#define true 1
#define false 0
#define NP 2

bool choosing[NP];
byte number[NP];
byte count;

inline try(i){
  choosing[i]=true;
  int j,mx;
  mx=number[0];
  j=0;
  do
   :: j==NP -> break;
   :: j<NP && mx<number[j] -> mx=number[j];j=j+1;
   :: else -> j=j+1;
  od;
  number[i]=mx+1;
  choosing[i]=false
}

inline ticket(i,j){
  (number[i] < number[j]) || (number[i]==number[j] && i==j)
}

inline door(i){
  int j;
  j=0;
  do
   :: j<NP -> (j==i || !choosing[j]);
             (j==i || number[j] == 0 || 
                      number[i]<number[j] || 
                      (number[j]==number[i] && i== j));
            j=j+1;
   :: else -> break;
  od
}

inline exit(i){
  number[i]=0
}

proctype A(byte i)
{
   try(i);
   door(i);

progress: 
   count=count+1;
   skip;
   count=count-1;
   exit(i)
}

  
proctype monitor(){
  assert(count == 0 | count == 1);
}

init{
  count = 0;
  atomic{
    int j;
    j=0;
    do 
     :: j<NP -> run A(j); j=j+1;
     :: else break;
    od; 
    run monitor();
  }
}
