G^{I(p,q)}$.

By the $FL1$-$BW$ property, there exists an integer $k>0$ and there exists a suffix $E_1$ of $E$ such that every infix $\sigma_1$ of $E_1$ that (1) starts with $try_{h_{i\in\{0,1\}}}^{I(p,q)}$ and ends with $crit_{h_{i\in\{0,1\}}}^{I(p,q)}$ and (2) contains exactly one occurrence of $crit_{h_{i\in\{0,1\}}}^{I(p,q)}$, contains at most $k$ occurrences of $crit_w^{I(p,q)}$.  

Let $e_1$ and $e_2$ be the event that initiates the first renewal interval of $w^{I(p,q)}$ in $E_1$ and the first $try$ event of $s_{i\in\{0,1\}}^{I(p,q)}$ in $E_1$, respectively (since $FL1$-progress, Finite Eating, and Finite Exiting hold, events $e_1$ and $e_2$ exist).  Then, by Lemma \ref{lem:fl1dining:renewalInterval}, each renewal interval $RI$ of $w^{I(p,q)}$ that begins after the occurrence of both $e_1$ and $e_2$ is encompassed by a trying-critical section of $s_{i\in\{0,1\}}^{I(p,q)}$ and, within $RI$, $w^{I(p,q)}$ can enter a critical section at most $k$ times.  This implies that, within $RI$, $w^{I(p,q)}$ may enter an exiting section at most $k+1$ times which in turn implies that the value of $counter$ at $w^{I(p,q)}$ after the occurrence of both $e_1$ and $e_2$  is bounded by $k+1$.

%Let $\sigma^E=E|X^{I(p,q)}$ and denote $\sigma^E_t$ as the suffix of $\sigma^E$ that begins at time $t$.   By the $FL1$-$BW$ property, there exists an integer $k>0$ and there exists a time $t_m$ such that every infix $\sigma'$ of $\sigma^E_{t_m}$ that (1) starts with $try_{s_{i\in\{0,1\}}}^{I(p,q)}$ and ends with $crit_{s_{i\in\{0,1\}}}^{I(p,q)}$ and (2) contains exactly one occurrence of $crit_{s_{i\in\{0,1\}}}^{I(p,q)}$, contains at most $k$ occurrences of $crit_w^{I(p,q)}$.  Let $t_1$ and $t_2$ be the starting times of the first renewal interval of $w^{I(p,q)}$ after time $t_m$ and the first trying section of $s_{i\in\{0,1\}}^{I(p,q)}$ after time $t_m$, respectively (since $FL1$-progress, Finite Eating, and Finite Exiting hold, times $t_1$ and $t_2$ exist).  Then, by Lemma \ref{lem:fl1dining:renewalInterval}, each renewal interval $RI$ of $w^{I(p,q)}$ that started after time $\max(t_1,t_2)$ is encompassed by a trying-critical section of $s_{i\in\{0,1\}}^{I(p,q)}$ and within $RI$, $w^{I(p,q)}$ can enter a critical section at most $k$ times.  This implies that within $RI$, $w^{I(p,q)}$ may enter an exiting section at most $k+1$ times which in turn implies that the value of $counter$ at $w^{I(p,q)}$ after time $\max(t_1,t_2)$ is bounded by $k+1$.

Without loss of generality, suppose $e_2$ occurs after $e_1$.   Then, before the occurrence of $e_2$, there exists a maximum value $c_{m}$ of variable $counter$ at $w^{I(p,q)}$.  Thus, variable $counter$ at $w^{I(p,q)}$ is bounded by $\max(c_m,k+1)$ in $E$ and, due to Lines 9 and 10 of Algorithm \ref{alg:fl1dining:extractFDsw}, variable $bound$ at $w^{I(p,q)}$ is also bounded by $\max(c_m,k+1)$ in $E$.  Since variable $bound$ at $w^{I(p,q)}$ is bounded and never decreases and since we already know, from the proof of Lemma \ref{lem:fl1dining:completeness}, that $crit_w^{I(p,q)}$ occurs infinitely often, there exists a suffix $E_2$ of $E$ in which variable $W[p][q]$ on node $p$ is set to $F$ permanently.  

Using similar arguments as above along with Lemma \ref{lem:fl1dining:renewalInterval2}, we can show that there exists a suffix of $E$ in which, for all $i\in\{0,1\}$, variable $W[p][q][i]$ on node $p$ is set to $F$ permanently (in this case, a hybrid thread $h_i$ corresponds to the above witness thread and two subject threads $s_{i,0}$ and $s_{i,1}$ correspond to the above two hybrid threads).   

Hence, we can conclude that there exists a suffix $E'$ of $E$ such that set $S$ of the decision thread $d$ on node $p$ will \emph{not} include $q$ permanently (Line 6 of Algorithm \ref{alg:fl1dining:extractFDd}). Consequently, every occurrence of event $response_p(S)$ in $E'$ satisfies $q\not\in S$ which proves the lemma.
%Again, since $crit_w^{I(p,q)}$ occurs infinitely often, there exist a time $t_4$ such that for all times after $t_4$, $skeptic(val)$ messages with $val=F$ are sent to the decision thread at node $p$ in FIFO order.  Since the channel is reliable, evenually and permanently, $suspect[q]$ at the decision thread on node $p$ is set to $F$.  By the fact that all neighbors of $p$ are correct, there exists a time $t_5$ such that for all times after $t_5$ and for all $r \in N_p$, $suspect[r]=F$ at the decision thread on node $p$.  Hence, variable $b$ is set to $F$ at all times after time $t_5$.  Lemma \ref{lem:fl1dining:accuracy} holds.
\end{proof}

%\begin{lemma}
%\label{lem:fl1dining:validity}
%$E|D$ satisfies \emph{Validity}.
%\end{lemma}
%\begin{proof}
%The proof is immediate from Lemmas \ref{lem:fl1dining:completeness} and \ref{lem:fl1dining:accuracy}.
%\end{proof}

The Accuracy property directly follows from Lemma \ref{lem:fl1dining:accuracy}.

\begin{lemma}
\label{lem:fl1dining:accuracy2}
$E|D$ satisfies \emph{Accuracy}.
\end{lemma}

Finally, we state the main theorem of this section.

\begin{theorem}
\label{thm:fl1dining:algorithm23}
Algorithm \ref{alg:fl1dining:extractFDsw}-\ref{alg:fl1dining:extractFDd} is an algorithm for the $\Diamond P^1$ problem.
\end{theorem}
\begin{proof}
Let $E$ be any execution of Algorithm \ref{alg:fl1dining:extractFDsw}-\ref{alg:fl1dining:extractFDd} such that 
\begin{compactitem}
\item $E|N$ satisfies the message-passing specification,
\item for each $h$, $1\leq h \leq H$, either $E|X^h$ is not user-correct for $X^h$ or $E|X^h$ satisfies the $BW$-$\square SX$-$FL1$ specification, and
\item $E|D$ is user-correct for $D$.
\end{compactitem}
Then, $E|D$ satisfies the $\Diamond P^1$ specification by Lemmas \ref{lem:fl1dining:wellformednessD}, \ref{lem:fl1dining:liveness}, \ref{lem:fl1dining:completeness2}, and \ref{lem:fl1dining:accuracy2}.
\end{proof}
\end{comment}

%Text goes here.

%\section{New Section}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%\begin{figure}[H]
%\centering
%\includegraphics[scale=.50]{figures/Penguins.jpg}
%\caption{TAMU figure - This is an example of a long figure title.  Figure titles need to be single-spaced within and double spaced between in the list of figures.}
%\label{fig:fl1dining:nk:landscapepenguins}
%\end{figure}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%\subsection{Subsection}
%\begin{table}[H]
%\centering
%\caption{This is a table template - This is an example of a long table title.  Table titles need to be single-spaced within and double spaced between in the list of tables.}
%\begin{tabular}{|l|c|c|c|c|c|}
%\hline
%Product & 1 & 2 & 3 & 4 & 5\\
%\hline
%Price & 124.- & 136.- & 85.- & 156.- & 23.-\\
%Guarantee [years] & 1 & 2 & - & 3 & 1\\
%Rating & 89\% & 84\% & 51\% & & 45\%\\
%\hline
%\hline
%Recommended & yes & yes & no & no & no\\
%\hline
%\end{tabular}
%\label{tab:template1}
%\end{table}


%\subsection{Subsection}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%\begin{figure}[H]
%\centering
%\includegraphics[scale=.50]{figures/Sunset.jpg}
%\caption{Sunset figure}
%\label{fig:fl1dining:nk:sunset-fig2}
%\end{figure}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%\subsubsection{This is a subsubsection}
%\begin{table}[H]
%\centering
%\caption{This is a table template - This is an example of a long table title.  Table titles need to be single-spaced within and double spaced between in the list of tables.}
%\begin{tabular}{|l|c|c|c|c|c|}
%\hline
%Product & 1 & 2 & 3 & 4 & 5\\
%\hline
%Price & 124.- & 136.- & 85.- & 156.- & 23.-\\
%Guarantee [years] & 1 & 2 & - & 3 & 1\\
%Rating & 89\% & 84\% & 51\% & & 45\%\\
%\hline
%\hline
%Recommended & yes & yes & no & no & no\\
%\hline
%\end{tabular}
%\label{tab:template1-2}
%\end{table}
%\section{Another Section}
