module routing sig IP {} sig Link {from, to: Router} sig Router {ip: IP, table: IP ->? Link, nexts: set Router} { table[IP].from in this nexts = table[IP].to no table[ip] } fact {inj (Router$ip)} fun inj [t,t'] (r:t->t') {all x: t' | sole r.x} fun Consistent () { all r: Router, i: IP | r.table[i].to in i.~ip.*~nexts } fun Forward (dest: IP, at, at': Router) { at' = at.table[dest].to } assert Progress { all dest: IP, at, at': Router | Consistent() && Forward (dest, at, at') => at != at' } fun showme () { Consistent () some Link all x: Link | x.from != x.to some Router.table } run showme for 3