[STATEMENT]
lemma A_trusts_NS2: "[| evs \<in> nsp; A \<notin> bad; B \<notin> bad |] ==> ns1 A B NA \<in> set evs
\<longrightarrow> Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (spies evs)
\<longrightarrow> ns2 B A NA NB \<in> set evs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>evs \<in> nsp; A \<notin> bad; B \<notin> bad\<rbrakk> \<Longrightarrow> Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs \<longrightarrow> Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (knows Spy evs) \<longrightarrow> Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<in> set evs
[PROOF STEP]
apply (erule nsp.induct, simp_all, safe)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>evs X Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs \<in> nsp; X \<in> synth (analz (knows Spy evs)); Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<notin> parts (knows Spy evs); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (insert X (knows Spy evs)); Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<notin> set evs\<rbrakk> \<Longrightarrow> B = Spy
 2. \<And>evs X Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs \<in> nsp; X \<in> synth (analz (knows Spy evs)); Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<notin> parts (knows Spy evs); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (insert X (knows Spy evs)); Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<notin> set evs\<rbrakk> \<Longrightarrow> A = Ba
 3. \<And>evs X Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs \<in> nsp; X \<in> synth (analz (knows Spy evs)); Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<notin> parts (knows Spy evs); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (insert X (knows Spy evs)); Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<notin> set evs\<rbrakk> \<Longrightarrow> Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> = X
 4. \<And>evs1 NAa Aa Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs1 \<in> nsp; Nonce NA \<notin> used evs1; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (knows Spy evs1); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<notin> set evs1\<rbrakk> \<Longrightarrow> Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<in> set evs1
[PROOF STEP]
apply (frule_tac B=B in ns1_imp_Guard, simp+)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>evs X. \<lbrakk>A \<notin> bad; B \<notin> bad; evs \<in> nsp; X \<in> synth (analz (knows Spy evs)); Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<notin> parts (knows Spy evs); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (insert X (knows Spy evs)); Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<notin> set evs; Guard NA {priEK A, priEK B} (knows Spy evs)\<rbrakk> \<Longrightarrow> B = Spy
 2. \<And>evs X Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs \<in> nsp; X \<in> synth (analz (knows Spy evs)); Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<notin> parts (knows Spy evs); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (insert X (knows Spy evs)); Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<notin> set evs\<rbrakk> \<Longrightarrow> A = Ba
 3. \<And>evs X Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs \<in> nsp; X \<in> synth (analz (knows Spy evs)); Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<notin> parts (knows Spy evs); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (insert X (knows Spy evs)); Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<notin> set evs\<rbrakk> \<Longrightarrow> Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> = X
 4. \<And>evs1 NAa Aa Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs1 \<in> nsp; Nonce NA \<notin> used evs1; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (knows Spy evs1); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<notin> set evs1\<rbrakk> \<Longrightarrow> Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<in> set evs1
[PROOF STEP]
apply (drule Guard_Nonce_analz, simp+, blast)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>evs X Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs \<in> nsp; X \<in> synth (analz (knows Spy evs)); Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<notin> parts (knows Spy evs); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (insert X (knows Spy evs)); Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<notin> set evs\<rbrakk> \<Longrightarrow> A = Ba
 2. \<And>evs X Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs \<in> nsp; X \<in> synth (analz (knows Spy evs)); Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<notin> parts (knows Spy evs); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (insert X (knows Spy evs)); Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<notin> set evs\<rbrakk> \<Longrightarrow> Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> = X
 3. \<And>evs1 NAa Aa Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs1 \<in> nsp; Nonce NA \<notin> used evs1; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (knows Spy evs1); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<notin> set evs1\<rbrakk> \<Longrightarrow> Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<in> set evs1
[PROOF STEP]
apply (frule_tac B=B in ns1_imp_Guard, simp+)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>evs X Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs \<in> nsp; X \<in> synth (analz (knows Spy evs)); Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<notin> parts (knows Spy evs); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (insert X (knows Spy evs)); Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<notin> set evs; Guard NA {priEK A, priEK B} (knows Spy evs)\<rbrakk> \<Longrightarrow> A = Ba
 2. \<And>evs X Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs \<in> nsp; X \<in> synth (analz (knows Spy evs)); Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<notin> parts (knows Spy evs); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (insert X (knows Spy evs)); Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<notin> set evs\<rbrakk> \<Longrightarrow> Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> = X
 3. \<And>evs1 NAa Aa Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs1 \<in> nsp; Nonce NA \<notin> used evs1; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (knows Spy evs1); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<notin> set evs1\<rbrakk> \<Longrightarrow> Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<in> set evs1
[PROOF STEP]
apply (drule Guard_Nonce_analz, simp+, blast)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>evs X Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs \<in> nsp; X \<in> synth (analz (knows Spy evs)); Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<notin> parts (knows Spy evs); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (insert X (knows Spy evs)); Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<notin> set evs\<rbrakk> \<Longrightarrow> Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> = X
 2. \<And>evs1 NAa Aa Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs1 \<in> nsp; Nonce NA \<notin> used evs1; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (knows Spy evs1); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<notin> set evs1\<rbrakk> \<Longrightarrow> Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<in> set evs1
[PROOF STEP]
apply (frule_tac B=B in ns1_imp_Guard, simp+)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>evs X. \<lbrakk>A \<notin> bad; B \<notin> bad; evs \<in> nsp; X \<in> synth (analz (knows Spy evs)); Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<notin> parts (knows Spy evs); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (insert X (knows Spy evs)); Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<notin> set evs; Guard NA {priEK A, priEK B} (knows Spy evs)\<rbrakk> \<Longrightarrow> Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> = X
 2. \<And>evs1 NAa Aa Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs1 \<in> nsp; Nonce NA \<notin> used evs1; Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace> \<in> parts (knows Spy evs1); Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<notin> set evs1\<rbrakk> \<Longrightarrow> Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB, Agent B\<rbrace>) \<in> set evs1
[PROOF STEP]
by (drule Guard_Nonce_analz, simp+, blast+)


[STATEMENT]
lemma prj'_joint_monic:
    assumes "\<guillemotleft>h: a \<rightarrow>\<^sub>C \<mu>\<nu>\<pi>.chine\<guillemotright>" and "\<guillemotleft>h': a \<rightarrow>\<^sub>C \<mu>\<nu>\<pi>.chine\<guillemotright>"
    and "Prj\<^sub>1 \<cdot> h = Prj\<^sub>1 \<cdot> h'" and "Prj\<^sub>1\<^sub>0 \<cdot> h = Prj\<^sub>1\<^sub>0 \<cdot> h'" and "Prj\<^sub>0\<^sub>0 \<cdot> h = Prj\<^sub>0\<^sub>0 \<cdot> h'"
    shows "h = h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. h = h'
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. h = h'
[PROOF STEP]
have "\<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
[PROOF STEP]
have "\<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
[PROOF STEP]
using assms \<mu>\<nu>.composable \<nu>\<pi>.composable src_def trg_def chine_composite(2)
                C.comp_assoc
[PROOF STATE]
proof (prove)
using this:
\<guillemotleft>h : a \<rightarrow>\<^sub>C \<mu>\<nu>\<pi>.chine\<guillemotright>
\<guillemotleft>h' : a \<rightarrow>\<^sub>C \<mu>\<nu>\<pi>.chine\<guillemotright>
Prj\<^sub>1 \<cdot> h = Prj\<^sub>1 \<cdot> h'
Prj\<^sub>1\<^sub>0 \<cdot> h = Prj\<^sub>1\<^sub>0 \<cdot> h'
Prj\<^sub>0\<^sub>0 \<cdot> h = Prj\<^sub>0\<^sub>0 \<cdot> h'
src \<mu> = trg \<nu>
src \<nu> = trg \<pi>
src ?\<mu> \<equiv> if arr ?\<mu> then mkObj (C.cod (Leg0 (Dom ?\<mu>))) else null
trg ?\<mu> \<equiv> if arr ?\<mu> then mkObj (C.cod (Leg1 (Dom ?\<mu>))) else null
\<mu>\<nu>\<pi>.chine = \<mu>.leg0 \<down>\<down> \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1
(?h \<cdot> ?g) \<cdot> ?f = ?h \<cdot> ?g \<cdot> ?f

goal (1 subgoal):
 1. \<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
\<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'

goal (1 subgoal):
 1. \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'

goal (1 subgoal):
 1. \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
[PROOF STEP]
have "\<nu>\<pi>.prj\<^sub>1 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>1 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<nu>\<pi>.prj\<^sub>1 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>1 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
[PROOF STEP]
using assms \<mu>\<nu>.composable \<nu>\<pi>.composable src_def trg_def chine_composite(2)
                C.comp_assoc
[PROOF STATE]
proof (prove)
using this:
\<guillemotleft>h : a \<rightarrow>\<^sub>C \<mu>\<nu>\<pi>.chine\<guillemotright>
\<guillemotleft>h' : a \<rightarrow>\<^sub>C \<mu>\<nu>\<pi>.chine\<guillemotright>
Prj\<^sub>1 \<cdot> h = Prj\<^sub>1 \<cdot> h'
Prj\<^sub>1\<^sub>0 \<cdot> h = Prj\<^sub>1\<^sub>0 \<cdot> h'
Prj\<^sub>0\<^sub>0 \<cdot> h = Prj\<^sub>0\<^sub>0 \<cdot> h'
src \<mu> = trg \<nu>
src \<nu> = trg \<pi>
src ?\<mu> \<equiv> if arr ?\<mu> then mkObj (C.cod (Leg0 (Dom ?\<mu>))) else null
trg ?\<mu> \<equiv> if arr ?\<mu> then mkObj (C.cod (Leg1 (Dom ?\<mu>))) else null
\<mu>\<nu>\<pi>.chine = \<mu>.leg0 \<down>\<down> \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1
(?h \<cdot> ?g) \<cdot> ?f = ?h \<cdot> ?g \<cdot> ?f

goal (1 subgoal):
 1. \<nu>\<pi>.prj\<^sub>1 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>1 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
\<nu>\<pi>.prj\<^sub>1 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>1 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'

goal (1 subgoal):
 1. \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
\<nu>\<pi>.prj\<^sub>1 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>1 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
\<nu>\<pi>.prj\<^sub>1 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>1 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'

goal (1 subgoal):
 1. \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
[PROOF STEP]
using assms \<mu>\<nu>.composable \<nu>\<pi>.composable src_def trg_def
                chine_composite(2) cod_char
                C.prj_joint_monic
                  [of \<nu>.leg0 \<pi>.leg1 "\<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h"
                      "\<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'"]
[PROOF STATE]
proof (prove)
using this:
\<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
\<nu>\<pi>.prj\<^sub>1 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>1 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
\<guillemotleft>h : a \<rightarrow>\<^sub>C \<mu>\<nu>\<pi>.chine\<guillemotright>
\<guillemotleft>h' : a \<rightarrow>\<^sub>C \<mu>\<nu>\<pi>.chine\<guillemotright>
Prj\<^sub>1 \<cdot> h = Prj\<^sub>1 \<cdot> h'
Prj\<^sub>1\<^sub>0 \<cdot> h = Prj\<^sub>1\<^sub>0 \<cdot> h'
Prj\<^sub>0\<^sub>0 \<cdot> h = Prj\<^sub>0\<^sub>0 \<cdot> h'
src \<mu> = trg \<nu>
src \<nu> = trg \<pi>
src ?\<mu> \<equiv> if arr ?\<mu> then mkObj (C.cod (Leg0 (Dom ?\<mu>))) else null
trg ?\<mu> \<equiv> if arr ?\<mu> then mkObj (C.cod (Leg1 (Dom ?\<mu>))) else null
\<mu>\<nu>\<pi>.chine = \<mu>.leg0 \<down>\<down> \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1
cod = (\<lambda>\<mu>. if arr \<mu> then \<lparr>Chn = span_in_category.apex (\<cdot>) (Cod \<mu>), Dom = Cod \<mu>, Cod = Cod \<mu>\<rparr> else null)
\<lbrakk>C.cospan \<nu>.leg0 \<pi>.leg1; C.seq \<nu>\<pi>.prj\<^sub>1 (\<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h); C.seq \<nu>\<pi>.prj\<^sub>1 (\<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'); \<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>0 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'; \<nu>\<pi>.prj\<^sub>1 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<nu>\<pi>.prj\<^sub>1 \<cdot> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'\<rbrakk> \<Longrightarrow> \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'

goal (1 subgoal):
 1. \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'

goal (1 subgoal):
 1. h = h'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'

goal (1 subgoal):
 1. h = h'
[PROOF STEP]
have "Prj\<^sub>1 \<cdot> h = Prj\<^sub>1 \<cdot> h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prj\<^sub>1 \<cdot> h = Prj\<^sub>1 \<cdot> h'
[PROOF STEP]
using assms cod_char
[PROOF STATE]
proof (prove)
using this:
\<guillemotleft>h : a \<rightarrow>\<^sub>C \<mu>\<nu>\<pi>.chine\<guillemotright>
\<guillemotleft>h' : a \<rightarrow>\<^sub>C \<mu>\<nu>\<pi>.chine\<guillemotright>
Prj\<^sub>1 \<cdot> h = Prj\<^sub>1 \<cdot> h'
Prj\<^sub>1\<^sub>0 \<cdot> h = Prj\<^sub>1\<^sub>0 \<cdot> h'
Prj\<^sub>0\<^sub>0 \<cdot> h = Prj\<^sub>0\<^sub>0 \<cdot> h'
cod = (\<lambda>\<mu>. if arr \<mu> then \<lparr>Chn = span_in_category.apex (\<cdot>) (Cod \<mu>), Dom = Cod \<mu>, Cod = Cod \<mu>\<rparr> else null)

goal (1 subgoal):
 1. Prj\<^sub>1 \<cdot> h = Prj\<^sub>1 \<cdot> h'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
Prj\<^sub>1 \<cdot> h = Prj\<^sub>1 \<cdot> h'

goal (1 subgoal):
 1. h = h'
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
Prj\<^sub>1 \<cdot> h = Prj\<^sub>1 \<cdot> h'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
Prj\<^sub>1 \<cdot> h = Prj\<^sub>1 \<cdot> h'

goal (1 subgoal):
 1. h = h'
[PROOF STEP]
using assms \<mu>\<nu>.composable \<nu>\<pi>.composable src_def trg_def chine_composite(2)
              C.prj_joint_monic [of \<mu>.leg0 "\<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1" h h']
[PROOF STATE]
proof (prove)
using this:
\<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'
Prj\<^sub>1 \<cdot> h = Prj\<^sub>1 \<cdot> h'
\<guillemotleft>h : a \<rightarrow>\<^sub>C \<mu>\<nu>\<pi>.chine\<guillemotright>
\<guillemotleft>h' : a \<rightarrow>\<^sub>C \<mu>\<nu>\<pi>.chine\<guillemotright>
Prj\<^sub>1 \<cdot> h = Prj\<^sub>1 \<cdot> h'
Prj\<^sub>1\<^sub>0 \<cdot> h = Prj\<^sub>1\<^sub>0 \<cdot> h'
Prj\<^sub>0\<^sub>0 \<cdot> h = Prj\<^sub>0\<^sub>0 \<cdot> h'
src \<mu> = trg \<nu>
src \<nu> = trg \<pi>
src ?\<mu> \<equiv> if arr ?\<mu> then mkObj (C.cod (Leg0 (Dom ?\<mu>))) else null
trg ?\<mu> \<equiv> if arr ?\<mu> then mkObj (C.cod (Leg1 (Dom ?\<mu>))) else null
\<mu>\<nu>\<pi>.chine = \<mu>.leg0 \<down>\<down> \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1
\<lbrakk>C.cospan \<mu>.leg0 (\<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1); C.seq Prj\<^sub>1 h; C.seq Prj\<^sub>1 h'; \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h = \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] \<cdot> h'; Prj\<^sub>1 \<cdot> h = Prj\<^sub>1 \<cdot> h'\<rbrakk> \<Longrightarrow> h = h'

goal (1 subgoal):
 1. h = h'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
h = h'

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "\<forall>x::('a, 'b) T3. P x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x. P x
[PROOF STEP]
nitpick [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x. P x
[PROOF STEP]
oops


[STATEMENT]
theorem jvm_lbv_correct:
  "wt_jvm_prog_lbv P Cert \<Longrightarrow> wf_jvm_prog P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wt_jvm_prog_lbv P Cert \<Longrightarrow> wf_jvm_prog P
[PROOF STEP]
(*<*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wt_jvm_prog_lbv P Cert \<Longrightarrow> wf_jvm_prog P
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. wt_jvm_prog_lbv P Cert \<Longrightarrow> wf_jvm_prog P
[PROOF STEP]
let ?\<Phi> = "\<lambda>C mn. let (C,Ts,T\<^sub>r,meth) = method P C mn; (mxs,mxl\<^sub>0,is,xt) = the meth in
              SOME \<tau>s. wt_method P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. wt_jvm_prog_lbv P Cert \<Longrightarrow> wf_jvm_prog P
[PROOF STEP]
assume wt: "wt_jvm_prog_lbv P Cert"
[PROOF STATE]
proof (state)
this:
wt_jvm_prog_lbv P Cert

goal (1 subgoal):
 1. wt_jvm_prog_lbv P Cert \<Longrightarrow> wf_jvm_prog P
[PROOF STEP]
hence "wf_jvm_prog\<^bsub>?\<Phi>\<^esub> P"
[PROOF STATE]
proof (prove)
using this:
wt_jvm_prog_lbv P Cert

goal (1 subgoal):
 1. wf_jvm_prog\<^bsub>\<lambda>C mn. let (C, Ts, T\<^sub>r, meth) = method P C mn; (mxs, mxl\<^sub>0, is, xt) = the meth in SOME \<tau>s. wt_method P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s\<^esub> P
[PROOF STEP]
apply (unfold wf_jvm_prog_phi_def wt_jvm_prog_lbv_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf_prog (\<lambda>P C (mn, Ts, T\<^sub>r, mxs, mxl\<^sub>0, b, et). wt_lbv P C Ts T\<^sub>r mxs mxl\<^sub>0 et (Cert C mn) b) P \<Longrightarrow> wf_prog (\<lambda>Pa C (M, Ts, T\<^sub>r, mxs, mxl\<^sub>0, is, xt). wt_method Pa C Ts T\<^sub>r mxs mxl\<^sub>0 is xt (let (C, Ts, T\<^sub>r, meth) = method P C M; (mxs, mxl\<^sub>0, is, xt) = the meth in Eps (wt_method P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt))) P
[PROOF STEP]
apply (erule wf_prog_lift)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>wf_md C M Ts Ca T m. \<lbrakk>wf_prog wf_md P; P \<turnstile> Ca sees M: Ts\<rightarrow>T = \<lfloor>m\<rfloor> in Ca; is_class P Ca; set Ts \<subseteq> types P; case (M, Ts, T, m) of (mn, Ts, T\<^sub>r, mxs, mxl\<^sub>0, b, et) \<Rightarrow> wt_lbv P Ca Ts T\<^sub>r mxs mxl\<^sub>0 et (Cert Ca mn) b\<rbrakk> \<Longrightarrow> case (M, Ts, T, m) of (M, Ts, T\<^sub>r, mxs, mxl\<^sub>0, is, xt) \<Rightarrow> wt_method P Ca Ts T\<^sub>r mxs mxl\<^sub>0 is xt (let (C, Ts, T\<^sub>r, meth) = method P Ca M; (mxs, mxl\<^sub>0, is, xt) = the meth in Eps (wt_method P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt))
[PROOF STEP]
apply(auto intro: someI_ex[OF start_context.wt_lbv_wt_method [OF start_context.intro]])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
wf_jvm_prog\<^bsub>\<lambda>C mn. let (C, Ts, T\<^sub>r, meth) = method P C mn; (mxs, mxl\<^sub>0, is, xt) = the meth in SOME \<tau>s. wt_method P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s\<^esub> P

goal (1 subgoal):
 1. wt_jvm_prog_lbv P Cert \<Longrightarrow> wf_jvm_prog P
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
wf_jvm_prog\<^bsub>\<lambda>C mn. let (C, Ts, T\<^sub>r, meth) = method P C mn; (mxs, mxl\<^sub>0, is, xt) = the meth in SOME \<tau>s. wt_method P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s\<^esub> P

goal (1 subgoal):
 1. wf_jvm_prog P
[PROOF STEP]
by (unfold wf_jvm_prog_def) blast
[PROOF STATE]
proof (state)
this:
wf_jvm_prog P

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma R23sD:
  "(s, t) \<in> R23s \<Longrightarrow>
    ik s = ik t \<inter> payload \<and> secret s = secret t \<and> progress s = progress t \<and>
    signalsInit s = signalsInit t \<and> signalsResp s = signalsResp t \<and>
    chan s = abs (ik t) \<and> l2_state.bad s = bad t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (s, t) \<in> R23s \<Longrightarrow> ik s = ik t \<inter> payload \<and> secret s = secret t \<and> progress s = progress t \<and> signalsInit s = signalsInit t \<and> signalsResp s = signalsResp t \<and> chan s = local.abs (ik t) \<and> l2_state.bad s = l3_state.bad t
[PROOF STEP]
by (auto simp add: R23s_def med23s_def)


[STATEMENT]
theorem load_after_store_disjoint_1:
  assumes "store h c val = Success h'"
    and "block_id c \<noteq> block_id c'"
  shows "load h c' t = load h' c' t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. load h c' t = load h' c' t
[PROOF STEP]
using assms store_cond_hard_cap[OF assms(1)]
[PROOF STATE]
proof (prove)
using this:
store h c val = Success h'
block_id c \<noteq> block_id c'
tag c = True
perm_store c = True
\<lbrakk>val = Cap_v ?cv; tag ?cv\<rbrakk> \<Longrightarrow> perm_cap_store c \<and> (perm_cap_store_local c \<or> perm_global ?cv)
offset c + int |memval_type val|\<^sub>\<tau> \<le> int (base c + len c)
int (base c) \<le> offset c
offset c mod int |memval_type val|\<^sub>\<tau> = 0

goal (1 subgoal):
 1. load h c' t = load h' c' t
[PROOF STEP]
unfolding store_def load_def
[PROOF STATE]
proof (prove)
using this:
(if tag c = False then Error (C2Err TagViolation) else if perm_store c = False then Error (C2Err PermitStoreViolation) else if case val of Cap_v cv \<Rightarrow> \<not> perm_cap_store c \<and> tag cv | _ \<Rightarrow> False then Error (C2Err PermitStoreCapViolation) else if case val of Cap_v cv \<Rightarrow> \<not> perm_cap_store_local c \<and> tag cv \<and> \<not> perm_global cv | _ \<Rightarrow> False then Error (C2Err PermitStoreLocalCapViolation) else if int (base c + len c) < offset c + int |memval_type val|\<^sub>\<tau> then Error (C2Err LengthViolation) else if offset c < int (base c) then Error (C2Err LengthViolation) else if offset c mod int |memval_type val|\<^sub>\<tau> \<noteq> 0 then Error (C2Err BadAddressViolation) else if val = Undef then Error (LogicErr (Unhandled STR '''')) else let obj = Mapping.lookup (heap_map h) (block_id c) in case obj of None \<Rightarrow> Error (LogicErr MissingResource) | Some Freed \<Rightarrow> Error (LogicErr UseAfterFree) | Some (Map m) \<Rightarrow> if offset c < int (fst (bounds m)) \<or> int (snd (bounds m)) < offset c + int |memval_type val|\<^sub>\<tau> then Error (LogicErr BufferOverrun) else Success (h\<lparr>heap_map := Mapping.update (block_id c) (Map (store_tval m (nat (offset c)) val)) (heap_map h)\<rparr>)) = Success h'
block_id c \<noteq> block_id c'
tag c = True
perm_store c = True
\<lbrakk>val = Cap_v ?cv; tag ?cv\<rbrakk> \<Longrightarrow> perm_cap_store c \<and> (perm_cap_store_local c \<or> perm_global ?cv)
offset c + int |memval_type val|\<^sub>\<tau> \<le> int (base c + len c)
int (base c) \<le> offset c
offset c mod int |memval_type val|\<^sub>\<tau> = 0

goal (1 subgoal):
 1. (if tag c' = False then Error (C2Err TagViolation) else if perm_load c' = False then Error (C2Err PermitLoadViolation) else if int (base c' + len c') < offset c' + int |t|\<^sub>\<tau> then Error (C2Err LengthViolation) else if offset c' < int (base c') then Error (C2Err LengthViolation) else if offset c' mod int |t|\<^sub>\<tau> \<noteq> 0 then Error (C2Err BadAddressViolation) else let obj = Mapping.lookup (heap_map h) (block_id c') in case obj of None \<Rightarrow> Error (LogicErr MissingResource) | Some Freed \<Rightarrow> Error (LogicErr UseAfterFree) | Some (Map m) \<Rightarrow> if offset c' < int (fst (bounds m)) \<or> int (snd (bounds m)) < offset c' + int |t|\<^sub>\<tau> then Error (LogicErr BufferOverrun) else Success (retrieve_tval m (nat (offset c')) t (perm_cap_load c'))) = (if tag c' = False then Error (C2Err TagViolation) else if perm_load c' = False then Error (C2Err PermitLoadViolation) else if int (base c' + len c') < offset c' + int |t|\<^sub>\<tau> then Error (C2Err LengthViolation) else if offset c' < int (base c') then Error (C2Err LengthViolation) else if offset c' mod int |t|\<^sub>\<tau> \<noteq> 0 then Error (C2Err BadAddressViolation) else let obj = Mapping.lookup (heap_map h') (block_id c') in case obj of None \<Rightarrow> Error (LogicErr MissingResource) | Some Freed \<Rightarrow> Error (LogicErr UseAfterFree) | Some (Map m) \<Rightarrow> if offset c' < int (fst (bounds m)) \<or> int (snd (bounds m)) < offset c' + int |t|\<^sub>\<tau> then Error (LogicErr BufferOverrun) else Success (retrieve_tval m (nat (offset c')) t (perm_cap_load c')))
[PROOF STEP]
by (clarsimp split: ccval.split_asm option.split_asm t.split_asm if_split_asm)


[STATEMENT]
lemma (in \<Z>) tiny_category_cat_FUNCT[cat_FUNCT_cs_intros]:
  assumes "\<Z> \<beta>" and "\<alpha> \<in>\<^sub>\<circ> \<beta>"
  shows "tiny_category \<beta> (cat_FUNCT \<alpha> \<AA> \<BB>)" (is \<open>tiny_category \<beta> ?FUNCT\<close>)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. tiny_category \<beta> (cat_FUNCT \<alpha> \<AA> \<BB>)
[PROOF STEP]
proof(intro tiny_categoryI)
[PROOF STATE]
proof (state)
goal (9 subgoals):
 1. \<Z> \<beta>
 2. vfsequence (cat_FUNCT \<alpha> \<AA> \<BB>)
 3. vsv (cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>)
 4. vcard (cat_FUNCT \<alpha> \<AA> \<BB>) = 6\<^sub>\<nat>
 5. tiny_semicategory \<beta> (cat_smc (cat_FUNCT \<alpha> \<AA> \<BB>))
 6. \<D>\<^sub>\<circ> (cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>) = cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>Obj\<rparr>
 7. \<And>a. a \<in>\<^sub>\<circ> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>Obj\<rparr> \<Longrightarrow> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>a\<rparr> : a \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> a
 8. \<And>a b f. f : a \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> b \<Longrightarrow> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>b\<rparr> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> f = f
 9. \<And>b c f. f : b \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> c \<Longrightarrow> f \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>b\<rparr> = f
[PROOF STEP]
show "vfsequence ?FUNCT"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vfsequence (cat_FUNCT \<alpha> \<AA> \<BB>)
[PROOF STEP]
unfolding cat_FUNCT_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vfsequence [cf_maps \<alpha> \<AA> \<BB>, ntcf_arrows \<alpha> \<AA> \<BB>, \<lambda>\<NN>\<in>\<^sub>\<circ>ntcf_arrows \<alpha> \<AA> \<BB>. \<NN>\<lparr>NTDom\<rparr>, \<lambda>\<NN>\<in>\<^sub>\<circ>ntcf_arrows \<alpha> \<AA> \<BB>. \<NN>\<lparr>NTCod\<rparr>, \<lambda>\<MM>\<NN>\<in>\<^sub>\<circ>composable_arrs (dg_FUNCT \<alpha> \<AA> \<BB>). \<MM>\<NN>\<lparr>[]\<^sub>\<circ>\<rparr> \<bullet>\<^sub>N\<^sub>T\<^sub>C\<^sub>F\<^bsub>\<AA>,\<BB>\<^esub> \<MM>\<NN>\<lparr>1\<^sub>\<nat>\<rparr>, VLambda (cf_maps \<alpha> \<AA> \<BB>) (ntcf_arrow_id \<AA> \<BB>)]\<^sub>\<circ>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vfsequence (cat_FUNCT \<alpha> \<AA> \<BB>)

goal (8 subgoals):
 1. \<Z> \<beta>
 2. vsv (cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>)
 3. vcard (cat_FUNCT \<alpha> \<AA> \<BB>) = 6\<^sub>\<nat>
 4. tiny_semicategory \<beta> (cat_smc (cat_FUNCT \<alpha> \<AA> \<BB>))
 5. \<D>\<^sub>\<circ> (cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>) = cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>Obj\<rparr>
 6. \<And>a. a \<in>\<^sub>\<circ> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>Obj\<rparr> \<Longrightarrow> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>a\<rparr> : a \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> a
 7. \<And>a b f. f : a \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> b \<Longrightarrow> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>b\<rparr> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> f = f
 8. \<And>b c f. f : b \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> c \<Longrightarrow> f \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>b\<rparr> = f
[PROOF STEP]
show "vcard ?FUNCT = 6\<^sub>\<nat>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vcard (cat_FUNCT \<alpha> \<AA> \<BB>) = 6\<^sub>\<nat>
[PROOF STEP]
unfolding cat_FUNCT_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vcard [cf_maps \<alpha> \<AA> \<BB>, ntcf_arrows \<alpha> \<AA> \<BB>, \<lambda>\<NN>\<in>\<^sub>\<circ>ntcf_arrows \<alpha> \<AA> \<BB>. \<NN>\<lparr>NTDom\<rparr>, \<lambda>\<NN>\<in>\<^sub>\<circ>ntcf_arrows \<alpha> \<AA> \<BB>. \<NN>\<lparr>NTCod\<rparr>, \<lambda>\<MM>\<NN>\<in>\<^sub>\<circ>composable_arrs (dg_FUNCT \<alpha> \<AA> \<BB>). \<MM>\<NN>\<lparr>[]\<^sub>\<circ>\<rparr> \<bullet>\<^sub>N\<^sub>T\<^sub>C\<^sub>F\<^bsub>\<AA>,\<BB>\<^esub> \<MM>\<NN>\<lparr>1\<^sub>\<nat>\<rparr>, VLambda (cf_maps \<alpha> \<AA> \<BB>) (ntcf_arrow_id \<AA> \<BB>)]\<^sub>\<circ> = 6\<^sub>\<nat>
[PROOF STEP]
by (simp add: nat_omega_simps)
[PROOF STATE]
proof (state)
this:
vcard (cat_FUNCT \<alpha> \<AA> \<BB>) = 6\<^sub>\<nat>

goal (7 subgoals):
 1. \<Z> \<beta>
 2. vsv (cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>)
 3. tiny_semicategory \<beta> (cat_smc (cat_FUNCT \<alpha> \<AA> \<BB>))
 4. \<D>\<^sub>\<circ> (cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>) = cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>Obj\<rparr>
 5. \<And>a. a \<in>\<^sub>\<circ> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>Obj\<rparr> \<Longrightarrow> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>a\<rparr> : a \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> a
 6. \<And>a b f. f : a \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> b \<Longrightarrow> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>b\<rparr> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> f = f
 7. \<And>b c f. f : b \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> c \<Longrightarrow> f \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>b\<rparr> = f
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
\<Z> \<beta>
\<alpha> \<in>\<^sub>\<circ> \<beta>
[PROOF STEP]
show "tiny_semicategory \<beta> (cat_smc ?FUNCT)"
[PROOF STATE]
proof (prove)
using this:
\<Z> \<beta>
\<alpha> \<in>\<^sub>\<circ> \<beta>

goal (1 subgoal):
 1. tiny_semicategory \<beta> (cat_smc (cat_FUNCT \<alpha> \<AA> \<BB>))
[PROOF STEP]
unfolding cat_smc_FUNCT
[PROOF STATE]
proof (prove)
using this:
\<Z> \<beta>
\<alpha> \<in>\<^sub>\<circ> \<beta>

goal (1 subgoal):
 1. tiny_semicategory \<beta> (smc_FUNCT \<alpha> \<AA> \<BB>)
[PROOF STEP]
by (auto simp add: tiny_semicategory_smc_FUNCT)
[PROOF STATE]
proof (state)
this:
tiny_semicategory \<beta> (cat_smc (cat_FUNCT \<alpha> \<AA> \<BB>))

goal (6 subgoals):
 1. \<Z> \<beta>
 2. vsv (cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>)
 3. \<D>\<^sub>\<circ> (cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>) = cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>Obj\<rparr>
 4. \<And>a. a \<in>\<^sub>\<circ> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>Obj\<rparr> \<Longrightarrow> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>a\<rparr> : a \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> a
 5. \<And>a b f. f : a \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> b \<Longrightarrow> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>b\<rparr> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> f = f
 6. \<And>b c f. f : b \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> c \<Longrightarrow> f \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>b\<rparr> = f
[PROOF STEP]
show CId_a: "?FUNCT\<lparr>CId\<rparr>\<lparr>\<FF>'\<rparr> : \<FF>' \<mapsto>\<^bsub>?FUNCT\<^esub> \<FF>'" if "\<FF>' \<in>\<^sub>\<circ> ?FUNCT\<lparr>Obj\<rparr>" for \<FF>'
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<FF>'\<rparr> : \<FF>' \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> \<FF>'
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<FF>'\<rparr> : \<FF>' \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> \<FF>'
[PROOF STEP]
from that
[PROOF STATE]
proof (chain)
picking this:
\<FF>' \<in>\<^sub>\<circ> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>Obj\<rparr>
[PROOF STEP]
obtain \<FF> where \<FF>'_def: "\<FF>' = cf_map \<FF>" and \<FF>: "\<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>"
[PROOF STATE]
proof (prove)
using this:
\<FF>' \<in>\<^sub>\<circ> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>Obj\<rparr>

goal (1 subgoal):
 1. (\<And>\<FF>. \<lbrakk>\<FF>' = cf_map \<FF>; \<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding cat_FUNCT_components
[PROOF STATE]
proof (prove)
using this:
\<FF>' \<in>\<^sub>\<circ> cf_maps \<alpha> \<AA> \<BB>

goal (1 subgoal):
 1. (\<And>\<FF>. \<lbrakk>\<FF>' = cf_map \<FF>; \<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by clarsimp
[PROOF STATE]
proof (state)
this:
\<FF>' = cf_map \<FF>
\<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>

goal (1 subgoal):
 1. cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<FF>'\<rparr> : \<FF>' \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> \<FF>'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<FF>'\<rparr> : \<FF>' \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> \<FF>'
[PROOF STEP]
using that \<FF>
[PROOF STATE]
proof (prove)
using this:
\<FF>' \<in>\<^sub>\<circ> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>Obj\<rparr>
\<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>

goal (1 subgoal):
 1. cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<FF>'\<rparr> : \<FF>' \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> \<FF>'
[PROOF STEP]
unfolding cat_FUNCT_components(1) \<FF>'_def
[PROOF STATE]
proof (prove)
using this:
cf_map \<FF> \<in>\<^sub>\<circ> cf_maps \<alpha> \<AA> \<BB>
\<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>

goal (1 subgoal):
 1. cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>cf_map \<FF>\<rparr> : cf_map \<FF> \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> cf_map \<FF>
[PROOF STEP]
by
        (
          cs_concl cs_shallow
            cs_simp: cat_FUNCT_cs_simps
            cs_intro: cat_cs_intros cat_FUNCT_cs_intros
        )
[PROOF STATE]
proof (state)
this:
cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<FF>'\<rparr> : \<FF>' \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> \<FF>'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?\<FF>' \<in>\<^sub>\<circ> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>Obj\<rparr> \<Longrightarrow> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>?\<FF>'\<rparr> : ?\<FF>' \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> ?\<FF>'

goal (5 subgoals):
 1. \<Z> \<beta>
 2. vsv (cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>)
 3. \<D>\<^sub>\<circ> (cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>) = cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>Obj\<rparr>
 4. \<And>a b f. f : a \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> b \<Longrightarrow> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>b\<rparr> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> f = f
 5. \<And>b c f. f : b \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> c \<Longrightarrow> f \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>b\<rparr> = f
[PROOF STEP]
show "?FUNCT\<lparr>CId\<rparr>\<lparr>\<GG>\<rparr> \<circ>\<^sub>A\<^bsub>?FUNCT\<^esub> \<NN> = \<NN>" if "\<NN> : \<FF> \<mapsto>\<^bsub>?FUNCT\<^esub> \<GG>" for \<NN> \<FF> \<GG>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<GG>\<rparr> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> \<NN> = \<NN>
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<GG>\<rparr> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> \<NN> = \<NN>
[PROOF STEP]
from that
[PROOF STATE]
proof (chain)
picking this:
\<NN> : \<FF> \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> \<GG>
[PROOF STEP]
obtain \<NN>' \<FF>' \<GG>'
      where \<NN>': "\<NN>' : \<FF>' \<mapsto>\<^sub>C\<^sub>F \<GG>' : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>"
        and \<NN>_def[cat_FUNCT_cs_simps]: "\<NN> = ntcf_arrow \<NN>'"
        and \<FF>_def[cat_FUNCT_cs_simps]: "\<FF> = cf_map \<FF>'"
        and \<GG>_def[cat_FUNCT_cs_simps]: "\<GG> = cf_map \<GG>'"
[PROOF STATE]
proof (prove)
using this:
\<NN> : \<FF> \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> \<GG>

goal (1 subgoal):
 1. (\<And>\<FF>' \<GG>' \<NN>'. \<lbrakk>\<NN>' : \<FF>' \<mapsto>\<^sub>C\<^sub>F \<GG>' : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>; \<NN> = ntcf_arrow \<NN>'; \<FF> = cf_map \<FF>'; \<GG> = cf_map \<GG>'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<NN>' : \<FF>' \<mapsto>\<^sub>C\<^sub>F \<GG>' : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>
\<NN> = ntcf_arrow \<NN>'
\<FF> = cf_map \<FF>'
\<GG> = cf_map \<GG>'

goal (1 subgoal):
 1. cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<GG>\<rparr> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> \<NN> = \<NN>
[PROOF STEP]
from \<NN>'
[PROOF STATE]
proof (chain)
picking this:
\<NN>' : \<FF>' \<mapsto>\<^sub>C\<^sub>F \<GG>' : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>
[PROOF STEP]
show "cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<GG>\<rparr> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> \<NN> = \<NN>"
[PROOF STATE]
proof (prove)
using this:
\<NN>' : \<FF>' \<mapsto>\<^sub>C\<^sub>F \<GG>' : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>

goal (1 subgoal):
 1. cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<GG>\<rparr> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> \<NN> = \<NN>
[PROOF STEP]
by
        (
          cs_concl
            cs_simp: cat_FUNCT_cs_simps cat_cs_simps
            cs_intro: cat_cs_intros cat_FUNCT_cs_intros
        )
[PROOF STATE]
proof (state)
this:
cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<GG>\<rparr> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> \<NN> = \<NN>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?\<NN> : ?\<FF> \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> ?\<GG> \<Longrightarrow> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>?\<GG>\<rparr> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> ?\<NN> = ?\<NN>

goal (4 subgoals):
 1. \<Z> \<beta>
 2. vsv (cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>)
 3. \<D>\<^sub>\<circ> (cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>) = cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>Obj\<rparr>
 4. \<And>b c f. f : b \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> c \<Longrightarrow> f \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>b\<rparr> = f
[PROOF STEP]
show "\<NN> \<circ>\<^sub>A\<^bsub>?FUNCT\<^esub> ?FUNCT\<lparr>CId\<rparr>\<lparr>\<GG>\<rparr> = \<NN>" if "\<NN> : \<GG> \<mapsto>\<^bsub>?FUNCT\<^esub> \<HH>" for \<NN> \<GG> \<HH>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<NN> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<GG>\<rparr> = \<NN>
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<NN> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<GG>\<rparr> = \<NN>
[PROOF STEP]
note \<NN> = cat_FUNCT_is_arrD[OF that]
[PROOF STATE]
proof (state)
this:
ntcf_of_ntcf_arrow \<AA> \<BB> \<NN> : cf_of_cf_map \<AA> \<BB> \<GG> \<mapsto>\<^sub>C\<^sub>F cf_of_cf_map \<AA> \<BB> \<HH> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>
\<NN> = ntcf_arrow (ntcf_of_ntcf_arrow \<AA> \<BB> \<NN>)
\<GG> = cf_map (cf_of_cf_map \<AA> \<BB> \<GG>)
\<HH> = cf_map (cf_of_cf_map \<AA> \<BB> \<HH>)

goal (1 subgoal):
 1. \<NN> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<GG>\<rparr> = \<NN>
[PROOF STEP]
from \<NN>(1)
[PROOF STATE]
proof (chain)
picking this:
ntcf_of_ntcf_arrow \<AA> \<BB> \<NN> : cf_of_cf_map \<AA> \<BB> \<GG> \<mapsto>\<^sub>C\<^sub>F cf_of_cf_map \<AA> \<BB> \<HH> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>
[PROOF STEP]
show "\<NN> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<GG>\<rparr> = \<NN>"
[PROOF STATE]
proof (prove)
using this:
ntcf_of_ntcf_arrow \<AA> \<BB> \<NN> : cf_of_cf_map \<AA> \<BB> \<GG> \<mapsto>\<^sub>C\<^sub>F cf_of_cf_map \<AA> \<BB> \<HH> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>

goal (1 subgoal):
 1. \<NN> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<GG>\<rparr> = \<NN>
[PROOF STEP]
by (subst (1 2) \<NN>(2), subst \<NN>(3), remdups)
        (
          cs_concl
            cs_simp: cat_FUNCT_cs_simps cat_cs_simps
            cs_intro: cat_cs_intros cat_FUNCT_cs_intros
        )
[PROOF STATE]
proof (state)
this:
\<NN> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>\<GG>\<rparr> = \<NN>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?\<NN> : ?\<GG> \<mapsto>\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> ?\<HH> \<Longrightarrow> ?\<NN> \<circ>\<^sub>A\<^bsub>cat_FUNCT \<alpha> \<AA> \<BB>\<^esub> cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>\<lparr>?\<GG>\<rparr> = ?\<NN>

goal (3 subgoals):
 1. \<Z> \<beta>
 2. vsv (cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>)
 3. \<D>\<^sub>\<circ> (cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>CId\<rparr>) = cat_FUNCT \<alpha> \<AA> \<BB>\<lparr>Obj\<rparr>
[PROOF STEP]
qed (simp_all add: assms cat_FUNCT_components)


[STATEMENT]
lemma "P \<and> Q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<and> Q
[PROOF STEP]
apply match_test'?
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<and> Q
[PROOF STEP]
oops


[STATEMENT]
lemma is_satis_g_restrict:
  fixes \<Gamma>'::\<Gamma> and \<Gamma>::\<Gamma>
  assumes "toSet \<Gamma> \<subseteq> toSet \<Gamma>'" and "i' \<Turnstile> \<Gamma>'" and  "i =   i' |` (fst ` toSet \<Gamma>)"  and "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f \<Gamma>"
  shows "i \<Turnstile> \<Gamma>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1.  i \<Turnstile> \<Gamma>
[PROOF STEP]
using assms is_satis_g_restrict1[OF assms(1) assms(2)] is_satis_g_restrict2[OF _ assms(3)]
[PROOF STATE]
proof (prove)
using this:
toSet \<Gamma> \<subseteq> toSet \<Gamma>'
 i' \<Turnstile> \<Gamma>'
i = i' |` (fst ` toSet \<Gamma>)
 \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f \<Gamma>
 i' \<Turnstile> \<Gamma>
\<lbrakk> i' \<Turnstile> ?\<Gamma> ; atom_dom ?\<Gamma> \<subseteq> atom ` fst ` toSet \<Gamma>;  ?\<Theta> ; ?B  \<turnstile>\<^sub>w\<^sub>f ?\<Gamma> \<rbrakk> \<Longrightarrow>  i \<Turnstile> ?\<Gamma>

goal (1 subgoal):
 1.  i \<Turnstile> \<Gamma>
[PROOF STEP]
by simp


[STATEMENT]
lemma WODNonInterference:
  "NonInterferenceIntra src trg knd
     (lift_valid_edge (valid_edge prog) sourcenode targetnode kind
       (_Entry_) (_Exit_))
     NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L)
     (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id
     (CFG_wf.wod_backward_slice src trg
       (lift_valid_edge (valid_edge prog) sourcenode targetnode kind
         (_Entry_) (_Exit_))
       (lift_Def (Defs prog) (_Entry_) (_Exit_) H L)
       (lift_Use (Uses prog) (_Entry_) (_Exit_) H L))
     reds (labels_LDCFG_nodes prog)
     NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_)) final"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. NonInterferenceIntra src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id (CFG_wf.wod_backward_slice src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L)) reds (labels_LDCFG_nodes prog) NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_)) final
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. NonInterferenceIntra src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id (CFG_wf.wod_backward_slice src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L)) reds (labels_LDCFG_nodes prog) NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_)) final
[PROOF STEP]
interpret NonInterferenceIntraGraph src trg knd
     "lift_valid_edge (valid_edge prog) sourcenode targetnode kind
       (_Entry_) (_Exit_)"
     NewEntry "lift_Def (Defs prog) (_Entry_) (_Exit_) H L"
     "lift_Use (Uses prog) (_Entry_) (_Exit_) H L" id
     "CFG_wf.wod_backward_slice src trg
       (lift_valid_edge (valid_edge prog) sourcenode targetnode kind
         (_Entry_) (_Exit_))
       (lift_Def (Defs prog) (_Entry_) (_Exit_) H L)
       (lift_Use (Uses prog) (_Entry_) (_Exit_) H L)"
     NewExit H L "LDCFG_node.Node (_Entry_)" "LDCFG_node.Node (_Exit_)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. NonInterferenceIntraGraph src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id (CFG_wf.wod_backward_slice src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L)) NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_))
[PROOF STEP]
by(rule WODNonInterferenceGraph)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. NonInterferenceIntra src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id wod_backward_slice reds (labels_LDCFG_nodes prog) NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_)) final
[PROOF STEP]
interpret BackwardSlice_wf src trg knd
    "lift_valid_edge (valid_edge prog) sourcenode targetnode kind
      (_Entry_) (_Exit_)"
    NewEntry "lift_Def (Defs prog) (_Entry_) (_Exit_) H L"
    "lift_Use (Uses prog) (_Entry_) (_Exit_) H L" id
    "CFG_wf.wod_backward_slice src trg
       (lift_valid_edge (valid_edge prog) sourcenode targetnode kind
         (_Entry_) (_Exit_))
       (lift_Def (Defs prog) (_Entry_) (_Exit_) H L)
       (lift_Use (Uses prog) (_Entry_) (_Exit_) H L)" reds "labels_LDCFG_nodes prog"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. BackwardSlice_wf src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id wod_backward_slice reds (labels_LDCFG_nodes prog)
[PROOF STEP]
proof(unfold_locales)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n c s c' s'. \<lbrakk>labels_LDCFG_nodes prog n c; \<langle>c,s\<rangle> \<rightarrow>* \<langle>c',s'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>n' as. local.path n as n' \<and> transfers (kinds as) s = s' \<and> preds (kinds as) s \<and> labels_LDCFG_nodes prog n' c'
[PROOF STEP]
fix n c s c' s'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n c s c' s'. \<lbrakk>labels_LDCFG_nodes prog n c; \<langle>c,s\<rangle> \<rightarrow>* \<langle>c',s'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>n' as. local.path n as n' \<and> transfers (kinds as) s = s' \<and> preds (kinds as) s \<and> labels_LDCFG_nodes prog n' c'
[PROOF STEP]
assume "labels_LDCFG_nodes prog n c" and "\<langle>c,s\<rangle> \<rightarrow>* \<langle>c',s'\<rangle>"
[PROOF STATE]
proof (state)
this:
labels_LDCFG_nodes prog n c
\<langle>c,s\<rangle> \<rightarrow>* \<langle>c',s'\<rangle>

goal (1 subgoal):
 1. \<And>n c s c' s'. \<lbrakk>labels_LDCFG_nodes prog n c; \<langle>c,s\<rangle> \<rightarrow>* \<langle>c',s'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>n' as. local.path n as n' \<and> transfers (kinds as) s = s' \<and> preds (kinds as) s \<and> labels_LDCFG_nodes prog n' c'
[PROOF STEP]
thus "\<exists>n' as. CFG.path src trg
     (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_))
      n as n' \<and> transfers (CFG.kinds knd as) s = s' \<and>
      preds (CFG.kinds knd as) s \<and> labels_LDCFG_nodes prog n' c'"
[PROOF STATE]
proof (prove)
using this:
labels_LDCFG_nodes prog n c
\<langle>c,s\<rangle> \<rightarrow>* \<langle>c',s'\<rangle>

goal (1 subgoal):
 1. \<exists>n' as. local.path n as n' \<and> transfers (kinds as) s = s' \<and> preds (kinds as) s \<and> labels_LDCFG_nodes prog n' c'
[PROOF STEP]
by(rule lifted_CFG_fund_prop)
[PROOF STATE]
proof (state)
this:
\<exists>n' as. local.path n as n' \<and> transfers (kinds as) s = s' \<and> preds (kinds as) s \<and> labels_LDCFG_nodes prog n' c'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. NonInterferenceIntra src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id wod_backward_slice reds (labels_LDCFG_nodes prog) NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_)) final
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. NonInterferenceIntra src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id wod_backward_slice reds (labels_LDCFG_nodes prog) NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_)) final
[PROOF STEP]
proof(unfold_locales)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>c n. \<lbrakk>final c; labels_LDCFG_nodes prog n c\<rbrakk> \<Longrightarrow> \<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id
[PROOF STEP]
fix c n
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>c n. \<lbrakk>final c; labels_LDCFG_nodes prog n c\<rbrakk> \<Longrightarrow> \<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id
[PROOF STEP]
assume "final c" and "labels_LDCFG_nodes prog n c"
[PROOF STATE]
proof (state)
this:
final c
labels_LDCFG_nodes prog n c

goal (1 subgoal):
 1. \<And>c n. \<lbrakk>final c; labels_LDCFG_nodes prog n c\<rbrakk> \<Longrightarrow> \<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id
[PROOF STEP]
from \<open>final c\<close>
[PROOF STATE]
proof (chain)
picking this:
final c
[PROOF STEP]
have [simp]:"c = Skip"
[PROOF STATE]
proof (prove)
using this:
final c

goal (1 subgoal):
 1. c = Skip
[PROOF STEP]
by(cases c) auto
[PROOF STATE]
proof (state)
this:
c = Skip

goal (1 subgoal):
 1. \<And>c n. \<lbrakk>final c; labels_LDCFG_nodes prog n c\<rbrakk> \<Longrightarrow> \<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id
[PROOF STEP]
from \<open>labels_LDCFG_nodes prog n c\<close>
[PROOF STATE]
proof (chain)
picking this:
labels_LDCFG_nodes prog n c
[PROOF STEP]
obtain nx where [simp]:"n = Node nx"
      and "labels_nodes prog nx Skip"
[PROOF STATE]
proof (prove)
using this:
labels_LDCFG_nodes prog n c

goal (1 subgoal):
 1. (\<And>nx. \<lbrakk>n = LDCFG_node.Node nx; labels_nodes prog nx Skip\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(cases n) auto
[PROOF STATE]
proof (state)
this:
n = LDCFG_node.Node nx
labels_nodes prog nx Skip

goal (1 subgoal):
 1. \<And>c n. \<lbrakk>final c; labels_LDCFG_nodes prog n c\<rbrakk> \<Longrightarrow> \<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id
[PROOF STEP]
from \<open>labels_nodes prog nx Skip\<close>
[PROOF STATE]
proof (chain)
picking this:
labels_nodes prog nx Skip
[PROOF STEP]
have "prog \<turnstile> nx -\<Up>id\<rightarrow> (_Exit_)"
[PROOF STATE]
proof (prove)
using this:
labels_nodes prog nx Skip

goal (1 subgoal):
 1. prog \<turnstile> nx -\<Up>id\<rightarrow> (_Exit_)
[PROOF STEP]
by(rule final_edge)
[PROOF STATE]
proof (state)
this:
prog \<turnstile> nx -\<Up>id\<rightarrow> (_Exit_)

goal (1 subgoal):
 1. \<And>c n. \<lbrakk>final c; labels_LDCFG_nodes prog n c\<rbrakk> \<Longrightarrow> \<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
prog \<turnstile> nx -\<Up>id\<rightarrow> (_Exit_)
[PROOF STEP]
obtain a where "valid_edge prog a" and "sourcenode a = nx"
      and "kind a = \<Up>id" and "targetnode a = (_Exit_)"
[PROOF STATE]
proof (prove)
using this:
prog \<turnstile> nx -\<Up>id\<rightarrow> (_Exit_)

goal (1 subgoal):
 1. (\<And>a. \<lbrakk>valid_edge prog a; sourcenode a = nx; kind a = \<Up>id; targetnode a = (_Exit_)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(auto simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
valid_edge prog a
sourcenode a = nx
kind a = \<Up>id
targetnode a = (_Exit_)

goal (1 subgoal):
 1. \<And>c n. \<lbrakk>final c; labels_LDCFG_nodes prog n c\<rbrakk> \<Longrightarrow> \<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id
[PROOF STEP]
with \<open>labels_nodes prog nx Skip\<close>
[PROOF STATE]
proof (chain)
picking this:
labels_nodes prog nx Skip
valid_edge prog a
sourcenode a = nx
kind a = \<Up>id
targetnode a = (_Exit_)
[PROOF STEP]
show "\<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode
      kind (_Entry_) (_Exit_) a \<and>
      src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id"
[PROOF STATE]
proof (prove)
using this:
labels_nodes prog nx Skip
valid_edge prog a
sourcenode a = nx
kind a = \<Up>id
targetnode a = (_Exit_)

goal (1 subgoal):
 1. \<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id
[PROOF STEP]
by(rule_tac x="(Node nx,\<Up>id,Node (_Exit_))" in exI)
        (auto intro!:lve_edge simp:knd_def valid_edge_def)
[PROOF STATE]
proof (state)
this:
\<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
NonInterferenceIntra src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id wod_backward_slice reds (labels_LDCFG_nodes prog) NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_)) final

goal:
No subgoals!
[PROOF STEP]
qed