set traceBacktracking = false.

free c:channel.
free a:bitstring[private].
free b:bitstring[private].

fun h(bitstring):bitstring.

event A(bitstring).
event B(bitstring).
event C.

query i:time, j:time, i':time, k:time, x:bitstring;
  event(A(a))@i && event(A(a))@i' && event(A(a)) && event(B(a))@j ==> i <> i' || (i = i' && (j < i || (j > i &&  event(A(a))@k && k <> i))).


query i:time, j:time, i':time, k:time, x:bitstring;
  attacker(h(a)) && event(A(a))@i && event(A(a))@i' && event(A(a)) && event(B(a))@j ==> i <> i' || (i = i' && (j < i || (j > i &&  event(A(a))@k && k <> i))).

query i:time, j:time, i':time, k:time, x:bitstring;
  attacker(h(a)) && attacker(a) && attacker(a) && attacker(h(b)) && attacker(c) && event(A(a)) && event(A(a)) ==> false.


process
  !
  in(c,y:bitstring);
  out(c,a);
  in(c,x:bitstring);
  event B(x);
  event A(x);
  event C;
  out(c,b);
  event B(x)

(* EXPECTPV
RESULT event(A(a[]))@i && event(A(a[]))@i' && event(A(a[])) && event(B(a[]))@j ==> i ≠ i' || (i = i' && (i > j || (j > i && event(A(a[]))@k && k ≠ i))) cannot be proved.
RESULT attacker(h(a[])) && event(A(a[]))@i && event(A(a[]))@i' && event(A(a[])) && event(B(a[]))@j ==> i ≠ i' || (i = i' && (i > j || (j > i && event(A(a[]))@k && k ≠ i))) cannot be proved.
RESULT not (attacker(h(a[])) && attacker(a[]) && attacker(a[]) && attacker(h(b[])) && attacker(c[]) && event(A(a[])) && event(A(a[]))) is false.
0.032s (user 0.008s + system 0.024s), max rss 8560K
END *)
