[STATEMENT]
lemma get_root_node_wf_is_l_get_root_node_wf [instances]:
  "l_get_root_node_wf heap_is_wellformed get_root_node type_wf known_ptr known_ptrs get_ancestors get_parent"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. l_get_root_node_wf Shadow_DOM.heap_is_wellformed Shadow_DOM.get_root_node ShadowRootClass.type_wf ShadowRootClass.known_ptr ShadowRootClass.known_ptrs Shadow_DOM.get_ancestors Shadow_DOM.get_parent
[PROOF STEP]
using known_ptrs_is_l_known_ptrs
[PROOF STATE]
proof (prove)
using this:
l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs

goal (1 subgoal):
 1. l_get_root_node_wf Shadow_DOM.heap_is_wellformed Shadow_DOM.get_root_node ShadowRootClass.type_wf ShadowRootClass.known_ptr ShadowRootClass.known_ptrs Shadow_DOM.get_ancestors Shadow_DOM.get_parent
[PROOF STEP]
apply(auto simp add: l_get_root_node_wf_def l_get_root_node_wf_axioms_def)[1]
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>h ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.known_ptrs h; ShadowRootClass.type_wf h; ptr |\<in>| object_ptr_kinds h\<rbrakk> \<Longrightarrow> h \<turnstile> ok Shadow_DOM.get_root_node ptr
 2. \<And>h ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> ok Shadow_DOM.get_root_node ptr\<rbrakk> \<Longrightarrow> ptr |\<in>| object_ptr_kinds h
 3. \<And>h ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> root |\<in>| object_ptr_kinds h
 4. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr
 5. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
 6. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 7. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 8. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
using get_root_node_ok
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>Shadow_DOM.heap_is_wellformed ?h; ShadowRootClass.known_ptrs ?h; ShadowRootClass.type_wf ?h; ?ptr |\<in>| object_ptr_kinds ?h\<rbrakk> \<Longrightarrow> ?h \<turnstile> ok Shadow_DOM.get_root_node ?ptr

goal (8 subgoals):
 1. \<And>h ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.known_ptrs h; ShadowRootClass.type_wf h; ptr |\<in>| object_ptr_kinds h\<rbrakk> \<Longrightarrow> h \<turnstile> ok Shadow_DOM.get_root_node ptr
 2. \<And>h ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> ok Shadow_DOM.get_root_node ptr\<rbrakk> \<Longrightarrow> ptr |\<in>| object_ptr_kinds h
 3. \<And>h ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> root |\<in>| object_ptr_kinds h
 4. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr
 5. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
 6. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 7. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 8. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>h ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> ok Shadow_DOM.get_root_node ptr\<rbrakk> \<Longrightarrow> ptr |\<in>| object_ptr_kinds h
 2. \<And>h ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> root |\<in>| object_ptr_kinds h
 3. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr
 4. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
 5. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 6. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 7. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
using get_root_node_ptr_in_heap
[PROOF STATE]
proof (prove)
using this:
?h \<turnstile> ok Shadow_DOM.get_root_node ?ptr \<Longrightarrow> ?ptr |\<in>| object_ptr_kinds ?h

goal (7 subgoals):
 1. \<And>h ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> ok Shadow_DOM.get_root_node ptr\<rbrakk> \<Longrightarrow> ptr |\<in>| object_ptr_kinds h
 2. \<And>h ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> root |\<in>| object_ptr_kinds h
 3. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr
 4. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
 5. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 6. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 7. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>h ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> root |\<in>| object_ptr_kinds h
 2. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr
 3. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
 4. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 5. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 6. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
using get_root_node_root_in_heap
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>Shadow_DOM.heap_is_wellformed ?h; ShadowRootClass.type_wf ?h; ShadowRootClass.known_ptrs ?h; ?h \<turnstile> Shadow_DOM.get_root_node ?ptr \<rightarrow>\<^sub>r ?root\<rbrakk> \<Longrightarrow> ?root |\<in>| object_ptr_kinds ?h

goal (6 subgoals):
 1. \<And>h ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> root |\<in>| object_ptr_kinds h
 2. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr
 3. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
 4. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 5. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 6. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr
 2. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
 3. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 4. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 5. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
using get_ancestors_same_root_node
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>Shadow_DOM.heap_is_wellformed ?h; ShadowRootClass.type_wf ?h; ShadowRootClass.known_ptrs ?h; ?h \<turnstile> Shadow_DOM.get_ancestors ?ptr \<rightarrow>\<^sub>r ?ancestors; ?ptr' \<in> set ?ancestors; ?ptr'' \<in> set ?ancestors\<rbrakk> \<Longrightarrow> ?h \<turnstile> Shadow_DOM.get_root_node ?ptr' \<rightarrow>\<^sub>r ?root_ptr = ?h \<turnstile> Shadow_DOM.get_root_node ?ptr'' \<rightarrow>\<^sub>r ?root_ptr

goal (5 subgoals):
 1. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr
 2. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
 3. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 4. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 5. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
apply(blast, blast)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 2. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 3. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
using get_root_node_same_no_parent
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>Shadow_DOM.heap_is_wellformed ?h; ShadowRootClass.type_wf ?h; ShadowRootClass.known_ptrs ?h; ?h \<turnstile> Shadow_DOM.get_root_node ?ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?child\<rbrakk> \<Longrightarrow> ?h \<turnstile> Shadow_DOM.get_parent ?child \<rightarrow>\<^sub>r None

goal (3 subgoals):
 1. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 2. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 3. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 2. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
(* using get_root_node_not_node_same apply blast *)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 2. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
using get_root_node_parent_same
[PROOF STATE]
proof (prove)
using this:
?h \<turnstile> Shadow_DOM.get_parent ?child \<rightarrow>\<^sub>r Some ?ptr \<Longrightarrow> ?h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?child) \<rightarrow>\<^sub>r ?root = ?h \<turnstile> Shadow_DOM.get_root_node ?ptr \<rightarrow>\<^sub>r ?root

goal (2 subgoals):
 1. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 2. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
apply (blast, blast)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma set_child_nodes_get_tag_name_is_l_set_child_nodes_get_tag_name [instances]:
  "l_set_child_nodes_get_tag_name type_wf set_child_nodes set_child_nodes_locs get_tag_name get_tag_name_locs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. l_set_child_nodes_get_tag_name ShadowRootClass.type_wf Shadow_DOM.set_child_nodes Shadow_DOM.set_child_nodes_locs get_tag_name get_tag_name_locs
[PROOF STEP]
apply(auto simp add: l_set_child_nodes_get_tag_name_def l_set_child_nodes_get_tag_name_axioms_def instances)[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ptr h h' w ptr' r. \<lbrakk>w \<in> Shadow_DOM.set_child_nodes_locs ptr; h \<turnstile> w \<rightarrow>\<^sub>h h'; r \<in> get_tag_name_locs ptr'\<rbrakk> \<Longrightarrow> r h h'
[PROOF STEP]
using set_child_nodes_get_tag_name
[PROOF STATE]
proof (prove)
using this:
\<forall>w\<in>Shadow_DOM.set_child_nodes_locs ?ptr. ?h \<turnstile> w \<rightarrow>\<^sub>h ?h' \<longrightarrow> (\<forall>r\<in>get_tag_name_locs ?ptr'. r ?h ?h')

goal (1 subgoal):
 1. \<And>ptr h h' w ptr' r. \<lbrakk>w \<in> Shadow_DOM.set_child_nodes_locs ptr; h \<turnstile> w \<rightarrow>\<^sub>h h'; r \<in> get_tag_name_locs ptr'\<rbrakk> \<Longrightarrow> r h h'
[PROOF STEP]
by fast


[STATEMENT]
lemma fall2_imp_alw_index:
assumes 0: "\<And> \<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<longrightarrow>
                     \<phi> [] [\<pi>,\<pi>'] = f (stateOf \<pi>) (stateOf \<pi>') \<and>
                     \<psi> [] [\<pi>,\<pi>'] = g (stateOf \<pi>) (stateOf \<pi>')"
shows
"fall2 (\<lambda> \<pi>' \<pi> \<pi>l. imp (alw (\<phi> \<pi>l)) (alw (\<psi> \<pi>l)) (\<pi>l @ [\<pi>,\<pi>'])) []
 \<longleftrightarrow>
 (\<forall> \<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0
           \<longrightarrow>
           (\<forall> i. (\<forall> j \<le> i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i)))
 )"
(is "?L \<longleftrightarrow> ?R")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fall2 (\<lambda>\<pi>' \<pi> \<pi>l. imp (alw (\<phi> \<pi>l)) (alw (\<psi> \<pi>l)) (\<pi>l @ [\<pi>, \<pi>'])) [] = (\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))))
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. fall2 (\<lambda>\<pi>' \<pi> \<pi>l. imp (alw (\<phi> \<pi>l)) (alw (\<psi> \<pi>l)) (\<pi>l @ [\<pi>, \<pi>'])) [] = (\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))))
[PROOF STEP]
have 1: "\<And> i \<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<longrightarrow>
                      f (fst (\<pi> !! i)) (fst (\<pi>' !! i)) = \<phi> [] [sdrop i \<pi>, sdrop i \<pi>'] \<and>
                      g (fst (\<pi> !! i)) (fst (\<pi>' !! i)) = \<psi> [] [sdrop i \<pi>, sdrop i \<pi>']"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i \<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<longrightarrow> f (fst (\<pi> !! i)) (fst (\<pi>' !! i)) = \<phi> [] [sdrop i \<pi>, sdrop i \<pi>'] \<and> g (fst (\<pi> !! i)) (fst (\<pi>' !! i)) = \<psi> [] [sdrop i \<pi>, sdrop i \<pi>']
[PROOF STEP]
using 0
[PROOF STATE]
proof (prove)
using this:
wfp AP' ?\<pi> \<and> wfp AP' ?\<pi>' \<longrightarrow> \<phi> [] [?\<pi>, ?\<pi>'] = f (stateOf ?\<pi>) (stateOf ?\<pi>') \<and> \<psi> [] [?\<pi>, ?\<pi>'] = g (stateOf ?\<pi>) (stateOf ?\<pi>')

goal (1 subgoal):
 1. \<And>i \<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<longrightarrow> f (fst (\<pi> !! i)) (fst (\<pi>' !! i)) = \<phi> [] [sdrop i \<pi>, sdrop i \<pi>'] \<and> g (fst (\<pi> !! i)) (fst (\<pi>' !! i)) = \<psi> [] [sdrop i \<pi>, sdrop i \<pi>']
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
wfp AP' ?\<pi> \<and> wfp AP' ?\<pi>' \<longrightarrow> f (fst (?\<pi> !! ?i)) (fst (?\<pi>' !! ?i)) = \<phi> [] [sdrop ?i ?\<pi>, sdrop ?i ?\<pi>'] \<and> g (fst (?\<pi> !! ?i)) (fst (?\<pi>' !! ?i)) = \<psi> [] [sdrop ?i ?\<pi>, sdrop ?i ?\<pi>']

goal (1 subgoal):
 1. fall2 (\<lambda>\<pi>' \<pi> \<pi>l. imp (alw (\<phi> \<pi>l)) (alw (\<psi> \<pi>l)) (\<pi>l @ [\<pi>, \<pi>'])) [] = (\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fall2 (\<lambda>\<pi>' \<pi> \<pi>l. imp (alw (\<phi> \<pi>l)) (alw (\<psi> \<pi>l)) (\<pi>l @ [\<pi>, \<pi>'])) [] = (\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))))
[PROOF STEP]
unfolding fall2_imp_alw
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']) = (\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))))
[PROOF STEP]
proof(intro iffI allI impI, elim conjE)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<pi> \<pi>' i. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']; \<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j)); wfp AP' \<pi>; wfp AP' \<pi>'; stateOf \<pi> = s0; stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))
 2. \<And>\<pi> \<pi>'. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))); wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
[PROOF STEP]
fix \<pi> \<pi>' i
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<pi> \<pi>' i. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']; \<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j)); wfp AP' \<pi>; wfp AP' \<pi>'; stateOf \<pi> = s0; stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))
 2. \<And>\<pi> \<pi>'. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))); wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
[PROOF STEP]
assume L: "\<forall> \<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0
                       \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>,\<pi>']"
    and \<pi>\<pi>'[simp]: "wfp AP' \<pi>" "wfp AP' \<pi>'" "stateOf \<pi> = s0" "stateOf \<pi>' = s0"
    and \<phi>: "\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))"
[PROOF STATE]
proof (state)
this:
\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
wfp AP' \<pi>
wfp AP' \<pi>'
stateOf \<pi> = s0
stateOf \<pi>' = s0
\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))

goal (2 subgoals):
 1. \<And>\<pi> \<pi>' i. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']; \<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j)); wfp AP' \<pi>; wfp AP' \<pi>'; stateOf \<pi> = s0; stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))
 2. \<And>\<pi> \<pi>'. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))); wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
[PROOF STEP]
have \<pi>\<pi>'i[simp]: "\<And> i. wfp AP' (sdrop i \<pi>) \<and> wfp AP' (sdrop i \<pi>')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i. wfp AP' (sdrop i \<pi>) \<and> wfp AP' (sdrop i \<pi>')
[PROOF STEP]
by (metis \<pi>\<pi>' wfp_sdrop)
[PROOF STATE]
proof (state)
this:
wfp AP' (sdrop ?i \<pi>) \<and> wfp AP' (sdrop ?i \<pi>')

goal (2 subgoals):
 1. \<And>\<pi> \<pi>' i. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']; \<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j)); wfp AP' \<pi>; wfp AP' \<pi>'; stateOf \<pi> = s0; stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))
 2. \<And>\<pi> \<pi>'. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))); wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
[PROOF STEP]
define \<pi>1 where "\<pi>1 = shift (stake (Suc i) \<pi>) (sconst (toSink (fst (\<pi> !! i)), L (toSink (fst (\<pi> !! i)))))"
[PROOF STATE]
proof (state)
this:
\<pi>1 = stake (Suc i) \<pi> @- sconst (toSink (fst (\<pi> !! i)), L (toSink (fst (\<pi> !! i))))

goal (2 subgoals):
 1. \<And>\<pi> \<pi>' i. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']; \<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j)); wfp AP' \<pi>; wfp AP' \<pi>'; stateOf \<pi> = s0; stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))
 2. \<And>\<pi> \<pi>'. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))); wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
[PROOF STEP]
define \<pi>1' where "\<pi>1' = shift (stake (Suc i) \<pi>') (sconst (toSink (fst (\<pi>' !! i)), L (toSink (fst (\<pi>' !! i)))))"
[PROOF STATE]
proof (state)
this:
\<pi>1' = stake (Suc i) \<pi>' @- sconst (toSink (fst (\<pi>' !! i)), L (toSink (fst (\<pi>' !! i))))

goal (2 subgoals):
 1. \<And>\<pi> \<pi>' i. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']; \<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j)); wfp AP' \<pi>; wfp AP' \<pi>'; stateOf \<pi> = s0; stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))
 2. \<And>\<pi> \<pi>'. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))); wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
[PROOF STEP]
have \<pi>1\<pi>1': "wfp AP' \<pi>1 \<and> stateOf \<pi>1 = s0 \<and> wfp AP' \<pi>1' \<and> stateOf \<pi>1' = s0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wfp AP' \<pi>1 \<and> stateOf \<pi>1 = s0 \<and> wfp AP' \<pi>1' \<and> stateOf \<pi>1' = s0
[PROOF STEP]
using wfp_stateOf_shift_stake_sconst
[PROOF STATE]
proof (prove)
using this:
wfp AP' ?\<pi> \<Longrightarrow> wfp AP' (stake (Suc ?i) ?\<pi> @- sconst (toSink (fst (?\<pi> !! ?i)), L (toSink (fst (?\<pi> !! ?i))))) \<and> stateOf (stake (Suc ?i) ?\<pi> @- sconst (toSink (fst (?\<pi> !! ?i)), L (toSink (fst (?\<pi> !! ?i))))) = stateOf ?\<pi>

goal (1 subgoal):
 1. wfp AP' \<pi>1 \<and> stateOf \<pi>1 = s0 \<and> wfp AP' \<pi>1' \<and> stateOf \<pi>1' = s0
[PROOF STEP]
unfolding \<pi>1_def \<pi>1'_def
[PROOF STATE]
proof (prove)
using this:
wfp AP' ?\<pi> \<Longrightarrow> wfp AP' (stake (Suc ?i) ?\<pi> @- sconst (toSink (fst (?\<pi> !! ?i)), L (toSink (fst (?\<pi> !! ?i))))) \<and> stateOf (stake (Suc ?i) ?\<pi> @- sconst (toSink (fst (?\<pi> !! ?i)), L (toSink (fst (?\<pi> !! ?i))))) = stateOf ?\<pi>

goal (1 subgoal):
 1. wfp AP' (stake (Suc i) \<pi> @- sconst (toSink (fst (\<pi> !! i)), L (toSink (fst (\<pi> !! i))))) \<and> stateOf (stake (Suc i) \<pi> @- sconst (toSink (fst (\<pi> !! i)), L (toSink (fst (\<pi> !! i))))) = s0 \<and> wfp AP' (stake (Suc i) \<pi>' @- sconst (toSink (fst (\<pi>' !! i)), L (toSink (fst (\<pi>' !! i))))) \<and> stateOf (stake (Suc i) \<pi>' @- sconst (toSink (fst (\<pi>' !! i)), L (toSink (fst (\<pi>' !! i))))) = s0
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
wfp AP' \<pi>1 \<and> stateOf \<pi>1 = s0 \<and> wfp AP' \<pi>1' \<and> stateOf \<pi>1' = s0

goal (2 subgoals):
 1. \<And>\<pi> \<pi>' i. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']; \<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j)); wfp AP' \<pi>; wfp AP' \<pi>'; stateOf \<pi> = s0; stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))
 2. \<And>\<pi> \<pi>'. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))); wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
[PROOF STEP]
hence \<pi>1\<pi>1'i: "\<And> i. wfp AP' (sdrop i \<pi>1) \<and> wfp AP' (sdrop i \<pi>1')"
[PROOF STATE]
proof (prove)
using this:
wfp AP' \<pi>1 \<and> stateOf \<pi>1 = s0 \<and> wfp AP' \<pi>1' \<and> stateOf \<pi>1' = s0

goal (1 subgoal):
 1. \<And>i. wfp AP' (sdrop i \<pi>1) \<and> wfp AP' (sdrop i \<pi>1')
[PROOF STEP]
by (metis \<pi>\<pi>' wfp_sdrop)
[PROOF STATE]
proof (state)
this:
wfp AP' (sdrop ?i \<pi>1) \<and> wfp AP' (sdrop ?i \<pi>1')

goal (2 subgoals):
 1. \<And>\<pi> \<pi>' i. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']; \<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j)); wfp AP' \<pi>; wfp AP' \<pi>'; stateOf \<pi> = s0; stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))
 2. \<And>\<pi> \<pi>'. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))); wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
[PROOF STEP]
have imp: "imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>1,\<pi>1']"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>1, \<pi>1']
[PROOF STEP]
using L  \<pi>1\<pi>1'
[PROOF STATE]
proof (prove)
using this:
\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
wfp AP' \<pi>1 \<and> stateOf \<pi>1 = s0 \<and> wfp AP' \<pi>1' \<and> stateOf \<pi>1' = s0

goal (1 subgoal):
 1. imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>1, \<pi>1']
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>1, \<pi>1']

goal (2 subgoals):
 1. \<And>\<pi> \<pi>' i. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']; \<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j)); wfp AP' \<pi>; wfp AP' \<pi>'; stateOf \<pi> = s0; stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))
 2. \<And>\<pi> \<pi>'. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))); wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>1, \<pi>1']

goal (2 subgoals):
 1. \<And>\<pi> \<pi>' i. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']; \<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j)); wfp AP' \<pi>; wfp AP' \<pi>'; stateOf \<pi> = s0; stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))
 2. \<And>\<pi> \<pi>'. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))); wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
[PROOF STEP]
have "alw (\<phi> []) [\<pi>1,\<pi>1']"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. alw (\<phi> []) [\<pi>1, \<pi>1']
[PROOF STEP]
unfolding alw
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>i. \<phi> [] (map (sdrop i) [\<pi>1, \<pi>1'])
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>i. \<phi> [] (map (sdrop i) [\<pi>1, \<pi>1'])
[PROOF STEP]
fix k
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>i. \<phi> [] (map (sdrop i) [\<pi>1, \<pi>1'])
[PROOF STEP]
have a: "fst (\<pi> !! i) \<in> S" and b: "fst (\<pi>' !! i) \<in> S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fst (\<pi> !! i) \<in> S &&& fst (\<pi>' !! i) \<in> S
[PROOF STEP]
using \<pi>\<pi>'
[PROOF STATE]
proof (prove)
using this:
wfp AP' \<pi>
wfp AP' \<pi>'
stateOf \<pi> = s0
stateOf \<pi>' = s0

goal (1 subgoal):
 1. fst (\<pi> !! i) \<in> S &&& fst (\<pi>' !! i) \<in> S
[PROOF STEP]
unfolding wfp
[PROOF STATE]
proof (prove)
using this:
\<forall>i. fst (\<pi> !! i) \<in> S \<and> snd (\<pi> !! i) \<subseteq> AP' \<and> snd (\<pi> !! i) \<inter> AP = L (fst (\<pi> !! i)) \<and> fst (\<pi> !! Suc i) \<in> \<delta> (fst (\<pi> !! i))
\<forall>i. fst (\<pi>' !! i) \<in> S \<and> snd (\<pi>' !! i) \<subseteq> AP' \<and> snd (\<pi>' !! i) \<inter> AP = L (fst (\<pi>' !! i)) \<and> fst (\<pi>' !! Suc i) \<in> \<delta> (fst (\<pi>' !! i))
stateOf \<pi> = s0
stateOf \<pi>' = s0

goal (1 subgoal):
 1. fst (\<pi> !! i) \<in> S &&& fst (\<pi>' !! i) \<in> S
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fst (\<pi> !! i) \<in> S
fst (\<pi>' !! i) \<in> S

goal (1 subgoal):
 1. \<And>i. \<phi> [] (map (sdrop i) [\<pi>1, \<pi>1'])
[PROOF STEP]
thus "\<phi> [] (map (sdrop k) [\<pi>1, \<pi>1'])"
[PROOF STATE]
proof (prove)
using this:
fst (\<pi> !! i) \<in> S
fst (\<pi>' !! i) \<in> S

goal (1 subgoal):
 1. \<phi> [] (map (sdrop k) [\<pi>1, \<pi>1'])
[PROOF STEP]
using \<phi> 0 \<pi>1\<pi>1'i
[PROOF STATE]
proof (prove)
using this:
fst (\<pi> !! i) \<in> S
fst (\<pi>' !! i) \<in> S
\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))
wfp AP' ?\<pi> \<and> wfp AP' ?\<pi>' \<longrightarrow> \<phi> [] [?\<pi>, ?\<pi>'] = f (stateOf ?\<pi>) (stateOf ?\<pi>') \<and> \<psi> [] [?\<pi>, ?\<pi>'] = g (stateOf ?\<pi>) (stateOf ?\<pi>')
wfp AP' (sdrop ?i \<pi>1) \<and> wfp AP' (sdrop ?i \<pi>1')

goal (1 subgoal):
 1. \<phi> [] (map (sdrop k) [\<pi>1, \<pi>1'])
[PROOF STEP]
unfolding \<pi>1_def \<pi>1'_def
[PROOF STATE]
proof (prove)
using this:
fst (\<pi> !! i) \<in> S
fst (\<pi>' !! i) \<in> S
\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))
wfp AP' ?\<pi> \<and> wfp AP' ?\<pi>' \<longrightarrow> \<phi> [] [?\<pi>, ?\<pi>'] = f (stateOf ?\<pi>) (stateOf ?\<pi>') \<and> \<psi> [] [?\<pi>, ?\<pi>'] = g (stateOf ?\<pi>) (stateOf ?\<pi>')
wfp AP' (sdrop ?i (stake (Suc i) \<pi> @- sconst (toSink (fst (\<pi> !! i)), L (toSink (fst (\<pi> !! i)))))) \<and> wfp AP' (sdrop ?i (stake (Suc i) \<pi>' @- sconst (toSink (fst (\<pi>' !! i)), L (toSink (fst (\<pi>' !! i))))))

goal (1 subgoal):
 1. \<phi> [] (map (sdrop k) [stake (Suc i) \<pi> @- sconst (toSink (fst (\<pi> !! i)), L (toSink (fst (\<pi> !! i)))), stake (Suc i) \<pi>' @- sconst (toSink (fst (\<pi>' !! i)), L (toSink (fst (\<pi>' !! i))))])
[PROOF STEP]
apply(cases "k < Suc i", simp_all del: stake.simps)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> k < Suc i; fst (\<pi> !! i) \<in> S; fst (\<pi>' !! i) \<in> S; \<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j)); \<And>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<longrightarrow> \<phi> [] [\<pi>, \<pi>'] = f (stateOf \<pi>) (stateOf \<pi>') \<and> \<psi> [] [\<pi>, \<pi>'] = g (stateOf \<pi>) (stateOf \<pi>'); \<And>ia. wfp AP' (sdrop ia (stake (Suc i) \<pi> @- sconst (toSink (fst (\<pi> !! i)), L (toSink (fst (\<pi> !! i)))))) \<and> wfp AP' (sdrop ia (stake (Suc i) \<pi>' @- sconst (toSink (fst (\<pi>' !! i)), L (toSink (fst (\<pi>' !! i))))))\<rbrakk> \<Longrightarrow> f (toSink (fst (\<pi> !! i))) (toSink (fst (\<pi>' !! i)))
[PROOF STEP]
using toSink[OF a] toSink[OF b] Sink_f
[PROOF STATE]
proof (prove)
using this:
toSink (fst (\<pi> !! i)) \<in> \<delta> (fst (\<pi> !! i)) \<inter> Sink
toSink (fst (\<pi>' !! i)) \<in> \<delta> (fst (\<pi>' !! i)) \<inter> Sink
{?s1.0, ?s2.0} \<subseteq> Sink \<Longrightarrow> f ?s1.0 ?s2.0

goal (1 subgoal):
 1. \<lbrakk>\<not> k < Suc i; fst (\<pi> !! i) \<in> S; fst (\<pi>' !! i) \<in> S; \<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j)); \<And>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<longrightarrow> \<phi> [] [\<pi>, \<pi>'] = f (stateOf \<pi>) (stateOf \<pi>') \<and> \<psi> [] [\<pi>, \<pi>'] = g (stateOf \<pi>) (stateOf \<pi>'); \<And>ia. wfp AP' (sdrop ia (stake (Suc i) \<pi> @- sconst (toSink (fst (\<pi> !! i)), L (toSink (fst (\<pi> !! i)))))) \<and> wfp AP' (sdrop ia (stake (Suc i) \<pi>' @- sconst (toSink (fst (\<pi>' !! i)), L (toSink (fst (\<pi>' !! i))))))\<rbrakk> \<Longrightarrow> f (toSink (fst (\<pi> !! i))) (toSink (fst (\<pi>' !! i)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<phi> [] (map (sdrop k) [\<pi>1, \<pi>1'])

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
alw (\<phi> []) [\<pi>1, \<pi>1']

goal (2 subgoals):
 1. \<And>\<pi> \<pi>' i. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']; \<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j)); wfp AP' \<pi>; wfp AP' \<pi>'; stateOf \<pi> = s0; stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))
 2. \<And>\<pi> \<pi>'. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))); wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>1, \<pi>1']
alw (\<phi> []) [\<pi>1, \<pi>1']
[PROOF STEP]
have "alw (\<psi> []) [\<pi>1,\<pi>1']"
[PROOF STATE]
proof (prove)
using this:
imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>1, \<pi>1']
alw (\<phi> []) [\<pi>1, \<pi>1']

goal (1 subgoal):
 1. alw (\<psi> []) [\<pi>1, \<pi>1']
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
alw (\<psi> []) [\<pi>1, \<pi>1']

goal (2 subgoals):
 1. \<And>\<pi> \<pi>' i. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']; \<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j)); wfp AP' \<pi>; wfp AP' \<pi>'; stateOf \<pi> = s0; stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))
 2. \<And>\<pi> \<pi>'. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))); wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
[PROOF STEP]
hence "\<psi> [] [sdrop i \<pi>1, sdrop i \<pi>1']"
[PROOF STATE]
proof (prove)
using this:
alw (\<psi> []) [\<pi>1, \<pi>1']

goal (1 subgoal):
 1. \<psi> [] [sdrop i \<pi>1, sdrop i \<pi>1']
[PROOF STEP]
unfolding alw
[PROOF STATE]
proof (prove)
using this:
\<forall>i. \<psi> [] (map (sdrop i) [\<pi>1, \<pi>1'])

goal (1 subgoal):
 1. \<psi> [] [sdrop i \<pi>1, sdrop i \<pi>1']
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<psi> [] [sdrop i \<pi>1, sdrop i \<pi>1']

goal (2 subgoals):
 1. \<And>\<pi> \<pi>' i. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']; \<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j)); wfp AP' \<pi>; wfp AP' \<pi>'; stateOf \<pi> = s0; stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))
 2. \<And>\<pi> \<pi>'. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))); wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
[PROOF STEP]
hence "g (fst (\<pi>1 !! i)) (fst (\<pi>1' !! i))"
[PROOF STATE]
proof (prove)
using this:
\<psi> [] [sdrop i \<pi>1, sdrop i \<pi>1']

goal (1 subgoal):
 1. g (fst (\<pi>1 !! i)) (fst (\<pi>1' !! i))
[PROOF STEP]
using 0 \<pi>1\<pi>1'i
[PROOF STATE]
proof (prove)
using this:
\<psi> [] [sdrop i \<pi>1, sdrop i \<pi>1']
wfp AP' ?\<pi> \<and> wfp AP' ?\<pi>' \<longrightarrow> \<phi> [] [?\<pi>, ?\<pi>'] = f (stateOf ?\<pi>) (stateOf ?\<pi>') \<and> \<psi> [] [?\<pi>, ?\<pi>'] = g (stateOf ?\<pi>) (stateOf ?\<pi>')
wfp AP' (sdrop ?i \<pi>1) \<and> wfp AP' (sdrop ?i \<pi>1')

goal (1 subgoal):
 1. g (fst (\<pi>1 !! i)) (fst (\<pi>1' !! i))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
g (fst (\<pi>1 !! i)) (fst (\<pi>1' !! i))

goal (2 subgoals):
 1. \<And>\<pi> \<pi>' i. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']; \<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j)); wfp AP' \<pi>; wfp AP' \<pi>'; stateOf \<pi> = s0; stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))
 2. \<And>\<pi> \<pi>'. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))); wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
[PROOF STEP]
thus "g (fst (\<pi> !! i)) (fst (\<pi>' !! i))"
[PROOF STATE]
proof (prove)
using this:
g (fst (\<pi>1 !! i)) (fst (\<pi>1' !! i))

goal (1 subgoal):
 1. g (fst (\<pi> !! i)) (fst (\<pi>' !! i))
[PROOF STEP]
unfolding \<pi>1_def \<pi>1'_def
[PROOF STATE]
proof (prove)
using this:
g (fst ((stake (Suc i) \<pi> @- sconst (toSink (fst (\<pi> !! i)), L (toSink (fst (\<pi> !! i))))) !! i)) (fst ((stake (Suc i) \<pi>' @- sconst (toSink (fst (\<pi>' !! i)), L (toSink (fst (\<pi>' !! i))))) !! i))

goal (1 subgoal):
 1. g (fst (\<pi> !! i)) (fst (\<pi>' !! i))
[PROOF STEP]
by (auto simp del: stake.simps)
[PROOF STATE]
proof (state)
this:
g (fst (\<pi> !! i)) (fst (\<pi>' !! i))

goal (1 subgoal):
 1. \<And>\<pi> \<pi>'. \<lbrakk>\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))); wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0\<rbrakk> \<Longrightarrow> imp (alw (\<phi> [])) (alw (\<psi> [])) [\<pi>, \<pi>']
[PROOF STEP]
qed(auto simp: sdrop_imp_alw 1)
[PROOF STATE]
proof (state)
this:
fall2 (\<lambda>\<pi>' \<pi> \<pi>l. imp (alw (\<phi> \<pi>l)) (alw (\<psi> \<pi>l)) (\<pi>l @ [\<pi>, \<pi>'])) [] = (\<forall>\<pi> \<pi>'. wfp AP' \<pi> \<and> wfp AP' \<pi>' \<and> stateOf \<pi> = s0 \<and> stateOf \<pi>' = s0 \<longrightarrow> (\<forall>i. (\<forall>j\<le>i. f (fst (\<pi> !! j)) (fst (\<pi>' !! j))) \<longrightarrow> g (fst (\<pi> !! i)) (fst (\<pi>' !! i))))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma vebt_memberi_refines: "refines (vebt_memberi ti  x) (vebt_memberi' t ti x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. refines (vebt_memberi ti x) (vebt_memberi' t ti x)
[PROOF STEP]
apply (induction arbitrary: t ti x rule: vebt_memberi'.fixp_induct)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. heap.admissible (\<lambda>vebt_memberi'. \<forall>x xa xb. refines (vebt_memberi xa xb) (curry (curry vebt_memberi') x xa xb))
 2. \<And>t ti x. refines (vebt_memberi ti x) (Heap.Heap Map.empty)
 3. \<And>f t ti x. (\<And>t ti x. refines (vebt_memberi ti x) (f t ti x)) \<Longrightarrow> refines (vebt_memberi ti x) (case ti of Nodei info deg treeArray summary \<Rightarrow> assert' (is_Node t) \<bind> (\<lambda>_. case info of None \<Rightarrow> return False | Some (mi, ma) \<Rightarrow> if deg \<le> 1 then return False else if x = mi then return True else if x = ma then return True else if x < mi then return False else if ma < x then return False else let (info', deg', treeList, summary') = case t of Node info' deg' treeList summary' \<Rightarrow> (info', deg', treeList, summary') in assert' (info = info' \<and> deg = deg') \<bind> (\<lambda>_. highi x (deg div 2) \<bind> (\<lambda>h. lowi x (deg div 2) \<bind> (\<lambda>l. assert' (l = low x (deg div 2) \<and> h = high x (deg div 2)) \<bind> (\<lambda>_. Array_Time.len treeArray \<bind> (\<lambda>len. assert' (len = length treeList) \<bind> (\<lambda>_. if h < len then assert' (h = high x (deg div 2) \<and> h < length treeList) \<bind> (\<lambda>_. Array_Time.nth treeArray h \<bind> (\<lambda>th. f (treeList ! h) th l)) else return False))))))) | Leafi a b \<Rightarrow> return (if x = 0 then a else if x = 1 then b else False))
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. heap.admissible (\<lambda>vebt_memberi'. \<forall>x xa xb. refines (vebt_memberi xa xb) (curry (curry vebt_memberi') x xa xb))
[PROOF STEP]
using refines_adm[where t = "\<lambda> arg. vebt_memberi (snd (fst arg)) (snd arg)"]
[PROOF STATE]
proof (prove)
using this:
heap.admissible (\<lambda>f. \<forall>x. refines (vebt_memberi (snd (fst x)) (snd x)) (f x))

goal (1 subgoal):
 1. heap.admissible (\<lambda>vebt_memberi'. \<forall>x xa xb. refines (vebt_memberi xa xb) (curry (curry vebt_memberi') x xa xb))
[PROOF STEP]
by simp
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>t ti x. refines (vebt_memberi ti x) (Heap.Heap Map.empty)
 2. \<And>f t ti x. (\<And>t ti x. refines (vebt_memberi ti x) (f t ti x)) \<Longrightarrow> refines (vebt_memberi ti x) (case ti of Nodei info deg treeArray summary \<Rightarrow> assert' (is_Node t) \<bind> (\<lambda>_. case info of None \<Rightarrow> return False | Some (mi, ma) \<Rightarrow> if deg \<le> 1 then return False else if x = mi then return True else if x = ma then return True else if x < mi then return False else if ma < x then return False else let (info', deg', treeList, summary') = case t of Node info' deg' treeList summary' \<Rightarrow> (info', deg', treeList, summary') in assert' (info = info' \<and> deg = deg') \<bind> (\<lambda>_. highi x (deg div 2) \<bind> (\<lambda>h. lowi x (deg div 2) \<bind> (\<lambda>l. assert' (l = low x (deg div 2) \<and> h = high x (deg div 2)) \<bind> (\<lambda>_. Array_Time.len treeArray \<bind> (\<lambda>len. assert' (len = length treeList) \<bind> (\<lambda>_. if h < len then assert' (h = high x (deg div 2) \<and> h < length treeList) \<bind> (\<lambda>_. Array_Time.nth treeArray h \<bind> (\<lambda>th. f (treeList ! h) th l)) else return False))))))) | Leafi a b \<Rightarrow> return (if x = 0 then a else if x = 1 then b else False))
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. refines (vebt_memberi ti_ x_) (Heap.Heap Map.empty)
[PROOF STEP]
by simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>f t ti x. (\<And>t ti x. refines (vebt_memberi ti x) (f t ti x)) \<Longrightarrow> refines (vebt_memberi ti x) (case ti of Nodei info deg treeArray summary \<Rightarrow> assert' (is_Node t) \<bind> (\<lambda>_. case info of None \<Rightarrow> return False | Some (mi, ma) \<Rightarrow> if deg \<le> 1 then return False else if x = mi then return True else if x = ma then return True else if x < mi then return False else if ma < x then return False else let (info', deg', treeList, summary') = case t of Node info' deg' treeList summary' \<Rightarrow> (info', deg', treeList, summary') in assert' (info = info' \<and> deg = deg') \<bind> (\<lambda>_. highi x (deg div 2) \<bind> (\<lambda>h. lowi x (deg div 2) \<bind> (\<lambda>l. assert' (l = low x (deg div 2) \<and> h = high x (deg div 2)) \<bind> (\<lambda>_. Array_Time.len treeArray \<bind> (\<lambda>len. assert' (len = length treeList) \<bind> (\<lambda>_. if h < len then assert' (h = high x (deg div 2) \<and> h < length treeList) \<bind> (\<lambda>_. Array_Time.nth treeArray h \<bind> (\<lambda>th. f (treeList ! h) th l)) else return False))))))) | Leafi a b \<Rightarrow> return (if x = 0 then a else if x = 1 then b else False))
[PROOF STEP]
subgoal for f t ti x
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>t ti x. refines (vebt_memberi ti x) (f t ti x)) \<Longrightarrow> refines (vebt_memberi ti x) (case ti of Nodei info deg treeArray summary \<Rightarrow> assert' (is_Node t) \<bind> (\<lambda>_. case info of None \<Rightarrow> return False | Some (mi, ma) \<Rightarrow> if deg \<le> 1 then return False else if x = mi then return True else if x = ma then return True else if x < mi then return False else if ma < x then return False else let (info', deg', treeList, summary') = case t of Node info' deg' treeList summary' \<Rightarrow> (info', deg', treeList, summary') in assert' (info = info' \<and> deg = deg') \<bind> (\<lambda>_. highi x (deg div 2) \<bind> (\<lambda>h. lowi x (deg div 2) \<bind> (\<lambda>l. assert' (l = low x (deg div 2) \<and> h = high x (deg div 2)) \<bind> (\<lambda>_. Array_Time.len treeArray \<bind> (\<lambda>len. assert' (len = length treeList) \<bind> (\<lambda>_. if h < len then assert' (h = high x (deg div 2) \<and> h < length treeList) \<bind> (\<lambda>_. Array_Time.nth treeArray h \<bind> (\<lambda>th. f (treeList ! h) th l)) else return False))))))) | Leafi a b \<Rightarrow> return (if x = 0 then a else if x = 1 then b else False))
[PROOF STEP]
apply(subst vebt_memberi.simps)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>t ti x. refines (vebt_memberi ti x) (f t ti x)) \<Longrightarrow> refines (case ti of Nodei None deg treeList summary \<Rightarrow> return False | Nodei (Some (mi, ma)) deg treeList summary \<Rightarrow> if deg \<le> 1 then return False else if x = mi then return True else if x = ma then return True else if x < mi then return False else if ma < x then return False else highi x (deg div 2) \<bind> (\<lambda>h. lowi x (deg div 2) \<bind> (\<lambda>l. Array_Time.len treeList \<bind> (\<lambda>len. if h < len then Array_Time.nth treeList h \<bind> (\<lambda>th. vebt_memberi th l) else return False))) | Leafi a b \<Rightarrow> return (if x = 0 then a else if x = 1 then b else False)) (case ti of Nodei info deg treeArray summary \<Rightarrow> assert' (is_Node t) \<bind> (\<lambda>_. case info of None \<Rightarrow> return False | Some (mi, ma) \<Rightarrow> if deg \<le> 1 then return False else if x = mi then return True else if x = ma then return True else if x < mi then return False else if ma < x then return False else let (info', deg', treeList, summary') = case t of Node info' deg' treeList summary' \<Rightarrow> (info', deg', treeList, summary') in assert' (info = info' \<and> deg = deg') \<bind> (\<lambda>_. highi x (deg div 2) \<bind> (\<lambda>h. lowi x (deg div 2) \<bind> (\<lambda>l. assert' (l = low x (deg div 2) \<and> h = high x (deg div 2)) \<bind> (\<lambda>_. Array_Time.len treeArray \<bind> (\<lambda>len. assert' (len = length treeList) \<bind> (\<lambda>_. if h < len then assert' (h = high x (deg div 2) \<and> h < length treeList) \<bind> (\<lambda>_. Array_Time.nth treeArray h \<bind> (\<lambda>th. f (treeList ! h) th l)) else return False))))))) | Leafi a b \<Rightarrow> return (if x = 0 then a else if x = 1 then b else False))
[PROOF STEP]
apply refines
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done