[STATEMENT]
lemma (in simplification) split_INV1_step:
  assumes "split_INV1 Q (\<Q>fin, \<Q>inf)" "(Qfin, Qeq) \<in> fixfree \<Q>fin" "x \<in> nongens Qfin" "cov x Qfin G"
  shows "split_INV1 Q
    (insert (simp (Conj Qfin (DISJ (qps G))), Qeq)
      (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G),
    insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf)"
    (is "split_INV1 Q (?Qfin, ?Qinf)")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. split_INV1 Q (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G), insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf)
[PROOF STEP]
proof (intro split_INV1_I EVAL'_I, goal_cases wf fin inf)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. wf_state Q rrb (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G), insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf)
 2. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}\<rbrakk> \<Longrightarrow> eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I
 3. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
case wf
[PROOF STATE]
proof (state)
this:

goal (3 subgoals):
 1. wf_state Q rrb (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G), insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf)
 2. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}\<rbrakk> \<Longrightarrow> eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I
 3. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
from assms(1)
[PROOF STATE]
proof (chain)
picking this:
split_INV1 Q (\<Q>fin, \<Q>inf)
[PROOF STEP]
have wf: "wf_state Q rrb (\<Q>fin, \<Q>inf)"
[PROOF STATE]
proof (prove)
using this:
split_INV1 Q (\<Q>fin, \<Q>inf)

goal (1 subgoal):
 1. wf_state Q rrb (\<Q>fin, \<Q>inf)
[PROOF STEP]
by (auto simp: split_INV1_def)
[PROOF STATE]
proof (state)
this:
wf_state Q rrb (\<Q>fin, \<Q>inf)

goal (3 subgoals):
 1. wf_state Q rrb (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G), insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf)
 2. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}\<rbrakk> \<Longrightarrow> eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I
 3. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
with assms(2,3)
[PROOF STATE]
proof (chain)
picking this:
(Qfin, Qeq) \<in> fixfree \<Q>fin
x \<in> nongens Qfin
wf_state Q rrb (\<Q>fin, \<Q>inf)
[PROOF STEP]
obtain xys where *:
    "x \<in> fv Qfin" "(Qfin, Qeq) \<in> \<Q>fin" "finite \<Q>fin" "finite Qeq" "finite \<Q>inf" "fv Qfin \<subseteq> fv Q" "Field Qeq \<subseteq> fv Q"
    "distinct xys" "leftfresh Qfin xys" "set xys = Qeq" "rrb Qfin" "irrefl Qeq"
[PROOF STATE]
proof (prove)
using this:
(Qfin, Qeq) \<in> fixfree \<Q>fin
x \<in> nongens Qfin
wf_state Q rrb (\<Q>fin, \<Q>inf)

goal (1 subgoal):
 1. (\<And>xys. \<lbrakk>x \<in> fv Qfin; (Qfin, Qeq) \<in> \<Q>fin; finite \<Q>fin; finite Qeq; finite \<Q>inf; fv Qfin \<subseteq> fv Q; Field Qeq \<subseteq> fv Q; distinct xys; leftfresh Qfin xys; set xys = Qeq; rrb Qfin; irrefl Qeq\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (auto simp: fixfree_def nongens_def wf_state_def)
[PROOF STATE]
proof (state)
this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
distinct xys
leftfresh Qfin xys
set xys = Qeq
rrb Qfin
irrefl Qeq

goal (3 subgoals):
 1. wf_state Q rrb (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G), insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf)
 2. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}\<rbrakk> \<Longrightarrow> eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I
 3. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
distinct xys
leftfresh Qfin xys
set xys = Qeq
rrb Qfin
irrefl Qeq

goal (3 subgoals):
 1. wf_state Q rrb (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G), insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf)
 2. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}\<rbrakk> \<Longrightarrow> eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I
 3. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
from *
[PROOF STATE]
proof (chain)
picking this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
distinct xys
leftfresh Qfin xys
set xys = Qeq
rrb Qfin
irrefl Qeq
[PROOF STEP]
have "\<exists>xs. leftfresh (simp (Conj Qfin (DISJ (qps G)))) xs \<and> distinct xs \<and> set xs = set xys"
[PROOF STATE]
proof (prove)
using this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
distinct xys
leftfresh Qfin xys
set xys = Qeq
rrb Qfin
irrefl Qeq

goal (1 subgoal):
 1. \<exists>xs. leftfresh (simp (Conj Qfin (DISJ (qps G)))) xs \<and> distinct xs \<and> set xs = set xys
[PROOF STEP]
using cov_fv[OF assms(4) _ qps_in] assms(4)
[PROOF STATE]
proof (prove)
using this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
distinct xys
leftfresh Qfin xys
set xys = Qeq
rrb Qfin
irrefl Qeq
\<lbrakk>x \<in> fv Qfin; ?Qqp \<in> qps G\<rbrakk> \<Longrightarrow> x \<in> fv ?Qqp \<and> fv ?Qqp \<subseteq> fv Qfin
cov x Qfin G

goal (1 subgoal):
 1. \<exists>xs. leftfresh (simp (Conj Qfin (DISJ (qps G)))) xs \<and> distinct xs \<and> set xs = set xys
[PROOF STEP]
by (intro exI[of _ xys])
      (force elim!: leftfresh_fv_subset dest!: fv_simp[THEN set_mp] fv_DISJ[THEN set_mp, rotated 1])
[PROOF STATE]
proof (state)
this:
\<exists>xs. leftfresh (simp (Conj Qfin (DISJ (qps G)))) xs \<and> distinct xs \<and> set xs = set xys

goal (3 subgoals):
 1. wf_state Q rrb (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G), insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf)
 2. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}\<rbrakk> \<Longrightarrow> eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I
 3. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<exists>xs. leftfresh (simp (Conj Qfin (DISJ (qps G)))) xs \<and> distinct xs \<and> set xs = set xys

goal (3 subgoals):
 1. wf_state Q rrb (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G), insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf)
 2. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}\<rbrakk> \<Longrightarrow> eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I
 3. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
from *
[PROOF STATE]
proof (chain)
picking this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
distinct xys
leftfresh Qfin xys
set xys = Qeq
rrb Qfin
irrefl Qeq
[PROOF STEP]
have "\<exists>xs. leftfresh (cp (Qfin[x \<^bold>\<rightarrow> z])) xs \<and> distinct xs \<and> set xs = insert (x, z) (set xys)"
    if "z \<in> eqs x G" for z
[PROOF STATE]
proof (prove)
using this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
distinct xys
leftfresh Qfin xys
set xys = Qeq
rrb Qfin
irrefl Qeq

goal (1 subgoal):
 1. \<exists>xs. leftfresh (cp (Qfin[x \<^bold>\<rightarrow> z])) xs \<and> distinct xs \<and> set xs = insert (x, z) (set xys)
[PROOF STEP]
using cov_fv[OF assms(4) _ eqs_in, of z x] assms(4) that
[PROOF STATE]
proof (prove)
using this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
distinct xys
leftfresh Qfin xys
set xys = Qeq
rrb Qfin
irrefl Qeq
\<lbrakk>x \<in> fv Qfin; z \<in> eqs x G\<rbrakk> \<Longrightarrow> x \<in> fv (x \<approx> z) \<and> fv (x \<approx> z) \<subseteq> fv Qfin
cov x Qfin G
z \<in> eqs x G

goal (1 subgoal):
 1. \<exists>xs. leftfresh (cp (Qfin[x \<^bold>\<rightarrow> z])) xs \<and> distinct xs \<and> set xs = insert (x, z) (set xys)
[PROOF STEP]
by (intro exI[of _ "if (x, z) \<in> set xys then xys else (x, z) # xys"])
      (auto simp: fv_subst dest!: fv_cp[THEN set_mp] elim!: leftfresh_fv_subset)
[PROOF STATE]
proof (state)
this:
?z1 \<in> eqs x G \<Longrightarrow> \<exists>xs. leftfresh (cp (Qfin[x \<^bold>\<rightarrow> ?z1])) xs \<and> distinct xs \<and> set xs = insert (x, ?z1) (set xys)

goal (3 subgoals):
 1. wf_state Q rrb (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G), insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf)
 2. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}\<rbrakk> \<Longrightarrow> eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I
 3. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
distinct xys
leftfresh Qfin xys
set xys = Qeq
rrb Qfin
irrefl Qeq
\<exists>xs. leftfresh (simp (Conj Qfin (DISJ (qps G)))) xs \<and> distinct xs \<and> set xs = set xys
?z1 \<in> eqs x G \<Longrightarrow> \<exists>xs. leftfresh (cp (Qfin[x \<^bold>\<rightarrow> ?z1])) xs \<and> distinct xs \<and> set xs = insert (x, ?z1) (set xys)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
distinct xys
leftfresh Qfin xys
set xys = Qeq
rrb Qfin
irrefl Qeq
\<exists>xs. leftfresh (simp (Conj Qfin (DISJ (qps G)))) xs \<and> distinct xs \<and> set xs = set xys
?z1 \<in> eqs x G \<Longrightarrow> \<exists>xs. leftfresh (cp (Qfin[x \<^bold>\<rightarrow> ?z1])) xs \<and> distinct xs \<and> set xs = insert (x, ?z1) (set xys)

goal (1 subgoal):
 1. wf_state Q rrb (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G), insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf)
[PROOF STEP]
using cov_fv[OF assms(4) _ qps_in] cov_fv[OF assms(4) _ eqs_in] assms(4)
[PROOF STATE]
proof (prove)
using this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
distinct xys
leftfresh Qfin xys
set xys = Qeq
rrb Qfin
irrefl Qeq
\<exists>xs. leftfresh (simp (Conj Qfin (DISJ (qps G)))) xs \<and> distinct xs \<and> set xs = set xys
?z1 \<in> eqs x G \<Longrightarrow> \<exists>xs. leftfresh (cp (Qfin[x \<^bold>\<rightarrow> ?z1])) xs \<and> distinct xs \<and> set xs = insert (x, ?z1) (set xys)
\<lbrakk>x \<in> fv Qfin; ?Qqp \<in> qps G\<rbrakk> \<Longrightarrow> x \<in> fv ?Qqp \<and> fv ?Qqp \<subseteq> fv Qfin
\<lbrakk>x \<in> fv Qfin; ?y1 \<in> eqs ?x1 G\<rbrakk> \<Longrightarrow> x \<in> fv (?x1 \<approx> ?y1) \<and> fv (?x1 \<approx> ?y1) \<subseteq> fv Qfin
cov x Qfin G

goal (1 subgoal):
 1. wf_state Q rrb (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G), insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf)
[PROOF STEP]
by (intro wf_state_Un wf_state_Diff wf)
      (auto simp: wf_state_def rrb_simp simplified_simp simplified_cp rrb_cp_subst fv_subst
      subset_eq irrefl_def
      dest!: fv_cp[THEN set_mp] fv_simp[THEN set_mp] fv_DISJ[THEN set_mp, rotated 1])
[PROOF STATE]
proof (state)
this:
wf_state Q rrb (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G), insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf)

goal (2 subgoals):
 1. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}\<rbrakk> \<Longrightarrow> eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I
 2. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}\<rbrakk> \<Longrightarrow> eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I
 2. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
case (fin I)
[PROOF STATE]
proof (state)
this:
finite (adom I)
eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}

goal (2 subgoals):
 1. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}\<rbrakk> \<Longrightarrow> eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I
 2. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
note eq = trans[OF sat_simp sat_DISJ, symmetric]
[PROOF STATE]
proof (state)
this:
finite ?G \<Longrightarrow> (\<exists>Q\<in>?G. sat Q ?I ?\<sigma>) = sat (simp (DISJ ?G)) ?I ?\<sigma>

goal (2 subgoals):
 1. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}\<rbrakk> \<Longrightarrow> eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I
 2. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
split_INV1 Q (\<Q>fin, \<Q>inf)
(Qfin, Qeq) \<in> fixfree \<Q>fin
x \<in> nongens Qfin
cov x Qfin G
[PROOF STEP]
have *:
    "x \<in> fv Qfin" "(Qfin, Qeq) \<in> \<Q>fin" "fv Qfin \<subseteq> fv Q" "Field Qeq \<subseteq> fv Q" and
    finite[simp]: "finite \<Q>fin" "finite Qeq" "finite \<Q>inf"
[PROOF STATE]
proof (prove)
using this:
split_INV1 Q (\<Q>fin, \<Q>inf)
(Qfin, Qeq) \<in> fixfree \<Q>fin
x \<in> nongens Qfin
cov x Qfin G

goal (1 subgoal):
 1. ((x \<in> fv Qfin &&& (Qfin, Qeq) \<in> \<Q>fin) &&& fv Qfin \<subseteq> fv Q &&& Field Qeq \<subseteq> fv Q) &&& finite \<Q>fin &&& finite Qeq &&& finite \<Q>inf
[PROOF STEP]
by (auto simp: split_INV1_def fixfree_def nongens_def wf_state_def)
[PROOF STATE]
proof (state)
this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
finite \<Q>fin
finite Qeq
finite \<Q>inf

goal (2 subgoals):
 1. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}\<rbrakk> \<Longrightarrow> eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I
 2. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
with fin
[PROOF STATE]
proof (chain)
picking this:
finite (adom I)
eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
finite \<Q>fin
finite Qeq
finite \<Q>inf
[PROOF STEP]
have unsat: "\<forall>\<sigma>. \<not> sat (Qfin \<^bold>\<bottom> x) I \<sigma>" and "\<forall>x\<in>\<Q>inf. \<forall>\<sigma>. \<not> sat x I \<sigma>"
[PROOF STATE]
proof (prove)
using this:
finite (adom I)
eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
finite \<Q>fin
finite Qeq
finite \<Q>inf

goal (1 subgoal):
 1. \<forall>\<sigma>. \<not> sat (Qfin \<^bold>\<bottom> x) I \<sigma> &&& \<forall>x\<in>\<Q>inf. \<forall>\<sigma>. \<not> sat x I \<sigma>
[PROOF STEP]
by (auto simp: eval_empty_close eval_simp_DISJ_closed)
[PROOF STATE]
proof (state)
this:
\<forall>\<sigma>. \<not> sat (Qfin \<^bold>\<bottom> x) I \<sigma>
\<forall>x\<in>\<Q>inf. \<forall>\<sigma>. \<not> sat x I \<sigma>

goal (2 subgoals):
 1. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}\<rbrakk> \<Longrightarrow> eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I
 2. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
with fin(1) assms(1) *
[PROOF STATE]
proof (chain)
picking this:
finite (adom I)
split_INV1 Q (\<Q>fin, \<Q>inf)
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
\<forall>\<sigma>. \<not> sat (Qfin \<^bold>\<bottom> x) I \<sigma>
\<forall>x\<in>\<Q>inf. \<forall>\<sigma>. \<not> sat x I \<sigma>
[PROOF STEP]
have "eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I"
[PROOF STATE]
proof (prove)
using this:
finite (adom I)
split_INV1 Q (\<Q>fin, \<Q>inf)
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
\<forall>\<sigma>. \<not> sat (Qfin \<^bold>\<bottom> x) I \<sigma>
\<forall>x\<in>\<Q>inf. \<forall>\<sigma>. \<not> sat x I \<sigma>

goal (1 subgoal):
 1. eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I
[PROOF STEP]
unfolding split_INV1_def Let_def assemble_def prod.case EVAL'_def
[PROOF STATE]
proof (prove)
using this:
finite (adom I)
wf_state Q rrb (\<Q>fin, \<Q>inf) \<and> (\<forall>I. finite (adom I) \<longrightarrow> (if eval (simp (DISJ (close ` \<Q>inf))) I = {} then eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I else infinite (eval Q I)))
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
\<forall>\<sigma>. \<not> sat (Qfin \<^bold>\<bottom> x) I \<sigma>
\<forall>x\<in>\<Q>inf. \<forall>\<sigma>. \<not> sat x I \<sigma>

goal (1 subgoal):
 1. eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I
[PROOF STEP]
by (auto simp: eval_empty_close eval_simp_DISJ_closed)
[PROOF STATE]
proof (state)
this:
eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I

goal (2 subgoals):
 1. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I = {}\<rbrakk> \<Longrightarrow> eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I
 2. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
with assms(4)
[PROOF STATE]
proof (chain)
picking this:
cov x Qfin G
eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
cov x Qfin G
eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I

goal (1 subgoal):
 1. eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I
[PROOF STEP]
proof (elim trans[rotated], intro eval_on_cong box_equals[OF _ eq eq])
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> (\<exists>Q\<in>CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G). sat Q I \<sigma>) = (\<exists>Q\<in>CONJ_disjoint ` \<Q>fin. sat Q I \<sigma>)
 2. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> finite (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G))
 3. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> finite (CONJ_disjoint ` \<Q>fin)
[PROOF STEP]
fix \<sigma>
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> (\<exists>Q\<in>CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G). sat Q I \<sigma>) = (\<exists>Q\<in>CONJ_disjoint ` \<Q>fin. sat Q I \<sigma>)
 2. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> finite (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G))
 3. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> finite (CONJ_disjoint ` \<Q>fin)
[PROOF STEP]
from *
[PROOF STATE]
proof (chain)
picking this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
[PROOF STEP]
have "(\<exists>Q\<in>\<Q>fin. sat (CONJ_disjoint Q) I \<sigma>) \<longleftrightarrow>
        sat (CONJ_disjoint (Qfin, Qeq)) I \<sigma> \<or> (\<exists>Q\<in>\<Q>fin - {(Qfin, Qeq)}. sat (CONJ_disjoint Q) I \<sigma>)"
[PROOF STATE]
proof (prove)
using this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q

goal (1 subgoal):
 1. (\<exists>Q\<in>\<Q>fin. sat (CONJ_disjoint Q) I \<sigma>) = (sat (CONJ_disjoint (Qfin, Qeq)) I \<sigma> \<or> (\<exists>Q\<in>\<Q>fin - {(Qfin, Qeq)}. sat (CONJ_disjoint Q) I \<sigma>))
[PROOF STEP]
using assms(4)
[PROOF STATE]
proof (prove)
using this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
cov x Qfin G

goal (1 subgoal):
 1. (\<exists>Q\<in>\<Q>fin. sat (CONJ_disjoint Q) I \<sigma>) = (sat (CONJ_disjoint (Qfin, Qeq)) I \<sigma> \<or> (\<exists>Q\<in>\<Q>fin - {(Qfin, Qeq)}. sat (CONJ_disjoint Q) I \<sigma>))
[PROOF STEP]
by (auto simp: fixfree_def)
[PROOF STATE]
proof (state)
this:
(\<exists>Q\<in>\<Q>fin. sat (CONJ_disjoint Q) I \<sigma>) = (sat (CONJ_disjoint (Qfin, Qeq)) I \<sigma> \<or> (\<exists>Q\<in>\<Q>fin - {(Qfin, Qeq)}. sat (CONJ_disjoint Q) I \<sigma>))

goal (3 subgoals):
 1. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> (\<exists>Q\<in>CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G). sat Q I \<sigma>) = (\<exists>Q\<in>CONJ_disjoint ` \<Q>fin. sat Q I \<sigma>)
 2. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> finite (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G))
 3. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> finite (CONJ_disjoint ` \<Q>fin)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<exists>Q\<in>\<Q>fin. sat (CONJ_disjoint Q) I \<sigma>) = (sat (CONJ_disjoint (Qfin, Qeq)) I \<sigma> \<or> (\<exists>Q\<in>\<Q>fin - {(Qfin, Qeq)}. sat (CONJ_disjoint Q) I \<sigma>))

goal (3 subgoals):
 1. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> (\<exists>Q\<in>CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G). sat Q I \<sigma>) = (\<exists>Q\<in>CONJ_disjoint ` \<Q>fin. sat Q I \<sigma>)
 2. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> finite (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G))
 3. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> finite (CONJ_disjoint ` \<Q>fin)
[PROOF STEP]
have "sat (CONJ_disjoint (Qfin, Qeq)) I \<sigma> \<longleftrightarrow>
        sat (CONJ_disjoint (simp (Conj Qfin (DISJ (qps G))), Qeq)) I \<sigma> \<or>
        (\<exists>Q\<in>(\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G. sat (CONJ_disjoint Q) I \<sigma>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sat (CONJ_disjoint (Qfin, Qeq)) I \<sigma> = (sat (CONJ_disjoint (simp (Conj Qfin (DISJ (qps G))), Qeq)) I \<sigma> \<or> (\<exists>Q\<in>(\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G. sat (CONJ_disjoint Q) I \<sigma>))
[PROOF STEP]
using cov_sat_fin[of x Qfin G I \<sigma>] assms(3,4) fin(1) unsat
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>cov x Qfin G; x \<in> fv Qfin; finite (adom I); \<And>\<sigma>. \<not> sat (Qfin \<^bold>\<bottom> x) I \<sigma>\<rbrakk> \<Longrightarrow> sat Qfin I \<sigma> = sat (Disj (simp (Conj Qfin (DISJ (qps G)))) (DISJ ((\<lambda>y. Conj (cp (Qfin[x \<^bold>\<rightarrow> y])) (x \<approx> y)) ` eqs x G))) I \<sigma>
x \<in> nongens Qfin
cov x Qfin G
finite (adom I)
\<forall>\<sigma>. \<not> sat (Qfin \<^bold>\<bottom> x) I \<sigma>

goal (1 subgoal):
 1. sat (CONJ_disjoint (Qfin, Qeq)) I \<sigma> = (sat (CONJ_disjoint (simp (Conj Qfin (DISJ (qps G))), Qeq)) I \<sigma> \<or> (\<exists>Q\<in>(\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G. sat (CONJ_disjoint Q) I \<sigma>))
[PROOF STEP]
by (auto simp: eval_empty_close sat_CONJ_disjoint nongens_def)
[PROOF STATE]
proof (state)
this:
sat (CONJ_disjoint (Qfin, Qeq)) I \<sigma> = (sat (CONJ_disjoint (simp (Conj Qfin (DISJ (qps G))), Qeq)) I \<sigma> \<or> (\<exists>Q\<in>(\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G. sat (CONJ_disjoint Q) I \<sigma>))

goal (3 subgoals):
 1. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> (\<exists>Q\<in>CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G). sat Q I \<sigma>) = (\<exists>Q\<in>CONJ_disjoint ` \<Q>fin. sat Q I \<sigma>)
 2. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> finite (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G))
 3. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> finite (CONJ_disjoint ` \<Q>fin)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(\<exists>Q\<in>\<Q>fin. sat (CONJ_disjoint Q) I \<sigma>) = ((sat (CONJ_disjoint (simp (Conj Qfin (DISJ (qps G))), Qeq)) I \<sigma> \<or> (\<exists>Q\<in>(\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G. sat (CONJ_disjoint Q) I \<sigma>)) \<or> (\<exists>Q\<in>\<Q>fin - {(Qfin, Qeq)}. sat (CONJ_disjoint Q) I \<sigma>))
[PROOF STEP]
show "(\<exists>Q\<in>CONJ_disjoint ` ?Qfin. sat Q I \<sigma>) \<longleftrightarrow> (\<exists>Q\<in>CONJ_disjoint ` \<Q>fin. sat Q I \<sigma>)"
[PROOF STATE]
proof (prove)
using this:
(\<exists>Q\<in>\<Q>fin. sat (CONJ_disjoint Q) I \<sigma>) = ((sat (CONJ_disjoint (simp (Conj Qfin (DISJ (qps G))), Qeq)) I \<sigma> \<or> (\<exists>Q\<in>(\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G. sat (CONJ_disjoint Q) I \<sigma>)) \<or> (\<exists>Q\<in>\<Q>fin - {(Qfin, Qeq)}. sat (CONJ_disjoint Q) I \<sigma>))

goal (1 subgoal):
 1. (\<exists>Q\<in>CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G). sat Q I \<sigma>) = (\<exists>Q\<in>CONJ_disjoint ` \<Q>fin. sat Q I \<sigma>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>Q\<in>CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G). sat Q I \<sigma>) = (\<exists>Q\<in>CONJ_disjoint ` \<Q>fin. sat Q I \<sigma>)

goal (2 subgoals):
 1. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> finite (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G))
 2. \<And>\<sigma>. \<lbrakk>cov x Qfin G; cov x Qfin G; eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I = eval Q I\<rbrakk> \<Longrightarrow> finite (CONJ_disjoint ` \<Q>fin)
[PROOF STEP]
qed simp_all
[PROOF STATE]
proof (state)
this:
eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)))) I = eval Q I

goal (1 subgoal):
 1. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
case (inf I)
[PROOF STATE]
proof (state)
this:
finite (adom I)
eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}

goal (1 subgoal):
 1. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
split_INV1 Q (\<Q>fin, \<Q>inf)
(Qfin, Qeq) \<in> fixfree \<Q>fin
x \<in> nongens Qfin
cov x Qfin G
[PROOF STEP]
have *:
    "x \<in> fv Qfin" "(Qfin, Qeq) \<in> \<Q>fin" "finite \<Q>fin" "finite Qeq" "finite \<Q>inf" "fv Qfin \<subseteq> fv Q" "Field Qeq \<subseteq> fv Q"
    "\<exists>xys. distinct xys \<and> leftfresh Qfin xys \<and> set xys = Qeq"
[PROOF STATE]
proof (prove)
using this:
split_INV1 Q (\<Q>fin, \<Q>inf)
(Qfin, Qeq) \<in> fixfree \<Q>fin
x \<in> nongens Qfin
cov x Qfin G

goal (1 subgoal):
 1. ((x \<in> fv Qfin &&& (Qfin, Qeq) \<in> \<Q>fin) &&& finite \<Q>fin &&& finite Qeq) &&& (finite \<Q>inf &&& fv Qfin \<subseteq> fv Q) &&& Field Qeq \<subseteq> fv Q &&& \<exists>xys. distinct xys \<and> leftfresh Qfin xys \<and> set xys = Qeq
[PROOF STEP]
by (auto simp: split_INV1_def fixfree_def nongens_def wf_state_def)
[PROOF STATE]
proof (state)
this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
\<exists>xys. distinct xys \<and> leftfresh Qfin xys \<and> set xys = Qeq

goal (1 subgoal):
 1. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
with inf
[PROOF STATE]
proof (chain)
picking this:
finite (adom I)
eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
\<exists>xys. distinct xys \<and> leftfresh Qfin xys \<and> set xys = Qeq
[PROOF STEP]
obtain \<sigma> where "sat (Qfin \<^bold>\<bottom> x) I \<sigma> \<or> (\<exists>Q \<in> \<Q>inf. sat Q I \<sigma>)"
[PROOF STATE]
proof (prove)
using this:
finite (adom I)
eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
\<exists>xys. distinct xys \<and> leftfresh Qfin xys \<and> set xys = Qeq

goal (1 subgoal):
 1. (\<And>\<sigma>. sat (Qfin \<^bold>\<bottom> x) I \<sigma> \<or> (\<exists>Q\<in>\<Q>inf. sat Q I \<sigma>) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (subst (asm) eval_simp_DISJ_closed) (auto simp: eval_empty_close sat_CONJ simp del: fv_CONJ)
[PROOF STATE]
proof (state)
this:
sat (Qfin \<^bold>\<bottom> x) I \<sigma> \<or> (\<exists>Q\<in>\<Q>inf. sat Q I \<sigma>)

goal (1 subgoal):
 1. \<And>I. \<lbrakk>finite (adom I); eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}\<rbrakk> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
sat (Qfin \<^bold>\<bottom> x) I \<sigma> \<or> (\<exists>Q\<in>\<Q>inf. sat Q I \<sigma>)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
sat (Qfin \<^bold>\<bottom> x) I \<sigma> \<or> (\<exists>Q\<in>\<Q>inf. sat Q I \<sigma>)

goal (1 subgoal):
 1. infinite (eval Q I)
[PROOF STEP]
proof (elim disjE)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. sat (Qfin \<^bold>\<bottom> x) I \<sigma> \<Longrightarrow> infinite (eval Q I)
 2. \<exists>Q\<in>\<Q>inf. sat Q I \<sigma> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
assume "sat (Qfin \<^bold>\<bottom> x) I \<sigma>"
[PROOF STATE]
proof (state)
this:
sat (Qfin \<^bold>\<bottom> x) I \<sigma>

goal (2 subgoals):
 1. sat (Qfin \<^bold>\<bottom> x) I \<sigma> \<Longrightarrow> infinite (eval Q I)
 2. \<exists>Q\<in>\<Q>inf. sat Q I \<sigma> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
sat (Qfin \<^bold>\<bottom> x) I \<sigma>
[PROOF STEP]
have "infinite (eval Qfin I)"
[PROOF STATE]
proof (prove)
using this:
sat (Qfin \<^bold>\<bottom> x) I \<sigma>

goal (1 subgoal):
 1. infinite (eval Qfin I)
[PROOF STEP]
by (rule cov_eval_inf[OF assms(4) *(1) inf(1)])
[PROOF STATE]
proof (state)
this:
infinite (eval Qfin I)

goal (2 subgoals):
 1. sat (Qfin \<^bold>\<bottom> x) I \<sigma> \<Longrightarrow> infinite (eval Q I)
 2. \<exists>Q\<in>\<Q>inf. sat Q I \<sigma> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
infinite (eval Qfin I)
[PROOF STEP]
have "infinite (eval_on (fv Q) (CONJ_disjoint (Qfin, Qeq)) I)"
[PROOF STATE]
proof (prove)
using this:
infinite (eval Qfin I)

goal (1 subgoal):
 1. infinite (eval_on (fv Q) (CONJ_disjoint (Qfin, Qeq)) I)
[PROOF STEP]
by (rule infinite_eval_CONJ_disjoint[OF _ inf(1) *(6,7) _ *(8)]) simp
[PROOF STATE]
proof (state)
this:
infinite (eval_on (fv Q) (CONJ_disjoint (Qfin, Qeq)) I)

goal (2 subgoals):
 1. sat (Qfin \<^bold>\<bottom> x) I \<sigma> \<Longrightarrow> infinite (eval Q I)
 2. \<exists>Q\<in>\<Q>inf. sat Q I \<sigma> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
with *
[PROOF STATE]
proof (chain)
picking this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
\<exists>xys. distinct xys \<and> leftfresh Qfin xys \<and> set xys = Qeq
infinite (eval_on (fv Q) (CONJ_disjoint (Qfin, Qeq)) I)
[PROOF STEP]
have "infinite (eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I)"
[PROOF STATE]
proof (prove)
using this:
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
\<exists>xys. distinct xys \<and> leftfresh Qfin xys \<and> set xys = Qeq
infinite (eval_on (fv Q) (CONJ_disjoint (Qfin, Qeq)) I)

goal (1 subgoal):
 1. infinite (eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I)
[PROOF STEP]
by (elim infinite_Implies_mono_on[rotated 3]) (auto simp: sat_simp)
[PROOF STATE]
proof (state)
this:
infinite (eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I)

goal (2 subgoals):
 1. sat (Qfin \<^bold>\<bottom> x) I \<sigma> \<Longrightarrow> infinite (eval Q I)
 2. \<exists>Q\<in>\<Q>inf. sat Q I \<sigma> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
with inf assms(1)
[PROOF STATE]
proof (chain)
picking this:
finite (adom I)
eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}
split_INV1 Q (\<Q>fin, \<Q>inf)
infinite (eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
finite (adom I)
eval (simp (DISJ (close ` insert (cp (Qfin \<^bold>\<bottom> x)) \<Q>inf))) I \<noteq> {}
split_INV1 Q (\<Q>fin, \<Q>inf)
infinite (eval_on (fv Q) (simp (DISJ (CONJ_disjoint ` \<Q>fin))) I)

goal (1 subgoal):
 1. infinite (eval Q I)
[PROOF STEP]
by (auto simp: split_INV1_def assemble_def EVAL'_def split: if_splits)
[PROOF STATE]
proof (state)
this:
infinite (eval Q I)

goal (1 subgoal):
 1. \<exists>Q\<in>\<Q>inf. sat Q I \<sigma> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>Q\<in>\<Q>inf. sat Q I \<sigma> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
assume "\<exists>Q\<in>\<Q>inf. sat Q I \<sigma>"
[PROOF STATE]
proof (state)
this:
\<exists>Q\<in>\<Q>inf. sat Q I \<sigma>

goal (1 subgoal):
 1. \<exists>Q\<in>\<Q>inf. sat Q I \<sigma> \<Longrightarrow> infinite (eval Q I)
[PROOF STEP]
with inf(1) assms(1) *
[PROOF STATE]
proof (chain)
picking this:
finite (adom I)
split_INV1 Q (\<Q>fin, \<Q>inf)
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
\<exists>xys. distinct xys \<and> leftfresh Qfin xys \<and> set xys = Qeq
\<exists>Q\<in>\<Q>inf. sat Q I \<sigma>
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
finite (adom I)
split_INV1 Q (\<Q>fin, \<Q>inf)
x \<in> fv Qfin
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
finite Qeq
finite \<Q>inf
fv Qfin \<subseteq> fv Q
Field Qeq \<subseteq> fv Q
\<exists>xys. distinct xys \<and> leftfresh Qfin xys \<and> set xys = Qeq
\<exists>Q\<in>\<Q>inf. sat Q I \<sigma>

goal (1 subgoal):
 1. infinite (eval Q I)
[PROOF STEP]
by (auto simp: split_INV1_def assemble_def EVAL'_def eval_simp_DISJ_closed eval_empty_close
          split: if_splits)
[PROOF STATE]
proof (state)
this:
infinite (eval Q I)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
infinite (eval Q I)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma mono_Retr:
"mono Sretr"
"mono ZOretr"  "mono ZOretrT"
"mono Wretr"  "mono WretrT"
"mono RetrT"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (Bisim.mono Sretr &&& Bisim.mono ZOretr &&& Bisim.mono ZOretrT) &&& Bisim.mono Wretr &&& Bisim.mono WretrT &&& Bisim.mono RetrT
[PROOF STEP]
unfolding mono_def Retr_defs match_defs
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>theta theta'. theta \<subseteq> theta' \<longrightarrow> {(c, d). (\<forall>s t c' s'. s \<approx> t \<and> (c, s) \<rightarrow>c (c', s') \<longrightarrow> (\<exists>d' t'. (d, t) \<rightarrow>c (d', t') \<and> s' \<approx> t' \<and> (c', d') \<in> theta)) \<and> (\<forall>s t s'. s \<approx> t \<and> (c, s) \<rightarrow>t s' \<longrightarrow> (\<exists>t'. (d, t) \<rightarrow>t t' \<and> s' \<approx> t'))} \<subseteq> {(c, d). (\<forall>s t c' s'. s \<approx> t \<and> (c, s) \<rightarrow>c (c', s') \<longrightarrow> (\<exists>d' t'. (d, t) \<rightarrow>c (d', t') \<and> s' \<approx> t' \<and> (c', d') \<in> theta')) \<and> (\<forall>s t s'. s \<approx> t \<and> (c, s) \<rightarrow>t s' \<longrightarrow> (\<exists>t'. (d, t) \<rightarrow>t t' \<and> s' \<approx> t'))} &&& \<forall>theta theta'. theta \<subseteq> theta' \<longrightarrow> {(c, d). (\<forall>s t c' s'. s \<approx> t \<and> (c, s) \<rightarrow>c (c', s') \<longrightarrow> s' \<approx> t \<and> (c', d) \<in> theta \<or> (\<exists>d' t'. (d, t) \<rightarrow>c (d', t') \<and> s' \<approx> t' \<and> (c', d') \<in> theta) \<or> (\<exists>t'. (d, t) \<rightarrow>t t' \<and> s' \<approx> t' \<and> discr c')) \<and> (\<forall>s t s'. s \<approx> t \<and> (c, s) \<rightarrow>t s' \<longrightarrow> s' \<approx> t \<and> discr d \<or> (\<exists>d' t'. (d, t) \<rightarrow>c (d', t') \<and> s' \<approx> t' \<and> discr d') \<or> (\<exists>t'. (d, t) \<rightarrow>t t' \<and> s' \<approx> t'))} \<subseteq> {(c, d). (\<forall>s t c' s'. s \<approx> t \<and> (c, s) \<rightarrow>c (c', s') \<longrightarrow> s' \<approx> t \<and> (c', d) \<in> theta' \<or> (\<exists>d' t'. (d, t) \<rightarrow>c (d', t') \<and> s' \<approx> t' \<and> (c', d') \<in> theta') \<or> (\<exists>t'. (d, t) \<rightarrow>t t' \<and> s' \<approx> t' \<and> discr c')) \<and> (\<forall>s t s'. s \<approx> t \<and> (c, s) \<rightarrow>t s' \<longrightarrow> s' \<approx> t \<and> discr d \<or> (\<exists>d' t'. (d, t) \<rightarrow>c (d', t') \<and> s' \<approx> t' \<and> discr d') \<or> (\<exists>t'. (d, t) \<rightarrow>t t' \<and> s' \<approx> t'))} &&& \<forall>theta theta'. theta \<subseteq> theta' \<longrightarrow> {(c, d). (\<forall>s t c' s'. s \<approx> t \<and> (c, s) \<rightarrow>c (c', s') \<longrightarrow> s' \<approx> t \<and> (c', d) \<in> theta \<or> (\<exists>d' t'. (d, t) \<rightarrow>c (d', t') \<and> s' \<approx> t' \<and> (c', d') \<in> theta)) \<and> (\<forall>s t s'. s \<approx> t \<and> (c, s) \<rightarrow>t s' \<longrightarrow> (\<exists>t'. (d, t) \<rightarrow>t t' \<and> s' \<approx> t'))} \<subseteq> {(c, d). (\<forall>s t c' s'. s \<approx> t \<and> (c, s) \<rightarrow>c (c', s') \<longrightarrow> s' \<approx> t \<and> (c', d) \<in> theta' \<or> (\<exists>d' t'. (d, t) \<rightarrow>c (d', t') \<and> s' \<approx> t' \<and> (c', d') \<in> theta')) \<and> (\<forall>s t s'. s \<approx> t \<and> (c, s) \<rightarrow>t s' \<longrightarrow> (\<exists>t'. (d, t) \<rightarrow>t t' \<and> s' \<approx> t'))}) &&& \<forall>theta theta'. theta \<subseteq> theta' \<longrightarrow> {(c, d). (\<forall>s t c' s'. s \<approx> t \<and> (c, s) \<rightarrow>c (c', s') \<longrightarrow> (\<exists>d' t'. (d, t) \<rightarrow>*c (d', t') \<and> s' \<approx> t' \<and> (c', d') \<in> theta) \<or> (\<exists>t'. (d, t) \<rightarrow>*t t' \<and> s' \<approx> t' \<and> discr c')) \<and> (\<forall>s t s'. s \<approx> t \<and> (c, s) \<rightarrow>t s' \<longrightarrow> (\<exists>d' t'. (d, t) \<rightarrow>*c (d', t') \<and> s' \<approx> t' \<and> discr d') \<or> (\<exists>t'. (d, t) \<rightarrow>*t t' \<and> s' \<approx> t'))} \<subseteq> {(c, d). (\<forall>s t c' s'. s \<approx> t \<and> (c, s) \<rightarrow>c (c', s') \<longrightarrow> (\<exists>d' t'. (d, t) \<rightarrow>*c (d', t') \<and> s' \<approx> t' \<and> (c', d') \<in> theta') \<or> (\<exists>t'. (d, t) \<rightarrow>*t t' \<and> s' \<approx> t' \<and> discr c')) \<and> (\<forall>s t s'. s \<approx> t \<and> (c, s) \<rightarrow>t s' \<longrightarrow> (\<exists>d' t'. (d, t) \<rightarrow>*c (d', t') \<and> s' \<approx> t' \<and> discr d') \<or> (\<exists>t'. (d, t) \<rightarrow>*t t' \<and> s' \<approx> t'))} &&& \<forall>theta theta'. theta \<subseteq> theta' \<longrightarrow> {(c, d). (\<forall>s t c' s'. s \<approx> t \<and> (c, s) \<rightarrow>c (c', s') \<longrightarrow> (\<exists>d' t'. (d, t) \<rightarrow>*c (d', t') \<and> s' \<approx> t' \<and> (c', d') \<in> theta)) \<and> (\<forall>s t s'. s \<approx> t \<and> (c, s) \<rightarrow>t s' \<longrightarrow> (\<exists>t'. (d, t) \<rightarrow>*t t' \<and> s' \<approx> t'))} \<subseteq> {(c, d). (\<forall>s t c' s'. s \<approx> t \<and> (c, s) \<rightarrow>c (c', s') \<longrightarrow> (\<exists>d' t'. (d, t) \<rightarrow>*c (d', t') \<and> s' \<approx> t' \<and> (c', d') \<in> theta')) \<and> (\<forall>s t s'. s \<approx> t \<and> (c, s) \<rightarrow>t s' \<longrightarrow> (\<exists>t'. (d, t) \<rightarrow>*t t' \<and> s' \<approx> t'))} &&& \<forall>theta theta'. theta \<subseteq> theta' \<longrightarrow> {(c, d). (\<forall>s t c' s'. mustT c s \<and> mustT d t \<and> s \<approx> t \<and> (c, s) \<rightarrow>c (c', s') \<longrightarrow> (\<exists>d' t'. (d, t) \<rightarrow>*c (d', t') \<and> s' \<approx> t' \<and> (c', d') \<in> theta)) \<and> (\<forall>s t s'. mustT c s \<and> mustT d t \<and> s \<approx> t \<and> (c, s) \<rightarrow>t s' \<longrightarrow> (\<exists>t'. (d, t) \<rightarrow>*t t' \<and> s' \<approx> t'))} \<subseteq> {(c, d). (\<forall>s t c' s'. mustT c s \<and> mustT d t \<and> s \<approx> t \<and> (c, s) \<rightarrow>c (c', s') \<longrightarrow> (\<exists>d' t'. (d, t) \<rightarrow>*c (d', t') \<and> s' \<approx> t' \<and> (c', d') \<in> theta')) \<and> (\<forall>s t s'. mustT c s \<and> mustT d t \<and> s \<approx> t \<and> (c, s) \<rightarrow>t s' \<longrightarrow> (\<exists>t'. (d, t) \<rightarrow>*t t' \<and> s' \<approx> t'))}
[PROOF STEP]
by blast+


[STATEMENT]
lemma Says_Server_message_form:
     "\<lbrakk> Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>)
         \<in> set evs; evs \<in> bankerberos \<rbrakk>
      \<Longrightarrow> K' = shrK A \<and> K \<notin> range shrK \<and>
          Ticket = (Crypt (shrK B) \<lbrace>Number Tk, Agent A, Key K\<rbrace>) \<and>
          Key K \<notin> used(before
                  Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>)
                  on evs) \<and>
          Tk = CT(before
                  Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>)
                  on evs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>) \<in> set evs; evs \<in> bankerberos\<rbrakk> \<Longrightarrow> K' = shrK A \<and> K \<notin> range shrK \<and> Ticket = Crypt (shrK B) \<lbrace>Number Tk, Agent A, Key K\<rbrace> \<and> Key K \<notin> used before Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>) on evs \<and> Tk = CT before Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>) on evs
[PROOF STEP]
apply (unfold before_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>) \<in> set evs; evs \<in> bankerberos\<rbrakk> \<Longrightarrow> K' = shrK A \<and> K \<notin> range shrK \<and> Ticket = Crypt (shrK B) \<lbrace>Number Tk, Agent A, Key K\<rbrace> \<and> Key K \<notin> used (takeWhile (\<lambda>z. z \<noteq> Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>)) (rev evs)) \<and> Tk = CT (takeWhile (\<lambda>z. z \<noteq> Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>)) (rev evs))
[PROOF STEP]
apply (erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. evs \<in> bankerberos \<Longrightarrow> Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>) \<in> set evs \<longrightarrow> K' = shrK A \<and> K \<notin> range shrK \<and> Ticket = Crypt (shrK B) \<lbrace>Number Tk, Agent A, Key K\<rbrace> \<and> Key K \<notin> used (takeWhile (\<lambda>z. z \<noteq> Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>)) (rev evs)) \<and> Tk = CT (takeWhile (\<lambda>z. z \<noteq> Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>)) (rev evs))
[PROOF STEP]
apply (erule bankerberos.induct, simp_all add: takeWhile_tail)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evs2 Ka A' Aa Ba. \<lbrakk>evs2 \<in> bankerberos; Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>) \<in> set evs2 \<longrightarrow> K' = shrK A \<and> K \<notin> range shrK \<and> Ticket = Crypt (shrK B) \<lbrace>Number Tk, Agent A, Key K\<rbrace> \<and> Key K \<notin> used (takeWhile (\<lambda>z. z \<noteq> Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>)) (rev evs2)) \<and> Tk = CT (takeWhile (\<lambda>z. z \<noteq> Says Server A (Crypt K' \<lbrace>Number Tk, Agent B, Key K, Ticket\<rbrace>)) (rev evs2)); Key Ka \<notin> used evs2; Ka \<in> symKeys; Says A' Server \<lbrace>Agent Aa, Agent Ba\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> A = Aa \<and> K' = shrK Aa \<and> Tk = CT evs2 \<and> B = Ba \<and> K = Ka \<and> Ticket = Crypt (shrK Ba) \<lbrace>Number (CT evs2), Agent Aa, Key Ka\<rbrace> \<longrightarrow> Key Ka \<notin> used (takeWhile (\<lambda>z. z \<noteq> Says Server Aa (Crypt (shrK Aa) \<lbrace>Number (CT evs2), Agent Ba, Key Ka, Crypt (shrK Ba) \<lbrace>Number (CT evs2), Agent Aa, Key Ka\<rbrace>\<rbrace>)) (rev evs2)) \<and> CT evs2 = CT (takeWhile (\<lambda>z. z \<noteq> Says Server Aa (Crypt (shrK Aa) \<lbrace>Number (CT evs2), Agent Ba, Key Ka, Crypt (shrK Ba) \<lbrace>Number (CT evs2), Agent Aa, Key Ka\<rbrace>\<rbrace>)) (rev evs2))
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>evs2 A'. \<lbrakk>evs2 \<in> bankerberos; Key K \<notin> used evs2; K \<in> symKeys; Says A' Server \<lbrace>Agent A, Agent B\<rbrace> \<in> set evs2; K' = shrK A; Tk = CT evs2; Ticket = Crypt (shrK B) \<lbrace>Number (CT evs2), Agent A, Key K\<rbrace>; Says Server A (Crypt (shrK A) \<lbrace>Number (CT evs2), Agent B, Key K, Crypt (shrK B) \<lbrace>Number (CT evs2), Agent A, Key K\<rbrace>\<rbrace>) \<notin> set evs2; Key K \<in> used (takeWhile (\<lambda>z. z \<noteq> Says Server A (Crypt (shrK A) \<lbrace>Number (CT evs2), Agent B, Key K, Crypt (shrK B) \<lbrace>Number (CT evs2), Agent A, Key K\<rbrace>\<rbrace>)) (rev evs2))\<rbrakk> \<Longrightarrow> False
 2. \<And>evs2 A'. \<lbrakk>evs2 \<in> bankerberos; Key K \<notin> used evs2; K \<in> symKeys; Says A' Server \<lbrace>Agent A, Agent B\<rbrace> \<in> set evs2; K' = shrK A; Tk = CT evs2; Ticket = Crypt (shrK B) \<lbrace>Number (CT evs2), Agent A, Key K\<rbrace>; Says Server A (Crypt (shrK A) \<lbrace>Number (CT evs2), Agent B, Key K, Crypt (shrK B) \<lbrace>Number (CT evs2), Agent A, Key K\<rbrace>\<rbrace>) \<notin> set evs2\<rbrakk> \<Longrightarrow> CT evs2 = CT (takeWhile (\<lambda>z. z \<noteq> Says Server A (Crypt (shrK A) \<lbrace>Number (CT evs2), Agent B, Key K, Crypt (shrK B) \<lbrace>Number (CT evs2), Agent A, Key K\<rbrace>\<rbrace>)) (rev evs2))
[PROOF STEP]
apply (metis length_rev set_rev takeWhile_void used_evs_rev)+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done