const int T; // time bound constant // safety check1: a machine cannot be broken and its downstream buffer full "safe1": P=? [ F(((m1=0) & (b1=n1))|((m2=0) & (b2=n2)))] // safety check2 : full adjacent buffers cannot become both non-full in one time unit "safe2_b1": (b1=n1 & b2=n2) => P<=0[X(b1 P<=0[X(b1