[STATEMENT]
lemma assign_eval\<^sub>w_load\<^sub>C:
  shows "(\<langle>x \<leftarrow> Load y, mds, mem\<rangle>\<^sub>C, \<langle>Stop, mds, mem (x := mem y)\<rangle>\<^sub>C) \<in> C.eval\<^sub>w"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eval_abv\<^sub>C \<langle>x \<leftarrow> aexp\<^sub>C.Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := mem y)\<rangle>\<^sub>C
[PROOF STEP]
using C.unannotated[OF C.assign, where E="[]", simplified]
[PROOF STATE]
proof (prove)
using this:
eval_abv\<^sub>C \<langle>?x1 \<leftarrow> ?e1, ?mds, ?mem\<rangle>\<^sub>C \<langle>Stop, ?mds, ?mem(?x1 := ev\<^sub>A\<^sub>C ?mem ?e1)\<rangle>\<^sub>C

goal (1 subgoal):
 1. eval_abv\<^sub>C \<langle>x \<leftarrow> aexp\<^sub>C.Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := mem y)\<rangle>\<^sub>C
[PROOF STEP]
apply(drule_tac x=x in meta_spec)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>e mds mem. eval_abv\<^sub>C \<langle>x \<leftarrow> e, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := ev\<^sub>A\<^sub>C mem e)\<rangle>\<^sub>C) \<Longrightarrow> eval_abv\<^sub>C \<langle>x \<leftarrow> aexp\<^sub>C.Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := mem y)\<rangle>\<^sub>C
[PROOF STEP]
apply(drule_tac x="Load y" in meta_spec)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>mds mem. eval_abv\<^sub>C \<langle>x \<leftarrow> aexp\<^sub>C.Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := ev\<^sub>A\<^sub>C mem (aexp\<^sub>C.Load y))\<rangle>\<^sub>C) \<Longrightarrow> eval_abv\<^sub>C \<langle>x \<leftarrow> aexp\<^sub>C.Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := mem y)\<rangle>\<^sub>C
[PROOF STEP]
apply(drule_tac x=mds in meta_spec)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>mem. eval_abv\<^sub>C \<langle>x \<leftarrow> aexp\<^sub>C.Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := ev\<^sub>A\<^sub>C mem (aexp\<^sub>C.Load y))\<rangle>\<^sub>C) \<Longrightarrow> eval_abv\<^sub>C \<langle>x \<leftarrow> aexp\<^sub>C.Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := mem y)\<rangle>\<^sub>C
[PROOF STEP]
apply(drule_tac x=mem in meta_spec)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eval_abv\<^sub>C \<langle>x \<leftarrow> aexp\<^sub>C.Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := ev\<^sub>A\<^sub>C mem (aexp\<^sub>C.Load y))\<rangle>\<^sub>C \<Longrightarrow> eval_abv\<^sub>C \<langle>x \<leftarrow> aexp\<^sub>C.Load y, mds, mem\<rangle>\<^sub>C \<langle>Stop, mds, mem(x := mem y)\<rangle>\<^sub>C
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma get_disconnected_nodes_ok:
  "type_wf h \<Longrightarrow> document_ptr |\<in>| document_ptr_kinds h \<Longrightarrow>
    h \<turnstile> ok (get_disconnected_nodes document_ptr)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>type_wf h; document_ptr |\<in>| document_ptr_kinds h\<rbrakk> \<Longrightarrow> h \<turnstile> ok get_disconnected_nodes document_ptr
[PROOF STEP]
apply(unfold type_wf_impl get_disconnected_nodes_impl[unfolded a_get_disconnected_nodes_def])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ShadowRootClass.type_wf h; document_ptr |\<in>| document_ptr_kinds h\<rbrakk> \<Longrightarrow> h \<turnstile> ok get_disconnected_nodes document_ptr
[PROOF STEP]
using CD.get_disconnected_nodes_ok CD.type_wf_impl ShadowRootClass.type_wf\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>type_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M ?h; ?document_ptr |\<in>| document_ptr_kinds ?h\<rbrakk> \<Longrightarrow> ?h \<turnstile> ok get_disconnected_nodes ?document_ptr
type_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M = DocumentClass.type_wf
ShadowRootClass.type_wf ?h \<Longrightarrow> DocumentClass.type_wf ?h

goal (1 subgoal):
 1. \<lbrakk>ShadowRootClass.type_wf h; document_ptr |\<in>| document_ptr_kinds h\<rbrakk> \<Longrightarrow> h \<turnstile> ok get_disconnected_nodes document_ptr
[PROOF STEP]
by blast


[STATEMENT]
lemma proj_ext_tuple:
  assumes S\<phi>_def: "S\<phi> \<equiv> {\<sigma>. esat \<phi> I \<sigma> UNIV}"
    and AD_sub: "act_edom \<phi> I \<subseteq> AD"
    and X\<phi>_def: "X\<phi> = fo_nmlz AD ` proj_vals S\<phi> (fv_fo_fmla_list \<phi>)"
    and ns\<phi>'_def: "ns\<phi>' = filter (\<lambda>n. n \<notin> fv_fo_fmla \<phi>) ns\<psi>"
    and sd_ns\<psi>: "sorted_distinct ns\<psi>"
    and fv_Un: "fv_fo_fmla \<psi> = fv_fo_fmla \<phi> \<union> set ns\<psi>"
    and Z_props: "\<And>xs. xs \<in> Z \<Longrightarrow> fo_nmlz AD xs = xs \<and> length xs = length (fv_fo_fmla_list \<psi>)"
  shows "Z \<inter> ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> =
    {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<in> X\<phi>}"
    "Z - ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> =
    {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<notin> X\<phi>}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Z \<inter> ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<in> X\<phi>} &&& Z - ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<notin> X\<phi>}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. Z \<inter> ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<in> X\<phi>}
 2. Z - ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<notin> X\<phi>}
[PROOF STEP]
have ad_agr_\<phi>:
    "\<And>\<sigma> \<tau>. ad_agr_sets (set (fv_fo_fmla_list \<phi>)) (set (fv_fo_fmla_list \<phi>)) AD \<sigma> \<tau> \<Longrightarrow>
      \<sigma> \<in> S\<phi> \<longleftrightarrow> \<tau> \<in> S\<phi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> \<tau>. ad_agr_sets (set (fv_fo_fmla_list \<phi>)) (set (fv_fo_fmla_list \<phi>)) AD \<sigma> \<tau> \<Longrightarrow> (\<sigma> \<in> S\<phi>) = (\<tau> \<in> S\<phi>)
[PROOF STEP]
using esat_UNIV_cong[OF ad_agr_sets_restrict, OF _ subset_refl] ad_agr_sets_mono AD_sub
[PROOF STATE]
proof (prove)
using this:
ad_agr_sets (set (fv_fo_fmla_list ?\<phi>)) (set (fv_fo_fmla_list ?\<phi>)) (act_edom ?\<phi> ?I) ?\<sigma> ?\<tau> \<Longrightarrow> esat ?\<phi> ?I ?\<sigma> UNIV = esat ?\<phi> ?I ?\<tau> UNIV
\<lbrakk>?X \<subseteq> ?Y; ad_agr_sets ?FV ?S ?Y ?\<sigma> ?\<tau>\<rbrakk> \<Longrightarrow> ad_agr_sets ?FV ?S ?X ?\<sigma> ?\<tau>
act_edom \<phi> I \<subseteq> AD

goal (1 subgoal):
 1. \<And>\<sigma> \<tau>. ad_agr_sets (set (fv_fo_fmla_list \<phi>)) (set (fv_fo_fmla_list \<phi>)) AD \<sigma> \<tau> \<Longrightarrow> (\<sigma> \<in> S\<phi>) = (\<tau> \<in> S\<phi>)
[PROOF STEP]
unfolding S\<phi>_def
[PROOF STATE]
proof (prove)
using this:
ad_agr_sets (set (fv_fo_fmla_list ?\<phi>)) (set (fv_fo_fmla_list ?\<phi>)) (act_edom ?\<phi> ?I) ?\<sigma> ?\<tau> \<Longrightarrow> esat ?\<phi> ?I ?\<sigma> UNIV = esat ?\<phi> ?I ?\<tau> UNIV
\<lbrakk>?X \<subseteq> ?Y; ad_agr_sets ?FV ?S ?Y ?\<sigma> ?\<tau>\<rbrakk> \<Longrightarrow> ad_agr_sets ?FV ?S ?X ?\<sigma> ?\<tau>
act_edom \<phi> I \<subseteq> AD

goal (1 subgoal):
 1. \<And>\<sigma> \<tau>. ad_agr_sets (set (fv_fo_fmla_list \<phi>)) (set (fv_fo_fmla_list \<phi>)) AD \<sigma> \<tau> \<Longrightarrow> (\<sigma> \<in> {\<sigma>. esat \<phi> I \<sigma> UNIV}) = (\<tau> \<in> {\<sigma>. esat \<phi> I \<sigma> UNIV})
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
ad_agr_sets (set (fv_fo_fmla_list \<phi>)) (set (fv_fo_fmla_list \<phi>)) AD ?\<sigma> ?\<tau> \<Longrightarrow> (?\<sigma> \<in> S\<phi>) = (?\<tau> \<in> S\<phi>)

goal (2 subgoals):
 1. Z \<inter> ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<in> X\<phi>}
 2. Z - ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<notin> X\<phi>}
[PROOF STEP]
have sd_ns\<phi>': "sorted_distinct ns\<phi>'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sorted_distinct ns\<phi>'
[PROOF STEP]
using sd_ns\<psi> sorted_filter[of id]
[PROOF STATE]
proof (prove)
using this:
sorted_distinct ns\<psi>
sorted (map id ?xs) \<Longrightarrow> sorted (map id (filter ?P ?xs))

goal (1 subgoal):
 1. sorted_distinct ns\<phi>'
[PROOF STEP]
by (auto simp: ns\<phi>'_def)
[PROOF STATE]
proof (state)
this:
sorted_distinct ns\<phi>'

goal (2 subgoals):
 1. Z \<inter> ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<in> X\<phi>}
 2. Z - ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<notin> X\<phi>}
[PROOF STEP]
have disj: "set (fv_fo_fmla_list \<phi>) \<inter> set ns\<phi>' = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (fv_fo_fmla_list \<phi>) \<inter> set ns\<phi>' = {}
[PROOF STEP]
by (auto simp: ns\<phi>'_def fv_fo_fmla_list_set)
[PROOF STATE]
proof (state)
this:
set (fv_fo_fmla_list \<phi>) \<inter> set ns\<phi>' = {}

goal (2 subgoals):
 1. Z \<inter> ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<in> X\<phi>}
 2. Z - ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<notin> X\<phi>}
[PROOF STEP]
have Un: "set (fv_fo_fmla_list \<phi>) \<union> set ns\<phi>' = set (fv_fo_fmla_list \<psi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (fv_fo_fmla_list \<phi>) \<union> set ns\<phi>' = set (fv_fo_fmla_list \<psi>)
[PROOF STEP]
using fv_Un
[PROOF STATE]
proof (prove)
using this:
fv_fo_fmla \<psi> = fv_fo_fmla \<phi> \<union> set ns\<psi>

goal (1 subgoal):
 1. set (fv_fo_fmla_list \<phi>) \<union> set ns\<phi>' = set (fv_fo_fmla_list \<psi>)
[PROOF STEP]
by (auto simp: ns\<phi>'_def fv_fo_fmla_list_set)
[PROOF STATE]
proof (state)
this:
set (fv_fo_fmla_list \<phi>) \<union> set ns\<phi>' = set (fv_fo_fmla_list \<psi>)

goal (2 subgoals):
 1. Z \<inter> ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<in> X\<phi>}
 2. Z - ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<notin> X\<phi>}
[PROOF STEP]
note proj = proj_tuple_correct[OF sorted_distinct_fv_list sd_ns\<phi>' sorted_distinct_fv_list
      disj Un X\<phi>_def ad_agr_\<phi>, simplified]
[PROOF STATE]
proof (state)
this:
\<lbrakk>fo_nmlz AD ?xs = ?xs; length ?xs = length (fv_fo_fmla_list \<psi>)\<rbrakk> \<Longrightarrow> (?xs \<in> fo_nmlz AD ` \<Union> (ext_tuple AD (fv_fo_fmla_list \<phi>) ns\<phi>' ` X\<phi>)) = (fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) ?xs)) \<in> X\<phi>)

goal (2 subgoals):
 1. Z \<inter> ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<in> X\<phi>}
 2. Z - ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<notin> X\<phi>}
[PROOF STEP]
have "fo_nmlz AD ` X\<phi> = X\<phi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fo_nmlz AD ` X\<phi> = X\<phi>
[PROOF STEP]
using fo_nmlz_idem[OF fo_nmlz_sound]
[PROOF STATE]
proof (prove)
using this:
fo_nmlz ?AD (fo_nmlz ?AD ?xs1) = fo_nmlz ?AD ?xs1

goal (1 subgoal):
 1. fo_nmlz AD ` X\<phi> = X\<phi>
[PROOF STEP]
by (auto simp: X\<phi>_def image_iff)
[PROOF STATE]
proof (state)
this:
fo_nmlz AD ` X\<phi> = X\<phi>

goal (2 subgoals):
 1. Z \<inter> ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<in> X\<phi>}
 2. Z - ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<notin> X\<phi>}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fo_nmlz AD ` X\<phi> = X\<phi>
[PROOF STEP]
have aux: "ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = fo_nmlz AD ` \<Union>(ext_tuple AD (fv_fo_fmla_list \<phi>) ns\<phi>' ` X\<phi>)"
[PROOF STATE]
proof (prove)
using this:
fo_nmlz AD ` X\<phi> = X\<phi>

goal (1 subgoal):
 1. ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = fo_nmlz AD ` \<Union> (ext_tuple AD (fv_fo_fmla_list \<phi>) ns\<phi>' ` X\<phi>)
[PROOF STEP]
by (auto simp: ext_tuple_set_def ext_tuple_def)
[PROOF STATE]
proof (state)
this:
ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = fo_nmlz AD ` \<Union> (ext_tuple AD (fv_fo_fmla_list \<phi>) ns\<phi>' ` X\<phi>)

goal (2 subgoals):
 1. Z \<inter> ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<in> X\<phi>}
 2. Z - ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<notin> X\<phi>}
[PROOF STEP]
show "Z \<inter> ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> =
    {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<in> X\<phi>}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Z \<inter> ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<in> X\<phi>}
[PROOF STEP]
using Z_props proj
[PROOF STATE]
proof (prove)
using this:
?xs \<in> Z \<Longrightarrow> fo_nmlz AD ?xs = ?xs \<and> length ?xs = length (fv_fo_fmla_list \<psi>)
\<lbrakk>fo_nmlz AD ?xs = ?xs; length ?xs = length (fv_fo_fmla_list \<psi>)\<rbrakk> \<Longrightarrow> (?xs \<in> fo_nmlz AD ` \<Union> (ext_tuple AD (fv_fo_fmla_list \<phi>) ns\<phi>' ` X\<phi>)) = (fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) ?xs)) \<in> X\<phi>)

goal (1 subgoal):
 1. Z \<inter> ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<in> X\<phi>}
[PROOF STEP]
by (auto simp: aux)
[PROOF STATE]
proof (state)
this:
Z \<inter> ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<in> X\<phi>}

goal (1 subgoal):
 1. Z - ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<notin> X\<phi>}
[PROOF STEP]
show "Z - ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> =
    {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<notin> X\<phi>}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Z - ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<notin> X\<phi>}
[PROOF STEP]
using Z_props proj
[PROOF STATE]
proof (prove)
using this:
?xs \<in> Z \<Longrightarrow> fo_nmlz AD ?xs = ?xs \<and> length ?xs = length (fv_fo_fmla_list \<psi>)
\<lbrakk>fo_nmlz AD ?xs = ?xs; length ?xs = length (fv_fo_fmla_list \<psi>)\<rbrakk> \<Longrightarrow> (?xs \<in> fo_nmlz AD ` \<Union> (ext_tuple AD (fv_fo_fmla_list \<phi>) ns\<phi>' ` X\<phi>)) = (fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) ?xs)) \<in> X\<phi>)

goal (1 subgoal):
 1. Z - ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<notin> X\<phi>}
[PROOF STEP]
by (auto simp: aux)
[PROOF STATE]
proof (state)
this:
Z - ext_tuple_set AD (fv_fo_fmla_list \<phi>) ns\<phi>' X\<phi> = {xs \<in> Z. fo_nmlz AD (proj_tuple (fv_fo_fmla_list \<phi>) (zip (fv_fo_fmla_list \<psi>) xs)) \<notin> X\<phi>}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma (in insertSort_impl) insertSort_modifies:
  shows
   "\<forall>\<sigma>. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {\<sigma>} \<acute>p :== PROC insertSort(\<acute>p)
    {t. t may_only_modify_globals \<sigma> in [next]}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<sigma>. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {\<sigma>} \<acute>p :== PROC insertSort(\<acute>p) (_Collect t (t may_only_modify_globals \<sigma> in [next]))
[PROOF STEP]
apply (hoare_rule HoarePartial.ProcRec1)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<sigma>. \<Gamma>,(\<Union>\<sigma>. {({\<sigma>}, insertSort_'proc, _Collect t (t may_only_modify_globals \<sigma> in [next]), {})})\<turnstile>\<^bsub>/UNIV\<^esub> {\<sigma>} \<acute>r :== Null;; WHILE \<acute>p \<noteq> Null DO \<acute>q :== \<acute>p;; \<acute>p :== \<acute>p\<rightarrow>\<acute>next;; \<acute>r :== CALL insert(\<acute>q,\<acute>r) OD;; \<acute>p :== \<acute>r (_Collect t (t may_only_modify_globals \<sigma> in [next]))
[PROOF STEP]
apply (vcg spec=modifies)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma real_resource_wiring:
  shows "cipher.res (key \<eta>) (enc \<eta>) (dec \<eta>)
    = RES (\<dagger>auth_channel.auth_oracle \<oplus>\<^sub>O key_channel_send \<oplus>\<^sub>O key_channel_recv) (None, Void)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cipher.res (key \<eta>) (enc \<eta>) (dec \<eta>) = RES (\<dagger>auth_channel.auth_oracle \<oplus>\<^sub>O key_channel_send \<oplus>\<^sub>O key_channel_recv) (None, Void)
[PROOF STEP]
including lifting_syntax
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cipher.res (key \<eta>) (enc \<eta>) (dec \<eta>) = RES (\<dagger>auth_channel.auth_oracle \<oplus>\<^sub>O key_channel_send \<oplus>\<^sub>O key_channel_recv) (None, Void)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. cipher.res (key \<eta>) (enc \<eta>) (dec \<eta>) = RES (\<dagger>auth_channel.auth_oracle \<oplus>\<^sub>O key_channel_send \<oplus>\<^sub>O key_channel_recv) (None, Void)
[PROOF STEP]
note[simp]= Rel_def prod.rel_eq[symmetric] split_def split_beta o_def exec_gpv_bind bind_map_spmf
    resource_of_oracle_rprodl rprodl_extend_state_oracle
    conv_callee_parallel[symmetric] extend_state_oracle_plus_oracle[symmetric]
    attach_CNV_RES attach_callee_parallel_intercept attach_stateless_callee
[PROOF STATE]
proof (state)
this:
Transfer.Rel ?r \<equiv> ?r
(=) = rel_prod (=) (=)
case_prod = (\<lambda>c p. c (fst p) (snd p))
(case ?prod of (x, xa) \<Rightarrow> ?f x xa) = ?f (fst ?prod) (snd ?prod)
?f \<circ> ?g = (\<lambda>x. ?f (?g x))
exec_gpv ?callee (?c \<bind> ?f) ?s = exec_gpv ?callee ?c ?s \<bind> (\<lambda>xa. case xa of (x, s') \<Rightarrow> exec_gpv ?callee (?f x) s')
map_spmf ?f ?p \<bind> ?g = ?p \<bind> ?g \<circ> ?f
RES ((rprodl ---> id ---> map_spmf (map_prod id lprodr)) ?oracle) ((?s1.0, ?s2.0), ?s3.0) = RES ?oracle (?s1.0, ?s2.0, ?s3.0)
(rprodl ---> id ---> map_spmf (map_prod id lprodr)) \<dagger>\<dagger>?oracle = \<dagger>?oracle
CNV ?callee1.0 ?s |\<^sub>= CNV ?callee2.0 ?s' = CNV (?callee1.0 \<ddagger>\<^sub>I ?callee2.0) (?s, ?s')
\<dagger>?oracle1.0 \<oplus>\<^sub>O \<dagger>?oracle2.0 = \<dagger>(?oracle1.0 \<oplus>\<^sub>O ?oracle2.0)
CNV ?callee ?s \<rhd> RES ?res ?s' = RES (attach_callee ?callee ?res) (?s, ?s')
attach_callee (?callee1.0 \<ddagger>\<^sub>I ?callee2.0) (?oracle1.0 \<oplus>\<^sub>O ?oracle2.0) = (rprodl ---> id ---> map_spmf (map_prod id lprodr)) (lift_state_oracle extend_state_oracle (attach_callee ?callee1.0 ?oracle1.0) \<oplus>\<^sub>O \<dagger>(attach_callee ?callee2.0 ?oracle2.0))
attach_callee (stateless_callee ?callee) ?oracle = \<dagger>(\<lambda>s q. exec_gpv ?oracle (?callee q) s)

goal (1 subgoal):
 1. cipher.res (key \<eta>) (enc \<eta>) (dec \<eta>) = RES (\<dagger>auth_channel.auth_oracle \<oplus>\<^sub>O key_channel_send \<oplus>\<^sub>O key_channel_recv) (None, Void)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cipher.res (key \<eta>) (enc \<eta>) (dec \<eta>) = RES (\<dagger>auth_channel.auth_oracle \<oplus>\<^sub>O key_channel_send \<oplus>\<^sub>O key_channel_recv) (None, Void)
[PROOF STEP]
unfolding channel.res_def cipher.res_def  cipher.routing_def cipher.enc_def cipher.dec_def
      interface_wiring cipher.\<pi>E_def key.res_def key_channel_send_def key_channel_recv_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 1\<^sub>C |\<^sub>= CNV (stateless_callee (\<lambda>m. Pause (Inl ()) Done \<bind> (\<lambda>k. lift_spmf (enc \<eta> (projl k) m) \<bind> (\<lambda>c. Pause (Inr c) Done \<bind> (\<lambda>_. Done ()))))) () |\<^sub>= CNV (stateless_callee (\<lambda>_. Pause (Inr ()) (case_sum (\<lambda>a. Done None) (case_option (Done None) (\<lambda>c. Pause (Inl ()) Done \<bind> (\<lambda>k. Done (dec \<eta> (projl k) c))))))) () \<rhd> RES (\<dagger>auth_channel.auth_oracle \<oplus>\<^sub>O ((key.key_oracle (key \<eta>))\<dagger> \<oplus>\<^sub>O \<dagger>channel.send_oracle) \<oplus>\<^sub>O (key.key_oracle (key \<eta>))\<dagger> \<oplus>\<^sub>O \<dagger>channel.recv_oracle) (None, Void) = RES (\<dagger>auth_channel.auth_oracle \<oplus>\<^sub>O (\<lambda>s m. (key.key_oracle (key \<eta>))\<dagger> s () \<bind> (\<lambda>(k, s). enc \<eta> k m \<bind> (\<lambda>c. \<dagger>channel.send_oracle s c \<bind> (\<lambda>(uu_, s). return_spmf ((), s))))) \<oplus>\<^sub>O (\<lambda>s m. \<dagger>channel.recv_oracle s () \<bind> (\<lambda>(c, s). case c of None \<Rightarrow> return_spmf (None, s) | Some c' \<Rightarrow> (key.key_oracle (key \<eta>))\<dagger> s () \<bind> (\<lambda>(k, s). return_spmf (dec \<eta> k c', s))))) (None, Void)
[PROOF STEP]
by (simp add: conv_callee_parallel_id_left[where s="()", symmetric])
      ((auto cong: option.case_cong simp add: option.case_distrib[where h="\<lambda>gpv. exec_gpv _ gpv _"]
          intro!: extend_state_oracle_parametric ) | subst lift_state_oracle_extend_state_oracle)+
[PROOF STATE]
proof (state)
this:
cipher.res (key \<eta>) (enc \<eta>) (dec \<eta>) = RES (\<dagger>auth_channel.auth_oracle \<oplus>\<^sub>O key_channel_send \<oplus>\<^sub>O key_channel_recv) (None, Void)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "X a = X b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. X a = X b
[PROOF STEP]
quickcheck[exhaustive, size = 4, expect = counterexample]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. X a = X b
[PROOF STEP]
oops


[STATEMENT]
lemma outstanding_refs_non_volatile_Read\<^sub>s\<^sub>b_all_acquired_dropWhile':
"\<And>m \<S> \<O> pending_write.
  \<lbrakk>reads_consistent pending_write \<O> m sb;non_volatile_owned_or_read_only pending_write \<S> \<O> sb;
a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk>
\<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired sb \<or>
    a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>)
      (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>m \<S> \<O> pending_write. \<lbrakk>reads_consistent pending_write \<O> m sb; non_volatile_owned_or_read_only pending_write \<S> \<O> sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
[PROOF STEP]
proof (induct sb)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>m \<S> \<O> pending_write. \<lbrakk>reads_consistent pending_write \<O> m []; non_volatile_owned_or_read_only pending_write \<S> \<O> []; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) [])\<rbrakk> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired [] \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) []) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) [])
 2. \<And>aa sb m \<S> \<O> pending_write. \<lbrakk>\<And>m \<S> \<O> pending_write. \<lbrakk>reads_consistent pending_write \<O> m sb; non_volatile_owned_or_read_only pending_write \<S> \<O> sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); reads_consistent pending_write \<O> m (aa # sb); non_volatile_owned_or_read_only pending_write \<S> \<O> (aa # sb); a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (aa # sb))\<rbrakk> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (aa # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (aa # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (aa # sb))
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
reads_consistent pending_write \<O> m []
non_volatile_owned_or_read_only pending_write \<S> \<O> []
a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) [])

goal (2 subgoals):
 1. \<And>m \<S> \<O> pending_write. \<lbrakk>reads_consistent pending_write \<O> m []; non_volatile_owned_or_read_only pending_write \<S> \<O> []; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) [])\<rbrakk> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired [] \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) []) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) [])
 2. \<And>aa sb m \<S> \<O> pending_write. \<lbrakk>\<And>m \<S> \<O> pending_write. \<lbrakk>reads_consistent pending_write \<O> m sb; non_volatile_owned_or_read_only pending_write \<S> \<O> sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); reads_consistent pending_write \<O> m (aa # sb); non_volatile_owned_or_read_only pending_write \<S> \<O> (aa # sb); a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (aa # sb))\<rbrakk> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (aa # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (aa # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (aa # sb))
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
reads_consistent pending_write \<O> m []
non_volatile_owned_or_read_only pending_write \<S> \<O> []
a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) [])

goal (1 subgoal):
 1. a \<in> \<O> \<or> a \<in> all_acquired [] \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) []) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) [])
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
a \<in> \<O> \<or> a \<in> all_acquired [] \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) []) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) [])

goal (1 subgoal):
 1. \<And>aa sb m \<S> \<O> pending_write. \<lbrakk>\<And>m \<S> \<O> pending_write. \<lbrakk>reads_consistent pending_write \<O> m sb; non_volatile_owned_or_read_only pending_write \<S> \<O> sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); reads_consistent pending_write \<O> m (aa # sb); non_volatile_owned_or_read_only pending_write \<S> \<O> (aa # sb); a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (aa # sb))\<rbrakk> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (aa # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (aa # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (aa # sb))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>aa sb m \<S> \<O> pending_write. \<lbrakk>\<And>m \<S> \<O> pending_write. \<lbrakk>reads_consistent pending_write \<O> m sb; non_volatile_owned_or_read_only pending_write \<S> \<O> sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); reads_consistent pending_write \<O> m (aa # sb); non_volatile_owned_or_read_only pending_write \<S> \<O> (aa # sb); a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (aa # sb))\<rbrakk> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (aa # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (aa # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (aa # sb))
[PROOF STEP]
case (Cons x sb)
[PROOF STATE]
proof (state)
this:
\<lbrakk>reads_consistent ?pending_write ?\<O> ?m sb; non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> ?\<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) ?\<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
reads_consistent pending_write \<O> m (x # sb)
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))

goal (1 subgoal):
 1. \<And>aa sb m \<S> \<O> pending_write. \<lbrakk>\<And>m \<S> \<O> pending_write. \<lbrakk>reads_consistent pending_write \<O> m sb; non_volatile_owned_or_read_only pending_write \<S> \<O> sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); reads_consistent pending_write \<O> m (aa # sb); non_volatile_owned_or_read_only pending_write \<S> \<O> (aa # sb); a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (aa # sb))\<rbrakk> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (aa # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (aa # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (aa # sb))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
proof (cases x)
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>x11 x12 x13 x14 x15 x16 x17 x18. x = Write\<^sub>s\<^sub>b x11 x12 x13 x14 x15 x16 x17 x18 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 2. \<And>x21 x22 x23 x24. x = Read\<^sub>s\<^sub>b x21 x22 x23 x24 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 3. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 4. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
case (Write\<^sub>s\<^sub>b volatile a' sop v A L R W)
[PROOF STATE]
proof (state)
this:
x = Write\<^sub>s\<^sub>b volatile a' sop v A L R W

goal (4 subgoals):
 1. \<And>x11 x12 x13 x14 x15 x16 x17 x18. x = Write\<^sub>s\<^sub>b x11 x12 x13 x14 x15 x16 x17 x18 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 2. \<And>x21 x22 x23 x24. x = Read\<^sub>s\<^sub>b x21 x22 x23 x24 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 3. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 4. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
proof (cases volatile)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. volatile \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 2. \<not> volatile \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
volatile

goal (2 subgoals):
 1. volatile \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 2. \<not> volatile \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
note volatile=this
[PROOF STATE]
proof (state)
this:
volatile

goal (2 subgoals):
 1. volatile \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 2. \<not> volatile \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
from Cons.prems
[PROOF STATE]
proof (chain)
picking this:
reads_consistent pending_write \<O> m (x # sb)
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
obtain
	non_vo: "non_volatile_owned_or_read_only True (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)
	            (\<O> \<union> A - R) sb" and
        out_vol: "outstanding_refs is_volatile_Read\<^sub>s\<^sub>b sb = {}" and
	out: "a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b sb"
[PROOF STATE]
proof (prove)
using this:
reads_consistent pending_write \<O> m (x # sb)
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))

goal (1 subgoal):
 1. (\<lbrakk>non_volatile_owned_or_read_only True (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) (\<O> \<union> A - R) sb; outstanding_refs is_volatile_Read\<^sub>s\<^sub>b sb = {}; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b sb\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (clarsimp simp add: Write\<^sub>s\<^sub>b True)
[PROOF STATE]
proof (state)
this:
non_volatile_owned_or_read_only True (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) (\<O> \<union> A - R) sb
outstanding_refs is_volatile_Read\<^sub>s\<^sub>b sb = {}
a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b sb

goal (2 subgoals):
 1. volatile \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 2. \<not> volatile \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
proof (cases "a \<in> \<O>")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. a \<in> \<O> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 2. a \<notin> \<O> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
a \<in> \<O>

goal (2 subgoals):
 1. a \<in> \<O> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 2. a \<notin> \<O> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
by (clarsimp simp add: Write\<^sub>s\<^sub>b True volatile)
[PROOF STATE]
proof (state)
this:
a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))

goal (1 subgoal):
 1. a \<notin> \<O> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. a \<notin> \<O> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
a \<notin> \<O>

goal (1 subgoal):
 1. a \<notin> \<O> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
from outstanding_non_volatile_Read\<^sub>s\<^sub>b_acquired_or_read_only_reads [OF non_vo out]
[PROOF STATE]
proof (chain)
picking this:
a \<in> acquired_reads True sb (\<O> \<union> A - R) \<or> a \<in> read_only_reads (\<O> \<union> A - R) sb
[PROOF STEP]
have a_in: "a \<in> acquired_reads True sb (\<O> \<union> A - R) \<or>
                    a \<in> read_only_reads (\<O> \<union> A - R) sb"
[PROOF STATE]
proof (prove)
using this:
a \<in> acquired_reads True sb (\<O> \<union> A - R) \<or> a \<in> read_only_reads (\<O> \<union> A - R) sb

goal (1 subgoal):
 1. a \<in> acquired_reads True sb (\<O> \<union> A - R) \<or> a \<in> read_only_reads (\<O> \<union> A - R) sb
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
a \<in> acquired_reads True sb (\<O> \<union> A - R) \<or> a \<in> read_only_reads (\<O> \<union> A - R) sb

goal (1 subgoal):
 1. a \<notin> \<O> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
with acquired_reads_all_acquired [of True sb "(\<O> \<union> A - R)"]
[PROOF STATE]
proof (chain)
picking this:
acquired_reads True sb (\<O> \<union> A - R) \<subseteq> \<O> \<union> A - R \<union> all_acquired sb
a \<in> acquired_reads True sb (\<O> \<union> A - R) \<or> a \<in> read_only_reads (\<O> \<union> A - R) sb
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
acquired_reads True sb (\<O> \<union> A - R) \<subseteq> \<O> \<union> A - R \<union> all_acquired sb
a \<in> acquired_reads True sb (\<O> \<union> A - R) \<or> a \<in> read_only_reads (\<O> \<union> A - R) sb

goal (1 subgoal):
 1. a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
by (auto simp add: Write\<^sub>s\<^sub>b volatile)
[PROOF STATE]
proof (state)
this:
a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))

goal (1 subgoal):
 1. \<not> volatile \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> volatile \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> volatile

goal (1 subgoal):
 1. \<not> volatile \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
with Cons
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>reads_consistent ?pending_write ?\<O> ?m sb; non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> ?\<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) ?\<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
reads_consistent pending_write \<O> m (x # sb)
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
\<not> volatile
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>reads_consistent ?pending_write ?\<O> ?m sb; non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> ?\<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) ?\<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
reads_consistent pending_write \<O> m (x # sb)
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
\<not> volatile

goal (1 subgoal):
 1. a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
by (auto simp add: Write\<^sub>s\<^sub>b False)
[PROOF STATE]
proof (state)
this:
a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))

goal (3 subgoals):
 1. \<And>x21 x22 x23 x24. x = Read\<^sub>s\<^sub>b x21 x22 x23 x24 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 2. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 3. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>x21 x22 x23 x24. x = Read\<^sub>s\<^sub>b x21 x22 x23 x24 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 2. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 3. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
case Read\<^sub>s\<^sub>b
[PROOF STATE]
proof (state)
this:
x = Read\<^sub>s\<^sub>b x21_ x22_ x23_ x24_

goal (3 subgoals):
 1. \<And>x21 x22 x23 x24. x = Read\<^sub>s\<^sub>b x21 x22 x23 x24 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 2. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 3. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
with Cons
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>reads_consistent ?pending_write ?\<O> ?m sb; non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> ?\<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) ?\<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
reads_consistent pending_write \<O> m (x # sb)
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
x = Read\<^sub>s\<^sub>b x21_ x22_ x23_ x24_
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>reads_consistent ?pending_write ?\<O> ?m sb; non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> ?\<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) ?\<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
reads_consistent pending_write \<O> m (x # sb)
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
x = Read\<^sub>s\<^sub>b x21_ x22_ x23_ x24_

goal (1 subgoal):
 1. a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
apply (clarsimp simp del: o_apply simp add: Read\<^sub>s\<^sub>b
	acquired_takeWhile_non_volatile_Write\<^sub>s\<^sub>b split: if_split_asm)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>\<And>pending_write \<O> m \<S>. \<lbrakk>reads_consistent pending_write \<O> m sb; non_volatile_owned_or_read_only pending_write \<S> \<O> sb\<rbrakk> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (Read\<^sub>s\<^sub>b x21_ x22_ x23_ x24_); \<not> x21_ \<longrightarrow> (pending_write \<longrightarrow> x24_ = m x22_) \<and> (x22_ \<in> \<O> \<longrightarrow> x24_ = m x22_); reads_consistent pending_write \<O> m sb; \<not> x21_ \<longrightarrow> pending_write \<longrightarrow> x22_ \<in> \<O> \<or> x22_ \<in> read_only \<S>; non_volatile_owned_or_read_only pending_write \<S> \<O> sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> (\<not> x21_ \<and> x22_ \<notin> \<O> \<longrightarrow> \<not> (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (Read\<^sub>s\<^sub>b False x22_ x23_ x24_) \<longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired sb \<or> a = x22_ \<or> a \<in> read_only_reads \<O> sb) \<and> (x21_ \<longrightarrow> \<not> (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (Read\<^sub>s\<^sub>b True x22_ x23_ x24_) \<longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads \<O> sb)
 2. \<lbrakk>\<And>pending_write \<O> m \<S>. \<lbrakk>reads_consistent pending_write \<O> m sb; non_volatile_owned_or_read_only pending_write \<S> \<O> sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); \<not> (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (Read\<^sub>s\<^sub>b False x22_ x23_ x24_); reads_consistent pending_write \<O> m sb; pending_write \<longrightarrow> x22_ \<in> \<O> \<or> x22_ \<in> read_only \<S>; non_volatile_owned_or_read_only pending_write \<S> \<O> sb; \<not> x21_; a = x22_ \<or> a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b sb; pending_write \<longrightarrow> x24_ = m x22_; x22_ \<in> \<O> \<longrightarrow> x24_ = m x22_\<rbrakk> \<Longrightarrow> (x22_ \<notin> \<O> \<longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired sb \<or> a = x22_ \<or> a \<in> read_only_reads \<O> sb) \<and> (x22_ \<in> \<O> \<longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads \<O> sb)
 3. \<lbrakk>\<And>pending_write \<O> m \<S>. \<lbrakk>reads_consistent pending_write \<O> m sb; non_volatile_owned_or_read_only pending_write \<S> \<O> sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb); \<not> (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (Read\<^sub>s\<^sub>b True x22_ x23_ x24_); reads_consistent pending_write \<O> m sb; non_volatile_owned_or_read_only pending_write \<S> \<O> sb; x21_; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b sb\<rbrakk> \<Longrightarrow> (a \<in> \<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads \<O> sb) \<and> (x22_ \<in> \<O> \<longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads \<O> sb)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))

goal (2 subgoals):
 1. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 2. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 2. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
case Prog\<^sub>s\<^sub>b
[PROOF STATE]
proof (state)
this:
x = Prog\<^sub>s\<^sub>b x31_ x32_ x33_

goal (2 subgoals):
 1. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
 2. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
with Cons
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>reads_consistent ?pending_write ?\<O> ?m sb; non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> ?\<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) ?\<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
reads_consistent pending_write \<O> m (x # sb)
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
x = Prog\<^sub>s\<^sub>b x31_ x32_ x33_
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>reads_consistent ?pending_write ?\<O> ?m sb; non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> ?\<O> \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) ?\<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
reads_consistent pending_write \<O> m (x # sb)
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
x = Prog\<^sub>s\<^sub>b x31_ x32_ x33_

goal (1 subgoal):
 1. a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
by (auto simp add: Read\<^sub>s\<^sub>b)
[PROOF STATE]
proof (state)
this:
a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))

goal (1 subgoal):
 1. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
case (Ghost\<^sub>s\<^sub>b A L R W)
[PROOF STATE]
proof (state)
this:
x = Ghost\<^sub>s\<^sub>b A L R W

goal (1 subgoal):
 1. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
with Cons.hyps [of pending_write "\<O> \<union> A - R" "m" "\<S> \<oplus>\<^bsub>W\<^esub> R  \<ominus>\<^bsub>A\<^esub> L"]  read_only_reads_antimono [of \<O> "\<O> \<union> A - R"]
      Cons.prems
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>reads_consistent pending_write (\<O> \<union> A - R) m sb; non_volatile_owned_or_read_only pending_write (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) (\<O> \<union> A - R) sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> \<O> \<union> A - R \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) (\<O> \<union> A - R)) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
\<O> \<subseteq> \<O> \<union> A - R \<Longrightarrow> read_only_reads (\<O> \<union> A - R) ?sb \<subseteq> read_only_reads \<O> ?sb
reads_consistent pending_write \<O> m (x # sb)
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
x = Ghost\<^sub>s\<^sub>b A L R W
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>reads_consistent pending_write (\<O> \<union> A - R) m sb; non_volatile_owned_or_read_only pending_write (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) (\<O> \<union> A - R) sb; a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)\<rbrakk> \<Longrightarrow> a \<in> \<O> \<union> A - R \<or> a \<in> all_acquired sb \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb) (\<O> \<union> A - R)) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb)
\<O> \<subseteq> \<O> \<union> A - R \<Longrightarrow> read_only_reads (\<O> \<union> A - R) ?sb \<subseteq> read_only_reads \<O> ?sb
reads_consistent pending_write \<O> m (x # sb)
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
a \<in> outstanding_refs is_non_volatile_Read\<^sub>s\<^sub>b (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
x = Ghost\<^sub>s\<^sub>b A L R W

goal (1 subgoal):
 1. a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))
[PROOF STEP]
by (auto simp add: Ghost\<^sub>s\<^sub>b)
[PROOF STATE]
proof (state)
this:
a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
a \<in> \<O> \<or> a \<in> all_acquired (x # sb) \<or> a \<in> read_only_reads (acquired True (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb)) \<O>) (dropWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) (x # sb))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "P (f::(myTdecl myTdef) T_bij)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P f
[PROOF STEP]
refute
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P f
[PROOF STEP]
oops


[STATEMENT]
lemma "\<not> Q (The Q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> Q (The Q)
[PROOF STEP]
nitpick [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> Q (The Q)
[PROOF STEP]
oops


[STATEMENT]
lemma IF_PARALLEL_tp:
  "\<lbrakk> (G, b, p) \<in> HS_B; (p , G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS;
     \<exists> x . LEQ p (H x) \<and> LEQ (H x) q;
     X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>;
     X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk>
  \<Longrightarrow> X \<rhd> Iff b c1 c2 : Sec (Q p H) (EQ G q) (EQ H q)
                       (\<lambda> (r, u) . (evalB b u \<longrightarrow> \<Phi> (r, u)) \<and>
                                   ( (\<not> evalB b u) \<longrightarrow> \<Psi> (r, u)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> X \<rhd> Iff b c1 c2 : Sec (Q p H) (EQ G q) (EQ H q) (\<lambda>(r, u). (evalB b u \<longrightarrow> \<Phi> (r, u)) \<and> (\<not> evalB b u \<longrightarrow> \<Psi> (r, u)))
[PROOF STEP]
(*<*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> X \<rhd> Iff b c1 c2 : Sec (Q p H) (EQ G q) (EQ H q) (\<lambda>(r, u). (evalB b u \<longrightarrow> \<Phi> (r, u)) \<and> (\<not> evalB b u \<longrightarrow> \<Psi> (r, u)))
[PROOF STEP]
apply (rule IF_PARALLEL)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> \<forall>s ss. EQ G p s ss \<longrightarrow> evalB b s = evalB b ss
 2. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> \<forall>x. LEQ (G x) (H x) \<or> LEQ p (H x)
 3. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> \<exists>x. LEQ p (H x) \<and> LEQ (H x) q
 4. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>
 5. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>
[PROOF STEP]
apply (clarsimp, erule HS_B_eval)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>x s ss. \<lbrakk>(p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>; LEQ p (H x); LEQ (H x) q; EQ G p s ss\<rbrakk> \<Longrightarrow> EQ G (?pp13 x s ss) s ss
 2. \<And>x s ss. \<lbrakk>(p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>; LEQ p (H x); LEQ (H x) q; EQ G p s ss\<rbrakk> \<Longrightarrow> LEQ p (?pp13 x s ss)
 3. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> \<forall>x. LEQ (G x) (H x) \<or> LEQ p (H x)
 4. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> \<exists>x. LEQ p (H x) \<and> LEQ (H x) q
 5. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>
 6. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>
[PROOF STEP]
apply assumption
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>x s ss. \<lbrakk>(p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>; LEQ p (H x); LEQ (H x) q; EQ G p s ss\<rbrakk> \<Longrightarrow> LEQ p p
 2. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> \<forall>x. LEQ (G x) (H x) \<or> LEQ p (H x)
 3. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> \<exists>x. LEQ p (H x) \<and> LEQ (H x) q
 4. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>
 5. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>
[PROOF STEP]
apply (rule LAT6)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> \<forall>x. LEQ (G x) (H x) \<or> LEQ p (H x)
 2. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> \<exists>x. LEQ p (H x) \<and> LEQ (H x) q
 3. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>
 4. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>
[PROOF STEP]
apply (erule HS_Aux1)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> \<exists>x. LEQ p (H x) \<and> LEQ (H x) q
 2. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>
 3. \<lbrakk>(G, b, p) \<in> HS_B; (p, G, c1, H) \<in> HS; (p, G, c2, H) \<in> HS; \<exists>x. LEQ p (H x) \<and> LEQ (H x) q; X \<rhd> c1 : Sec (Q p H) (EQ G q) (EQ H q) \<Phi>; X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>\<rbrakk> \<Longrightarrow> X \<rhd> c2 : Sec (Q p H) (EQ G q) (EQ H q) \<Psi>
[PROOF STEP]
apply assumption+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done