[STATEMENT]
lemma "\<forall>\<sigma>. \<exists> X. \<sigma> \<Turnstile> (_  \<leftarrow> assume\<^sub>S\<^sub>E P ; x  \<leftarrow> M; assert\<^sub>S\<^sub>E (\<lambda>\<sigma>.  x=X \<and> Q x \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<sigma>. \<exists>X. \<sigma> \<Turnstile> _bind_SE _ (assume\<^sub>S\<^sub>E P) (_bind_SE x M (assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. x = X \<and> Q x \<sigma>)))
[PROOF STEP]
oops


[STATEMENT]
lemma "(\<lambda>b. b<maxsize, X) \<in> A \<rightarrow> bool_rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>b. b < maxsize, X) \<in> A \<rightarrow> bool_rel
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a a'. \<lbrakk>(a, a') \<in> A; a < maxsize\<rbrakk> \<Longrightarrow> X a'
 2. \<And>a a'. \<lbrakk>(a, a') \<in> A; X a'\<rbrakk> \<Longrightarrow> a < maxsize
[PROOF STEP]
oops


[STATEMENT]
lemma ev_signal_weakly_step_consistent:
  assumes eq_obs: "vpeq u s1 s2"
      and eq_act: "vpeq (partition tid) s1 s2"
      and inv1:   "atomic_step_invariant s1"
      and inv2:   "atomic_step_invariant s2"
      and prec1: "atomic_step_precondition s1 (current s1) ipt"
      and prec2: "atomic_step_precondition s1 (current s1) ipt"
    shows "vpeq u
                (atomic_step_ev_signal tid partner s1)
                (atomic_step_ev_signal tid partner s2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vpeq u (atomic_step_ev_signal tid partner s1) (atomic_step_ev_signal tid partner s2)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
vpeq u s1 s2
vpeq (Step.partition tid) s1 s2
atomic_step_invariant s1
atomic_step_invariant s2
atomic_step_precondition s1 (current s1) ipt
atomic_step_precondition s1 (current s1) ipt

goal (1 subgoal):
 1. vpeq u (atomic_step_ev_signal tid partner s1) (atomic_step_ev_signal tid partner s2)
[PROOF STEP]
unfolding vpeq_def vpeq_subj_subj_def vpeq_obj_def vpeq_subj_obj_def vpeq_local_def
              atomic_step_ev_signal_def
[PROOF STATE]
proof (prove)
using this:
(\<forall>obj_id. Policy.sp_spec_subj_obj u obj_id READ \<longrightarrow> obj s1 obj_id = obj s2 obj_id) \<and> (\<forall>v. (Policy.sp_spec_subj_subj u v \<longrightarrow> sp_impl_subj_subj s1 u v = sp_impl_subj_subj s2 u v) \<and> (Policy.sp_spec_subj_subj v u \<longrightarrow> sp_impl_subj_subj s1 v u = sp_impl_subj_subj s2 v u)) \<and> (\<forall>ob m p1. (Policy.sp_spec_subj_obj u ob m \<longrightarrow> sp_impl_subj_obj s1 u ob m = sp_impl_subj_obj s2 u ob m) \<and> (Policy.sp_spec_subj_obj p1 ob PROVIDE \<and> (Policy.sp_spec_subj_obj u ob READ \<or> Policy.sp_spec_subj_obj u ob WRITE) \<longrightarrow> sp_impl_subj_obj s1 p1 ob PROVIDE = sp_impl_subj_obj s2 p1 ob PROVIDE)) \<and> (\<forall>tid. Step.partition tid = u \<longrightarrow> thread s1 tid = thread s2 tid)
(\<forall>obj_id. Policy.sp_spec_subj_obj (Step.partition tid) obj_id READ \<longrightarrow> obj s1 obj_id = obj s2 obj_id) \<and> (\<forall>v. (Policy.sp_spec_subj_subj (Step.partition tid) v \<longrightarrow> sp_impl_subj_subj s1 (Step.partition tid) v = sp_impl_subj_subj s2 (Step.partition tid) v) \<and> (Policy.sp_spec_subj_subj v (Step.partition tid) \<longrightarrow> sp_impl_subj_subj s1 v (Step.partition tid) = sp_impl_subj_subj s2 v (Step.partition tid))) \<and> (\<forall>ob m p1. (Policy.sp_spec_subj_obj (Step.partition tid) ob m \<longrightarrow> sp_impl_subj_obj s1 (Step.partition tid) ob m = sp_impl_subj_obj s2 (Step.partition tid) ob m) \<and> (Policy.sp_spec_subj_obj p1 ob PROVIDE \<and> (Policy.sp_spec_subj_obj (Step.partition tid) ob READ \<or> Policy.sp_spec_subj_obj (Step.partition tid) ob WRITE) \<longrightarrow> sp_impl_subj_obj s1 p1 ob PROVIDE = sp_impl_subj_obj s2 p1 ob PROVIDE)) \<and> (\<forall>tida. Step.partition tida = Step.partition tid \<longrightarrow> thread s1 tida = thread s2 tida)
atomic_step_invariant s1
atomic_step_invariant s2
atomic_step_precondition s1 (current s1) ipt
atomic_step_precondition s1 (current s1) ipt

goal (1 subgoal):
 1. (\<forall>obj_id. Policy.sp_spec_subj_obj u obj_id READ \<longrightarrow> obj (s1\<lparr>thread := (thread s1)(partner := thread s1 partner\<lparr>ev_counter := Suc (ev_counter (thread s1 partner))\<rparr>)\<rparr>) obj_id = obj (s2\<lparr>thread := (thread s2)(partner := thread s2 partner\<lparr>ev_counter := Suc (ev_counter (thread s2 partner))\<rparr>)\<rparr>) obj_id) \<and> (\<forall>v. (Policy.sp_spec_subj_subj u v \<longrightarrow> sp_impl_subj_subj (s1\<lparr>thread := (thread s1)(partner := thread s1 partner\<lparr>ev_counter := Suc (ev_counter (thread s1 partner))\<rparr>)\<rparr>) u v = sp_impl_subj_subj (s2\<lparr>thread := (thread s2)(partner := thread s2 partner\<lparr>ev_counter := Suc (ev_counter (thread s2 partner))\<rparr>)\<rparr>) u v) \<and> (Policy.sp_spec_subj_subj v u \<longrightarrow> sp_impl_subj_subj (s1\<lparr>thread := (thread s1)(partner := thread s1 partner\<lparr>ev_counter := Suc (ev_counter (thread s1 partner))\<rparr>)\<rparr>) v u = sp_impl_subj_subj (s2\<lparr>thread := (thread s2)(partner := thread s2 partner\<lparr>ev_counter := Suc (ev_counter (thread s2 partner))\<rparr>)\<rparr>) v u)) \<and> (\<forall>ob m p1. (Policy.sp_spec_subj_obj u ob m \<longrightarrow> sp_impl_subj_obj (s1\<lparr>thread := (thread s1)(partner := thread s1 partner\<lparr>ev_counter := Suc (ev_counter (thread s1 partner))\<rparr>)\<rparr>) u ob m = sp_impl_subj_obj (s2\<lparr>thread := (thread s2)(partner := thread s2 partner\<lparr>ev_counter := Suc (ev_counter (thread s2 partner))\<rparr>)\<rparr>) u ob m) \<and> (Policy.sp_spec_subj_obj p1 ob PROVIDE \<and> (Policy.sp_spec_subj_obj u ob READ \<or> Policy.sp_spec_subj_obj u ob WRITE) \<longrightarrow> sp_impl_subj_obj (s1\<lparr>thread := (thread s1)(partner := thread s1 partner\<lparr>ev_counter := Suc (ev_counter (thread s1 partner))\<rparr>)\<rparr>) p1 ob PROVIDE = sp_impl_subj_obj (s2\<lparr>thread := (thread s2)(partner := thread s2 partner\<lparr>ev_counter := Suc (ev_counter (thread s2 partner))\<rparr>)\<rparr>) p1 ob PROVIDE)) \<and> (\<forall>tid. Step.partition tid = u \<longrightarrow> thread (s1\<lparr>thread := (thread s1)(partner := thread s1 partner\<lparr>ev_counter := Suc (ev_counter (thread s1 partner))\<rparr>)\<rparr>) tid = thread (s2\<lparr>thread := (thread s2)(partner := thread s2 partner\<lparr>ev_counter := Suc (ev_counter (thread s2 partner))\<rparr>)\<rparr>) tid)
[PROOF STEP]
by simp


[STATEMENT]
lemma "x = (case (x, y) of (x', y') \<Rightarrow> x')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x = (case (x, y) of (x', y') \<Rightarrow> x')
[PROOF STEP]
nitpick [expect = none]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x = (case (x, y) of (x', y') \<Rightarrow> x')
[PROOF STEP]
sorry


[STATEMENT]
lemma (in antisym)
  "R x y --> R y z --> R x z"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. R x y \<longrightarrow> R y z \<longrightarrow> R x z
[PROOF STEP]
quickcheck[exhaustive, expect = no_counterexample]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. R x y \<longrightarrow> R y z \<longrightarrow> R x z
[PROOF STEP]
oops


[STATEMENT]
lemma "x\<^sup>\<omega> \<cdot> y = x\<^sup>\<omega>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x\<^sup>\<omega> \<cdot> y = x\<^sup>\<omega>
[PROOF STEP]
(*nitpick [expect=genuine] -- "2-element counterexample"*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x\<^sup>\<omega> \<cdot> y = x\<^sup>\<omega>
[PROOF STEP]
oops