[STATEMENT]
lemma constructive_security_obsf_sim_cong:
  assumes sec: "constructive_security_obsf real_resource ideal_resource sim \<I>_real \<I>_ideal \<I>_common \<A> adv"
    and cong: "\<I>_real, \<I>_ideal \<turnstile>\<^sub>C sim \<sim> sim'"
    and pfinite [pfinite_intro]: "pfinite_converter \<I>_real \<I>_ideal sim'" (* This could probably be derived from cong and sec.pfinite_sim *)
  shows "constructive_security_obsf real_resource ideal_resource sim' \<I>_real \<I>_ideal \<I>_common \<A> adv"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. constructive_security_obsf real_resource ideal_resource sim' \<I>_real \<I>_ideal \<I>_common \<A> adv
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<I>_real \<oplus>\<^sub>\<I> \<I>_common \<turnstile>res real_resource \<surd>
 2. \<I>_ideal \<oplus>\<^sub>\<I> \<I>_common \<turnstile>res ideal_resource \<surd>
 3. \<I>_real, \<I>_ideal \<turnstile>\<^sub>C sim' \<surd>
 4. pfinite_converter \<I>_real \<I>_ideal sim'
 5. 0 \<le> adv
 6. exception_\<I> (\<I>_real \<oplus>\<^sub>\<I> \<I>_common) \<turnstile>g \<A> \<surd> \<Longrightarrow> advantage \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) (obsf_resource real_resource) \<le> adv
[PROOF STEP]
interpret constructive_security_obsf real_resource ideal_resource sim \<I>_real \<I>_ideal \<I>_common \<A> adv
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. constructive_security_obsf real_resource ideal_resource sim \<I>_real \<I>_ideal \<I>_common \<A> adv
[PROOF STEP]
by fact
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<I>_real \<oplus>\<^sub>\<I> \<I>_common \<turnstile>res real_resource \<surd>
 2. \<I>_ideal \<oplus>\<^sub>\<I> \<I>_common \<turnstile>res ideal_resource \<surd>
 3. \<I>_real, \<I>_ideal \<turnstile>\<^sub>C sim' \<surd>
 4. pfinite_converter \<I>_real \<I>_ideal sim'
 5. 0 \<le> adv
 6. exception_\<I> (\<I>_real \<oplus>\<^sub>\<I> \<I>_common) \<turnstile>g \<A> \<surd> \<Longrightarrow> advantage \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) (obsf_resource real_resource) \<le> adv
[PROOF STEP]
show "\<I>_real \<oplus>\<^sub>\<I> \<I>_common \<turnstile>res real_resource \<surd>" "\<I>_ideal \<oplus>\<^sub>\<I> \<I>_common \<turnstile>res ideal_resource \<surd>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<I>_real \<oplus>\<^sub>\<I> \<I>_common \<turnstile>res real_resource \<surd> &&& \<I>_ideal \<oplus>\<^sub>\<I> \<I>_common \<turnstile>res ideal_resource \<surd>
[PROOF STEP]
by(rule WT_intro)+
[PROOF STATE]
proof (state)
this:
\<I>_real \<oplus>\<^sub>\<I> \<I>_common \<turnstile>res real_resource \<surd>
\<I>_ideal \<oplus>\<^sub>\<I> \<I>_common \<turnstile>res ideal_resource \<surd>

goal (4 subgoals):
 1. \<I>_real, \<I>_ideal \<turnstile>\<^sub>C sim' \<surd>
 2. pfinite_converter \<I>_real \<I>_ideal sim'
 3. 0 \<le> adv
 4. exception_\<I> (\<I>_real \<oplus>\<^sub>\<I> \<I>_common) \<turnstile>g \<A> \<surd> \<Longrightarrow> advantage \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) (obsf_resource real_resource) \<le> adv
[PROOF STEP]
from cong
[PROOF STATE]
proof (chain)
picking this:
\<I>_real,\<I>_ideal \<turnstile>\<^sub>C sim \<sim> sim'
[PROOF STEP]
show [WT_intro]: "\<I>_real, \<I>_ideal \<turnstile>\<^sub>C sim' \<surd>"
[PROOF STATE]
proof (prove)
using this:
\<I>_real,\<I>_ideal \<turnstile>\<^sub>C sim \<sim> sim'

goal (1 subgoal):
 1. \<I>_real, \<I>_ideal \<turnstile>\<^sub>C sim' \<surd>
[PROOF STEP]
by(rule eq_\<I>_converterD_WT1)(rule WT_intro)
[PROOF STATE]
proof (state)
this:
\<I>_real, \<I>_ideal \<turnstile>\<^sub>C sim' \<surd>

goal (3 subgoals):
 1. pfinite_converter \<I>_real \<I>_ideal sim'
 2. 0 \<le> adv
 3. exception_\<I> (\<I>_real \<oplus>\<^sub>\<I> \<I>_common) \<turnstile>g \<A> \<surd> \<Longrightarrow> advantage \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) (obsf_resource real_resource) \<le> adv
[PROOF STEP]
show "pfinite_converter \<I>_real \<I>_ideal sim'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pfinite_converter \<I>_real \<I>_ideal sim'
[PROOF STEP]
by fact
[PROOF STATE]
proof (state)
this:
pfinite_converter \<I>_real \<I>_ideal sim'

goal (2 subgoals):
 1. 0 \<le> adv
 2. exception_\<I> (\<I>_real \<oplus>\<^sub>\<I> \<I>_common) \<turnstile>g \<A> \<surd> \<Longrightarrow> advantage \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) (obsf_resource real_resource) \<le> adv
[PROOF STEP]
show "0 \<le> adv"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> adv
[PROOF STEP]
by(rule adv_nonneg)
[PROOF STATE]
proof (state)
this:
0 \<le> adv

goal (1 subgoal):
 1. exception_\<I> (\<I>_real \<oplus>\<^sub>\<I> \<I>_common) \<turnstile>g \<A> \<surd> \<Longrightarrow> advantage \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) (obsf_resource real_resource) \<le> adv
[PROOF STEP]
assume WT [WT_intro]: "exception_\<I> (\<I>_real \<oplus>\<^sub>\<I> \<I>_common) \<turnstile>g \<A> \<surd>"
[PROOF STATE]
proof (state)
this:
exception_\<I> (\<I>_real \<oplus>\<^sub>\<I> \<I>_common) \<turnstile>g \<A> \<surd>

goal (1 subgoal):
 1. exception_\<I> (\<I>_real \<oplus>\<^sub>\<I> \<I>_common) \<turnstile>g \<A> \<surd> \<Longrightarrow> advantage \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) (obsf_resource real_resource) \<le> adv
[PROOF STEP]
have "connect_obsf \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) = connect_obsf \<A> (obsf_resource (sim |\<^sub>= 1\<^sub>C \<rhd> ideal_resource))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. connect_obsf \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) = connect_obsf \<A> (obsf_resource (sim |\<^sub>= 1\<^sub>C \<rhd> ideal_resource))
[PROOF STEP]
by(rule connect_eq_resource_cong WT_intro obsf_resource_eq_\<I>_cong eq_\<I>_attach_on' parallel_converter2_eq_\<I>_cong cong[symmetric] eq_\<I>_converter_reflI | simp)+
[PROOF STATE]
proof (state)
this:
connect_obsf \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) = connect_obsf \<A> (obsf_resource (sim |\<^sub>= 1\<^sub>C \<rhd> ideal_resource))

goal (1 subgoal):
 1. exception_\<I> (\<I>_real \<oplus>\<^sub>\<I> \<I>_common) \<turnstile>g \<A> \<surd> \<Longrightarrow> advantage \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) (obsf_resource real_resource) \<le> adv
[PROOF STEP]
with adv[OF WT]
[PROOF STATE]
proof (chain)
picking this:
advantage \<A> (obsf_resource (sim |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) (obsf_resource real_resource) \<le> adv
connect_obsf \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) = connect_obsf \<A> (obsf_resource (sim |\<^sub>= 1\<^sub>C \<rhd> ideal_resource))
[PROOF STEP]
show "advantage \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) (obsf_resource real_resource) \<le> adv"
[PROOF STATE]
proof (prove)
using this:
advantage \<A> (obsf_resource (sim |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) (obsf_resource real_resource) \<le> adv
connect_obsf \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) = connect_obsf \<A> (obsf_resource (sim |\<^sub>= 1\<^sub>C \<rhd> ideal_resource))

goal (1 subgoal):
 1. advantage \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) (obsf_resource real_resource) \<le> adv
[PROOF STEP]
unfolding advantage_def
[PROOF STATE]
proof (prove)
using this:
\<bar>spmf (connect_obsf \<A> (obsf_resource (sim |\<^sub>= 1\<^sub>C \<rhd> ideal_resource))) True - spmf (connect_obsf \<A> (obsf_resource real_resource)) True\<bar> \<le> adv
connect_obsf \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) = connect_obsf \<A> (obsf_resource (sim |\<^sub>= 1\<^sub>C \<rhd> ideal_resource))

goal (1 subgoal):
 1. \<bar>spmf (connect_obsf \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource))) True - spmf (connect_obsf \<A> (obsf_resource real_resource)) True\<bar> \<le> adv
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
advantage \<A> (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) (obsf_resource real_resource) \<le> adv

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma logical_instr_privilege:
assumes a1: "s' = snd (fst (logical_instr instr
  (s::(('a::len) sparc_state))))
  \<and> (((get_S (cpu_reg_val PSR s)))::word1) = 0"
shows "(((get_S (cpu_reg_val PSR s')))::word1) = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. get_S (cpu_reg_val PSR s') = 0
[PROOF STEP]
using a1
[PROOF STATE]
proof (prove)
using this:
s' = snd (fst (logical_instr instr s)) \<and> get_S (cpu_reg_val PSR s) = 0

goal (1 subgoal):
 1. get_S (cpu_reg_val PSR s') = 0
[PROOF STEP]
apply (simp add: logical_instr_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s' = snd (fst ((let instr_name = fst instr; op_list = snd instr; rd = get_operand_w5 (op_list ! 3) in do operand2 \<leftarrow> gets (get_operand2 op_list);
curr_win \<leftarrow> get_curr_win ();
rs1_val \<leftarrow> gets (user_reg_val curr_win (get_operand_w5 (op_list ! Suc 0)));
rd_val \<leftarrow> gets (user_reg_val curr_win rd);
y \<leftarrow> write_reg (if rd \<noteq> 0 then logical_result instr_name rs1_val operand2 else rd_val) curr_win rd;
logical_instr_sub1 instr_name (logical_result instr_name rs1_val operand2)
od) s)) \<and> get_S (cpu_reg_val PSR s) = 0 \<Longrightarrow> get_S (cpu_reg_val PSR (snd (fst ((let instr_name = fst instr; op_list = snd instr; rd = get_operand_w5 (op_list ! 3) in do operand2 \<leftarrow> gets (get_operand2 op_list);
curr_win \<leftarrow> get_curr_win ();
rs1_val \<leftarrow> gets (user_reg_val curr_win (get_operand_w5 (op_list ! Suc 0)));
rd_val \<leftarrow> gets (user_reg_val curr_win rd);
y \<leftarrow> write_reg (if rd \<noteq> 0 then logical_result instr_name rs1_val operand2 else rd_val) curr_win rd;
logical_instr_sub1 instr_name (logical_result instr_name rs1_val operand2)
od) s)))) = 0
[PROOF STEP]
apply (simp add: Let_def simpler_gets_def bind_def h1_def h2_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s' = snd (fst (case fst (get_curr_win () s) of (a, b) \<Rightarrow> (fst (case fst (write_reg (if get_operand_w5 (snd instr ! 3) \<noteq> 0 then logical_result (fst instr) (user_reg_val a (get_operand_w5 (snd instr ! Suc 0)) b) (get_operand2 (snd instr) s) else user_reg_val a (get_operand_w5 (snd instr ! 3)) b) a (get_operand_w5 (snd instr ! 3)) b) of (aa, x) \<Rightarrow> logical_instr_sub1 (fst instr) (logical_result (fst instr) (user_reg_val a (get_operand_w5 (snd instr ! Suc 0)) b) (get_operand2 (snd instr) s)) x), snd (case fst (write_reg (if get_operand_w5 (snd instr ! 3) \<noteq> 0 then logical_result (fst instr) (user_reg_val a (get_operand_w5 (snd instr ! Suc 0)) b) (get_operand2 (snd instr) s) else user_reg_val a (get_operand_w5 (snd instr ! 3)) b) a (get_operand_w5 (snd instr ! 3)) b) of (aa, x) \<Rightarrow> logical_instr_sub1 (fst instr) (logical_result (fst instr) (user_reg_val a (get_operand_w5 (snd instr ! Suc 0)) b) (get_operand2 (snd instr) s)) x) \<or> snd (write_reg (if get_operand_w5 (snd instr ! 3) \<noteq> 0 then logical_result (fst instr) (user_reg_val a (get_operand_w5 (snd instr ! Suc 0)) b) (get_operand2 (snd instr) s) else user_reg_val a (get_operand_w5 (snd instr ! 3)) b) a (get_operand_w5 (snd instr ! 3)) b)))) \<and> get_S (cpu_reg_val PSR s) = 0 \<Longrightarrow> get_S (cpu_reg_val PSR (snd (fst (case fst (get_curr_win () s) of (a, b) \<Rightarrow> (fst (case fst (write_reg (if get_operand_w5 (snd instr ! 3) \<noteq> 0 then logical_result (fst instr) (user_reg_val a (get_operand_w5 (snd instr ! Suc 0)) b) (get_operand2 (snd instr) s) else user_reg_val a (get_operand_w5 (snd instr ! 3)) b) a (get_operand_w5 (snd instr ! 3)) b) of (aa, x) \<Rightarrow> logical_instr_sub1 (fst instr) (logical_result (fst instr) (user_reg_val a (get_operand_w5 (snd instr ! Suc 0)) b) (get_operand2 (snd instr) s)) x), snd (case fst (write_reg (if get_operand_w5 (snd instr ! 3) \<noteq> 0 then logical_result (fst instr) (user_reg_val a (get_operand_w5 (snd instr ! Suc 0)) b) (get_operand2 (snd instr) s) else user_reg_val a (get_operand_w5 (snd instr ! 3)) b) a (get_operand_w5 (snd instr ! 3)) b) of (aa, x) \<Rightarrow> logical_instr_sub1 (fst instr) (logical_result (fst instr) (user_reg_val a (get_operand_w5 (snd instr ! Suc 0)) b) (get_operand2 (snd instr) s)) x) \<or> snd (write_reg (if get_operand_w5 (snd instr ! 3) \<noteq> 0 then logical_result (fst instr) (user_reg_val a (get_operand_w5 (snd instr ! Suc 0)) b) (get_operand2 (snd instr) s) else user_reg_val a (get_operand_w5 (snd instr ! 3)) b) a (get_operand_w5 (snd instr ! 3)) b)))))) = 0
[PROOF STEP]
apply (simp add: case_prod_unfold)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s' = snd (fst (logical_instr_sub1 (fst instr) (logical_result (fst instr) (user_reg_val (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! Suc 0)) (snd (fst (get_curr_win () s)))) (get_operand2 (snd instr) s)) (snd (fst (write_reg (if get_operand_w5 (snd instr ! 3) \<noteq> 0 then logical_result (fst instr) (user_reg_val (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! Suc 0)) (snd (fst (get_curr_win () s)))) (get_operand2 (snd instr) s) else user_reg_val (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! 3)) (snd (fst (get_curr_win () s)))) (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! 3)) (snd (fst (get_curr_win () s)))))))) \<and> get_S (cpu_reg_val PSR s) = 0 \<Longrightarrow> (get_operand_w5 (snd instr ! 3) \<noteq> 0 \<longrightarrow> get_S (cpu_reg_val PSR (snd (fst (logical_instr_sub1 (fst instr) (logical_result (fst instr) (user_reg_val (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! Suc 0)) (snd (fst (get_curr_win () s)))) (get_operand2 (snd instr) s)) (snd (fst (write_reg (logical_result (fst instr) (user_reg_val (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! Suc 0)) (snd (fst (get_curr_win () s)))) (get_operand2 (snd instr) s)) (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! 3)) (snd (fst (get_curr_win () s)))))))))) = 0) \<and> (get_operand_w5 (snd instr ! 3) = 0 \<longrightarrow> get_S (cpu_reg_val PSR (snd (fst (logical_instr_sub1 (fst instr) (logical_result (fst instr) (user_reg_val (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! Suc 0)) (snd (fst (get_curr_win () s)))) (get_operand2 (snd instr) s)) (snd (fst (write_reg (user_reg_val (fst (fst (get_curr_win () s))) 0 (snd (fst (get_curr_win () s)))) (fst (fst (get_curr_win () s))) 0 (snd (fst (get_curr_win () s)))))))))) = 0)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>s' = snd (fst (logical_instr_sub1 (fst instr) (logical_result (fst instr) (user_reg_val (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! Suc 0)) (snd (fst (get_curr_win () s)))) (get_operand2 (snd instr) s)) (snd (fst (write_reg (logical_result (fst instr) (user_reg_val (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! Suc 0)) (snd (fst (get_curr_win () s)))) (get_operand2 (snd instr) s)) (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! 3)) (snd (fst (get_curr_win () s)))))))); get_S (cpu_reg_val PSR s) = 0; get_operand_w5 (snd instr ! 3) \<noteq> 0\<rbrakk> \<Longrightarrow> get_S (cpu_reg_val PSR (snd (fst (logical_instr_sub1 (fst instr) (logical_result (fst instr) (user_reg_val (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! Suc 0)) (snd (fst (get_curr_win () s)))) (get_operand2 (snd instr) s)) (snd (fst (write_reg (logical_result (fst instr) (user_reg_val (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! Suc 0)) (snd (fst (get_curr_win () s)))) (get_operand2 (snd instr) s)) (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! 3)) (snd (fst (get_curr_win () s)))))))))) = 0
 2. \<lbrakk>s' = snd (fst (logical_instr_sub1 (fst instr) (logical_result (fst instr) (user_reg_val (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! Suc 0)) (snd (fst (get_curr_win () s)))) (get_operand2 (snd instr) s)) (snd (fst (write_reg (user_reg_val (fst (fst (get_curr_win () s))) 0 (snd (fst (get_curr_win () s)))) (fst (fst (get_curr_win () s))) 0 (snd (fst (get_curr_win () s)))))))); get_S (cpu_reg_val PSR s) = 0; get_operand_w5 (snd instr ! 3) = 0\<rbrakk> \<Longrightarrow> get_S (cpu_reg_val PSR (snd (fst (logical_instr_sub1 (fst instr) (logical_result (fst instr) (user_reg_val (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! Suc 0)) (snd (fst (get_curr_win () s)))) (get_operand2 (snd instr) s)) (snd (fst (write_reg (user_reg_val (fst (fst (get_curr_win () s))) 0 (snd (fst (get_curr_win () s)))) (fst (fst (get_curr_win () s))) 0 (snd (fst (get_curr_win () s)))))))))) = 0
[PROOF STEP]
apply (meson get_curr_win_privilege logical_instr_sub1_privilege write_reg_privilege)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>s' = snd (fst (logical_instr_sub1 (fst instr) (logical_result (fst instr) (user_reg_val (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! Suc 0)) (snd (fst (get_curr_win () s)))) (get_operand2 (snd instr) s)) (snd (fst (write_reg (user_reg_val (fst (fst (get_curr_win () s))) 0 (snd (fst (get_curr_win () s)))) (fst (fst (get_curr_win () s))) 0 (snd (fst (get_curr_win () s)))))))); get_S (cpu_reg_val PSR s) = 0; get_operand_w5 (snd instr ! 3) = 0\<rbrakk> \<Longrightarrow> get_S (cpu_reg_val PSR (snd (fst (logical_instr_sub1 (fst instr) (logical_result (fst instr) (user_reg_val (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! Suc 0)) (snd (fst (get_curr_win () s)))) (get_operand2 (snd instr) s)) (snd (fst (write_reg (user_reg_val (fst (fst (get_curr_win () s))) 0 (snd (fst (get_curr_win () s)))) (fst (fst (get_curr_win () s))) 0 (snd (fst (get_curr_win () s)))))))))) = 0
[PROOF STEP]
by (meson get_curr_win_privilege logical_instr_sub1_privilege write_reg_privilege)


[STATEMENT]
theorem abs_model_check_correct:
  "abs_model_check T1 T2 T3 T4 sys \<phi> \<le> do {
    ASSERT (sa sys);
    ASSERT (finite ((g_E sys)\<^sup>* `` g_V0 sys));
    SPEC (\<lambda>res. case res of
      None \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi>
    | Some None \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi>
    | Some (Some r) \<Rightarrow> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>)
  }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. abs_model_check T1 T2 T3 T4 sys \<phi> \<le> ASSERT (sa sys) \<bind> (\<lambda>_. ASSERT (finite ((g_E sys)\<^sup>* `` g_V0 sys)) \<bind> (\<lambda>_. SPEC (\<lambda>res. case res of None \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi> | Some None \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi> | Some (Some r) \<Rightarrow> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>)))
[PROOF STEP]
unfolding abs_model_check_def ltl_to_gba_spec_def inter_spec_def
    find_ce_spec_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. SPEC (\<lambda>gba. igba.lang gba = language_ltlc (not\<^sub>c \<phi>) \<and> igba gba \<and> finite ((g_E gba)\<^sup>* `` g_V0 gba)) \<bind> (\<lambda>gba. ASSERT (igba gba) \<bind> (\<lambda>_. ASSERT (sa sys) \<bind> (\<lambda>_. ASSERT (sa sys) \<bind> (\<lambda>_. ASSERT (finite ((g_E sys)\<^sup>* `` g_V0 sys)) \<bind> (\<lambda>_. ASSERT (igba gba) \<bind> (\<lambda>_. ASSERT (finite ((g_E gba)\<^sup>* `` g_V0 gba)) \<bind> (\<lambda>_. SPEC (\<lambda>(G, project). igb_graph G \<and> finite ((g_E G)\<^sup>* `` g_V0 G) \<and> (\<forall>r. (\<exists>r'. igb_graph.is_acc_run G r' \<and> r = project \<circ> r') = (graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<in> igba.lang gba))))))) \<bind> (\<lambda>(Gprod, map_state). ASSERT (igb_graph Gprod) \<bind> (\<lambda>_. ASSERT (igb_graph Gprod) \<bind> (\<lambda>_. ASSERT (finite ((g_E Gprod)\<^sup>* `` g_V0 Gprod)) \<bind> (\<lambda>_. SPEC (\<lambda>res. case res of None \<Rightarrow> \<forall>r. \<not> igb_graph.is_acc_run Gprod r | Some None \<Rightarrow> \<exists>r. igb_graph.is_acc_run Gprod r | Some (Some r) \<Rightarrow> igb_graph.is_acc_run Gprod r))) \<bind> (\<lambda>ce. case ce of None \<Rightarrow> RETURN None | Some None \<Rightarrow> RETURN (Some None) | Some (Some r) \<Rightarrow> RETURN (Some (Some (map_state \<circ> r))))))))) \<le> ASSERT (sa sys) \<bind> (\<lambda>_. ASSERT (finite ((g_E sys)\<^sup>* `` g_V0 sys)) \<bind> (\<lambda>_. SPEC (\<lambda>res. case res of None \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi> | Some None \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi> | Some (Some r) \<Rightarrow> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>)))
[PROOF STEP]
apply (refine_rcg refine_vcg ASSERT_leI le_ASSERTI)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>x. \<lbrakk>sa sys; finite ((g_E sys)\<^sup>* `` g_V0 sys); igba.lang x = language_ltlc (not\<^sub>c \<phi>) \<and> igba x \<and> finite ((g_E x)\<^sup>* `` g_V0 x)\<rbrakk> \<Longrightarrow> igba x
 2. \<And>x. \<lbrakk>sa sys; finite ((g_E sys)\<^sup>* `` g_V0 sys); igba.lang x = language_ltlc (not\<^sub>c \<phi>) \<and> igba x \<and> finite ((g_E x)\<^sup>* `` g_V0 x); igba x; sa sys; sa sys; finite ((g_E sys)\<^sup>* `` g_V0 sys); igba x\<rbrakk> \<Longrightarrow> finite ((g_E x)\<^sup>* `` g_V0 x)
 3. \<And>x xa a b. \<lbrakk>sa sys; finite ((g_E sys)\<^sup>* `` g_V0 sys); igba.lang x = language_ltlc (not\<^sub>c \<phi>) \<and> igba x \<and> finite ((g_E x)\<^sup>* `` g_V0 x); igba x; sa sys; sa sys; finite ((g_E sys)\<^sup>* `` g_V0 sys); igba x; finite ((g_E x)\<^sup>* `` g_V0 x); case xa of (G, project) \<Rightarrow> igb_graph G \<and> finite ((g_E G)\<^sup>* `` g_V0 G) \<and> (\<forall>r. (\<exists>r'. igb_graph.is_acc_run G r' \<and> r = project \<circ> r') = (graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<in> igba.lang x)); xa = (a, b)\<rbrakk> \<Longrightarrow> igb_graph a
 4. \<And>x xa a b. \<lbrakk>sa sys; finite ((g_E sys)\<^sup>* `` g_V0 sys); igba.lang x = language_ltlc (not\<^sub>c \<phi>) \<and> igba x \<and> finite ((g_E x)\<^sup>* `` g_V0 x); igba x; sa sys; sa sys; finite ((g_E sys)\<^sup>* `` g_V0 sys); igba x; finite ((g_E x)\<^sup>* `` g_V0 x); case xa of (G, project) \<Rightarrow> igb_graph G \<and> finite ((g_E G)\<^sup>* `` g_V0 G) \<and> (\<forall>r. (\<exists>r'. igb_graph.is_acc_run G r' \<and> r = project \<circ> r') = (graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<in> igba.lang x)); xa = (a, b); igb_graph a; igb_graph a\<rbrakk> \<Longrightarrow> finite ((g_E a)\<^sup>* `` g_V0 a)
 5. \<And>x xa a b xb. \<lbrakk>sa sys; finite ((g_E sys)\<^sup>* `` g_V0 sys); igba.lang x = language_ltlc (not\<^sub>c \<phi>) \<and> igba x \<and> finite ((g_E x)\<^sup>* `` g_V0 x); igba x; sa sys; sa sys; finite ((g_E sys)\<^sup>* `` g_V0 sys); igba x; finite ((g_E x)\<^sup>* `` g_V0 x); case xa of (G, project) \<Rightarrow> igb_graph G \<and> finite ((g_E G)\<^sup>* `` g_V0 G) \<and> (\<forall>r. (\<exists>r'. igb_graph.is_acc_run G r' \<and> r = project \<circ> r') = (graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<in> igba.lang x)); xa = (a, b); igb_graph a; igb_graph a; finite ((g_E a)\<^sup>* `` g_V0 a); case xb of None \<Rightarrow> \<forall>r. \<not> igb_graph.is_acc_run a r | Some None \<Rightarrow> \<exists>r. igb_graph.is_acc_run a r | Some (Some r) \<Rightarrow> igb_graph.is_acc_run a r; xb = None\<rbrakk> \<Longrightarrow> case None of None \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi> | Some None \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi> | Some (Some r) \<Rightarrow> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>
 6. \<And>x xa a b xb xc. \<lbrakk>sa sys; finite ((g_E sys)\<^sup>* `` g_V0 sys); igba.lang x = language_ltlc (not\<^sub>c \<phi>) \<and> igba x \<and> finite ((g_E x)\<^sup>* `` g_V0 x); igba x; sa sys; sa sys; finite ((g_E sys)\<^sup>* `` g_V0 sys); igba x; finite ((g_E x)\<^sup>* `` g_V0 x); case xa of (G, project) \<Rightarrow> igb_graph G \<and> finite ((g_E G)\<^sup>* `` g_V0 G) \<and> (\<forall>r. (\<exists>r'. igb_graph.is_acc_run G r' \<and> r = project \<circ> r') = (graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<in> igba.lang x)); xa = (a, b); igb_graph a; igb_graph a; finite ((g_E a)\<^sup>* `` g_V0 a); case xb of None \<Rightarrow> \<forall>r. \<not> igb_graph.is_acc_run a r | Some None \<Rightarrow> \<exists>r. igb_graph.is_acc_run a r | Some (Some r) \<Rightarrow> igb_graph.is_acc_run a r; xb = Some xc; xc = None\<rbrakk> \<Longrightarrow> case Some None of None \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi> | Some None \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi> | Some (Some r) \<Rightarrow> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>
 7. \<And>x xa a b xb xc xd. \<lbrakk>sa sys; finite ((g_E sys)\<^sup>* `` g_V0 sys); igba.lang x = language_ltlc (not\<^sub>c \<phi>) \<and> igba x \<and> finite ((g_E x)\<^sup>* `` g_V0 x); igba x; sa sys; sa sys; finite ((g_E sys)\<^sup>* `` g_V0 sys); igba x; finite ((g_E x)\<^sup>* `` g_V0 x); case xa of (G, project) \<Rightarrow> igb_graph G \<and> finite ((g_E G)\<^sup>* `` g_V0 G) \<and> (\<forall>r. (\<exists>r'. igb_graph.is_acc_run G r' \<and> r = project \<circ> r') = (graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<in> igba.lang x)); xa = (a, b); igb_graph a; igb_graph a; finite ((g_E a)\<^sup>* `` g_V0 a); case xb of None \<Rightarrow> \<forall>r. \<not> igb_graph.is_acc_run a r | Some None \<Rightarrow> \<exists>r. igb_graph.is_acc_run a r | Some (Some r) \<Rightarrow> igb_graph.is_acc_run a r; xb = Some xc; xc = Some xd\<rbrakk> \<Longrightarrow> case Some (Some (b \<circ> xd)) of None \<Rightarrow> sa.lang sys \<subseteq> language_ltlc \<phi> | Some None \<Rightarrow> \<not> sa.lang sys \<subseteq> language_ltlc \<phi> | Some (Some r) \<Rightarrow> graph_defs.is_run sys r \<and> sa_L sys \<circ> r \<notin> language_ltlc \<phi>
[PROOF STEP]
apply (auto simp: sa.lang_def
    sa.accept_def[THEN meta_eq_to_obj_eq, THEN ext[of "sa.accept sys"] ])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
(* TODO: We really need an extended abs_def attribute, that digests
      conditional definitions! *)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma valid_validn: "\<Turnstile> \<lbrace>A\<rbrace> C, m, l \<lbrace>B\<rbrace> I \<Longrightarrow> \<Turnstile>\<^sub>K \<lbrace>A\<rbrace> C, m, l \<lbrace>B\<rbrace> I"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1.  \<Turnstile> \<lbrace> A \<rbrace> C , m , l \<lbrace> B \<rbrace> I \<Longrightarrow> \<Turnstile>\<^sub>K \<lbrace> A \<rbrace> C , m , l \<lbrace> B \<rbrace> I
[PROOF STEP]
(*<*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1.  \<Turnstile> \<lbrace> A \<rbrace> C , m , l \<lbrace> B \<rbrace> I \<Longrightarrow> \<Turnstile>\<^sub>K \<lbrace> A \<rbrace> C , m , l \<lbrace> B \<rbrace> I
[PROOF STEP]
apply (simp add: valid_def validn_def Opsem_def MS_def Reach_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>a aa b. mbody_is C m (a, aa, b) \<longrightarrow> (\<forall>Mspec Minv Anno. MST\<down>(C, m) = Some (Mspec, Minv, Anno) \<longrightarrow> (\<forall>ab ba ac ad bb. (\<exists>k. ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep) \<longrightarrow> A (ab, ba) (ac, ad, bb) \<longrightarrow> (\<forall>h v. (\<exists>n. ((a, aa, b), l, (ac, ad, bb), n, h, v) \<in> Exec) \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ll, ae, af, bc) \<in> MStep) \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ae, af, bc) \<in> Reachable) \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc)))))) \<Longrightarrow> \<forall>a aa b. mbody_is C m (a, aa, b) \<longrightarrow> (\<forall>Mspec Minv Anno. MST\<down>(C, m) = Some (Mspec, Minv, Anno) \<longrightarrow> (\<forall>ab ba ac ad bb. (\<exists>k. ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep) \<longrightarrow> A (ab, ba) (ac, ad, bb) \<longrightarrow> (\<forall>k\<le>K. (\<forall>h v. ((a, aa, b), l, (ac, ad, bb), k, h, v) \<in> Exec \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. (((a, aa, b), l, (ac, ad, bb), k, ll, ae, af, bc) \<in> MStep \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> (((a, aa, b), l, (ac, ad, bb), k, ae, af, bc) \<in> Reachable \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc)))))))
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a aa b Mspec Minv Anno ab ba ac ad bb k ka. \<lbrakk>\<forall>a aa b. mbody_is C m (a, aa, b) \<longrightarrow> (\<forall>ab ba ac ad bb. (\<exists>k. ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep) \<longrightarrow> A (ab, ba) (ac, ad, bb) \<longrightarrow> (\<forall>h v. (\<exists>n. ((a, aa, b), l, (ac, ad, bb), n, h, v) \<in> Exec) \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ll, ae, af, bc) \<in> MStep) \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ae, af, bc) \<in> Reachable) \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))); mbody_is C m (a, aa, b); MST\<down>(C, m) = Some (Mspec, Minv, Anno); ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep; A (ab, ba) (ac, ad, bb); ka \<le> K\<rbrakk> \<Longrightarrow> (\<forall>h v. ((a, aa, b), l, (ac, ad, bb), ka, h, v) \<in> Exec \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. (((a, aa, b), l, (ac, ad, bb), ka, ll, ae, af, bc) \<in> MStep \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> (((a, aa, b), l, (ac, ad, bb), ka, ae, af, bc) \<in> Reachable \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))
[PROOF STEP]
apply (erule_tac x=a in allE)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a aa b Mspec Minv Anno ab ba ac ad bb k ka. \<lbrakk>mbody_is C m (a, aa, b); MST\<down>(C, m) = Some (Mspec, Minv, Anno); ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep; A (ab, ba) (ac, ad, bb); ka \<le> K; \<forall>aa b. mbody_is C m (a, aa, b) \<longrightarrow> (\<forall>ab ba ac ad bb. (\<exists>k. ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep) \<longrightarrow> A (ab, ba) (ac, ad, bb) \<longrightarrow> (\<forall>h v. (\<exists>n. ((a, aa, b), l, (ac, ad, bb), n, h, v) \<in> Exec) \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ll, ae, af, bc) \<in> MStep) \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ae, af, bc) \<in> Reachable) \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc)))))\<rbrakk> \<Longrightarrow> (\<forall>h v. ((a, aa, b), l, (ac, ad, bb), ka, h, v) \<in> Exec \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. (((a, aa, b), l, (ac, ad, bb), ka, ll, ae, af, bc) \<in> MStep \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> (((a, aa, b), l, (ac, ad, bb), ka, ae, af, bc) \<in> Reachable \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))
[PROOF STEP]
apply (erule_tac x=aa in allE)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a aa b Mspec Minv Anno ab ba ac ad bb k ka. \<lbrakk>mbody_is C m (a, aa, b); MST\<down>(C, m) = Some (Mspec, Minv, Anno); ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep; A (ab, ba) (ac, ad, bb); ka \<le> K; \<forall>b. mbody_is C m (a, aa, b) \<longrightarrow> (\<forall>ab ba ac ad bb. (\<exists>k. ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep) \<longrightarrow> A (ab, ba) (ac, ad, bb) \<longrightarrow> (\<forall>h v. (\<exists>n. ((a, aa, b), l, (ac, ad, bb), n, h, v) \<in> Exec) \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ll, ae, af, bc) \<in> MStep) \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ae, af, bc) \<in> Reachable) \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc)))))\<rbrakk> \<Longrightarrow> (\<forall>h v. ((a, aa, b), l, (ac, ad, bb), ka, h, v) \<in> Exec \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. (((a, aa, b), l, (ac, ad, bb), ka, ll, ae, af, bc) \<in> MStep \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> (((a, aa, b), l, (ac, ad, bb), ka, ae, af, bc) \<in> Reachable \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))
[PROOF STEP]
apply (erule_tac x=b in allE, clarsimp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a aa b Mspec Minv Anno ab ba ac ad bb k ka. \<lbrakk>mbody_is C m (a, aa, b); MST\<down>(C, m) = Some (Mspec, Minv, Anno); ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep; A (ab, ba) (ac, ad, bb); ka \<le> K; \<forall>ab ba ac ad bb. (\<exists>k. ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep) \<longrightarrow> A (ab, ba) (ac, ad, bb) \<longrightarrow> (\<forall>h v. (\<exists>n. ((a, aa, b), l, (ac, ad, bb), n, h, v) \<in> Exec) \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ll, ae, af, bc) \<in> MStep) \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ae, af, bc) \<in> Reachable) \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))\<rbrakk> \<Longrightarrow> (\<forall>h v. ((a, aa, b), l, (ac, ad, bb), ka, h, v) \<in> Exec \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. (((a, aa, b), l, (ac, ad, bb), ka, ll, ae, af, bc) \<in> MStep \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> (((a, aa, b), l, (ac, ad, bb), ka, ae, af, bc) \<in> Reachable \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))
[PROOF STEP]
apply (erule_tac x=ab in allE)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a aa b Mspec Minv Anno ab ba ac ad bb k ka. \<lbrakk>mbody_is C m (a, aa, b); MST\<down>(C, m) = Some (Mspec, Minv, Anno); ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep; A (ab, ba) (ac, ad, bb); ka \<le> K; \<forall>ba ac ad bb. (\<exists>k. ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep) \<longrightarrow> A (ab, ba) (ac, ad, bb) \<longrightarrow> (\<forall>h v. (\<exists>n. ((a, aa, b), l, (ac, ad, bb), n, h, v) \<in> Exec) \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ll, ae, af, bc) \<in> MStep) \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ae, af, bc) \<in> Reachable) \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))\<rbrakk> \<Longrightarrow> (\<forall>h v. ((a, aa, b), l, (ac, ad, bb), ka, h, v) \<in> Exec \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. (((a, aa, b), l, (ac, ad, bb), ka, ll, ae, af, bc) \<in> MStep \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> (((a, aa, b), l, (ac, ad, bb), ka, ae, af, bc) \<in> Reachable \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))
[PROOF STEP]
apply (erule_tac x=ba in allE)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a aa b Mspec Minv Anno ab ba ac ad bb k ka. \<lbrakk>mbody_is C m (a, aa, b); MST\<down>(C, m) = Some (Mspec, Minv, Anno); ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep; A (ab, ba) (ac, ad, bb); ka \<le> K; \<forall>ac ad bb. (\<exists>k. ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep) \<longrightarrow> A (ab, ba) (ac, ad, bb) \<longrightarrow> (\<forall>h v. (\<exists>n. ((a, aa, b), l, (ac, ad, bb), n, h, v) \<in> Exec) \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ll, ae, af, bc) \<in> MStep) \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ae, af, bc) \<in> Reachable) \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))\<rbrakk> \<Longrightarrow> (\<forall>h v. ((a, aa, b), l, (ac, ad, bb), ka, h, v) \<in> Exec \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. (((a, aa, b), l, (ac, ad, bb), ka, ll, ae, af, bc) \<in> MStep \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> (((a, aa, b), l, (ac, ad, bb), ka, ae, af, bc) \<in> Reachable \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))
[PROOF STEP]
apply (erule_tac x=ac in allE)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a aa b Mspec Minv Anno ab ba ac ad bb k ka. \<lbrakk>mbody_is C m (a, aa, b); MST\<down>(C, m) = Some (Mspec, Minv, Anno); ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep; A (ab, ba) (ac, ad, bb); ka \<le> K; \<forall>ad bb. (\<exists>k. ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep) \<longrightarrow> A (ab, ba) (ac, ad, bb) \<longrightarrow> (\<forall>h v. (\<exists>n. ((a, aa, b), l, (ac, ad, bb), n, h, v) \<in> Exec) \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ll, ae, af, bc) \<in> MStep) \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ae, af, bc) \<in> Reachable) \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))\<rbrakk> \<Longrightarrow> (\<forall>h v. ((a, aa, b), l, (ac, ad, bb), ka, h, v) \<in> Exec \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. (((a, aa, b), l, (ac, ad, bb), ka, ll, ae, af, bc) \<in> MStep \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> (((a, aa, b), l, (ac, ad, bb), ka, ae, af, bc) \<in> Reachable \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))
[PROOF STEP]
apply (erule_tac x=ad in allE)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a aa b Mspec Minv Anno ab ba ac ad bb k ka. \<lbrakk>mbody_is C m (a, aa, b); MST\<down>(C, m) = Some (Mspec, Minv, Anno); ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep; A (ab, ba) (ac, ad, bb); ka \<le> K; \<forall>bb. (\<exists>k. ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep) \<longrightarrow> A (ab, ba) (ac, ad, bb) \<longrightarrow> (\<forall>h v. (\<exists>n. ((a, aa, b), l, (ac, ad, bb), n, h, v) \<in> Exec) \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ll, ae, af, bc) \<in> MStep) \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ae, af, bc) \<in> Reachable) \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))\<rbrakk> \<Longrightarrow> (\<forall>h v. ((a, aa, b), l, (ac, ad, bb), ka, h, v) \<in> Exec \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. (((a, aa, b), l, (ac, ad, bb), ka, ll, ae, af, bc) \<in> MStep \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> (((a, aa, b), l, (ac, ad, bb), ka, ae, af, bc) \<in> Reachable \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))
[PROOF STEP]
apply (erule_tac x=bb in allE, erule impE)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a aa b Mspec Minv Anno ab ba ac ad bb k ka. \<lbrakk>mbody_is C m (a, aa, b); MST\<down>(C, m) = Some (Mspec, Minv, Anno); ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep; A (ab, ba) (ac, ad, bb); ka \<le> K\<rbrakk> \<Longrightarrow> \<exists>k. ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep
 2. \<And>a aa b Mspec Minv Anno ab ba ac ad bb k ka. \<lbrakk>mbody_is C m (a, aa, b); MST\<down>(C, m) = Some (Mspec, Minv, Anno); ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep; A (ab, ba) (ac, ad, bb); ka \<le> K; A (ab, ba) (ac, ad, bb) \<longrightarrow> (\<forall>h v. (\<exists>n. ((a, aa, b), l, (ac, ad, bb), n, h, v) \<in> Exec) \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ll, ae, af, bc) \<in> MStep) \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ae, af, bc) \<in> Reachable) \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))\<rbrakk> \<Longrightarrow> (\<forall>h v. ((a, aa, b), l, (ac, ad, bb), ka, h, v) \<in> Exec \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. (((a, aa, b), l, (ac, ad, bb), ka, ll, ae, af, bc) \<in> MStep \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> (((a, aa, b), l, (ac, ad, bb), ka, ae, af, bc) \<in> Reachable \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))
[PROOF STEP]
apply fast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a aa b Mspec Minv Anno ab ba ac ad bb k ka. \<lbrakk>mbody_is C m (a, aa, b); MST\<down>(C, m) = Some (Mspec, Minv, Anno); ((a, aa, b), b, mkState (ab, ba), k, l, ac, ad, bb) \<in> MStep; A (ab, ba) (ac, ad, bb); ka \<le> K; A (ab, ba) (ac, ad, bb) \<longrightarrow> (\<forall>h v. (\<exists>n. ((a, aa, b), l, (ac, ad, bb), n, h, v) \<in> Exec) \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ll, ae, af, bc) \<in> MStep) \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> ((\<exists>k. ((a, aa, b), l, (ac, ad, bb), k, ae, af, bc) \<in> Reachable) \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))\<rbrakk> \<Longrightarrow> (\<forall>h v. ((a, aa, b), l, (ac, ad, bb), ka, h, v) \<in> Exec \<longrightarrow> B (ab, ba) (ac, ad, bb) (h, v)) \<and> (\<forall>ll ae af bc. (((a, aa, b), l, (ac, ad, bb), ka, ll, ae, af, bc) \<in> MStep \<longrightarrow> (\<forall>Q. Anno\<down>ll = Some Q \<longrightarrow> Q (ab, ba) (ae, af, bc))) \<and> (((a, aa, b), l, (ac, ad, bb), ka, ae, af, bc) \<in> Reachable \<longrightarrow> I (ab, ba) (ac, ad, bb) (heap (ae, af, bc))))
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "1\<^sub>\<pi> \<cdot> x = 1\<^sub>\<pi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 1\<^sub>\<pi> \<cdot> x = 1\<^sub>\<pi>
[PROOF STEP]
nitpick
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 1\<^sub>\<pi> \<cdot> x = 1\<^sub>\<pi>
[PROOF STEP]
oops


[STATEMENT]
lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_child_nodes_type_wf_preserved [simp]:
  "h \<turnstile> put_M element_ptr child_nodes_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. h \<turnstile> put_M element_ptr child_nodes_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> ElementClass.type_wf h = ElementClass.type_wf h'
[PROOF STEP]
apply(auto simp add: type_wf_defs NodeClass.type_wf_defs ObjectClass.type_wf_defs
      Let_def put_M_defs get_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def
      get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def get\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def
      split: prod.splits option.splits Option.bind_splits elim!: bind_returns_heap_E)[1]
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x2 node_ptr va. \<lbrakk>h' = Heap (fmupd (cast (cast element_ptr)) (cast (cast (x2\<lparr>child_nodes := v\<rparr>))) (the_heap h)); fmlookup (the_heap h) (cast (cast element_ptr)) = Some (cast (cast x2)); \<forall>node_ptr\<in>fset (node_ptr_kinds h). (fmlookup (the_heap h) (cast node_ptr) = None \<longrightarrow> cast element_ptr = node_ptr) \<and> (\<forall>v. fmlookup (the_heap h) (cast node_ptr) = Some v \<longrightarrow> cast element_ptr \<noteq> node_ptr \<longrightarrow> (\<exists>y. cast y = v)); \<forall>element_ptra\<in>fset (element_ptr_kinds h). (fmlookup (the_heap h) (cast (cast element_ptra)) = None \<longrightarrow> element_ptr = element_ptra) \<and> (\<forall>v. ((\<forall>node. cast node \<noteq> v) \<longrightarrow> fmlookup (the_heap h) (cast (cast element_ptra)) = Some v \<longrightarrow> element_ptr = element_ptra) \<and> (\<forall>va. cast va = v \<longrightarrow> fmlookup (the_heap h) (cast (cast element_ptra)) = Some v \<longrightarrow> element_ptr \<noteq> element_ptra \<longrightarrow> (\<exists>y. cast y = va))); node_ptr |\<in>| node_ptr_kinds h; fmlookup (the_heap h) (cast node_ptr) = Some va\<rbrakk> \<Longrightarrow> \<exists>y. cast y = va
 2. \<And>x2 element_ptra va. \<lbrakk>h' = Heap (fmupd (cast (cast element_ptr)) (cast (cast (x2\<lparr>child_nodes := v\<rparr>))) (the_heap h)); fmlookup (the_heap h) (cast (cast element_ptr)) = Some (cast (cast x2)); \<forall>node_ptr\<in>fset (node_ptr_kinds h). (fmlookup (the_heap h) (cast node_ptr) = None \<longrightarrow> cast element_ptr = node_ptr) \<and> (\<forall>v. fmlookup (the_heap h) (cast node_ptr) = Some v \<longrightarrow> cast element_ptr \<noteq> node_ptr \<longrightarrow> (\<exists>y. cast y = v)); \<forall>element_ptra\<in>fset (element_ptr_kinds h). (fmlookup (the_heap h) (cast (cast element_ptra)) = None \<longrightarrow> element_ptr = element_ptra) \<and> (\<forall>v. ((\<forall>node. cast node \<noteq> v) \<longrightarrow> fmlookup (the_heap h) (cast (cast element_ptra)) = Some v \<longrightarrow> element_ptr = element_ptra) \<and> (\<forall>va. cast va = v \<longrightarrow> fmlookup (the_heap h) (cast (cast element_ptra)) = Some v \<longrightarrow> element_ptr \<noteq> element_ptra \<longrightarrow> (\<exists>y. cast y = va))); element_ptra |\<in>| element_ptr_kinds h; fmlookup (the_heap h) (cast (cast element_ptra)) = Some (cast va)\<rbrakk> \<Longrightarrow> \<exists>y. cast y = va
[PROOF STEP]
apply (metis finite_set_in option.inject)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x2 element_ptra va. \<lbrakk>h' = Heap (fmupd (cast (cast element_ptr)) (cast (cast (x2\<lparr>child_nodes := v\<rparr>))) (the_heap h)); fmlookup (the_heap h) (cast (cast element_ptr)) = Some (cast (cast x2)); \<forall>node_ptr\<in>fset (node_ptr_kinds h). (fmlookup (the_heap h) (cast node_ptr) = None \<longrightarrow> cast element_ptr = node_ptr) \<and> (\<forall>v. fmlookup (the_heap h) (cast node_ptr) = Some v \<longrightarrow> cast element_ptr \<noteq> node_ptr \<longrightarrow> (\<exists>y. cast y = v)); \<forall>element_ptra\<in>fset (element_ptr_kinds h). (fmlookup (the_heap h) (cast (cast element_ptra)) = None \<longrightarrow> element_ptr = element_ptra) \<and> (\<forall>v. ((\<forall>node. cast node \<noteq> v) \<longrightarrow> fmlookup (the_heap h) (cast (cast element_ptra)) = Some v \<longrightarrow> element_ptr = element_ptra) \<and> (\<forall>va. cast va = v \<longrightarrow> fmlookup (the_heap h) (cast (cast element_ptra)) = Some v \<longrightarrow> element_ptr \<noteq> element_ptra \<longrightarrow> (\<exists>y. cast y = va))); element_ptra |\<in>| element_ptr_kinds h; fmlookup (the_heap h) (cast (cast element_ptra)) = Some (cast va)\<rbrakk> \<Longrightarrow> \<exists>y. cast y = va
[PROOF STEP]
apply (metis cast\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>2\<^sub>N\<^sub>o\<^sub>d\<^sub>e_inv finite_set_in option.sel)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma step11_integrity:
     "\<lbrakk> Says A B (Certificate) \<in> set evs;
         \<forall> p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>;
         A \<noteq> Spy; evs \<in> srb \<rbrakk>
     \<Longrightarrow> \<exists> K Nb.
      Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set evs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Says A B Certificate \<in> set evs; \<forall>p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>; A \<noteq> Spy; evs \<in> srb\<rbrakk> \<Longrightarrow> \<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set evs
[PROOF STEP]
apply (erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>; A \<noteq> Spy; evs \<in> srb\<rbrakk> \<Longrightarrow> Says A B Certificate \<in> set evs \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set evs)
[PROOF STEP]
apply (erule srb.induct)
[PROOF STATE]
proof (prove)
goal (20 subgoals):
 1. \<lbrakk>\<forall>p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>; A \<noteq> Spy\<rbrakk> \<Longrightarrow> Says A B Certificate \<in> set [] \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set [])
 2. \<And>evsF X Ba Aa. \<lbrakk>\<forall>p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>; A \<noteq> Spy; evsF \<in> srb; Says A B Certificate \<in> set evsF \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set evsF); X \<in> synth (analz (knows Spy evsF)); illegalUse (Card Ba)\<rbrakk> \<Longrightarrow> Says A B Certificate \<in> set (Says Spy Aa X # Inputs Spy (Card Ba) X # evsF) \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set (Says Spy Aa X # Inputs Spy (Card Ba) X # evsF))
 3. \<And>evsFo Nb Aa Ba. \<lbrakk>\<forall>p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>; A \<noteq> Spy; evsFo \<in> srb; Says A B Certificate \<in> set evsFo \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set evsFo); Nonce Nb \<in> analz (knows Spy evsFo); Key (pairK (Aa, Ba)) \<in> knows Spy evsFo\<rbrakk> \<Longrightarrow> Says A B Certificate \<in> set (Notes Spy (Key (sesK (Nb, pairK (Aa, Ba)))) # evsFo) \<longrightarrow> (\<exists>K Nba. Outpts (Card A) A \<lbrace>Agent B, Nonce Nba, Key K, Certificate\<rbrace> \<in> set (Notes Spy (Key (sesK (Nb, pairK (Aa, Ba)))) # evsFo))
 4. \<And>evsrb Aa Ba X. \<lbrakk>\<forall>p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>; A \<noteq> Spy; evsrb \<in> srb; Says A B Certificate \<in> set evsrb \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set evsrb); Says Aa Ba X \<in> set evsrb\<rbrakk> \<Longrightarrow> Says A B Certificate \<in> set (Gets Ba X # evsrb) \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set (Gets Ba X # evsrb))
 5. \<And>evs1 Aa Ba. \<lbrakk>\<forall>p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>; A \<noteq> Spy; evs1 \<in> srb; Says A B Certificate \<in> set evs1 \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set evs1); Aa \<noteq> Server\<rbrakk> \<Longrightarrow> Says A B Certificate \<in> set (Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> # evs1) \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set (Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> # evs1))
 6. \<And>evs2 Aa Ba. \<lbrakk>\<forall>p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>; A \<noteq> Spy; evs2 \<in> srb; Says A B Certificate \<in> set evs2 \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set evs2); Gets Server \<lbrace>Agent Aa, Agent Ba\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> Says A B Certificate \<in> set (Says Server Aa \<lbrace>Nonce (Pairkey (Aa, Ba)), Crypt (shrK Aa) \<lbrace>Nonce (Pairkey (Aa, Ba)), Agent Ba\<rbrace>\<rbrace> # evs2) \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set (Says Server Aa \<lbrace>Nonce (Pairkey (Aa, Ba)), Crypt (shrK Aa) \<lbrace>Nonce (Pairkey (Aa, Ba)), Agent Ba\<rbrace>\<rbrace> # evs2))
 7. \<And>evs3 Aa Ba Pk Certificatea. \<lbrakk>\<forall>p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>; A \<noteq> Spy; evs3 \<in> srb; Says A B Certificate \<in> set evs3 \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set evs3); legalUse Card Aa; Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> \<in> set evs3; Gets Aa \<lbrace>Nonce Pk, Certificatea\<rbrace> \<in> set evs3\<rbrakk> \<Longrightarrow> Says A B Certificate \<in> set (Inputs Aa (Card Aa) (Agent Aa) # evs3) \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set (Inputs Aa (Card Aa) (Agent Aa) # evs3))
 8. \<And>evs4 Na Aa. \<lbrakk>\<forall>p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>; A \<noteq> Spy; evs4 \<in> srb; Says A B Certificate \<in> set evs4 \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set evs4); Nonce Na \<notin> used evs4; legalUse Card Aa; Aa \<noteq> Server; Inputs Aa (Card Aa) (Agent Aa) \<in> set evs4\<rbrakk> \<Longrightarrow> Says A B Certificate \<in> set (Outpts (Card Aa) Aa \<lbrace>Nonce Na, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> # evs4) \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set (Outpts (Card Aa) Aa \<lbrace>Nonce Na, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> # evs4))
 9. \<And>evs4F Na Aa. \<lbrakk>\<forall>p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>; A \<noteq> Spy; evs4F \<in> srb; Says A B Certificate \<in> set evs4F \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set evs4F); Nonce Na \<notin> used evs4F; illegalUse (Card Aa); Inputs Spy (Card Aa) (Agent Aa) \<in> set evs4F\<rbrakk> \<Longrightarrow> Says A B Certificate \<in> set (Outpts (Card Aa) Spy \<lbrace>Nonce Na, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> # evs4F) \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set (Outpts (Card Aa) Spy \<lbrace>Nonce Na, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> # evs4F))
 10. \<And>evs5 Aa Na Certificatea Ba. \<lbrakk>\<forall>p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>; A \<noteq> Spy; evs5 \<in> srb; Says A B Certificate \<in> set evs5 \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set evs5); Outpts (Card Aa) Aa \<lbrace>Nonce Na, Certificatea\<rbrace> \<in> set evs5; \<forall>p q. Certificatea \<noteq> \<lbrace>p, q\<rbrace>\<rbrakk> \<Longrightarrow> Says A B Certificate \<in> set (Says Aa Ba \<lbrace>Agent Aa, Nonce Na\<rbrace> # evs5) \<longrightarrow> (\<exists>K Nb. Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, Certificate\<rbrace> \<in> set (Says Aa Ba \<lbrace>Agent Aa, Nonce Na\<rbrace> # evs5))
A total of 20 subgoals...
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "QQ = PP"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. QQ = PP
[PROOF STEP]
find_proof IfMatchRuleExt
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. QQ = PP
[PROOF STEP]
oops


[STATEMENT]
lemma (in valid_program) history_consistent_append_conv:
  "\<And>\<theta> ys p. \<forall>sop \<in> write_sops xs. valid_sop sop \<Longrightarrow>
                read_tmps xs \<inter> read_tmps ys = {} \<Longrightarrow> valid_prog p \<Longrightarrow>
          history_consistent \<theta> p (xs@ys) =
           (history_consistent (\<theta>|` (dom \<theta> - read_tmps ys)) p xs \<and>
            history_consistent \<theta> (last_prog p xs) ys \<and>
            read_tmps ys \<inter> \<Union>(fst ` write_sops xs) = {})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<theta> ys p. \<lbrakk>\<forall>sop\<in>write_sops xs. valid_sop sop; read_tmps xs \<inter> read_tmps ys = {}; valid_prog p\<rbrakk> \<Longrightarrow> history_consistent \<theta> p (xs @ ys) = (history_consistent (\<theta> |` (dom \<theta> - read_tmps ys)) p xs \<and> history_consistent \<theta> (last_prog p xs) ys \<and> read_tmps ys \<inter> \<Union> (fst ` write_sops xs) = {})
[PROOF STEP]
apply rule
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>\<theta> ys p. \<lbrakk>\<forall>sop\<in>write_sops xs. valid_sop sop; read_tmps xs \<inter> read_tmps ys = {}; valid_prog p; history_consistent \<theta> p (xs @ ys)\<rbrakk> \<Longrightarrow> history_consistent (\<theta> |` (dom \<theta> - read_tmps ys)) p xs \<and> history_consistent \<theta> (last_prog p xs) ys \<and> read_tmps ys \<inter> \<Union> (fst ` write_sops xs) = {}
 2. \<And>\<theta> ys p. \<lbrakk>\<forall>sop\<in>write_sops xs. valid_sop sop; read_tmps xs \<inter> read_tmps ys = {}; valid_prog p; history_consistent (\<theta> |` (dom \<theta> - read_tmps ys)) p xs \<and> history_consistent \<theta> (last_prog p xs) ys \<and> read_tmps ys \<inter> \<Union> (fst ` write_sops xs) = {}\<rbrakk> \<Longrightarrow> history_consistent \<theta> p (xs @ ys)
[PROOF STEP]
apply  (rule history_consistent_appendD,assumption+)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<theta> ys p. \<lbrakk>\<forall>sop\<in>write_sops xs. valid_sop sop; read_tmps xs \<inter> read_tmps ys = {}; valid_prog p; history_consistent (\<theta> |` (dom \<theta> - read_tmps ys)) p xs \<and> history_consistent \<theta> (last_prog p xs) ys \<and> read_tmps ys \<inter> \<Union> (fst ` write_sops xs) = {}\<rbrakk> \<Longrightarrow> history_consistent \<theta> p (xs @ ys)
[PROOF STEP]
apply (rule history_consistent_appendI)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>\<theta> ys p. \<lbrakk>\<forall>sop\<in>write_sops xs. valid_sop sop; read_tmps xs \<inter> read_tmps ys = {}; valid_prog p; history_consistent (\<theta> |` (dom \<theta> - read_tmps ys)) p xs \<and> history_consistent \<theta> (last_prog p xs) ys \<and> read_tmps ys \<inter> \<Union> (fst ` write_sops xs) = {}\<rbrakk> \<Longrightarrow> \<forall>sop\<in>write_sops xs. valid_sop sop
 2. \<And>\<theta> ys p. \<lbrakk>\<forall>sop\<in>write_sops xs. valid_sop sop; read_tmps xs \<inter> read_tmps ys = {}; valid_prog p; history_consistent (\<theta> |` (dom \<theta> - read_tmps ys)) p xs \<and> history_consistent \<theta> (last_prog p xs) ys \<and> read_tmps ys \<inter> \<Union> (fst ` write_sops xs) = {}\<rbrakk> \<Longrightarrow> history_consistent (\<theta> |` (dom \<theta> - read_tmps ys)) p xs
 3. \<And>\<theta> ys p. \<lbrakk>\<forall>sop\<in>write_sops xs. valid_sop sop; read_tmps xs \<inter> read_tmps ys = {}; valid_prog p; history_consistent (\<theta> |` (dom \<theta> - read_tmps ys)) p xs \<and> history_consistent \<theta> (last_prog p xs) ys \<and> read_tmps ys \<inter> \<Union> (fst ` write_sops xs) = {}\<rbrakk> \<Longrightarrow> history_consistent \<theta> (last_prog p xs) ys
 4. \<And>\<theta> ys p. \<lbrakk>\<forall>sop\<in>write_sops xs. valid_sop sop; read_tmps xs \<inter> read_tmps ys = {}; valid_prog p; history_consistent (\<theta> |` (dom \<theta> - read_tmps ys)) p xs \<and> history_consistent \<theta> (last_prog p xs) ys \<and> read_tmps ys \<inter> \<Union> (fst ` write_sops xs) = {}\<rbrakk> \<Longrightarrow> read_tmps ys \<inter> \<Union> (fst ` write_sops xs) = {}
 5. \<And>\<theta> ys p. \<lbrakk>\<forall>sop\<in>write_sops xs. valid_sop sop; read_tmps xs \<inter> read_tmps ys = {}; valid_prog p; history_consistent (\<theta> |` (dom \<theta> - read_tmps ys)) p xs \<and> history_consistent \<theta> (last_prog p xs) ys \<and> read_tmps ys \<inter> \<Union> (fst ` write_sops xs) = {}\<rbrakk> \<Longrightarrow> valid_prog p
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma jmm_heap: "heap addr2thread_id thread_id2addr jmm_allocate jmm_typeof_addr jmm_heap_write P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. heap (\<lambda>x. x) (\<lambda>x. x) jmm_allocate jmm_typeof_addr jmm_heap_write P
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>h a C. \<lbrakk>jmm_typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> a = a
 2. \<And>h' a h hT. \<lbrakk>(h', a) \<in> jmm_allocate h hT; is_htype P hT\<rbrakk> \<Longrightarrow> jmm_typeof_addr h' a = \<lfloor>hT\<rfloor>
 3. \<And>h' h hT a. (h', a) \<in> jmm_allocate h hT \<Longrightarrow> h \<unlhd>jmm' h'
 4. \<And>h a al v h'. jmm_heap_write h a al v h' \<Longrightarrow> h \<unlhd>jmm' h'
[PROOF STEP]
fix h' a h hT
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>h a C. \<lbrakk>jmm_typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> a = a
 2. \<And>h' a h hT. \<lbrakk>(h', a) \<in> jmm_allocate h hT; is_htype P hT\<rbrakk> \<Longrightarrow> jmm_typeof_addr h' a = \<lfloor>hT\<rfloor>
 3. \<And>h' h hT a. (h', a) \<in> jmm_allocate h hT \<Longrightarrow> h \<unlhd>jmm' h'
 4. \<And>h a al v h'. jmm_heap_write h a al v h' \<Longrightarrow> h \<unlhd>jmm' h'
[PROOF STEP]
assume "(h', a) \<in> jmm_allocate h hT"
[PROOF STATE]
proof (state)
this:
(h', a) \<in> jmm_allocate h hT

goal (4 subgoals):
 1. \<And>h a C. \<lbrakk>jmm_typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> a = a
 2. \<And>h' a h hT. \<lbrakk>(h', a) \<in> jmm_allocate h hT; is_htype P hT\<rbrakk> \<Longrightarrow> jmm_typeof_addr h' a = \<lfloor>hT\<rfloor>
 3. \<And>h' h hT a. (h', a) \<in> jmm_allocate h hT \<Longrightarrow> h \<unlhd>jmm' h'
 4. \<And>h a al v h'. jmm_heap_write h a al v h' \<Longrightarrow> h \<unlhd>jmm' h'
[PROOF STEP]
thus "jmm_typeof_addr h' a = \<lfloor>hT\<rfloor>"
[PROOF STATE]
proof (prove)
using this:
(h', a) \<in> jmm_allocate h hT

goal (1 subgoal):
 1. jmm_typeof_addr h' a = \<lfloor>hT\<rfloor>
[PROOF STEP]
by(auto simp add: jmm_heap_ops_defs)
[PROOF STATE]
proof (state)
this:
jmm_typeof_addr h' a = \<lfloor>hT\<rfloor>

goal (3 subgoals):
 1. \<And>h a C. \<lbrakk>jmm_typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> a = a
 2. \<And>h' h hT a. (h', a) \<in> jmm_allocate h hT \<Longrightarrow> h \<unlhd>jmm' h'
 3. \<And>h a al v h'. jmm_heap_write h a al v h' \<Longrightarrow> h \<unlhd>jmm' h'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>h a C. \<lbrakk>jmm_typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> a = a
 2. \<And>h' h hT a. (h', a) \<in> jmm_allocate h hT \<Longrightarrow> h \<unlhd>jmm' h'
 3. \<And>h a al v h'. jmm_heap_write h a al v h' \<Longrightarrow> h \<unlhd>jmm' h'
[PROOF STEP]
fix h' :: "('addr :: addr) JMM_heap" and h hT a
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>h a C. \<lbrakk>jmm_typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> a = a
 2. \<And>h' h hT a. (h', a) \<in> jmm_allocate h hT \<Longrightarrow> h \<unlhd>jmm' h'
 3. \<And>h a al v h'. jmm_heap_write h a al v h' \<Longrightarrow> h \<unlhd>jmm' h'
[PROOF STEP]
assume "(h', a) \<in> jmm_allocate h hT"
[PROOF STATE]
proof (state)
this:
(h', a) \<in> jmm_allocate h hT

goal (3 subgoals):
 1. \<And>h a C. \<lbrakk>jmm_typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> a = a
 2. \<And>h' h hT a. (h', a) \<in> jmm_allocate h hT \<Longrightarrow> h \<unlhd>jmm' h'
 3. \<And>h a al v h'. jmm_heap_write h a al v h' \<Longrightarrow> h \<unlhd>jmm' h'
[PROOF STEP]
thus "h \<unlhd>jmm h'"
[PROOF STATE]
proof (prove)
using this:
(h', a) \<in> jmm_allocate h hT

goal (1 subgoal):
 1. h \<unlhd>jmm' h'
[PROOF STEP]
by(fastforce simp add: jmm_heap_ops_defs intro: jmm.hextI)
[PROOF STATE]
proof (state)
this:
h \<unlhd>jmm' h'

goal (2 subgoals):
 1. \<And>h a C. \<lbrakk>jmm_typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> a = a
 2. \<And>h a al v h'. jmm_heap_write h a al v h' \<Longrightarrow> h \<unlhd>jmm' h'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>h a C. \<lbrakk>jmm_typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> a = a
 2. \<And>h a al v h'. jmm_heap_write h a al v h' \<Longrightarrow> h \<unlhd>jmm' h'
[PROOF STEP]
fix h a al v and h' :: "('addr :: addr) JMM_heap"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>h a C. \<lbrakk>jmm_typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> a = a
 2. \<And>h a al v h'. jmm_heap_write h a al v h' \<Longrightarrow> h \<unlhd>jmm' h'
[PROOF STEP]
assume "jmm_heap_write h a al v h'"
[PROOF STATE]
proof (state)
this:
jmm_heap_write h a al v h'

goal (2 subgoals):
 1. \<And>h a C. \<lbrakk>jmm_typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> a = a
 2. \<And>h a al v h'. jmm_heap_write h a al v h' \<Longrightarrow> h \<unlhd>jmm' h'
[PROOF STEP]
thus "h \<unlhd>jmm h'"
[PROOF STATE]
proof (prove)
using this:
jmm_heap_write h a al v h'

goal (1 subgoal):
 1. h \<unlhd>jmm' h'
[PROOF STEP]
by cases auto
[PROOF STATE]
proof (state)
this:
h \<unlhd>jmm' h'

goal (1 subgoal):
 1. \<And>h a C. \<lbrakk>jmm_typeof_addr h a = \<lfloor>Class_type C\<rfloor>; P \<turnstile> C \<preceq>\<^sup>* Thread\<rbrakk> \<Longrightarrow> a = a
[PROOF STEP]
qed simp


[STATEMENT]
lemma fresh_fun_NotL[eqvt_force]:
  fixes pi1::"name prm"
  and   pi2::"coname prm"
  shows "pi1\<bullet>fresh_fun (\<lambda>x'. Cut <c>.P (x').NotL <a>.M x')=
             fresh_fun (pi1\<bullet>(\<lambda>x'. Cut <c>.P (x').NotL <a>.M x'))"
  and   "pi2\<bullet>fresh_fun (\<lambda>x'. Cut <c>.P (x').NotL <a>.M x')=
             fresh_fun (pi2\<bullet>(\<lambda>x'. Cut <c>.P (x').NotL <a>.M x'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pi1 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi1 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x')) &&& pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi2 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
[PROOF STEP]
apply -
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. pi1 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi1 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
 2. pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi2 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
[PROOF STEP]
apply(perm_simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. pi1 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (\<lambda>x. Cut <c>.(pi1 \<bullet> P) x.NotL <a>.(pi1 \<bullet> M) x)
 2. pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi2 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
[PROOF STEP]
apply(generate_fresh "name")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ca. ca \<sharp> (M, P, a, c, pi1) \<Longrightarrow> pi1 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (\<lambda>x. Cut <c>.(pi1 \<bullet> P) x.NotL <a>.(pi1 \<bullet> M) x)
 2. pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi2 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
[PROOF STEP]
apply(auto simp add: fresh_prod)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> pi1 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (\<lambda>x. Cut <c>.(pi1 \<bullet> P) x.NotL <a>.(pi1 \<bullet> M) x)
 2. pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi2 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
[PROOF STEP]
apply(simp add: fresh_fun_simp_NotL)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> Cut <(pi1 \<bullet> c)>.(pi1 \<bullet> P) (pi1 \<bullet> ca).NotL <(pi1 \<bullet> a)>.(pi1 \<bullet> M) (pi1 \<bullet> ca) = fresh_fun (\<lambda>x. Cut <c>.(pi1 \<bullet> P) x.NotL <a>.(pi1 \<bullet> M) x)
 2. pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi2 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
[PROOF STEP]
apply(rule sym)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> fresh_fun (\<lambda>x. Cut <c>.(pi1 \<bullet> P) x.NotL <a>.(pi1 \<bullet> M) x) = Cut <(pi1 \<bullet> c)>.(pi1 \<bullet> P) (pi1 \<bullet> ca).NotL <(pi1 \<bullet> a)>.(pi1 \<bullet> M) (pi1 \<bullet> ca)
 2. pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi2 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
[PROOF STEP]
apply(rule trans)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> fresh_fun (\<lambda>x. Cut <c>.(pi1 \<bullet> P) x.NotL <a>.(pi1 \<bullet> M) x) = ?s11 ca
 2. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> ?s11 ca = Cut <(pi1 \<bullet> c)>.(pi1 \<bullet> P) (pi1 \<bullet> ca).NotL <(pi1 \<bullet> a)>.(pi1 \<bullet> M) (pi1 \<bullet> ca)
 3. pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi2 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
[PROOF STEP]
apply(rule fresh_fun_simp_NotL)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> ?x'14 ca \<sharp> pi1 \<bullet> P
 2. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> ?x'14 ca \<sharp> pi1 \<bullet> M
 3. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> Cut <c>.(pi1 \<bullet> P) ?x'14 ca.NotL <a>.(pi1 \<bullet> M) ?x'14 ca = Cut <(pi1 \<bullet> c)>.(pi1 \<bullet> P) (pi1 \<bullet> ca).NotL <(pi1 \<bullet> a)>.(pi1 \<bullet> M) (pi1 \<bullet> ca)
 4. pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi2 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
[PROOF STEP]
apply(rule fresh_perm_name)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> ?x'14 ca \<sharp> pi1
 2. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> ?x'14 ca \<sharp> P
 3. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> ?x'14 ca \<sharp> pi1 \<bullet> M
 4. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> Cut <c>.(pi1 \<bullet> P) ?x'14 ca.NotL <a>.(pi1 \<bullet> M) ?x'14 ca = Cut <(pi1 \<bullet> c)>.(pi1 \<bullet> P) (pi1 \<bullet> ca).NotL <(pi1 \<bullet> a)>.(pi1 \<bullet> M) (pi1 \<bullet> ca)
 5. pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi2 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
[PROOF STEP]
apply(assumption)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> ca \<sharp> P
 2. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> ca \<sharp> pi1 \<bullet> M
 3. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> Cut <c>.(pi1 \<bullet> P) ca.NotL <a>.(pi1 \<bullet> M) ca = Cut <(pi1 \<bullet> c)>.(pi1 \<bullet> P) (pi1 \<bullet> ca).NotL <(pi1 \<bullet> a)>.(pi1 \<bullet> M) (pi1 \<bullet> ca)
 4. pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi2 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
[PROOF STEP]
apply(assumption)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> ca \<sharp> pi1 \<bullet> M
 2. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> Cut <c>.(pi1 \<bullet> P) ca.NotL <a>.(pi1 \<bullet> M) ca = Cut <(pi1 \<bullet> c)>.(pi1 \<bullet> P) (pi1 \<bullet> ca).NotL <(pi1 \<bullet> a)>.(pi1 \<bullet> M) (pi1 \<bullet> ca)
 3. pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi2 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
[PROOF STEP]
apply(rule fresh_perm_name)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> ca \<sharp> pi1
 2. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> ca \<sharp> M
 3. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> Cut <c>.(pi1 \<bullet> P) ca.NotL <a>.(pi1 \<bullet> M) ca = Cut <(pi1 \<bullet> c)>.(pi1 \<bullet> P) (pi1 \<bullet> ca).NotL <(pi1 \<bullet> a)>.(pi1 \<bullet> M) (pi1 \<bullet> ca)
 4. pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi2 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
[PROOF STEP]
apply(assumption)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> ca \<sharp> M
 2. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> Cut <c>.(pi1 \<bullet> P) ca.NotL <a>.(pi1 \<bullet> M) ca = Cut <(pi1 \<bullet> c)>.(pi1 \<bullet> P) (pi1 \<bullet> ca).NotL <(pi1 \<bullet> a)>.(pi1 \<bullet> M) (pi1 \<bullet> ca)
 3. pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi2 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
[PROOF STEP]
apply(assumption)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ca. \<lbrakk>ca \<sharp> M; ca \<sharp> P; ca \<sharp> a; ca \<sharp> c; ca \<sharp> pi1\<rbrakk> \<Longrightarrow> Cut <c>.(pi1 \<bullet> P) ca.NotL <a>.(pi1 \<bullet> M) ca = Cut <(pi1 \<bullet> c)>.(pi1 \<bullet> P) (pi1 \<bullet> ca).NotL <(pi1 \<bullet> a)>.(pi1 \<bullet> M) (pi1 \<bullet> ca)
 2. pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi2 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
[PROOF STEP]
apply(simp add: at_prm_fresh[OF at_name_inst] swap_simps)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (pi2 \<bullet> (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x'))
[PROOF STEP]
apply(perm_simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (\<lambda>x. Cut <(pi2 \<bullet> c)>.(pi2 \<bullet> P) x.NotL <(pi2 \<bullet> a)>.(pi2 \<bullet> M) x)
[PROOF STEP]
apply(subgoal_tac "\<exists>n::name. n\<sharp>(P,M,pi2\<bullet>P,pi2\<bullet>M,pi2)")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<exists>n. n \<sharp> (P, M, pi2 \<bullet> P, pi2 \<bullet> M, pi2) \<Longrightarrow> pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (\<lambda>x. Cut <(pi2 \<bullet> c)>.(pi2 \<bullet> P) x.NotL <(pi2 \<bullet> a)>.(pi2 \<bullet> M) x)
 2. \<exists>n. n \<sharp> (P, M, pi2 \<bullet> P, pi2 \<bullet> M, pi2)
[PROOF STEP]
apply(simp add: fresh_prod)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<exists>n. n \<sharp> P \<and> n \<sharp> M \<and> n \<sharp> pi2 \<bullet> P \<and> n \<sharp> pi2 \<bullet> M \<and> n \<sharp> pi2 \<Longrightarrow> pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (\<lambda>x. Cut <(pi2 \<bullet> c)>.(pi2 \<bullet> P) x.NotL <(pi2 \<bullet> a)>.(pi2 \<bullet> M) x)
 2. \<exists>n. n \<sharp> (P, M, pi2 \<bullet> P, pi2 \<bullet> M, pi2)
[PROOF STEP]
apply(auto)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>n. \<lbrakk>n \<sharp> P; n \<sharp> M; n \<sharp> pi2 \<bullet> P; n \<sharp> pi2 \<bullet> M; n \<sharp> pi2\<rbrakk> \<Longrightarrow> pi2 \<bullet> fresh_fun (\<lambda>x'. Cut <c>.P x'.NotL <a>.M x') = fresh_fun (\<lambda>x. Cut <(pi2 \<bullet> c)>.(pi2 \<bullet> P) x.NotL <(pi2 \<bullet> a)>.(pi2 \<bullet> M) x)
 2. \<exists>n. n \<sharp> (P, M, pi2 \<bullet> P, pi2 \<bullet> M, pi2)
[PROOF STEP]
apply(simp add: fresh_fun_simp_NotL calc_atm)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>n. n \<sharp> (P, M, pi2 \<bullet> P, pi2 \<bullet> M, pi2)
[PROOF STEP]
apply(rule exists_fresh')
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (supp (P, M, pi2 \<bullet> P, pi2 \<bullet> M, pi2))
[PROOF STEP]
apply(simp add: fin_supp)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done