[STATEMENT]
lemma add_to_slots_assoc:
  "add_to_slots x (add_to_slots (y ++ z) obj) =
   add_to_slots (x ++ y) (add_to_slots z obj)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Abstract_Separation_D.add_to_slots x (Abstract_Separation_D.add_to_slots (y ++ z) obj) = Abstract_Separation_D.add_to_slots (x ++ y) (Abstract_Separation_D.add_to_slots z obj)
[PROOF STEP]
apply (clarsimp simp: add_to_slots_def update_slots_def object_slots_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (case case obj of Endpoint \<Rightarrow> obj | Tcb x \<Rightarrow> Tcb (x\<lparr>cdl_tcb_caps := y ++ z ++ (case obj of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) | CNode x \<Rightarrow> CNode (x\<lparr>cdl_cnode_caps := y ++ z ++ (case obj of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) of Endpoint \<Rightarrow> case obj of Endpoint \<Rightarrow> obj | Tcb x \<Rightarrow> Tcb (x\<lparr>cdl_tcb_caps := y ++ z ++ (case obj of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) | CNode x \<Rightarrow> CNode (x\<lparr>cdl_cnode_caps := y ++ z ++ (case obj of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) | Tcb xa \<Rightarrow> Tcb (xa\<lparr>cdl_tcb_caps := x ++ (case case obj of Endpoint \<Rightarrow> obj | Tcb x \<Rightarrow> Tcb (x\<lparr>cdl_tcb_caps := y ++ z ++ (case obj of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) | CNode x \<Rightarrow> CNode (x\<lparr>cdl_cnode_caps := y ++ z ++ (case obj of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) | CNode xa \<Rightarrow> CNode (xa\<lparr>cdl_cnode_caps := x ++ (case case obj of Endpoint \<Rightarrow> obj | Tcb x \<Rightarrow> Tcb (x\<lparr>cdl_tcb_caps := y ++ z ++ (case obj of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) | CNode x \<Rightarrow> CNode (x\<lparr>cdl_cnode_caps := y ++ z ++ (case obj of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>)) = (case case obj of Endpoint \<Rightarrow> obj | Tcb x \<Rightarrow> Tcb (x\<lparr>cdl_tcb_caps := z ++ (case obj of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) | CNode x \<Rightarrow> CNode (x\<lparr>cdl_cnode_caps := z ++ (case obj of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) of Endpoint \<Rightarrow> case obj of Endpoint \<Rightarrow> obj | Tcb x \<Rightarrow> Tcb (x\<lparr>cdl_tcb_caps := z ++ (case obj of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) | CNode x \<Rightarrow> CNode (x\<lparr>cdl_cnode_caps := z ++ (case obj of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) | Tcb xa \<Rightarrow> Tcb (xa\<lparr>cdl_tcb_caps := x ++ y ++ (case case obj of Endpoint \<Rightarrow> obj | Tcb x \<Rightarrow> Tcb (x\<lparr>cdl_tcb_caps := z ++ (case obj of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) | CNode x \<Rightarrow> CNode (x\<lparr>cdl_cnode_caps := z ++ (case obj of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) | CNode xa \<Rightarrow> CNode (xa\<lparr>cdl_cnode_caps := x ++ y ++ (case case obj of Endpoint \<Rightarrow> obj | Tcb x \<Rightarrow> Tcb (x\<lparr>cdl_tcb_caps := z ++ (case obj of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) | CNode x \<Rightarrow> CNode (x\<lparr>cdl_cnode_caps := z ++ (case obj of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>) of Endpoint \<Rightarrow> Map.empty | Tcb x \<Rightarrow> cdl_tcb_caps x | CNode x \<Rightarrow> cdl_cnode_caps x)\<rparr>))
[PROOF STEP]
apply (fastforce simp: cdl_tcb.splits cdl_cnode.splits
                 split: cdl_object.splits)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma sim_move10_reds:
  "\<lbrakk> (h', a) \<in> allocate h (Class_type C); ta1 = \<lbrace>NewHeapElem a (Class_type C)\<rbrace>; ta = \<lbrace>NewHeapElem a (Class_type C)\<rbrace> \<rbrakk>
  \<Longrightarrow> sim_move10 P t ta1 (new C) e1' (new C) h xs ta (addr a) h' xs"
  "allocate h (Class_type C) = {} \<Longrightarrow> sim_move10 P t \<epsilon> (new C) e1' (new C) h xs \<epsilon> (THROW OutOfMemory) h xs"
  "\<lbrakk> (h', a) \<in> allocate h (Array_type T (nat (sint i))); 0 <=s i;
     ta1 = \<lbrace>NewHeapElem a (Array_type T (nat (sint i)))\<rbrace>; ta = \<lbrace>NewHeapElem a (Array_type T (nat (sint i)))\<rbrace> \<rbrakk>
  \<Longrightarrow> sim_move10 P t ta1 (newA T\<lfloor>Val (Intg i)\<rceil>) e1' (newA T\<lfloor>Val (Intg i)\<rceil>) h xs ta (addr a) h' xs"
  "i <s 0 \<Longrightarrow> sim_move10 P t \<epsilon> (newA T\<lfloor>Val (Intg i)\<rceil>) e1' (newA T\<lfloor>Val (Intg i)\<rceil>) h xs \<epsilon> (THROW NegativeArraySize) h xs"
  "\<lbrakk> allocate h (Array_type T (nat (sint i))) = {}; 0 <=s i \<rbrakk>
  \<Longrightarrow> sim_move10 P t \<epsilon> (newA T\<lfloor>Val (Intg i)\<rceil>) e1' (newA T\<lfloor>Val (Intg i)\<rceil>) h xs \<epsilon> (THROW OutOfMemory) h xs"
  "\<lbrakk> typeof\<^bsub>h\<^esub> v = \<lfloor>U\<rfloor>; P \<turnstile> U \<le> T \<rbrakk>
  \<Longrightarrow> sim_move10 P t \<epsilon> (Cast T (Val v)) e1' (Cast T (Val v)) h xs \<epsilon> (Val v) h xs"
  "\<lbrakk> typeof\<^bsub>h\<^esub> v = \<lfloor>U\<rfloor>; \<not> P \<turnstile> U \<le> T \<rbrakk>
  \<Longrightarrow> sim_move10 P t \<epsilon> (Cast T (Val v)) e1' (Cast T (Val v)) h xs \<epsilon> (THROW ClassCast) h xs"
  "\<lbrakk> typeof\<^bsub>h\<^esub> v = \<lfloor>U\<rfloor>; b \<longleftrightarrow> v \<noteq> Null \<and> P \<turnstile> U \<le> T \<rbrakk>
  \<Longrightarrow> sim_move10 P t \<epsilon> ((Val v) instanceof T) e1' ((Val v) instanceof T) h xs \<epsilon> (Val (Bool b)) h xs"
  "binop bop v1 v2 = Some (Inl v) \<Longrightarrow> sim_move10 P t \<epsilon> ((Val v1) \<guillemotleft>bop\<guillemotright> (Val v2)) e1' (Val v1 \<guillemotleft>bop\<guillemotright> Val v2) h xs \<epsilon> (Val v) h xs"
  "binop bop v1 v2 = Some (Inr a) \<Longrightarrow> sim_move10 P t \<epsilon> ((Val v1) \<guillemotleft>bop\<guillemotright> (Val v2)) e1' (Val v1 \<guillemotleft>bop\<guillemotright> Val v2) h xs \<epsilon> (Throw a) h xs"
  "xs V = \<lfloor>v\<rfloor> \<Longrightarrow> sim_move10 P t \<epsilon> (Var V') e1' (Var V) h xs \<epsilon> (Val v) h xs"
  "sim_move10 P t \<epsilon> (V' := Val v) e1' (V := Val v) h xs \<epsilon> unit h (xs(V \<mapsto> v))"
  "sim_move10 P t \<epsilon> (null\<lfloor>Val v\<rceil>) e1' (null\<lfloor>Val v\<rceil>) h xs \<epsilon> (THROW NullPointer) h xs"
  "\<lbrakk> typeof_addr h a = \<lfloor>Array_type T n\<rfloor>; i <s 0 \<or> sint i \<ge> int n \<rbrakk>
  \<Longrightarrow> sim_move10 P t \<epsilon> (addr a\<lfloor>Val (Intg i)\<rceil>) e1' ((addr a)\<lfloor>Val (Intg i)\<rceil>) h xs \<epsilon> (THROW ArrayIndexOutOfBounds) h xs"
  "\<lbrakk> typeof_addr h a = \<lfloor>Array_type T n\<rfloor>; 0 <=s i; sint i < int n;
     heap_read h a (ACell (nat (sint i))) v;
     ta1 = \<lbrace>ReadMem a (ACell (nat (sint i))) v\<rbrace>; ta = \<lbrace>ReadMem a (ACell (nat (sint i))) v\<rbrace> \<rbrakk>
  \<Longrightarrow> sim_move10 P t ta1 (addr a\<lfloor>Val (Intg i)\<rceil>) e1' ((addr a)\<lfloor>Val (Intg i)\<rceil>) h xs ta (Val v) h xs"
  "sim_move10 P t \<epsilon> (null\<lfloor>Val v\<rceil> := Val v') e1' (null\<lfloor>Val v\<rceil> := Val v') h xs \<epsilon> (THROW NullPointer) h xs"
  "\<lbrakk> typeof_addr h a = \<lfloor>Array_type T n\<rfloor>; i <s 0 \<or> sint i \<ge> int n \<rbrakk>
  \<Longrightarrow> sim_move10 P t \<epsilon> (AAss (addr a) (Val (Intg i)) (Val v)) e1' (AAss (addr a) (Val (Intg i)) (Val v)) h xs \<epsilon> (THROW ArrayIndexOutOfBounds) h xs"
 "\<lbrakk> typeof_addr h a = \<lfloor>Array_type T n\<rfloor>; 0 <=s i; sint i < int n; typeof\<^bsub>h\<^esub> v = \<lfloor>U\<rfloor>; \<not> (P \<turnstile> U \<le> T) \<rbrakk>
  \<Longrightarrow> sim_move10 P t \<epsilon> (AAss (addr a) (Val (Intg i)) (Val v)) e1' (AAss (addr a) (Val (Intg i)) (Val v)) h xs \<epsilon> (THROW ArrayStore) h xs"
  "\<lbrakk> typeof_addr h a = \<lfloor>Array_type T n\<rfloor>; 0 <=s i; sint i < int n; typeof\<^bsub>h\<^esub> v = Some U; P \<turnstile> U \<le> T;
     heap_write h a (ACell (nat (sint i))) v h';
     ta1 = \<lbrace>WriteMem a (ACell (nat (sint i))) v\<rbrace>; ta = \<lbrace>WriteMem a (ACell (nat (sint i))) v\<rbrace> \<rbrakk>
  \<Longrightarrow> sim_move10 P t ta1 (AAss (addr a) (Val (Intg i)) (Val v)) e1' (AAss (addr a) (Val (Intg i)) (Val v)) h xs ta unit h' xs"
  "typeof_addr h a = \<lfloor>Array_type T n\<rfloor> \<Longrightarrow> sim_move10 P t \<epsilon> (addr a\<bullet>length) e1' (addr a\<bullet>length) h xs \<epsilon> (Val (Intg (word_of_nat n))) h xs"
  "sim_move10 P t \<epsilon> (null\<bullet>length) e1' (null\<bullet>length) h xs \<epsilon> (THROW NullPointer) h xs"
  "\<lbrakk> heap_read h a (CField D F) v; ta1 = \<lbrace>ReadMem a (CField D F) v\<rbrace>; ta = \<lbrace>ReadMem a (CField D F) v\<rbrace> \<rbrakk>
  \<Longrightarrow> sim_move10 P t ta1 (addr a\<bullet>F{D}) e1' (addr a\<bullet>F{D}) h xs ta (Val v) h xs"
  "sim_move10 P t \<epsilon> (null\<bullet>F{D}) e1' (null\<bullet>F{D}) h xs \<epsilon> (THROW NullPointer) h xs"
  "\<lbrakk> heap_write h a (CField D F) v h'; ta1 = \<lbrace>WriteMem a (CField D F) v\<rbrace>; ta = \<lbrace>WriteMem a (CField D F) v\<rbrace> \<rbrakk>
  \<Longrightarrow> sim_move10 P t ta1 (addr a\<bullet>F{D} := Val v) e1' (addr a\<bullet>F{D} := Val v) h xs ta unit h' xs"
  "sim_move10 P t \<epsilon> (null\<bullet>compareAndSwap(D\<bullet>F, Val v, Val v')) e1' (null\<bullet>compareAndSwap(D\<bullet>F, Val v, Val v')) h xs \<epsilon> (THROW NullPointer) h xs"
  "\<lbrakk> heap_read h a (CField D F) v''; heap_write h a (CField D F) v' h'; v'' = v;
     ta1 = \<lbrace> ReadMem a (CField D F) v'', WriteMem a (CField D F) v' \<rbrace>; ta = \<lbrace> ReadMem a (CField D F) v'', WriteMem a (CField D F) v' \<rbrace> \<rbrakk>
  \<Longrightarrow> sim_move10 P t ta1 (addr a\<bullet>compareAndSwap(D\<bullet>F, Val v, Val v')) e1' (addr a\<bullet>compareAndSwap(D\<bullet>F, Val v, Val v')) h xs ta true h' xs"
  "\<lbrakk> heap_read h a (CField D F) v''; v'' \<noteq> v;
     ta1 = \<lbrace> ReadMem a (CField D F) v'' \<rbrace>; ta = \<lbrace> ReadMem a (CField D F) v'' \<rbrace> \<rbrakk>
  \<Longrightarrow> sim_move10 P t ta1 (addr a\<bullet>compareAndSwap(D\<bullet>F, Val v, Val v')) e1' (addr a\<bullet>compareAndSwap(D\<bullet>F, Val v, Val v')) h xs ta false h xs"

  "sim_move10 P t \<epsilon> (null\<bullet>F{D} := Val v) e1' (null\<bullet>F{D} := Val v) h xs \<epsilon> (THROW NullPointer) h xs"
  "sim_move10 P t \<epsilon> ({V':T=None; Val u}) e1' ({V:T=vo; Val u}) h xs \<epsilon> (Val u) h xs"
  "sim_move10 P t \<epsilon> ({V':T=\<lfloor>v\<rfloor>; e}) ({V':T=None; e}) ({V:T=vo; e'}) h xs \<epsilon> ({V:T=vo; e'}) h xs"

  "sim_move10 P t \<epsilon> (sync\<^bsub>V'\<^esub>(null) e0) e1' (sync(null) e1) h xs \<epsilon> (THROW NullPointer) h xs"
  "sim_move10 P t \<epsilon> (Val v;;e0) e1' (Val v;; e1) h xs \<epsilon> e1 h xs"
  "sim_move10 P t \<epsilon> (if (true) e0 else e0') e1' (if (true) e1 else e2) h xs \<epsilon> e1 h xs"
  "sim_move10 P t \<epsilon> (if (false) e0 else e0') e1' (if (false) e1 else e2) h xs \<epsilon> e2 h xs"
  "sim_move10 P t \<epsilon> (throw null) e1' (throw null) h xs \<epsilon> (THROW NullPointer) h xs"
  "sim_move10 P t \<epsilon> (try (Val v) catch(C V') e0) e1' (try (Val v) catch(C V) e1) h xs \<epsilon> (Val v) h xs"
  "\<lbrakk> typeof_addr h a = \<lfloor>Class_type D\<rfloor>; P \<turnstile> D \<preceq>\<^sup>* C \<rbrakk>
  \<Longrightarrow> sim_move10 P t \<epsilon> (try (Throw a) catch(C V') e0) e1' (try (Throw a) catch(C V) e1) h xs \<epsilon> ({V:Class C=\<lfloor>Addr a\<rfloor>; e1}) h xs"
  "sim_move10 P t \<epsilon> (newA T\<lfloor>Throw a\<rceil>) e1' (newA T\<lfloor>Throw a\<rceil>) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (Cast T (Throw a)) e1' (Cast T (Throw a)) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> ((Throw a) instanceof T) e1' ((Throw a) instanceof T) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> ((Throw a) \<guillemotleft>bop\<guillemotright> e0) e1' ((Throw a) \<guillemotleft>bop\<guillemotright> e1) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (Val v \<guillemotleft>bop\<guillemotright> (Throw a)) e1' (Val v \<guillemotleft>bop\<guillemotright> (Throw a)) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (V' := Throw a) e1' (V := Throw a) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (Throw a\<lfloor>e0\<rceil>) e1' (Throw a\<lfloor>e1\<rceil>) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (Val v\<lfloor>Throw a\<rceil>) e1' (Val v\<lfloor>Throw a\<rceil>) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (Throw a\<lfloor>e0\<rceil> := e0') e1' (Throw a\<lfloor>e1\<rceil> := e2) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (Val v\<lfloor>Throw a\<rceil> := e0) e1' (Val v\<lfloor>Throw a\<rceil> := e1) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (Val v\<lfloor>Val v'\<rceil> := Throw a) e1' (Val v\<lfloor>Val v'\<rceil> := Throw a) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (Throw a\<bullet>length) e1' (Throw a\<bullet>length) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (Throw a\<bullet>F{D}) e1' (Throw a\<bullet>F{D}) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (Throw a\<bullet>F{D} := e0) e1' (Throw a\<bullet>F{D} := e1) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (Val v\<bullet>F{D} := Throw a) e1' (Val v\<bullet>F{D} := Throw a) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (CompareAndSwap (Throw a) D F e0 e0') e1' (Throw a\<bullet>compareAndSwap(D\<bullet>F, e1'', e1''')) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (CompareAndSwap (Val v) D F (Throw a) e0') e1' (Val v\<bullet>compareAndSwap(D\<bullet>F, Throw a, e1'')) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (CompareAndSwap (Val v) D F (Val v') (Throw a)) e1' (Val v\<bullet>compareAndSwap(D\<bullet>F, Val v', Throw a)) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (Throw a\<bullet>M(es0)) e1' (Throw a\<bullet>M(es1)) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (Val v\<bullet>M(map Val vs @ Throw a # es0)) e1' (Val v\<bullet>M(map Val vs @ Throw a # es1)) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> ({V':T=None; Throw a}) e1' ({V:T=vo; Throw a}) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (sync\<^bsub>V'\<^esub>(Throw a) e0) e1' (sync(Throw a) e1) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (Throw a;;e0) e1' (Throw a;;e1) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (if (Throw a) e0 else e0') e1' (if (Throw a) e1 else e2) h xs \<epsilon> (Throw a) h xs"
  "sim_move10 P t \<epsilon> (throw (Throw a)) e1' (throw (Throw a)) h xs \<epsilon> (Throw a) h xs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (((((\<lbrakk>(h', a) \<in> allocate h (Class_type C); ta1 = \<lbrace>NewHeapElem a (Class_type C)\<rbrace>; ta = \<lbrace>NewHeapElem a (Class_type C)\<rbrace>\<rbrakk> \<Longrightarrow> sim_move10 P t ta1 (new C) e1' (new C) h xs ta (addr a) h' xs) &&& (allocate h (Class_type C) = {} \<Longrightarrow> sim_move10 P t \<lbrace>\<rbrace> (new C) e1' (new C) h xs \<lbrace>\<rbrace> (Throw (addr_of_sys_xcpt OutOfMemory)) h xs) &&& (\<lbrakk>(h', a) \<in> allocate h (Array_type T (nat (sint i))); 0 \<le>s i; ta1 = \<lbrace>NewHeapElem a (Array_type T (nat (sint i)))\<rbrace>; ta = \<lbrace>NewHeapElem a (Array_type T (nat (sint i)))\<rbrace>\<rbrakk> \<Longrightarrow> sim_move10 P t ta1 (newA T\<lfloor>Val (Intg i)\<rceil>) e1' (newA T\<lfloor>Val (Intg i)\<rceil>) h xs ta (addr a) h' xs)) &&& ((i <s 0 \<Longrightarrow> sim_move10 P t \<lbrace>\<rbrace> (newA T\<lfloor>Val (Intg i)\<rceil>) e1' (newA T\<lfloor>Val (Intg i)\<rceil>) h xs \<lbrace>\<rbrace> (Throw (addr_of_sys_xcpt NegativeArraySize)) h xs) &&& (\<lbrakk>allocate h (Array_type T (nat (sint i))) = {}; 0 \<le>s i\<rbrakk> \<Longrightarrow> sim_move10 P t \<lbrace>\<rbrace> (newA T\<lfloor>Val (Intg i)\<rceil>) e1' (newA T\<lfloor>Val (Intg i)\<rceil>) h xs \<lbrace>\<rbrace> (Throw (addr_of_sys_xcpt OutOfMemory)) h xs)) &&& (\<lbrakk>typeof\<^bsub>h\<^esub> v = \<lfloor>U\<rfloor>; P \<turnstile> U \<le> T\<rbrakk> \<Longrightarrow> sim_move10 P t \<lbrace>\<rbrace> (Cast T (Val v)) e1' (Cast T (Val v)) h xs \<lbrace>\<rbrace> (Val v) h xs) &&& (\<lbrakk>typeof\<^bsub>h\<^esub> v = \<lfloor>U\<rfloor>; \<not> P \<turnstile> U \<le> T\<rbrakk> \<Longrightarrow> sim_move10 P t \<lbrace>\<rbrace> (Cast T (Val v)) e1' (Cast T (Val v)) h xs \<lbrace>\<rbrace> (Throw (addr_of_sys_xcpt ClassCast)) h xs)) &&& (((\<lbrakk>typeof\<^bsub>h\<^esub> v = \<lfloor>U\<rfloor>; b = (v \<noteq> Null \<and> P \<turnstile> U \<le> T)\<rbrakk> \<Longrightarrow> sim_move10 P t \<lbrace>\<rbrace> (Val v instanceof T) e1' (Val v instanceof T) h xs \<lbrace>\<rbrace> (Val (Bool b)) h xs) &&& (binop bop v1 v2 = \<lfloor>Inl v\<rfloor> \<Longrightarrow> sim_move10 P t \<lbrace>\<rbrace> (Val v1 \<guillemotleft>bop\<guillemotright> Val v2) e1' (Val v1 \<guillemotleft>bop\<guillemotright> Val v2) h xs \<lbrace>\<rbrace> (Val v) h xs)) &&& (binop bop v1 v2 = \<lfloor>Inr a\<rfloor> \<Longrightarrow> sim_move10 P t \<lbrace>\<rbrace> (Val v1 \<guillemotleft>bop\<guillemotright> Val v2) e1' (Val v1 \<guillemotleft>bop\<guillemotright> Val v2) h xs \<lbrace>\<rbrace> (Throw a) h xs) &&& (xs V = \<lfloor>v\<rfloor> \<Longrightarrow> sim_move10 P t \<lbrace>\<rbrace> (Var V') e1' (Var V) h xs \<lbrace>\<rbrace> (Val v) h xs)) &&& (sim_move10 P t \<lbrace>\<rbrace> (V':=Val v) e1' (V:=Val v) h xs \<lbrace>\<rbrace> unit h (xs(V \<mapsto> v)) &&& sim_move10 P t \<lbrace>\<rbrace> (null\<lfloor>Val v\<rceil>) e1' (null\<lfloor>Val v\<rceil>) h xs \<lbrace>\<rbrace> (Throw (addr_of_sys_xcpt NullPointer)) h xs) &&& (\<lbrakk>typeof_addr h a = \<lfloor>Array_type T n\<rfloor>; i <s 0 \<or> int n \<le> sint i\<rbrakk> \<Longrightarrow> sim_move10 P t \<lbrace>\<rbrace> (addr a\<lfloor>Val (Intg i)\<rceil>) e1' (addr a\<lfloor>Val (Intg i)\<rceil>) h xs \<lbrace>\<rbrace> (Throw (addr_of_sys_xcpt ArrayIndexOutOfBounds)) h xs) &&& (\<lbrakk>typeof_addr h a = \<lfloor>Array_type T n\<rfloor>; 0 \<le>s i; sint i < int n; heap_read h a (ACell (nat (sint i))) v; ta1 = \<lbrace>ReadMem a (ACell (nat (sint i))) v\<rbrace>; ta = \<lbrace>ReadMem a (ACell (nat (sint i))) v\<rbrace>\<rbrakk> \<Longrightarrow> sim_move10 P t ta1 (addr a\<lfloor>Val (Intg i)\<rceil>) e1' (addr a\<lfloor>Val (Intg i)\<rceil>) h xs ta (Val v) h xs)) &&& (((sim_move10 P t \<lbrace>\<rbrace> (null\<lfloor>Val v\<rceil> := Val v') e1' (null\<lfloor>Val v\<rceil> := Val v') h xs \<lbrace>\<rbrace> (Throw (addr_of_sys_xcpt NullPointer)) h xs &&& (\<lbrakk>typeof_addr h a = \<lfloor>Array_type T n\<rfloor>; i <s 0 \<or> int n \<le> sint i\<rbrakk> \<Longrightarrow> sim_move10 P t \<lbrace>\<rbrace> (addr a\<lfloor>Val (Intg i)\<rceil> := Val v) e1' (addr a\<lfloor>Val (Intg i)\<rceil> := Val v) h xs \<lbrace>\<rbrace> (Throw (addr_of_sys_xcpt ArrayIndexOutOfBounds)) h xs)) &&& (\<lbrakk>typeof_addr h a = \<lfloor>Array_type T n\<rfloor>; 0 \<le>s i; sint i < int n; typeof\<^bsub>h\<^esub> v = \<lfloor>U\<rfloor>; \<not> P \<turnstile> U \<le> T\<rbrakk> \<Longrightarrow> sim_move10 P t \<lbrace>\<rbrace> (addr a\<lfloor>Val (Intg i)\<rceil> := Val v) e1' (addr a\<lfloor>Val (Intg i)\<rceil> := Val v) h xs \<lbrace>\<rbrace> (Throw (addr_of_sys_xcpt ArrayStore)) h xs) &&& (\<lbrakk>typeof_addr h a = \<lfloor>Array_type T n\<rfloor>; 0 \<le>s i; sint i < int n; typeof\<^bsub>h\<^esub> v = \<lfloor>U\<rfloor>; P \<turnstile> U \<le> T; heap_write h a (ACell (nat (sint i))) v h'; ta1 = \<lbrace>WriteMem a (ACell (nat (sint i))) v\<rbrace>; ta = \<lbrace>WriteMem a (ACell (nat (sint i))) v\<rbrace>\<rbrakk> \<Longrightarrow> sim_move10 P t ta1 (addr a\<lfloor>Val (Intg i)\<rceil> := Val v) e1' (addr a\<lfloor>Val (Intg i)\<rceil> := Val v) h xs ta unit h' xs)) &&& ((typeof_addr h a = \<lfloor>Array_type T n\<rfloor> \<Longrightarrow> sim_move10 P t \<lbrace>\<rbrace> (addr a\<bullet>length) e1' (addr a\<bullet>length) h xs \<lbrace>\<rbrace> (Val (Intg (word_of_nat n))) h xs) &&& sim_move10 P t \<lbrace>\<rbrace> (null\<bullet>length) e1' (null\<bullet>length) h xs \<lbrace>\<rbrace> (Throw (addr_of_sys_xcpt NullPointer)) h xs) &&& (\<lbrakk>heap_read h a (CField D F) v; ta1 = \<lbrace>ReadMem a (CField D F) v\<rbrace>; ta = \<lbrace>ReadMem a (CField D F) v\<rbrace>\<rbrakk> \<Longrightarrow> sim_move10 P t ta1 (addr a\<bullet>F{D}) e1' (addr a\<bullet>F{D}) h xs ta (Val v) h xs) &&& sim_move10 P t \<lbrace>\<rbrace> (null\<bullet>F{D}) e1' (null\<bullet>F{D}) h xs \<lbrace>\<rbrace> (Throw (addr_of_sys_xcpt NullPointer)) h xs) &&& (((\<lbrakk>heap_write h a (CField D F) v h'; ta1 = \<lbrace>WriteMem a (CField D F) v\<rbrace>; ta = \<lbrace>WriteMem a (CField D F) v\<rbrace>\<rbrakk> \<Longrightarrow> sim_move10 P t ta1 (addr a\<bullet>F{D} := Val v) e1' (addr a\<bullet>F{D} := Val v) h xs ta unit h' xs) &&& sim_move10 P t \<lbrace>\<rbrace> (null\<bullet>compareAndSwap(D\<bullet>F, Val v, Val v')) e1' (null\<bullet>compareAndSwap(D\<bullet>F, Val v, Val v')) h xs \<lbrace>\<rbrace> (Throw (addr_of_sys_xcpt NullPointer)) h xs) &&& (\<lbrakk>heap_read h a (CField D F) v''; heap_write h a (CField D F) v' h'; v'' = v; ta1 = \<lbrace>ReadMem a (CField D F) v'', WriteMem a (CField D F) v'\<rbrace>; ta = \<lbrace>ReadMem a (CField D F) v'', WriteMem a (CField D F) v'\<rbrace>\<rbrakk> \<Longrightarrow> sim_move10 P t ta1 (addr a\<bullet>compareAndSwap(D\<bullet>F, Val v, Val v')) e1' (addr a\<bullet>compareAndSwap(D\<bullet>F, Val v, Val v')) h xs ta true h' xs) &&& (\<lbrakk>heap_read h a (CField D F) v''; v'' \<noteq> v; ta1 = \<lbrace>ReadMem a (CField D F) v''\<rbrace>; ta = \<lbrace>ReadMem a (CField D F) v''\<rbrace>\<rbrakk> \<Longrightarrow> sim_move10 P t ta1 (addr a\<bullet>compareAndSwap(D\<bullet>F, Val v, Val v')) e1' (addr a\<bullet>compareAndSwap(D\<bullet>F, Val v, Val v')) h xs ta false h xs)) &&& (sim_move10 P t \<lbrace>\<rbrace> (null\<bullet>F{D} := Val v) e1' (null\<bullet>F{D} := Val v) h xs \<lbrace>\<rbrace> (Throw (addr_of_sys_xcpt NullPointer)) h xs &&& sim_move10 P t \<lbrace>\<rbrace> {V':T=None; Val u} e1' {V:T=vo; Val u} h xs \<lbrace>\<rbrace> (Val u) h xs) &&& sim_move10 P t \<lbrace>\<rbrace> {V':T=\<lfloor>v\<rfloor>; e} {V':T=None; e} {V:T=vo; e'} h xs \<lbrace>\<rbrace> {V:T=vo; e'} h xs &&& sim_move10 P t \<lbrace>\<rbrace> (sync\<^bsub>V'\<^esub> (null) e0) e1' (sync(null) e1) h xs \<lbrace>\<rbrace> (Throw (addr_of_sys_xcpt NullPointer)) h xs) &&& (((sim_move10 P t \<lbrace>\<rbrace> (Val v;; e0) e1' (Val v;; e1) h xs \<lbrace>\<rbrace> e1 h xs &&& sim_move10 P t \<lbrace>\<rbrace> (if (true) e0 else e0') e1' (if (true) e1 else e2) h xs \<lbrace>\<rbrace> e1 h xs &&& sim_move10 P t \<lbrace>\<rbrace> (if (false) e0 else e0') e1' (if (false) e1 else e2) h xs \<lbrace>\<rbrace> e2 h xs) &&& (sim_move10 P t \<lbrace>\<rbrace> (throw null) e1' (throw null) h xs \<lbrace>\<rbrace> (Throw (addr_of_sys_xcpt NullPointer)) h xs &&& sim_move10 P t \<lbrace>\<rbrace> (try Val v catch(C V') e0) e1' (try Val v catch(C V) e1) h xs \<lbrace>\<rbrace> (Val v) h xs) &&& (\<lbrakk>typeof_addr h a = \<lfloor>Class_type D\<rfloor>; P \<turnstile> D \<preceq>\<^sup>* C\<rbrakk> \<Longrightarrow> sim_move10 P t \<lbrace>\<rbrace> (try Throw a catch(C V') e0) e1' (try Throw a catch(C V) e1) h xs \<lbrace>\<rbrace> {V:Class C=\<lfloor>Addr a\<rfloor>; e1} h xs) &&& sim_move10 P t \<lbrace>\<rbrace> (newA T\<lfloor>Throw a\<rceil>) e1' (newA T\<lfloor>Throw a\<rceil>) h xs \<lbrace>\<rbrace> (Throw a) h xs) &&& ((sim_move10 P t \<lbrace>\<rbrace> (Cast T (Throw a)) e1' (Cast T (Throw a)) h xs \<lbrace>\<rbrace> (Throw a) h xs &&& sim_move10 P t \<lbrace>\<rbrace> (Throw a instanceof T) e1' (Throw a instanceof T) h xs \<lbrace>\<rbrace> (Throw a) h xs) &&& sim_move10 P t \<lbrace>\<rbrace> (Throw a \<guillemotleft>bop\<guillemotright> e0) e1' (Throw a \<guillemotleft>bop\<guillemotright> e1) h xs \<lbrace>\<rbrace> (Throw a) h xs &&& sim_move10 P t \<lbrace>\<rbrace> (Val v \<guillemotleft>bop\<guillemotright> Throw a) e1' (Val v \<guillemotleft>bop\<guillemotright> Throw a) h xs \<lbrace>\<rbrace> (Throw a) h xs) &&& (sim_move10 P t \<lbrace>\<rbrace> (V':=Throw a) e1' (V:=Throw a) h xs \<lbrace>\<rbrace> (Throw a) h xs &&& sim_move10 P t \<lbrace>\<rbrace> (Throw a\<lfloor>e0\<rceil>) e1' (Throw a\<lfloor>e1\<rceil>) h xs \<lbrace>\<rbrace> (Throw a) h xs) &&& sim_move10 P t \<lbrace>\<rbrace> (Val v\<lfloor>Throw a\<rceil>) e1' (Val v\<lfloor>Throw a\<rceil>) h xs \<lbrace>\<rbrace> (Throw a) h xs &&& sim_move10 P t \<lbrace>\<rbrace> (Throw a\<lfloor>e0\<rceil> := e0') e1' (Throw a\<lfloor>e1\<rceil> := e2) h xs \<lbrace>\<rbrace> (Throw a) h xs) &&& (((sim_move10 P t \<lbrace>\<rbrace> (Val v\<lfloor>Throw a\<rceil> := e0) e1' (Val v\<lfloor>Throw a\<rceil> := e1) h xs \<lbrace>\<rbrace> (Throw a) h xs &&& sim_move10 P t \<lbrace>\<rbrace> (Val v\<lfloor>Val v'\<rceil> := Throw a) e1' (Val v\<lfloor>Val v'\<rceil> := Throw a) h xs \<lbrace>\<rbrace> (Throw a) h xs) &&& sim_move10 P t \<lbrace>\<rbrace> (Throw a\<bullet>length) e1' (Throw a\<bullet>length) h xs \<lbrace>\<rbrace> (Throw a) h xs &&& sim_move10 P t \<lbrace>\<rbrace> (Throw a\<bullet>F{D}) e1' (Throw a\<bullet>F{D}) h xs \<lbrace>\<rbrace> (Throw a) h xs) &&& (sim_move10 P t \<lbrace>\<rbrace> (Throw a\<bullet>F{D} := e0) e1' (Throw a\<bullet>F{D} := e1) h xs \<lbrace>\<rbrace> (Throw a) h xs &&& sim_move10 P t \<lbrace>\<rbrace> (Val v\<bullet>F{D} := Throw a) e1' (Val v\<bullet>F{D} := Throw a) h xs \<lbrace>\<rbrace> (Throw a) h xs) &&& sim_move10 P t \<lbrace>\<rbrace> (Throw a\<bullet>compareAndSwap(D\<bullet>F, e0, e0')) e1' (Throw a\<bullet>compareAndSwap(D\<bullet>F, e1'', e1''')) h xs \<lbrace>\<rbrace> (Throw a) h xs &&& sim_move10 P t \<lbrace>\<rbrace> (Val v\<bullet>compareAndSwap(D\<bullet>F, Throw a, e0')) e1' (Val v\<bullet>compareAndSwap(D\<bullet>F, Throw a, e1'')) h xs \<lbrace>\<rbrace> (Throw a) h xs) &&& ((sim_move10 P t \<lbrace>\<rbrace> (Val v\<bullet>compareAndSwap(D\<bullet>F, Val v', Throw a)) e1' (Val v\<bullet>compareAndSwap(D\<bullet>F, Val v', Throw a)) h xs \<lbrace>\<rbrace> (Throw a) h xs &&& sim_move10 P t \<lbrace>\<rbrace> (Throw a\<bullet>M(es0)) e1' (Throw a\<bullet>M(es1)) h xs \<lbrace>\<rbrace> (Throw a) h xs) &&& sim_move10 P t \<lbrace>\<rbrace> (Val v\<bullet>M(map Val vs @ Throw a # es0)) e1' (Val v\<bullet>M(map Val vs @ Throw a # es1)) h xs \<lbrace>\<rbrace> (Throw a) h xs &&& sim_move10 P t \<lbrace>\<rbrace> {V':T=None; Throw a} e1' {V:T=vo; Throw a} h xs \<lbrace>\<rbrace> (Throw a) h xs) &&& (sim_move10 P t \<lbrace>\<rbrace> (sync\<^bsub>V'\<^esub> (Throw a) e0) e1' (sync(Throw a) e1) h xs \<lbrace>\<rbrace> (Throw a) h xs &&& sim_move10 P t \<lbrace>\<rbrace> (Throw a;; e0) e1' (Throw a;; e1) h xs \<lbrace>\<rbrace> (Throw a) h xs) &&& sim_move10 P t \<lbrace>\<rbrace> (if (Throw a) e0 else e0') e1' (if (Throw a) e1 else e2) h xs \<lbrace>\<rbrace> (Throw a) h xs &&& sim_move10 P t \<lbrace>\<rbrace> (throw (Throw a)) e1' (throw (Throw a)) h xs \<lbrace>\<rbrace> (Throw a) h xs
[PROOF STEP]
apply(fastforce simp add: sim_move10_def no_calls_def no_call_def ta_bisim_def intro: red_reds.intros)+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma [sep_heap_rules]:
"\<lbrakk>(tb, tc) \<in> rp; (eb, ec) \<in> rp\<rbrakk> \<Longrightarrow>
<bdd_relator rp s>
  ifci v tc ec s
<\<lambda>(r,s'). bdd_relator (insert (bf_if v tb eb,r) rp) s'>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(tb, tc) \<in> rp; (eb, ec) \<in> rp\<rbrakk> \<Longrightarrow> <bdd_relator rp s> ifci v tc ec s <\<lambda>(r, s'). bdd_relator (insert (bf_if v tb eb, r) rp) s'>
[PROOF STEP]
text\<open>This probably doesn't hold.\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(tb, tc) \<in> rp; (eb, ec) \<in> rp\<rbrakk> \<Longrightarrow> <bdd_relator rp s> ifci v tc ec s <\<lambda>(r, s'). bdd_relator (insert (bf_if v tb eb, r) rp) s'>
[PROOF STEP]
oops


[STATEMENT]
lemma "P [x, y]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P [x, y]
[PROOF STEP]
refute [expect = potential]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P [x, y]
[PROOF STEP]
oops


[STATEMENT]
lemma "undefined False \<longleftrightarrow> undefined True \<Longrightarrow> x = (y::bool one_or_two)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. undefined False = undefined True \<Longrightarrow> x = y
[PROOF STEP]
nitpick [expect = none]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. undefined False = undefined True \<Longrightarrow> x = y
[PROOF STEP]
sorry


[STATEMENT]
lemma (in B1_algebra) "x = x\<cdot>y\<longrightarrow> x = x\<cdot>y\<^sup>\<star>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x = x \<cdot> y \<longrightarrow> x = x \<cdot> y\<^sup>\<star>
[PROOF STEP]
oops


[STATEMENT]
lemma oneBIT_step1x:
    assumes "x\<noteq>y" "x : {x0,y0}" "y\<in>{x0,y0}"
    shows "BIT_Step (type1 [x0, y0] x y) x = type0 [x0, y0] x y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. type1 [x0, y0] x y \<bind> (\<lambda>s. BIT_step s x \<bind> (\<lambda>(a, is'). return_pmf (step (fst s) x a, is'))) = type0 [x0, y0] x y
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
x \<noteq> y
x \<in> {x0, y0}
y \<in> {x0, y0}

goal (1 subgoal):
 1. type1 [x0, y0] x y \<bind> (\<lambda>s. BIT_step s x \<bind> (\<lambda>(a, is'). return_pmf (step (fst s) x a, is'))) = type0 [x0, y0] x y
[PROOF STEP]
apply(simp add: type1_def BIT_step_def bind_assoc_pmf bind_return_pmf step_def mtf2_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<noteq> y; x = x0 \<or> x = y0; y = x0 \<or> y = y0\<rbrakk> \<Longrightarrow> (y0 = x \<longrightarrow> (x0 = x \<longrightarrow> bernoulli_pmf (1 / 2) \<bind> (\<lambda>xa. bernoulli_pmf (1 / 2) \<bind> (\<lambda>xb. return_pmf (if x \<in> set (fst (if \<not> xa \<and> [] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))) then swaps [index (swaps [] (fst (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x - (if fst (snd (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))) ! index (snd (snd (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x then 0 else length (fst (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))))..<index (swaps [] (fst (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x] (swaps [] (fst (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) else swaps [] (fst (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))), flip (index (snd (snd (if \<not> xa \<and> [] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x) (fst (snd (if \<not> xa \<and> [] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))), snd (snd (if \<not> xa \<and> [] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))))) = type0 [x, x] x y) \<and> (x0 \<noteq> x \<longrightarrow> (x0 = y \<longrightarrow> bernoulli_pmf (1 / 2) \<bind> (\<lambda>xa. bernoulli_pmf (1 / 2) \<bind> (\<lambda>xb. return_pmf (if x \<in> set (fst (if \<not> xb \<and> xa then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))) then swaps [index (swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x - (if fst (snd (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))) ! index (snd (snd (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x then 0 else length (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))))..<index (swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x] (swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) else swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))), flip (index (snd (snd (if \<not> xb \<and> xa then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x) (fst (snd (if \<not> xb \<and> xa then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))), snd (snd (if \<not> xb \<and> xa then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))))) = type0 [y, x] x y) \<and> (x0 \<noteq> y \<longrightarrow> bernoulli_pmf (1 / 2) \<bind> (\<lambda>xa. bernoulli_pmf (1 / 2) \<bind> (\<lambda>xb. return_pmf (if x \<in> set (fst (if \<not> xb \<and> [] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))) then swaps [index (swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x - (if fst (snd (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))) ! index (snd (snd (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x then 0 else length (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))))..<index (swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x] (swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) else swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))), flip (index (snd (snd (if \<not> xb \<and> [] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x) (fst (snd (if \<not> xb \<and> [] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))), snd (snd (if \<not> xb \<and> [] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))))) = type0 [x0, x] x y))) \<and> (y0 \<noteq> x \<longrightarrow> (x0 = x \<longrightarrow> (y0 = y \<longrightarrow> bernoulli_pmf (1 / 2) \<bind> (\<lambda>xa. bernoulli_pmf (1 / 2) \<bind> (\<lambda>xb. return_pmf (if x \<in> set (fst (if \<not> xa \<and> xb then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))) then swaps [index (swaps [] (fst (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x - (if fst (snd (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))) ! index (snd (snd (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x then 0 else length (fst (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))))..<index (swaps [] (fst (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x] (swaps [] (fst (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) else swaps [] (fst (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))), flip (index (snd (snd (if \<not> xa \<and> xb then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x) (fst (snd (if \<not> xa \<and> xb then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))), snd (snd (if \<not> xa \<and> xb then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))))) = type0 [x, y] x y) \<and> (y0 \<noteq> y \<longrightarrow> bernoulli_pmf (1 / 2) \<bind> (\<lambda>xa. bernoulli_pmf (1 / 2) \<bind> (\<lambda>xb. return_pmf (if x \<in> set (fst (if \<not> xa \<and> [] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))) then swaps [index (swaps [] (fst (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x - (if fst (snd (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))) ! index (snd (snd (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x then 0 else length (fst (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))))..<index (swaps [] (fst (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x] (swaps [] (fst (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) else swaps [] (fst (if \<not> [xa, xb] ! 0 \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))), flip (index (snd (snd (if \<not> xa \<and> [] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x) (fst (snd (if \<not> xa \<and> [] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))), snd (snd (if \<not> xa \<and> [] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))))) = type0 [x, y0] x y)) \<and> (x0 \<noteq> x \<longrightarrow> (y0 = y \<longrightarrow> (x0 = y \<longrightarrow> bernoulli_pmf (1 / 2) \<bind> (\<lambda>xa. bernoulli_pmf (1 / 2) \<bind> (\<lambda>xb. return_pmf (if x \<in> set (fst (if \<not> [] ! 0 \<and> xa then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))) then swaps [index (swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x - (if fst (snd (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))) ! index (snd (snd (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x then 0 else length (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))))..<index (swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x] (swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) else swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))), flip (length (snd (snd (if \<not> [] ! 0 \<and> xa then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))))) (fst (snd (if \<not> [] ! 0 \<and> xa then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))), snd (snd (if \<not> [] ! 0 \<and> xa then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))))) = type0 [y, y] x y) \<and> (x0 \<noteq> y \<longrightarrow> bernoulli_pmf (1 / 2) \<bind> (\<lambda>xa. bernoulli_pmf (1 / 2) \<bind> (\<lambda>xb. return_pmf (if x \<in> set (fst (if \<not> [] ! 0 \<and> xb then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))) then swaps [index (swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x - (if fst (snd (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))) ! index (snd (snd (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x then 0 else length (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))))..<index (swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x] (swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) else swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! (index [y0] y + 1) then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))), flip (length (snd (snd (if \<not> [] ! 0 \<and> xb then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))))) (fst (snd (if \<not> [] ! 0 \<and> xb then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))), snd (snd (if \<not> [] ! 0 \<and> xb then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))))) = type0 [x0, y] x y)) \<and> (y0 \<noteq> y \<longrightarrow> (x0 = y \<longrightarrow> bernoulli_pmf (1 / 2) \<bind> (\<lambda>xa. bernoulli_pmf (1 / 2) \<bind> (\<lambda>xb. return_pmf (if x \<in> set (fst (if \<not> [] ! 0 \<and> xa then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))) then swaps [index (swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x - (if fst (snd (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))) ! index (snd (snd (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x then 0 else length (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))))..<index (swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) x] (swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))) else swaps [] (fst (if \<not> [xa, xb] ! (index [y0] x + 1) \<and> [xa, xb] ! 0 then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))), flip (length (snd (snd (if \<not> [] ! 0 \<and> xa then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0]))))) (fst (snd (if \<not> [] ! 0 \<and> xa then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))), snd (snd (if \<not> [] ! 0 \<and> xa then ([y, x], [xa, xb], [x0, y0]) else ([x, y], [xa, xb], [x0, y0])))))) = type0 [y, y0] x y) \<and> (x0 \<noteq> y \<longrightarrow> bernoulli_pmf (1 / 2) \<bind> (\<lambda>xa. bernoulli_pmf (1 / 2) \<bind> (\<lambda>xb. return_pmf ([x, y], [xa, xb], [x0, y0]))) = type0 [x0, y0] x y))))
[PROOF STEP]
apply(safe)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>x0 \<noteq> y0; x = x0; y = y0; y0 \<noteq> x0\<rbrakk> \<Longrightarrow> bernoulli_pmf (1 / 2) \<bind> (\<lambda>x. bernoulli_pmf (1 / 2) \<bind> (\<lambda>xa. return_pmf (if x0 \<in> set (fst (if \<not> x \<and> xa then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0]))) then swaps [index (swaps [] (fst (if \<not> [x, xa] ! 0 \<and> [x, xa] ! (index [y0] y0 + 1) then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0])))) x0 - (if fst (snd (if \<not> [x, xa] ! 0 \<and> [x, xa] ! (index [y0] y0 + 1) then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0]))) ! index (snd (snd (if \<not> [x, xa] ! 0 \<and> [x, xa] ! (index [y0] y0 + 1) then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0])))) x0 then 0 else length (fst (if \<not> [x, xa] ! 0 \<and> [x, xa] ! (index [y0] y0 + 1) then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0]))))..<index (swaps [] (fst (if \<not> [x, xa] ! 0 \<and> [x, xa] ! (index [y0] y0 + 1) then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0])))) x0] (swaps [] (fst (if \<not> [x, xa] ! 0 \<and> [x, xa] ! (index [y0] y0 + 1) then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0])))) else swaps [] (fst (if \<not> [x, xa] ! 0 \<and> [x, xa] ! (index [y0] y0 + 1) then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0]))), flip (index (snd (snd (if \<not> x \<and> xa then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0])))) x0) (fst (snd (if \<not> x \<and> xa then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0])))), snd (snd (if \<not> x \<and> xa then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0])))))) = type0 [x0, y0] x0 y0
 2. \<lbrakk>y0 \<noteq> x0; x = y0; y = x0; x0 \<noteq> y0\<rbrakk> \<Longrightarrow> bernoulli_pmf (1 / 2) \<bind> (\<lambda>x. bernoulli_pmf (1 / 2) \<bind> (\<lambda>xa. return_pmf (if y0 \<in> set (fst (if \<not> xa \<and> x then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))) then swaps [index (swaps [] (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) y0 - (if fst (snd (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))) ! index (snd (snd (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) y0 then 0 else length (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))))..<index (swaps [] (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) y0] (swaps [] (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) else swaps [] (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))), flip (index (snd (snd (if \<not> xa \<and> x then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) y0) (fst (snd (if \<not> xa \<and> x then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))), snd (snd (if \<not> xa \<and> x then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))))) = type0 [x0, y0] y0 x0
[PROOF STEP]
apply(rule pmf_eqI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>i. \<lbrakk>x0 \<noteq> y0; x = x0; y = y0; y0 \<noteq> x0\<rbrakk> \<Longrightarrow> pmf (bernoulli_pmf (1 / 2) \<bind> (\<lambda>x. bernoulli_pmf (1 / 2) \<bind> (\<lambda>xa. return_pmf (if x0 \<in> set (fst (if \<not> x \<and> xa then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0]))) then swaps [index (swaps [] (fst (if \<not> [x, xa] ! 0 \<and> [x, xa] ! (index [y0] y0 + 1) then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0])))) x0 - (if fst (snd (if \<not> [x, xa] ! 0 \<and> [x, xa] ! (index [y0] y0 + 1) then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0]))) ! index (snd (snd (if \<not> [x, xa] ! 0 \<and> [x, xa] ! (index [y0] y0 + 1) then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0])))) x0 then 0 else length (fst (if \<not> [x, xa] ! 0 \<and> [x, xa] ! (index [y0] y0 + 1) then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0]))))..<index (swaps [] (fst (if \<not> [x, xa] ! 0 \<and> [x, xa] ! (index [y0] y0 + 1) then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0])))) x0] (swaps [] (fst (if \<not> [x, xa] ! 0 \<and> [x, xa] ! (index [y0] y0 + 1) then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0])))) else swaps [] (fst (if \<not> [x, xa] ! 0 \<and> [x, xa] ! (index [y0] y0 + 1) then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0]))), flip (index (snd (snd (if \<not> x \<and> xa then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0])))) x0) (fst (snd (if \<not> x \<and> xa then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0])))), snd (snd (if \<not> x \<and> xa then ([y0, x0], [x, xa], [x0, y0]) else ([x0, y0], [x, xa], [x0, y0]))))))) i = pmf (type0 [x0, y0] x0 y0) i
 2. \<lbrakk>y0 \<noteq> x0; x = y0; y = x0; x0 \<noteq> y0\<rbrakk> \<Longrightarrow> bernoulli_pmf (1 / 2) \<bind> (\<lambda>x. bernoulli_pmf (1 / 2) \<bind> (\<lambda>xa. return_pmf (if y0 \<in> set (fst (if \<not> xa \<and> x then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))) then swaps [index (swaps [] (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) y0 - (if fst (snd (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))) ! index (snd (snd (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) y0 then 0 else length (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))))..<index (swaps [] (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) y0] (swaps [] (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) else swaps [] (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))), flip (index (snd (snd (if \<not> xa \<and> x then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) y0) (fst (snd (if \<not> xa \<and> x then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))), snd (snd (if \<not> xa \<and> x then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))))) = type0 [x0, y0] y0 x0
[PROOF STEP]
apply(simp add: pmf_bind swap_def type0_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>y0 \<noteq> x0; x = y0; y = x0; x0 \<noteq> y0\<rbrakk> \<Longrightarrow> bernoulli_pmf (1 / 2) \<bind> (\<lambda>x. bernoulli_pmf (1 / 2) \<bind> (\<lambda>xa. return_pmf (if y0 \<in> set (fst (if \<not> xa \<and> x then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))) then swaps [index (swaps [] (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) y0 - (if fst (snd (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))) ! index (snd (snd (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) y0 then 0 else length (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))))..<index (swaps [] (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) y0] (swaps [] (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) else swaps [] (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))), flip (index (snd (snd (if \<not> xa \<and> x then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) y0) (fst (snd (if \<not> xa \<and> x then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))), snd (snd (if \<not> xa \<and> x then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))))) = type0 [x0, y0] y0 x0
[PROOF STEP]
apply(rule pmf_eqI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i. \<lbrakk>y0 \<noteq> x0; x = y0; y = x0; x0 \<noteq> y0\<rbrakk> \<Longrightarrow> pmf (bernoulli_pmf (1 / 2) \<bind> (\<lambda>x. bernoulli_pmf (1 / 2) \<bind> (\<lambda>xa. return_pmf (if y0 \<in> set (fst (if \<not> xa \<and> x then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))) then swaps [index (swaps [] (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) y0 - (if fst (snd (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))) ! index (snd (snd (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) y0 then 0 else length (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))))..<index (swaps [] (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) y0] (swaps [] (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) else swaps [] (fst (if \<not> [x, xa] ! (index [y0] y0 + 1) \<and> [x, xa] ! 0 then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))), flip (index (snd (snd (if \<not> xa \<and> x then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))) y0) (fst (snd (if \<not> xa \<and> x then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0])))), snd (snd (if \<not> xa \<and> x then ([x0, y0], [x, xa], [x0, y0]) else ([y0, x0], [x, xa], [x0, y0]))))))) i = pmf (type0 [x0, y0] y0 x0) i
[PROOF STEP]
apply(simp add: add.commute pmf_bind swap_def type0_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma retrieve_stored_tval_u16:
  assumes "val = Uint16_v v"
  shows "retrieve_tval (store_tval obj off val) off (memval_type val) b = val"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. retrieve_tval (store_tval obj off val) off (memval_type val) b = val
[PROOF STEP]
unfolding retrieve_tval_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if is_contiguous_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau> then case memval_type val of Uint8 \<Rightarrow> Uint8_v (decode_u8_list (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Sint8 \<Rightarrow> Sint8_v (UCAST(8 \<rightarrow> 8 signed) (decode_u8_list (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>))) | Uint16 \<Rightarrow> Uint16_v (cat_u16 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Sint16 \<Rightarrow> Sint16_v (cat_s16 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Uint32 \<Rightarrow> Uint32_v (cat_u32 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Sint32 \<Rightarrow> Sint32_v (cat_s32 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Uint64 \<Rightarrow> Uint64_v (cat_u64 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Sint64 \<Rightarrow> Sint64_v (cat_s64 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Cap \<Rightarrow> if is_contiguous_zeros (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau> then Cap_v NULL else Undef else if is_cap (content (store_tval obj off val)) off then let cap = get_cap (content (store_tval obj off val)) off; tv = the (Mapping.lookup (tags (store_tval obj off val)) (cap_offset off)); t = case b of True \<Rightarrow> tv | False \<Rightarrow> False; cv = mem_capability.extend cap \<lparr>tag = t\<rparr>; nth_frag = of_nth (the (Mapping.lookup (content (store_tval obj off val)) off)) in case memval_type val of Uint8 \<Rightarrow> Cap_v_frag (mem_capability.extend cap \<lparr>tag = False\<rparr>) nth_frag | Sint8 \<Rightarrow> Cap_v_frag (mem_capability.extend cap \<lparr>tag = False\<rparr>) nth_frag | Cap \<Rightarrow> if is_contiguous_cap (content (store_tval obj off val)) cap off |memval_type val|\<^sub>\<tau> then Cap_v cv else Undef | _ \<Rightarrow> Undef else Undef) = val
[PROOF STEP]
proof (clarsimp simp add: assms stored_tval_contiguous_bytes; safe)
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint16_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
 2. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint16_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off))\<rbrakk> \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
 3. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
 4. off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
 5. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
 6. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
[PROOF STEP]
show "\<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint16_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off));
     is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk>
    \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint16_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
[PROOF STEP]
by (presburger add: decode_encoded_u16_in_mem)
[PROOF STATE]
proof (state)
this:
\<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint16_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v

goal (5 subgoals):
 1. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint16_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off))\<rbrakk> \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
 2. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
 3. off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
 4. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
 5. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint16_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off))\<rbrakk> \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
 2. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
 3. off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
 4. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
 5. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
[PROOF STEP]
show "\<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint16_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off))\<rbrakk>
    \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint16_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off))\<rbrakk> \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
[PROOF STEP]
by (metis ccval.distinct(49) ccval.distinct(51) ccval.distinct(53) is_contiguous_bytes.simps(2) memval_size_u16 numeral_2_eq_2 stored_tval_contiguous_bytes)
[PROOF STATE]
proof (state)
this:
\<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint16_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off))\<rbrakk> \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>

goal (4 subgoals):
 1. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
 2. off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
 3. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
 4. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
 2. off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
 3. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
 4. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
[PROOF STEP]
show "\<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk>
    \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
[PROOF STEP]
by (presburger add: decode_encoded_u16_in_mem)
[PROOF STATE]
proof (state)
this:
\<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v

goal (3 subgoals):
 1. off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
 2. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
 3. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
 2. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
 3. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
[PROOF STEP]
show "off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
[PROOF STEP]
by (metis Suc_1 ccval.distinct(49) ccval.distinct(51) ccval.distinct(53) is_contiguous_bytes.simps(2) memval_size_u16 stored_tval_contiguous_bytes)
[PROOF STATE]
proof (state)
this:
off \<notin> Mapping.keys (content (store_tval obj off (Uint16_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>

goal (2 subgoals):
 1. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
 2. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
 2. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
[PROOF STEP]
show "\<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk>
    \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v
[PROOF STEP]
by (presburger add: decode_encoded_u16_in_mem)
[PROOF STATE]
proof (state)
this:
\<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u16 (retrieve_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>) = v

goal (1 subgoal):
 1. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
[PROOF STEP]
show "memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>
[PROOF STEP]
by (metis cctype.simps(75) ccval.distinct(49) ccval.distinct(51) ccval.distinct(53) memval_size_u16 sizeof_def stored_tval_contiguous_bytes)
[PROOF STATE]
proof (state)
this:
memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint16_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint16_v v))) off |Uint16|\<^sub>\<tau>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma WT_callee_real1: "((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<turnstile>c
  (key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s \<surd>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<turnstile>c (key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s \<surd>
[PROOF STEP]
apply(rule WT_calleeI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>call ret sa. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call)\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
[PROOF STEP]
apply(cases s)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>call ret sa a b c. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c)\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
[PROOF STEP]
apply(case_tac call)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>call ret sa a b c aa. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
 2. \<And>call ret sa a b c ba. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
[PROOF STEP]
apply(rename_tac [!] x)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>call ret sa a b c x. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inl x\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
 2. \<And>call ret sa a b c x. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inr x\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
[PROOF STEP]
apply(case_tac [!] x)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>call ret sa a b c x aa. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inl x; x = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
 2. \<And>call ret sa a b c x ba. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inl x; x = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
 3. \<And>call ret sa a b c x aa. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
 4. \<And>call ret sa a b c x ba. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inr x; x = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
[PROOF STEP]
apply(rename_tac [!] y)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>call ret sa a b c x y. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inl x; x = Inl y\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
 2. \<And>call ret sa a b c x y. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inl x; x = Inr y\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
 3. \<And>call ret sa a b c x y. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
 4. \<And>call ret sa a b c x y. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inr x; x = Inr y\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
[PROOF STEP]
apply(case_tac [!] y)
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inl x; x = Inl y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
 2. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inl x; x = Inl y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
 3. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inl x; x = Inr y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
 4. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inl x; x = Inr y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
 5. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
 6. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
 7. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inr x; x = Inr y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
 8. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))); (ret, sa) \<in> set_spmf ((key.fuse key_rest \<ddagger>\<^sub>O auth.fuse auth_rest) s call); s = (a, b, c); call = Inr x; x = Inr y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full))) call
[PROOF STEP]
by(auto simp add: fused_resource.fuse.simps)