[STATEMENT]
lemma wadjust_loop_erase_nonempty[simp]: "wadjust_loop_erase m rs (c, b) \<Longrightarrow> c \<noteq> []"
  "wadjust_loop_on_left_moving m rs (c, b) \<Longrightarrow> c \<noteq> []"
  "wadjust_loop_right_move2 m rs (c, b) \<Longrightarrow> c \<noteq> []"
  "wadjust_erase2 m rs (c, Bk # list) \<Longrightarrow> c \<noteq> []"
  "wadjust_on_left_moving m rs (c,b) \<Longrightarrow> c \<noteq> []"
  "wadjust_on_left_moving_O m rs (c, Bk # list) = False"
  "wadjust_goon_left_moving m rs (c, b) \<Longrightarrow> c \<noteq> []"
  "wadjust_loop_on_left_moving_O m rs (c, Bk # list) = False"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (((wadjust_loop_erase m rs (c, b) \<Longrightarrow> c \<noteq> []) &&& (wadjust_loop_on_left_moving m rs (c, b) \<Longrightarrow> c \<noteq> [])) &&& (wadjust_loop_right_move2 m rs (c, b) \<Longrightarrow> c \<noteq> []) &&& (wadjust_erase2 m rs (c, Bk # list) \<Longrightarrow> c \<noteq> [])) &&& ((wadjust_on_left_moving m rs (c, b) \<Longrightarrow> c \<noteq> []) &&& wadjust_on_left_moving_O m rs (c, Bk # list) = False) &&& (wadjust_goon_left_moving m rs (c, b) \<Longrightarrow> c \<noteq> []) &&& wadjust_loop_on_left_moving_O m rs (c, Bk # list) = False
[PROOF STEP]
by(auto simp: wadjust_loop_erase.simps wadjust_loop_on_left_moving.simps
      wadjust_loop_on_left_moving_O.simps wadjust_loop_on_left_moving_B.simps
      wadjust_loop_right_move2.simps wadjust_erase2.simps
      wadjust_on_left_moving.simps
      wadjust_on_left_moving_O.simps
      wadjust_on_left_moving_B.simps wadjust_goon_left_moving.simps
      wadjust_goon_left_moving_B.simps
      wadjust_goon_left_moving_O.simps)


[STATEMENT]
lemma \<R>\<^sub>3_closed_glob_consistent:
  "closed_glob_consistent (\<R>\<^sub>3 \<Gamma>' \<S>' P')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. closed_glob_consistent (\<R>\<^sub>3 \<Gamma>' \<S>' P')
[PROOF STEP]
unfolding closed_glob_consistent_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>c\<^sub>1 mds mem\<^sub>1 c\<^sub>2 mem\<^sub>2. (\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle>, \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>) \<in> \<R>\<^sub>3 \<Gamma>' \<S>' P' \<longrightarrow> (\<forall>A. (\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x) \<and> (\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x) \<and> (\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<notin> mds AsmNoReadOrWrite \<or> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x) \<longrightarrow> (\<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle>, \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>) \<in> \<R>\<^sub>3 \<Gamma>' \<S>' P')
[PROOF STEP]
proof(clarsimp)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>c\<^sub>1 mds mem\<^sub>1 c\<^sub>2 mem\<^sub>2 A. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
fix c\<^sub>1 mds mem\<^sub>1 c\<^sub>2 mem\<^sub>2 A
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>c\<^sub>1 mds mem\<^sub>1 c\<^sub>2 mem\<^sub>2 A. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
assume in_\<R>\<^sub>3: "\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>"
[PROOF STATE]
proof (state)
this:
\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>

goal (1 subgoal):
 1. \<And>c\<^sub>1 mds mem\<^sub>1 c\<^sub>2 mem\<^sub>2 A. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
assume A_modifies_vars: "\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x"
[PROOF STATE]
proof (state)
this:
\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x

goal (1 subgoal):
 1. \<And>c\<^sub>1 mds mem\<^sub>1 c\<^sub>2 mem\<^sub>2 A. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
assume A_modifies_dma: "\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x"
[PROOF STATE]
proof (state)
this:
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x

goal (1 subgoal):
 1. \<And>c\<^sub>1 mds mem\<^sub>1 c\<^sub>2 mem\<^sub>2 A. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
assume A_modifies_sec: "\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x"
[PROOF STATE]
proof (state)
this:
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x

goal (1 subgoal):
 1. \<And>c\<^sub>1 mds mem\<^sub>1 c\<^sub>2 mem\<^sub>2 A. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
(* do a bit of massaging to get the goal state set-up nicely for the induction rule *)
[PROOF STATE]
proof (state)
this:
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x

goal (1 subgoal):
 1. \<And>c\<^sub>1 mds mem\<^sub>1 c\<^sub>2 mem\<^sub>2 A. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
define lc\<^sub>1 where "lc\<^sub>1 \<equiv> \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle>"
[PROOF STATE]
proof (state)
this:
lc\<^sub>1 \<equiv> \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle>

goal (1 subgoal):
 1. \<And>c\<^sub>1 mds mem\<^sub>1 c\<^sub>2 mem\<^sub>2 A. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
define lc\<^sub>2 where "lc\<^sub>2 \<equiv> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>"
[PROOF STATE]
proof (state)
this:
lc\<^sub>2 \<equiv> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>

goal (1 subgoal):
 1. \<And>c\<^sub>1 mds mem\<^sub>1 c\<^sub>2 mem\<^sub>2 A. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
from lc\<^sub>1_def lc\<^sub>2_def in_\<R>\<^sub>3
[PROOF STATE]
proof (chain)
picking this:
lc\<^sub>1 \<equiv> \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle>
lc\<^sub>2 \<equiv> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>
\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>
[PROOF STEP]
have "lc\<^sub>1 \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> lc\<^sub>2"
[PROOF STATE]
proof (prove)
using this:
lc\<^sub>1 \<equiv> \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle>
lc\<^sub>2 \<equiv> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>
\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>

goal (1 subgoal):
 1. lc\<^sub>1 \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> lc\<^sub>2
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
lc\<^sub>1 \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> lc\<^sub>2

goal (1 subgoal):
 1. \<And>c\<^sub>1 mds mem\<^sub>1 c\<^sub>2 mem\<^sub>2 A. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
from this lc\<^sub>1_def lc\<^sub>2_def A_modifies_vars A_modifies_dma A_modifies_sec
[PROOF STATE]
proof (chain)
picking this:
lc\<^sub>1 \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> lc\<^sub>2
lc\<^sub>1 \<equiv> \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle>
lc\<^sub>2 \<equiv> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>
\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x
[PROOF STEP]
show "\<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>"
[PROOF STATE]
proof (prove)
using this:
lc\<^sub>1 \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> lc\<^sub>2
lc\<^sub>1 \<equiv> \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle>
lc\<^sub>2 \<equiv> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>
\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x

goal (1 subgoal):
 1. \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
proof(induct arbitrary: c\<^sub>1 mds mem\<^sub>1 c\<^sub>2 mds mem\<^sub>2 rule: \<R>\<^sub>3_aux.induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>c\<^sub>1 mds mem\<^sub>1 \<Gamma> \<S> P c\<^sub>2 mem\<^sub>2 c \<Gamma>' \<S>' P'. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<turnstile> \<Gamma>,\<S>,P {c} \<Gamma>',\<S>',P'; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1 ;; c, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2 ;; c, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
 2. \<And>c\<^sub>1 mds mem\<^sub>1 \<Gamma> \<S> P c\<^sub>2 mem\<^sub>2 c \<Gamma>' \<S>' P'. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<lbrakk>\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>; \<turnstile> \<Gamma>,\<S>,P {c} \<Gamma>',\<S>',P'; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1 ;; c, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2 ;; c, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
case (intro\<^sub>1 c\<^sub>1 mds mem\<^sub>1 \<Gamma> \<S> P c\<^sub>2 mem\<^sub>2 c \<Gamma>' \<S>' P')
[PROOF STATE]
proof (state)
this:
\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>
\<turnstile> \<Gamma>,\<S>,P {c} \<Gamma>',\<S>',P'
\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x

goal (2 subgoals):
 1. \<And>c\<^sub>1 mds mem\<^sub>1 \<Gamma> \<S> P c\<^sub>2 mem\<^sub>2 c \<Gamma>' \<S>' P'. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<turnstile> \<Gamma>,\<S>,P {c} \<Gamma>',\<S>',P'; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1 ;; c, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2 ;; c, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
 2. \<And>c\<^sub>1 mds mem\<^sub>1 \<Gamma> \<S> P c\<^sub>2 mem\<^sub>2 c \<Gamma>' \<S>' P'. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<lbrakk>\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>; \<turnstile> \<Gamma>,\<S>,P {c} \<Gamma>',\<S>',P'; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1 ;; c, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2 ;; c, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<langle>c\<^sub>1 ;; c, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2 ;; c, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
apply (rule \<R>\<^sub>3_aux.intro\<^sub>1[OF _ intro\<^sub>1(2)])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
using \<R>\<^sub>1_closed_glob_consistent intro\<^sub>1
[PROOF STATE]
proof (prove)
using this:
closed_glob_consistent (\<R>\<^sub>1 ?\<Gamma>' ?\<S>' ?P')
\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>
\<turnstile> \<Gamma>,\<S>,P {c} \<Gamma>',\<S>',P'
\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x

goal (1 subgoal):
 1. \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
unfolding closed_glob_consistent_def
[PROOF STATE]
proof (prove)
using this:
\<forall>c\<^sub>1 mds mem\<^sub>1 c\<^sub>2 mem\<^sub>2. \<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>?\<Gamma>',?\<S>',?P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle> \<longrightarrow> (\<forall>A. (\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x) \<and> (\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x) \<and> (\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<notin> mds AsmNoReadOrWrite \<or> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x) \<longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>1\<^bsub>?\<Gamma>',?\<S>',?P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>)
\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>
\<turnstile> \<Gamma>,\<S>,P {c} \<Gamma>',\<S>',P'
\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x

goal (1 subgoal):
 1. \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>1\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<langle>c\<^sub>1 ;; c, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2 ;; c, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>

goal (1 subgoal):
 1. \<And>c\<^sub>1 mds mem\<^sub>1 \<Gamma> \<S> P c\<^sub>2 mem\<^sub>2 c \<Gamma>' \<S>' P'. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<lbrakk>\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>; \<turnstile> \<Gamma>,\<S>,P {c} \<Gamma>',\<S>',P'; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1 ;; c, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2 ;; c, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>c\<^sub>1 mds mem\<^sub>1 \<Gamma> \<S> P c\<^sub>2 mem\<^sub>2 c \<Gamma>' \<S>' P'. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<lbrakk>\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>; \<turnstile> \<Gamma>,\<S>,P {c} \<Gamma>',\<S>',P'; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1 ;; c, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2 ;; c, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
case (intro\<^sub>3 c\<^sub>1 mds mem\<^sub>1 \<Gamma> \<S> P c\<^sub>2 mem\<^sub>2 c \<Gamma>' \<S>' P')
[PROOF STATE]
proof (state)
this:
\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>
\<lbrakk>\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
\<turnstile> \<Gamma>,\<S>,P {c} \<Gamma>',\<S>',P'
\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x

goal (1 subgoal):
 1. \<And>c\<^sub>1 mds mem\<^sub>1 \<Gamma> \<S> P c\<^sub>2 mem\<^sub>2 c \<Gamma>' \<S>' P'. \<lbrakk>\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>; \<lbrakk>\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>; \<turnstile> \<Gamma>,\<S>,P {c} \<Gamma>',\<S>',P'; \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1 ;; c, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2 ;; c, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<langle>c\<^sub>1 ;; c, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2 ;; c, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
[PROOF STEP]
apply(rule \<R>\<^sub>3_aux.intro\<^sub>3)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>?\<Gamma>,?\<S>,?P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
 2. \<turnstile> ?\<Gamma>,?\<S>,?P {c} \<Gamma>',\<S>',P'
[PROOF STEP]
apply(rule intro\<^sub>3(2))
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x
 2. \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x
 3. \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x
 4. \<turnstile> \<Gamma>,\<S>,P {c} \<Gamma>',\<S>',P'
[PROOF STEP]
using intro\<^sub>3
[PROOF STATE]
proof (prove)
using this:
\<langle>c\<^sub>1, mds, mem\<^sub>1\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2\<rangle>
\<lbrakk>\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x; \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x\<rbrakk> \<Longrightarrow> \<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>,\<S>,P\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>
\<turnstile> \<Gamma>,\<S>,P {c} \<Gamma>',\<S>',P'
\<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x
\<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x

goal (4 subgoals):
 1. \<forall>x. case A x of None \<Rightarrow> True | Some (v, v') \<Rightarrow> mem\<^sub>1 x \<noteq> v \<or> mem\<^sub>2 x \<noteq> v' \<longrightarrow> \<not> var_asm_not_written mds x
 2. \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x \<noteq> dma mem\<^sub>1 x \<longrightarrow> \<not> var_asm_not_written mds x
 3. \<forall>x. dma mem\<^sub>1 [\<parallel>\<^sub>1 A] x = Low \<and> (x \<in> mds AsmNoReadOrWrite \<longrightarrow> x \<in> \<C>) \<longrightarrow> mem\<^sub>1 [\<parallel>\<^sub>1 A] x = mem\<^sub>2 [\<parallel>\<^sub>2 A] x
 4. \<turnstile> \<Gamma>,\<S>,P {c} \<Gamma>',\<S>',P'
[PROOF STEP]
apply simp+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
\<langle>c\<^sub>1 ;; c, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2 ;; c, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<langle>c\<^sub>1, mds, mem\<^sub>1 [\<parallel>\<^sub>1 A]\<rangle> \<R>\<^sup>3\<^bsub>\<Gamma>',\<S>',P'\<^esub> \<langle>c\<^sub>2, mds, mem\<^sub>2 [\<parallel>\<^sub>2 A]\<rangle>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma anno_type_helpers [simp]:
  "(to_total \<Gamma> x) \<le>:\<^sub>P (to_total (add_anno \<Gamma> \<S> (buffer +=\<^sub>m AsmNoWrite)) x)"
  "(to_total \<Gamma> x) \<le>:\<^sub>P (to_total (add_anno \<Gamma> \<S> (buffer +=\<^sub>m AsmNoReadOrWrite)) x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. to_total \<Gamma> x \<le>:\<^sub>P to_total \<Gamma> \<oplus>\<^sub>\<S> (buffer +=\<^sub>m AsmNoWrite) x &&& to_total \<Gamma> x \<le>:\<^sub>P to_total \<Gamma> \<oplus>\<^sub>\<S> (buffer +=\<^sub>m AsmNoReadOrWrite) x
[PROOF STEP]
apply(auto simp: to_total_def add_anno_def subtype_def intro: subset_entailment)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma adj_sub_ode:"\<And>\<sigma> x1 x2. (\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> (\<Union>a\<in>SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2). SFV \<sigma> a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x1 x2. (\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))
[PROOF STEP]
subgoal for \<sigma> x1 x2
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (SDom \<sigma> \<inter> SIGP (EvolveODE x1 x2)))
[PROOF STEP]
unfolding SDom_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>i\<in>{i |i. Inl i \<in> SIGO x1}. case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x) \<subseteq> \<Union> (SFV \<sigma> ` (({Inl x |x. x \<in> dom (SFunctions \<sigma>)} \<union> {Inr (Inl x) |x. x \<in> dom (SContexts \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPredicates \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPrograms \<sigma>)}) \<inter> SIGP (EvolveODE x1 x2)))
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x xa. \<lbrakk>x \<in> (case SFunctions \<sigma> xa of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x); Inl xa \<in> SIGO x1\<rbrakk> \<Longrightarrow> \<exists>xa\<in>({Inl x |x. x \<in> dom (SFunctions \<sigma>)} \<union> {Inr (Inl x) |x. x \<in> dom (SContexts \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPredicates \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPrograms \<sigma>)}) \<inter> (SIGF x2 \<union> {Inl x |x. Inl x \<in> SIGO x1} \<union> {Inr (Inr x) |x. Inr x \<in> SIGO x1}). x \<in> SFV \<sigma> xa
[PROOF STEP]
subgoal for x i
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<in> (case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x); Inl i \<in> SIGO x1\<rbrakk> \<Longrightarrow> \<exists>xa\<in>({Inl x |x. x \<in> dom (SFunctions \<sigma>)} \<union> {Inr (Inl x) |x. x \<in> dom (SContexts \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPredicates \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPrograms \<sigma>)}) \<inter> (SIGF x2 \<union> {Inl x |x. Inl x \<in> SIGO x1} \<union> {Inr (Inr x) |x. Inr x \<in> SIGO x1}). x \<in> SFV \<sigma> xa
[PROOF STEP]
apply (cases "SFunctions \<sigma> i")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>x \<in> (case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x); Inl i \<in> SIGO x1; SFunctions \<sigma> i = None\<rbrakk> \<Longrightarrow> \<exists>xa\<in>({Inl x |x. x \<in> dom (SFunctions \<sigma>)} \<union> {Inr (Inl x) |x. x \<in> dom (SContexts \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPredicates \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPrograms \<sigma>)}) \<inter> (SIGF x2 \<union> {Inl x |x. Inl x \<in> SIGO x1} \<union> {Inr (Inr x) |x. Inr x \<in> SIGO x1}). x \<in> SFV \<sigma> xa
 2. \<And>a. \<lbrakk>x \<in> (case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x); Inl i \<in> SIGO x1; SFunctions \<sigma> i = Some a\<rbrakk> \<Longrightarrow> \<exists>xa\<in>({Inl x |x. x \<in> dom (SFunctions \<sigma>)} \<union> {Inr (Inl x) |x. x \<in> dom (SContexts \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPredicates \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPrograms \<sigma>)}) \<inter> (SIGF x2 \<union> {Inl x |x. Inl x \<in> SIGO x1} \<union> {Inr (Inr x) |x. Inr x \<in> SIGO x1}). x \<in> SFV \<sigma> xa
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>x \<in> FVT a; Inl i \<in> SIGO x1; SFunctions \<sigma> i = Some a\<rbrakk> \<Longrightarrow> \<exists>xa\<in>({Inl x |x. x \<in> dom (SFunctions \<sigma>)} \<union> {Inr (Inl x) |x. x \<in> dom (SContexts \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPredicates \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPrograms \<sigma>)}) \<inter> (SIGF x2 \<union> {Inl x |x. Inl x \<in> SIGO x1} \<union> {Inr (Inr x) |x. Inr x \<in> SIGO x1}). x \<in> SFV \<sigma> xa
[PROOF STEP]
subgoal for a
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<in> FVT a; Inl i \<in> SIGO x1; SFunctions \<sigma> i = Some a\<rbrakk> \<Longrightarrow> \<exists>xa\<in>({Inl x |x. x \<in> dom (SFunctions \<sigma>)} \<union> {Inr (Inl x) |x. x \<in> dom (SContexts \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPredicates \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPrograms \<sigma>)}) \<inter> (SIGF x2 \<union> {Inl x |x. Inl x \<in> SIGO x1} \<union> {Inr (Inr x) |x. Inr x \<in> SIGO x1}). x \<in> SFV \<sigma> xa
[PROOF STEP]
using adj_sub_ode_fact[of i x1 x \<sigma> x2]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>Inl i \<in> SIGO x1; x \<in> (case SFunctions \<sigma> i of None \<Rightarrow> {} | Some x \<Rightarrow> FVT x)\<rbrakk> \<Longrightarrow> Inl i \<in> ({Inl x |x. x \<in> dom (SFunctions \<sigma>)} \<union> {Inr (Inl x) |x. x \<in> dom (SContexts \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPredicates \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPrograms \<sigma>)}) \<inter> (SIGF x2 \<union> {Inl x |x. Inl x \<in> SIGO x1} \<union> {Inr (Inr x) |x. Inr x \<in> SIGO x1})

goal (1 subgoal):
 1. \<lbrakk>x \<in> FVT a; Inl i \<in> SIGO x1; SFunctions \<sigma> i = Some a\<rbrakk> \<Longrightarrow> \<exists>xa\<in>({Inl x |x. x \<in> dom (SFunctions \<sigma>)} \<union> {Inr (Inl x) |x. x \<in> dom (SContexts \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPredicates \<sigma>)} \<union> {Inr (Inr x) |x. x \<in> dom (SPrograms \<sigma>)}) \<inter> (SIGF x2 \<union> {Inl x |x. Inl x \<in> SIGO x1} \<union> {Inr (Inr x) |x. Inr x \<in> SIGO x1}). x \<in> SFV \<sigma> xa
[PROOF STEP]
by (metis (mono_tags, lifting) SFV.simps(1) option.simps(5))
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "p \<bullet> (THE x. P x) = foo"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p \<bullet> (THE x. P x) = foo
[PROOF STEP]
apply(perm_strict_simp exclude: The)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (p \<bullet> The) (p \<bullet> P) = foo
[PROOF STEP]
apply(perm_simp exclude: The)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (p \<bullet> The) (p \<bullet> P) = foo
[PROOF STEP]
oops


[STATEMENT]
lemma ProcModifyReturn_sound:
  assumes valid_call: "\<forall>n. \<Gamma>,\<Theta> \<Turnstile>n:\<^bsub>/F\<^esub> P call init p return' c Q,A"
  assumes valid_modif:
    "\<forall>\<sigma>. \<forall>n. \<Gamma>,\<Theta>\<Turnstile>n:\<^bsub>/UNIV\<^esub> {\<sigma>} Call p (Modif \<sigma>),(ModifAbr \<sigma>)"
  assumes ret_modif:
    "\<forall>s t. t \<in> Modif (init s)
           \<longrightarrow> return' s t = return s t"
  assumes ret_modifAbr: "\<forall>s t. t \<in> ModifAbr (init s)
                             \<longrightarrow> return' s t = return s t"
  shows "\<Gamma>,\<Theta> \<Turnstile>n:\<^bsub>/F\<^esub> P (call init p return c) Q,A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Gamma>,\<Theta>\<Turnstile>n:\<^bsub>/F\<^esub> P call init p return c Q,A
[PROOF STEP]
proof (rule cnvalidI)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>s t. \<lbrakk>\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/F\<^esub> P Call p Q,A; \<Gamma>\<turnstile> \<langle>call init p return c,Normal s\<rangle> =n\<Rightarrow> t; s \<in> P; t \<notin> Fault ` F\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
fix s t
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>s t. \<lbrakk>\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/F\<^esub> P Call p Q,A; \<Gamma>\<turnstile> \<langle>call init p return c,Normal s\<rangle> =n\<Rightarrow> t; s \<in> P; t \<notin> Fault ` F\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume ctxt: "\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma> \<Turnstile>n:\<^bsub>/F\<^esub> P (Call p) Q,A"
[PROOF STATE]
proof (state)
this:
\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/F\<^esub> P Call p Q,A

goal (1 subgoal):
 1. \<And>s t. \<lbrakk>\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/F\<^esub> P Call p Q,A; \<Gamma>\<turnstile> \<langle>call init p return c,Normal s\<rangle> =n\<Rightarrow> t; s \<in> P; t \<notin> Fault ` F\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/F\<^esub> P Call p Q,A
[PROOF STEP]
have ctxt': "\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma> \<Turnstile>n:\<^bsub>/UNIV\<^esub> P (Call p) Q,A"
[PROOF STATE]
proof (prove)
using this:
\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/F\<^esub> P Call p Q,A

goal (1 subgoal):
 1. \<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/UNIV\<^esub> P Call p Q,A
[PROOF STEP]
by (auto intro: nvalid_augment_Faults)
[PROOF STATE]
proof (state)
this:
\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/UNIV\<^esub> P Call p Q,A

goal (1 subgoal):
 1. \<And>s t. \<lbrakk>\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/F\<^esub> P Call p Q,A; \<Gamma>\<turnstile> \<langle>call init p return c,Normal s\<rangle> =n\<Rightarrow> t; s \<in> P; t \<notin> Fault ` F\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume exec: "\<Gamma>\<turnstile>\<langle>call init p return c,Normal s\<rangle> =n\<Rightarrow> t"
[PROOF STATE]
proof (state)
this:
\<Gamma>\<turnstile> \<langle>call init p return c,Normal s\<rangle> =n\<Rightarrow> t

goal (1 subgoal):
 1. \<And>s t. \<lbrakk>\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/F\<^esub> P Call p Q,A; \<Gamma>\<turnstile> \<langle>call init p return c,Normal s\<rangle> =n\<Rightarrow> t; s \<in> P; t \<notin> Fault ` F\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume P: "s \<in> P"
[PROOF STATE]
proof (state)
this:
s \<in> P

goal (1 subgoal):
 1. \<And>s t. \<lbrakk>\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/F\<^esub> P Call p Q,A; \<Gamma>\<turnstile> \<langle>call init p return c,Normal s\<rangle> =n\<Rightarrow> t; s \<in> P; t \<notin> Fault ` F\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume t_notin_F: "t \<notin> Fault ` F"
[PROOF STATE]
proof (state)
this:
t \<notin> Fault ` F

goal (1 subgoal):
 1. \<And>s t. \<lbrakk>\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/F\<^esub> P Call p Q,A; \<Gamma>\<turnstile> \<langle>call init p return c,Normal s\<rangle> =n\<Rightarrow> t; s \<in> P; t \<notin> Fault ` F\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
from exec
[PROOF STATE]
proof (chain)
picking this:
\<Gamma>\<turnstile> \<langle>call init p return c,Normal s\<rangle> =n\<Rightarrow> t
[PROOF STEP]
show "t \<in> Normal ` Q \<union> Abrupt ` A"
[PROOF STATE]
proof (prove)
using this:
\<Gamma>\<turnstile> \<langle>call init p return c,Normal s\<rangle> =n\<Rightarrow> t

goal (1 subgoal):
 1. t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
proof (cases rule: execn_call_Normal_elim)
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>c s t',Normal (return s t')\<rangle> =Suc i\<Rightarrow> t; n = Suc i\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 5. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
fix bdy m t'
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>c s t',Normal (return s t')\<rangle> =Suc i\<Rightarrow> t; n = Suc i\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 5. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume bdy: "\<Gamma> p = Some bdy"
[PROOF STATE]
proof (state)
this:
\<Gamma> p = Some bdy

goal (5 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>c s t',Normal (return s t')\<rangle> =Suc i\<Rightarrow> t; n = Suc i\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 5. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume exec_body: "\<Gamma>\<turnstile>\<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Normal t'"
[PROOF STATE]
proof (state)
this:
\<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Normal t'

goal (5 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>c s t',Normal (return s t')\<rangle> =Suc i\<Rightarrow> t; n = Suc i\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 5. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume exec_c: "\<Gamma>\<turnstile>\<langle>c s t',Normal (return s t')\<rangle> =Suc m\<Rightarrow> t"
[PROOF STATE]
proof (state)
this:
\<Gamma>\<turnstile> \<langle>c s t',Normal (return s t')\<rangle> =Suc m\<Rightarrow> t

goal (5 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>c s t',Normal (return s t')\<rangle> =Suc i\<Rightarrow> t; n = Suc i\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 5. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume n: "n = Suc m"
[PROOF STATE]
proof (state)
this:
n = Suc m

goal (5 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>c s t',Normal (return s t')\<rangle> =Suc i\<Rightarrow> t; n = Suc i\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 5. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
from exec_body n bdy
[PROOF STATE]
proof (chain)
picking this:
\<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Normal t'
n = Suc m
\<Gamma> p = Some bdy
[PROOF STEP]
have "\<Gamma>\<turnstile>\<langle>Call p,Normal (init s)\<rangle> =n\<Rightarrow> Normal t'"
[PROOF STATE]
proof (prove)
using this:
\<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Normal t'
n = Suc m
\<Gamma> p = Some bdy

goal (1 subgoal):
 1. \<Gamma>\<turnstile> \<langle>Call p,Normal (init s)\<rangle> =n\<Rightarrow> Normal t'
[PROOF STEP]
by (auto simp add: intro: execn.Call)
[PROOF STATE]
proof (state)
this:
\<Gamma>\<turnstile> \<langle>Call p,Normal (init s)\<rangle> =n\<Rightarrow> Normal t'

goal (5 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>c s t',Normal (return s t')\<rangle> =Suc i\<Rightarrow> t; n = Suc i\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 5. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
from cnvalidD [OF valid_modif [rule_format, of n "init s"] ctxt' this] P
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>init s \<in> {init s}; Normal t' \<notin> range Fault\<rbrakk> \<Longrightarrow> Normal t' \<in> Normal ` Modif (init s) \<union> Abrupt ` ModifAbr (init s)
s \<in> P
[PROOF STEP]
have "t' \<in> Modif (init s)"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>init s \<in> {init s}; Normal t' \<notin> range Fault\<rbrakk> \<Longrightarrow> Normal t' \<in> Normal ` Modif (init s) \<union> Abrupt ` ModifAbr (init s)
s \<in> P

goal (1 subgoal):
 1. t' \<in> Modif (init s)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t' \<in> Modif (init s)

goal (5 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>c s t',Normal (return s t')\<rangle> =Suc i\<Rightarrow> t; n = Suc i\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 5. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
with ret_modif
[PROOF STATE]
proof (chain)
picking this:
\<forall>s t. t \<in> Modif (init s) \<longrightarrow> return' s t = return s t
t' \<in> Modif (init s)
[PROOF STEP]
have "Normal (return' s t') =
      Normal (return s t')"
[PROOF STATE]
proof (prove)
using this:
\<forall>s t. t \<in> Modif (init s) \<longrightarrow> return' s t = return s t
t' \<in> Modif (init s)

goal (1 subgoal):
 1. Normal (return' s t') = Normal (return s t')
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
Normal (return' s t') = Normal (return s t')

goal (5 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>c s t',Normal (return s t')\<rangle> =Suc i\<Rightarrow> t; n = Suc i\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 5. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
with exec_body exec_c bdy n
[PROOF STATE]
proof (chain)
picking this:
\<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Normal t'
\<Gamma>\<turnstile> \<langle>c s t',Normal (return s t')\<rangle> =Suc m\<Rightarrow> t
\<Gamma> p = Some bdy
n = Suc m
Normal (return' s t') = Normal (return s t')
[PROOF STEP]
have "\<Gamma>\<turnstile>\<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t"
[PROOF STATE]
proof (prove)
using this:
\<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Normal t'
\<Gamma>\<turnstile> \<langle>c s t',Normal (return s t')\<rangle> =Suc m\<Rightarrow> t
\<Gamma> p = Some bdy
n = Suc m
Normal (return' s t') = Normal (return s t')

goal (1 subgoal):
 1. \<Gamma>\<turnstile> \<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t
[PROOF STEP]
by (auto intro: execn_call)
[PROOF STATE]
proof (state)
this:
\<Gamma>\<turnstile> \<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t

goal (5 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Normal t'; \<Gamma>\<turnstile> \<langle>c s t',Normal (return s t')\<rangle> =Suc i\<Rightarrow> t; n = Suc i\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 5. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>s \<in> P; t \<notin> Fault ` F\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
s \<in> P
t \<notin> Fault ` F
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>s \<in> P; t \<notin> Fault ` F\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
s \<in> P
t \<notin> Fault ` F

goal (1 subgoal):
 1. t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
t \<in> Normal ` Q \<union> Abrupt ` A

goal (4 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
fix bdy m t'
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume bdy: "\<Gamma> p = Some bdy"
[PROOF STATE]
proof (state)
this:
\<Gamma> p = Some bdy

goal (4 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume exec_body: "\<Gamma>\<turnstile>\<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Abrupt t'"
[PROOF STATE]
proof (state)
this:
\<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Abrupt t'

goal (4 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume n: "n = Suc m"
[PROOF STATE]
proof (state)
this:
n = Suc m

goal (4 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume t: "t = Abrupt (return s t')"
[PROOF STATE]
proof (state)
this:
t = Abrupt (return s t')

goal (4 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
t = Abrupt (return s t')

goal (4 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
from exec_body n bdy
[PROOF STATE]
proof (chain)
picking this:
\<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Abrupt t'
n = Suc m
\<Gamma> p = Some bdy
[PROOF STEP]
have "\<Gamma>\<turnstile>\<langle>Call p,Normal (init s)\<rangle> =n\<Rightarrow> Abrupt t'"
[PROOF STATE]
proof (prove)
using this:
\<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Abrupt t'
n = Suc m
\<Gamma> p = Some bdy

goal (1 subgoal):
 1. \<Gamma>\<turnstile> \<langle>Call p,Normal (init s)\<rangle> =n\<Rightarrow> Abrupt t'
[PROOF STEP]
by (auto simp add: intro: execn.intros)
[PROOF STATE]
proof (state)
this:
\<Gamma>\<turnstile> \<langle>Call p,Normal (init s)\<rangle> =n\<Rightarrow> Abrupt t'

goal (4 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
from cnvalidD [OF valid_modif [rule_format, of n "init s"] ctxt' this] P
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>init s \<in> {init s}; Abrupt t' \<notin> range Fault\<rbrakk> \<Longrightarrow> Abrupt t' \<in> Normal ` Modif (init s) \<union> Abrupt ` ModifAbr (init s)
s \<in> P
[PROOF STEP]
have "t' \<in> ModifAbr (init s)"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>init s \<in> {init s}; Abrupt t' \<notin> range Fault\<rbrakk> \<Longrightarrow> Abrupt t' \<in> Normal ` Modif (init s) \<union> Abrupt ` ModifAbr (init s)
s \<in> P

goal (1 subgoal):
 1. t' \<in> ModifAbr (init s)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t' \<in> ModifAbr (init s)

goal (4 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
with ret_modifAbr
[PROOF STATE]
proof (chain)
picking this:
\<forall>s t. t \<in> ModifAbr (init s) \<longrightarrow> return' s t = return s t
t' \<in> ModifAbr (init s)
[PROOF STEP]
have "Abrupt (return s t') = Abrupt (return' s t')"
[PROOF STATE]
proof (prove)
using this:
\<forall>s t. t \<in> ModifAbr (init s) \<longrightarrow> return' s t = return s t
t' \<in> ModifAbr (init s)

goal (1 subgoal):
 1. Abrupt (return s t') = Abrupt (return' s t')
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
Abrupt (return s t') = Abrupt (return' s t')

goal (4 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
t = Abrupt (return' s t')
[PROOF STEP]
have "t = Abrupt (return' s t')"
[PROOF STATE]
proof (prove)
using this:
t = Abrupt (return' s t')

goal (1 subgoal):
 1. t = Abrupt (return' s t')
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
t = Abrupt (return' s t')

goal (4 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
with exec_body bdy n
[PROOF STATE]
proof (chain)
picking this:
\<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Abrupt t'
\<Gamma> p = Some bdy
n = Suc m
t = Abrupt (return' s t')
[PROOF STEP]
have "\<Gamma>\<turnstile>\<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t"
[PROOF STATE]
proof (prove)
using this:
\<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Abrupt t'
\<Gamma> p = Some bdy
n = Suc m
t = Abrupt (return' s t')

goal (1 subgoal):
 1. \<Gamma>\<turnstile> \<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t
[PROOF STEP]
by (auto intro: execn_callAbrupt)
[PROOF STATE]
proof (state)
this:
\<Gamma>\<turnstile> \<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t

goal (4 subgoals):
 1. \<And>bdy i t'. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Abrupt t'; n = Suc i; t = Abrupt (return s t')\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 4. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
from cnvalidD [OF valid_call [rule_format] ctxt this] P t_notin_F
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>s \<in> P; t \<notin> Fault ` F\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
s \<in> P
t \<notin> Fault ` F
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>s \<in> P; t \<notin> Fault ` F\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
s \<in> P
t \<notin> Fault ` F

goal (1 subgoal):
 1. t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
t \<in> Normal ` Q \<union> Abrupt ` A

goal (3 subgoals):
 1. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
fix bdy m f
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume bdy: "\<Gamma> p = Some bdy"
[PROOF STATE]
proof (state)
this:
\<Gamma> p = Some bdy

goal (3 subgoals):
 1. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume "\<Gamma>\<turnstile>\<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Fault f" "n = Suc m"
      "t = Fault f"
[PROOF STATE]
proof (state)
this:
\<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Fault f
n = Suc m
t = Fault f

goal (3 subgoals):
 1. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
with bdy
[PROOF STATE]
proof (chain)
picking this:
\<Gamma> p = Some bdy
\<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Fault f
n = Suc m
t = Fault f
[PROOF STEP]
have "\<Gamma>\<turnstile>\<langle>call init p return' c ,Normal s\<rangle> =n\<Rightarrow> t"
[PROOF STATE]
proof (prove)
using this:
\<Gamma> p = Some bdy
\<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Fault f
n = Suc m
t = Fault f

goal (1 subgoal):
 1. \<Gamma>\<turnstile> \<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t
[PROOF STEP]
by (auto intro: execn_callFault)
[PROOF STATE]
proof (state)
this:
\<Gamma>\<turnstile> \<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t

goal (3 subgoals):
 1. \<And>bdy i f. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Fault f; n = Suc i; t = Fault f\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 3. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
from valid_call [rule_format] ctxt this P t_notin_F
[PROOF STATE]
proof (chain)
picking this:
\<Gamma>,\<Theta>\<Turnstile>?n:\<^bsub>/F\<^esub> P call init p return' c Q,A
\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/F\<^esub> P Call p Q,A
\<Gamma>\<turnstile> \<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t
s \<in> P
t \<notin> Fault ` F
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<Gamma>,\<Theta>\<Turnstile>?n:\<^bsub>/F\<^esub> P call init p return' c Q,A
\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/F\<^esub> P Call p Q,A
\<Gamma>\<turnstile> \<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t
s \<in> P
t \<notin> Fault ` F

goal (1 subgoal):
 1. t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
by (rule cnvalidD)
[PROOF STATE]
proof (state)
this:
t \<in> Normal ` Q \<union> Abrupt ` A

goal (2 subgoals):
 1. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
fix bdy m
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume bdy: "\<Gamma> p = Some bdy"
[PROOF STATE]
proof (state)
this:
\<Gamma> p = Some bdy

goal (2 subgoals):
 1. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume "\<Gamma>\<turnstile>\<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Stuck" "n = Suc m"
      "t = Stuck"
[PROOF STATE]
proof (state)
this:
\<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Stuck
n = Suc m
t = Stuck

goal (2 subgoals):
 1. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
with bdy
[PROOF STATE]
proof (chain)
picking this:
\<Gamma> p = Some bdy
\<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Stuck
n = Suc m
t = Stuck
[PROOF STEP]
have "\<Gamma>\<turnstile>\<langle>call init p return' c ,Normal s\<rangle> =n\<Rightarrow> t"
[PROOF STATE]
proof (prove)
using this:
\<Gamma> p = Some bdy
\<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =m\<Rightarrow> Stuck
n = Suc m
t = Stuck

goal (1 subgoal):
 1. \<Gamma>\<turnstile> \<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t
[PROOF STEP]
by (auto intro: execn_callStuck)
[PROOF STATE]
proof (state)
this:
\<Gamma>\<turnstile> \<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t

goal (2 subgoals):
 1. \<And>bdy i. \<lbrakk>\<Gamma> p = Some bdy; \<Gamma>\<turnstile> \<langle>bdy,Normal (init s)\<rangle> =i\<Rightarrow> Stuck; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
 2. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
from valid_call [rule_format] ctxt this P t_notin_F
[PROOF STATE]
proof (chain)
picking this:
\<Gamma>,\<Theta>\<Turnstile>?n:\<^bsub>/F\<^esub> P call init p return' c Q,A
\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/F\<^esub> P Call p Q,A
\<Gamma>\<turnstile> \<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t
s \<in> P
t \<notin> Fault ` F
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<Gamma>,\<Theta>\<Turnstile>?n:\<^bsub>/F\<^esub> P call init p return' c Q,A
\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/F\<^esub> P Call p Q,A
\<Gamma>\<turnstile> \<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t
s \<in> P
t \<notin> Fault ` F

goal (1 subgoal):
 1. t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
by (rule cnvalidD)
[PROOF STATE]
proof (state)
this:
t \<in> Normal ` Q \<union> Abrupt ` A

goal (1 subgoal):
 1. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
fix m
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
assume "\<Gamma> p = None"
    and  "n = Suc m" "t = Stuck"
[PROOF STATE]
proof (state)
this:
\<Gamma> p = None
n = Suc m
t = Stuck

goal (1 subgoal):
 1. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<Gamma> p = None
n = Suc m
t = Stuck
[PROOF STEP]
have "\<Gamma>\<turnstile>\<langle>call init p return' c ,Normal s\<rangle> =n\<Rightarrow> t"
[PROOF STATE]
proof (prove)
using this:
\<Gamma> p = None
n = Suc m
t = Stuck

goal (1 subgoal):
 1. \<Gamma>\<turnstile> \<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t
[PROOF STEP]
by (auto intro: execn_callUndefined)
[PROOF STATE]
proof (state)
this:
\<Gamma>\<turnstile> \<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t

goal (1 subgoal):
 1. \<And>i. \<lbrakk>\<Gamma> p = None; n = Suc i; t = Stuck\<rbrakk> \<Longrightarrow> t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
from valid_call [rule_format] ctxt this P t_notin_F
[PROOF STATE]
proof (chain)
picking this:
\<Gamma>,\<Theta>\<Turnstile>?n:\<^bsub>/F\<^esub> P call init p return' c Q,A
\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/F\<^esub> P Call p Q,A
\<Gamma>\<turnstile> \<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t
s \<in> P
t \<notin> Fault ` F
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<Gamma>,\<Theta>\<Turnstile>?n:\<^bsub>/F\<^esub> P call init p return' c Q,A
\<forall>(P, p, Q, A)\<in>\<Theta>. \<Gamma>\<Turnstile>n:\<^bsub>/F\<^esub> P Call p Q,A
\<Gamma>\<turnstile> \<langle>call init p return' c,Normal s\<rangle> =n\<Rightarrow> t
s \<in> P
t \<notin> Fault ` F

goal (1 subgoal):
 1. t \<in> Normal ` Q \<union> Abrupt ` A
[PROOF STEP]
by (rule cnvalidD)
[PROOF STATE]
proof (state)
this:
t \<in> Normal ` Q \<union> Abrupt ` A

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
t \<in> Normal ` Q \<union> Abrupt ` A

goal:
No subgoals!
[PROOF STEP]
qed