anchor.diff:  -define(QC_OUT(P),
           eqc:on_output(fun(Str, Args) -> io:format(user, Str, Args) end, P)).
   
  --record(state,{vclock, model}).
  +-record(state, {vclocks = []}).
   
   eqc_test_() ->
       ?_assert(eqc:quickcheck(?QC_OUT(prop_vclock()))).
  
positive.code:     elements(?ACTOR_IDS).
  
  gen_vclock() ->
      frequency([
                 {1, {new_model(), vclock:fresh()}},
                 {3, ?LAZY(gen_incr_vclock())}
                ]).
  
  gen_incr_vclock() ->
      ?LET({Actor, {M,Vc}},
           {gen_actor_id(), gen_vclock()},
           {orddict:update_counter(Actor, 1, M), vclock:increment(Actor, Vc)}).
  
  merge({_,O}, V) ->
      vclock:merge([O,V]).
  
  model_merge(M,OM) ->
      orddict:merge(fun(_K,A,B) -> erlang:max(A,B) end, M, OM).
  
  new_model() ->
      orddict:from_list([{ID, 0} || ID <- ?ACTOR_IDS]).
  -endif.
  
negative.code: 
  %% Initialize the state
  initial_state() ->
     #state{}.
  
  %% Command generator, S is the state
  command(#state{vclocks=Vs}) ->
      oneof([{call, ?MODULE, fresh, []}] ++
            [{call, ?MODULE, increment, [gen_actor_id(), elements(Vs)]} || length(Vs) > 0] ++
            [{call, ?MODULE, get_counter, [gen_actor_id(), elements(Vs)]} || length(Vs) > 0] ++
            [{call, ?MODULE, merge, [list(elements(Vs))]} || length(Vs) > 0] ++ 
            [{call, ?MODULE, descends, [elements(Vs), elements(Vs)]} || length(Vs) > 0]
            ).
  
  %% Next state transformation, S is the current state
  next_state(S,_V,{call,_,get_counter,[_, _]}) ->
      S;
  next_state(S,_V,{call,_,descends,[_, _]}) ->
      S;
  next_state(#state{vclocks=Vs}=S,V,{call,_,_,_}) ->
      S#state{vclocks=Vs ++ [V]}.
  
  %% Precondition, checked before command is added to the command sequence
  precondition(_S,{call,_,_,_}) ->
  