[STATEMENT]
lemma next_plane0_incr_finV:
 "\<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g \<rbrakk>
  \<Longrightarrow> \<forall>v \<in> \<V> g. v \<in> \<V> g' \<and>
        ((\<forall>f\<in>\<F> g. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow>
         (\<forall>f\<in>\<F> g'. v \<in> \<V> f \<longrightarrow> f \<in> \<F> g))" (is "_ \<Longrightarrow> _ \<Longrightarrow> ?Q g g'")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g\<rbrakk> \<Longrightarrow> \<forall>v\<in>\<V> g. v \<in> \<V> g' \<and> ((\<forall>f\<in>\<F> g. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> g'. v \<in> \<V> f \<longrightarrow> f \<in> \<F> g))
[PROOF STEP]
apply(rule next_plane0_incr[where Q = ?Q and g=g and g'=g'])
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>x y z. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; \<forall>v\<in>\<V> x. v \<in> \<V> y \<and> ((\<forall>f\<in>\<F> x. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> y. v \<in> \<V> f \<longrightarrow> f \<in> \<F> x)); \<forall>v\<in>\<V> y. v \<in> \<V> z \<and> ((\<forall>f\<in>\<F> y. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> z. v \<in> \<V> f \<longrightarrow> f \<in> \<F> y))\<rbrakk> \<Longrightarrow> \<forall>v\<in>\<V> x. v \<in> \<V> z \<and> ((\<forall>f\<in>\<F> x. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> z. v \<in> \<V> f \<longrightarrow> f \<in> \<F> x))
 2. \<And>f ga. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; \<not> final f\<rbrakk> \<Longrightarrow> \<forall>v\<in>\<V> ga. v \<in> \<V> (makeFaceFinal f ga) \<and> ((\<forall>f\<in>\<F> ga. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (makeFaceFinal f ga). v \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
 3. \<And>ga u v f vs. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; pre_splitFace ga u v f vs\<rbrakk> \<Longrightarrow> \<forall>va\<in>\<V> ga. va \<in> \<V> (snd (snd (splitFace ga u v f vs))) \<and> ((\<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (snd (snd (splitFace ga u v f vs))). va \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
 4. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g\<rbrakk> \<Longrightarrow> minGraphProps g
 5. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g\<rbrakk> \<Longrightarrow> g' \<in> set (next_plane0\<^bsub>?p\<^esub> g)
[PROOF STEP]
prefer 4
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g\<rbrakk> \<Longrightarrow> minGraphProps g
 2. \<And>x y z. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; \<forall>v\<in>\<V> x. v \<in> \<V> y \<and> ((\<forall>f\<in>\<F> x. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> y. v \<in> \<V> f \<longrightarrow> f \<in> \<F> x)); \<forall>v\<in>\<V> y. v \<in> \<V> z \<and> ((\<forall>f\<in>\<F> y. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> z. v \<in> \<V> f \<longrightarrow> f \<in> \<F> y))\<rbrakk> \<Longrightarrow> \<forall>v\<in>\<V> x. v \<in> \<V> z \<and> ((\<forall>f\<in>\<F> x. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> z. v \<in> \<V> f \<longrightarrow> f \<in> \<F> x))
 3. \<And>f ga. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; \<not> final f\<rbrakk> \<Longrightarrow> \<forall>v\<in>\<V> ga. v \<in> \<V> (makeFaceFinal f ga) \<and> ((\<forall>f\<in>\<F> ga. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (makeFaceFinal f ga). v \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
 4. \<And>ga u v f vs. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; pre_splitFace ga u v f vs\<rbrakk> \<Longrightarrow> \<forall>va\<in>\<V> ga. va \<in> \<V> (snd (snd (splitFace ga u v f vs))) \<and> ((\<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (snd (snd (splitFace ga u v f vs))). va \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
 5. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g\<rbrakk> \<Longrightarrow> g' \<in> set (next_plane0\<^bsub>?p\<^esub> g)
[PROOF STEP]
apply assumption
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>x y z. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; \<forall>v\<in>\<V> x. v \<in> \<V> y \<and> ((\<forall>f\<in>\<F> x. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> y. v \<in> \<V> f \<longrightarrow> f \<in> \<F> x)); \<forall>v\<in>\<V> y. v \<in> \<V> z \<and> ((\<forall>f\<in>\<F> y. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> z. v \<in> \<V> f \<longrightarrow> f \<in> \<F> y))\<rbrakk> \<Longrightarrow> \<forall>v\<in>\<V> x. v \<in> \<V> z \<and> ((\<forall>f\<in>\<F> x. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> z. v \<in> \<V> f \<longrightarrow> f \<in> \<F> x))
 2. \<And>f ga. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; \<not> final f\<rbrakk> \<Longrightarrow> \<forall>v\<in>\<V> ga. v \<in> \<V> (makeFaceFinal f ga) \<and> ((\<forall>f\<in>\<F> ga. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (makeFaceFinal f ga). v \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
 3. \<And>ga u v f vs. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; pre_splitFace ga u v f vs\<rbrakk> \<Longrightarrow> \<forall>va\<in>\<V> ga. va \<in> \<V> (snd (snd (splitFace ga u v f vs))) \<and> ((\<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (snd (snd (splitFace ga u v f vs))). va \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
 4. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g\<rbrakk> \<Longrightarrow> g' \<in> set (next_plane0\<^bsub>?p\<^esub> g)
[PROOF STEP]
prefer 4
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g\<rbrakk> \<Longrightarrow> g' \<in> set (next_plane0\<^bsub>?p\<^esub> g)
 2. \<And>x y z. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; \<forall>v\<in>\<V> x. v \<in> \<V> y \<and> ((\<forall>f\<in>\<F> x. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> y. v \<in> \<V> f \<longrightarrow> f \<in> \<F> x)); \<forall>v\<in>\<V> y. v \<in> \<V> z \<and> ((\<forall>f\<in>\<F> y. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> z. v \<in> \<V> f \<longrightarrow> f \<in> \<F> y))\<rbrakk> \<Longrightarrow> \<forall>v\<in>\<V> x. v \<in> \<V> z \<and> ((\<forall>f\<in>\<F> x. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> z. v \<in> \<V> f \<longrightarrow> f \<in> \<F> x))
 3. \<And>f ga. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; \<not> final f\<rbrakk> \<Longrightarrow> \<forall>v\<in>\<V> ga. v \<in> \<V> (makeFaceFinal f ga) \<and> ((\<forall>f\<in>\<F> ga. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (makeFaceFinal f ga). v \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
 4. \<And>ga u v f vs. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; pre_splitFace ga u v f vs\<rbrakk> \<Longrightarrow> \<forall>va\<in>\<V> ga. va \<in> \<V> (snd (snd (splitFace ga u v f vs))) \<and> ((\<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (snd (snd (splitFace ga u v f vs))). va \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
[PROOF STEP]
apply assumption
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x y z. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; \<forall>v\<in>\<V> x. v \<in> \<V> y \<and> ((\<forall>f\<in>\<F> x. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> y. v \<in> \<V> f \<longrightarrow> f \<in> \<F> x)); \<forall>v\<in>\<V> y. v \<in> \<V> z \<and> ((\<forall>f\<in>\<F> y. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> z. v \<in> \<V> f \<longrightarrow> f \<in> \<F> y))\<rbrakk> \<Longrightarrow> \<forall>v\<in>\<V> x. v \<in> \<V> z \<and> ((\<forall>f\<in>\<F> x. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> z. v \<in> \<V> f \<longrightarrow> f \<in> \<F> x))
 2. \<And>f ga. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; \<not> final f\<rbrakk> \<Longrightarrow> \<forall>v\<in>\<V> ga. v \<in> \<V> (makeFaceFinal f ga) \<and> ((\<forall>f\<in>\<F> ga. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (makeFaceFinal f ga). v \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
 3. \<And>ga u v f vs. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; pre_splitFace ga u v f vs\<rbrakk> \<Longrightarrow> \<forall>va\<in>\<V> ga. va \<in> \<V> (snd (snd (splitFace ga u v f vs))) \<and> ((\<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (snd (snd (splitFace ga u v f vs))). va \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
[PROOF STEP]
apply fast
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>f ga. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; \<not> final f\<rbrakk> \<Longrightarrow> \<forall>v\<in>\<V> ga. v \<in> \<V> (makeFaceFinal f ga) \<and> ((\<forall>f\<in>\<F> ga. v \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (makeFaceFinal f ga). v \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
 2. \<And>ga u v f vs. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; pre_splitFace ga u v f vs\<rbrakk> \<Longrightarrow> \<forall>va\<in>\<V> ga. va \<in> \<V> (snd (snd (splitFace ga u v f vs))) \<and> ((\<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (snd (snd (splitFace ga u v f vs))). va \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
[PROOF STEP]
apply(clarsimp simp:makeFaceFinal_def vertices_graph makeFaceFinalFaceList_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>f ga v fa. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; \<not> final f; v < countVertices ga; \<forall>f\<in>\<F> ga. v \<in> \<V> f \<longrightarrow> final f; fa \<in> set (replace f [setFinal f] (faces ga)); v \<in> \<V> fa\<rbrakk> \<Longrightarrow> fa \<in> \<F> ga
 2. \<And>ga u v f vs. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; pre_splitFace ga u v f vs\<rbrakk> \<Longrightarrow> \<forall>va\<in>\<V> ga. va \<in> \<V> (snd (snd (splitFace ga u v f vs))) \<and> ((\<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (snd (snd (splitFace ga u v f vs))). va \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
[PROOF STEP]
apply(drule replace5)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>f ga v fa. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; \<not> final f; v < countVertices ga; \<forall>f\<in>\<F> ga. v \<in> \<V> f \<longrightarrow> final f; v \<in> \<V> fa; fa \<in> \<F> ga \<or> fa \<in> set [setFinal f]\<rbrakk> \<Longrightarrow> fa \<in> \<F> ga
 2. \<And>ga u v f vs. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; pre_splitFace ga u v f vs\<rbrakk> \<Longrightarrow> \<forall>va\<in>\<V> ga. va \<in> \<V> (snd (snd (splitFace ga u v f vs))) \<and> ((\<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (snd (snd (splitFace ga u v f vs))). va \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
[PROOF STEP]
apply(erule disjE)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>f ga v fa. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; \<not> final f; v < countVertices ga; \<forall>f\<in>\<F> ga. v \<in> \<V> f \<longrightarrow> final f; v \<in> \<V> fa; fa \<in> \<F> ga\<rbrakk> \<Longrightarrow> fa \<in> \<F> ga
 2. \<And>f ga v fa. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; \<not> final f; v < countVertices ga; \<forall>f\<in>\<F> ga. v \<in> \<V> f \<longrightarrow> final f; v \<in> \<V> fa; fa \<in> set [setFinal f]\<rbrakk> \<Longrightarrow> fa \<in> \<F> ga
 3. \<And>ga u v f vs. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; pre_splitFace ga u v f vs\<rbrakk> \<Longrightarrow> \<forall>va\<in>\<V> ga. va \<in> \<V> (snd (snd (splitFace ga u v f vs))) \<and> ((\<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (snd (snd (splitFace ga u v f vs))). va \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>f ga v fa. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; \<not> final f; v < countVertices ga; \<forall>f\<in>\<F> ga. v \<in> \<V> f \<longrightarrow> final f; v \<in> \<V> fa; fa \<in> set [setFinal f]\<rbrakk> \<Longrightarrow> fa \<in> \<F> ga
 2. \<And>ga u v f vs. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; pre_splitFace ga u v f vs\<rbrakk> \<Longrightarrow> \<forall>va\<in>\<V> ga. va \<in> \<V> (snd (snd (splitFace ga u v f vs))) \<and> ((\<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (snd (snd (splitFace ga u v f vs))). va \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
[PROOF STEP]
apply(simp add:setFinal_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ga u v f vs. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; pre_splitFace ga u v f vs\<rbrakk> \<Longrightarrow> \<forall>va\<in>\<V> ga. va \<in> \<V> (snd (snd (splitFace ga u v f vs))) \<and> ((\<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (snd (snd (splitFace ga u v f vs))). va \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
[PROOF STEP]
apply(unfold pre_splitFace_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ga u v f vs. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga \<and> \<not> final f \<and> distinct (vertices f) \<and> distinct vs \<and> \<V> ga \<inter> set vs = {} \<and> \<V> f \<inter> set vs = {} \<and> u \<in> \<V> f \<and> v \<in> \<V> f \<and> u \<noteq> v \<and> ((u, v) \<notin> \<E> f \<and> (v, u) \<notin> \<E> f \<and> (u, v) \<notin> \<E> ga \<and> (v, u) \<notin> \<E> ga \<or> vs \<noteq> [])\<rbrakk> \<Longrightarrow> \<forall>va\<in>\<V> ga. va \<in> \<V> (snd (snd (splitFace ga u v f vs))) \<and> ((\<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f) \<longrightarrow> (\<forall>f\<in>\<F> (snd (snd (splitFace ga u v f vs))). va \<in> \<V> f \<longrightarrow> f \<in> \<F> ga))
[PROOF STEP]
apply(clarsimp simp:splitFace_def split_def vertices_graph)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ga u v f vs va. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; va < countVertices ga; \<not> final f; distinct (vertices f); distinct vs; {0..<countVertices ga} \<inter> set vs = {}; \<V> f \<inter> set vs = {}; u \<in> \<V> f; v \<in> \<V> f; u \<noteq> v; \<not> is_nextElem (vertices f) u v \<and> \<not> is_nextElem (vertices f) v u \<and> (u, v) \<notin> \<E> ga \<and> (v, u) \<notin> \<E> ga \<or> vs \<noteq> []; \<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f\<rbrakk> \<Longrightarrow> (va \<in> \<V> (fst (split_face f u v vs)) \<longrightarrow> fst (split_face f u v vs) \<in> \<F> ga) \<and> (\<forall>f\<in>set (replace f [snd (split_face f u v vs)] (faces ga)). va \<in> \<V> f \<longrightarrow> f \<in> \<F> ga)
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ga u v f vs va. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; va < countVertices ga; \<not> final f; distinct (vertices f); distinct vs; {0..<countVertices ga} \<inter> set vs = {}; \<V> f \<inter> set vs = {}; u \<in> \<V> f; v \<in> \<V> f; u \<noteq> v; \<not> is_nextElem (vertices f) u v \<and> \<not> is_nextElem (vertices f) v u \<and> (u, v) \<notin> \<E> ga \<and> (v, u) \<notin> \<E> ga \<or> vs \<noteq> []; \<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f\<rbrakk> \<Longrightarrow> va \<in> \<V> (fst (split_face f u v vs)) \<longrightarrow> fst (split_face f u v vs) \<in> \<F> ga
 2. \<And>ga u v f vs va. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; va < countVertices ga; \<not> final f; distinct (vertices f); distinct vs; {0..<countVertices ga} \<inter> set vs = {}; \<V> f \<inter> set vs = {}; u \<in> \<V> f; v \<in> \<V> f; u \<noteq> v; \<not> is_nextElem (vertices f) u v \<and> \<not> is_nextElem (vertices f) v u \<and> (u, v) \<notin> \<E> ga \<and> (v, u) \<notin> \<E> ga \<or> vs \<noteq> []; \<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f\<rbrakk> \<Longrightarrow> \<forall>f\<in>set (replace f [snd (split_face f u v vs)] (faces ga)). va \<in> \<V> f \<longrightarrow> f \<in> \<F> ga
[PROOF STEP]
apply(clarsimp simp:split_face_def vertices_graph atLeastLessThan_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ga u v f vs va. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; va < countVertices ga; \<not> final f; distinct (vertices f); distinct vs; {..<countVertices ga} \<inter> set vs = {}; \<V> f \<inter> set vs = {}; u \<in> \<V> f; v \<in> \<V> f; u \<noteq> v; \<not> is_nextElem (vertices f) u v \<and> \<not> is_nextElem (vertices f) v u \<and> (u, v) \<notin> \<E> ga \<and> (v, u) \<notin> \<E> ga \<or> vs \<noteq> []; \<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f\<rbrakk> \<Longrightarrow> (va = u \<longrightarrow> Face (rev vs @ u # between (vertices f) u v @ [v]) Nonfinal \<in> \<F> ga) \<and> (va = v \<longrightarrow> Face (rev vs @ u # between (vertices f) u v @ [v]) Nonfinal \<in> \<F> ga) \<and> (va \<in> set vs \<longrightarrow> Face (rev vs @ u # between (vertices f) u v @ [v]) Nonfinal \<in> \<F> ga) \<and> (va \<in> set (between (vertices f) u v) \<longrightarrow> Face (rev vs @ u # between (vertices f) u v @ [v]) Nonfinal \<in> \<F> ga)
 2. \<And>ga u v f vs va. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; va < countVertices ga; \<not> final f; distinct (vertices f); distinct vs; {0..<countVertices ga} \<inter> set vs = {}; \<V> f \<inter> set vs = {}; u \<in> \<V> f; v \<in> \<V> f; u \<noteq> v; \<not> is_nextElem (vertices f) u v \<and> \<not> is_nextElem (vertices f) v u \<and> (u, v) \<notin> \<E> ga \<and> (v, u) \<notin> \<E> ga \<or> vs \<noteq> []; \<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f\<rbrakk> \<Longrightarrow> \<forall>f\<in>set (replace f [snd (split_face f u v vs)] (faces ga)). va \<in> \<V> f \<longrightarrow> f \<in> \<F> ga
[PROOF STEP]
apply(blast dest:inbetween_inset)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ga u v f vs va. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; va < countVertices ga; \<not> final f; distinct (vertices f); distinct vs; {0..<countVertices ga} \<inter> set vs = {}; \<V> f \<inter> set vs = {}; u \<in> \<V> f; v \<in> \<V> f; u \<noteq> v; \<not> is_nextElem (vertices f) u v \<and> \<not> is_nextElem (vertices f) v u \<and> (u, v) \<notin> \<E> ga \<and> (v, u) \<notin> \<E> ga \<or> vs \<noteq> []; \<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f\<rbrakk> \<Longrightarrow> \<forall>f\<in>set (replace f [snd (split_face f u v vs)] (faces ga)). va \<in> \<V> f \<longrightarrow> f \<in> \<F> ga
[PROOF STEP]
apply(clarsimp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ga u v f vs va fa. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; va < countVertices ga; \<not> final f; distinct (vertices f); distinct vs; {0..<countVertices ga} \<inter> set vs = {}; \<V> f \<inter> set vs = {}; u \<in> \<V> f; v \<in> \<V> f; u \<noteq> v; \<not> is_nextElem (vertices f) u v \<and> \<not> is_nextElem (vertices f) v u \<and> (u, v) \<notin> \<E> ga \<and> (v, u) \<notin> \<E> ga \<or> vs \<noteq> []; \<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f; fa \<in> set (replace f [snd (split_face f u v vs)] (faces ga)); va \<in> \<V> fa\<rbrakk> \<Longrightarrow> fa \<in> \<F> ga
[PROOF STEP]
apply(erule disjE[OF replace5])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ga u v f vs va fa. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; va < countVertices ga; \<not> final f; distinct (vertices f); distinct vs; {0..<countVertices ga} \<inter> set vs = {}; \<V> f \<inter> set vs = {}; u \<in> \<V> f; v \<in> \<V> f; u \<noteq> v; \<not> is_nextElem (vertices f) u v \<and> \<not> is_nextElem (vertices f) v u \<and> (u, v) \<notin> \<E> ga \<and> (v, u) \<notin> \<E> ga \<or> vs \<noteq> []; \<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f; va \<in> \<V> fa; fa \<in> \<F> ga\<rbrakk> \<Longrightarrow> fa \<in> \<F> ga
 2. \<And>ga u v f vs va fa. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; va < countVertices ga; \<not> final f; distinct (vertices f); distinct vs; {0..<countVertices ga} \<inter> set vs = {}; \<V> f \<inter> set vs = {}; u \<in> \<V> f; v \<in> \<V> f; u \<noteq> v; \<not> is_nextElem (vertices f) u v \<and> \<not> is_nextElem (vertices f) v u \<and> (u, v) \<notin> \<E> ga \<and> (v, u) \<notin> \<E> ga \<or> vs \<noteq> []; \<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f; va \<in> \<V> fa; fa \<in> set [snd (split_face f u v vs)]\<rbrakk> \<Longrightarrow> fa \<in> \<F> ga
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ga u v f vs va fa. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; va < countVertices ga; \<not> final f; distinct (vertices f); distinct vs; {0..<countVertices ga} \<inter> set vs = {}; \<V> f \<inter> set vs = {}; u \<in> \<V> f; v \<in> \<V> f; u \<noteq> v; \<not> is_nextElem (vertices f) u v \<and> \<not> is_nextElem (vertices f) v u \<and> (u, v) \<notin> \<E> ga \<and> (v, u) \<notin> \<E> ga \<or> vs \<noteq> []; \<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f; va \<in> \<V> fa; fa \<in> set [snd (split_face f u v vs)]\<rbrakk> \<Longrightarrow> fa \<in> \<F> ga
[PROOF STEP]
apply(clarsimp simp:split_face_def vertices_graph)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ga u v f vs va. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g); minGraphProps g; f \<in> \<F> ga; va < countVertices ga; \<not> final f; distinct (vertices f); distinct vs; {0..<countVertices ga} \<inter> set vs = {}; \<V> f \<inter> set vs = {}; u \<in> \<V> f; v \<in> \<V> f; u \<noteq> v; \<not> is_nextElem (vertices f) u v \<and> \<not> is_nextElem (vertices f) v u \<and> (u, v) \<notin> \<E> ga \<and> (v, u) \<notin> \<E> ga \<or> vs \<noteq> []; \<forall>f\<in>\<F> ga. va \<in> \<V> f \<longrightarrow> final f; va = v \<or> va = u \<or> va \<in> set (between (vertices f) v u) \<or> va \<in> set vs\<rbrakk> \<Longrightarrow> Face (v # between (vertices f) v u @ u # vs) Nonfinal \<in> \<F> ga
[PROOF STEP]
apply(blast dest:inbetween_inset)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_none [simp]:
  "cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t document = None \<longleftrightarrow> \<not> (\<exists>shadow_root. cast\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t shadow_root = document)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (cast document = None) = (\<nexists>shadow_root. cast shadow_root = document)
[PROOF STEP]
apply(auto simp add: cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_def cast\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def RObject.extend_def
      RDocument.extend_def RDocument.truncate_def
      split: sum.splits option.splits)[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x1. RDocument.more document = Some (Inl x1) \<Longrightarrow> \<exists>shadow_root. \<lparr>RObject.nothing = (), RDocument.nothing = (), doctype = doctype shadow_root, document_element = document_element shadow_root, disconnected_nodes = disconnected_nodes shadow_root, \<dots> = Some (Inl (RDocument.more shadow_root))\<rparr> = document
[PROOF STEP]
by (metis (mono_tags, lifting) RDocument.select_convs(2) RDocument.select_convs(3)
      RDocument.select_convs(4) RDocument.select_convs(5) RDocument.surjective old.unit.exhaust)


[STATEMENT]
lemma "P Eps"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P Eps
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P Eps
[PROOF STEP]
oops


[STATEMENT]
lemma "P \<Longrightarrow> Q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<Longrightarrow> Q
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<Longrightarrow> Q
[PROOF STEP]
oops


[STATEMENT]
lemma     syntax_test: "(o1 \<leftarrow> f1 ; o2 \<leftarrow> f2; result (post o1 o2)) = X"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. _bind_SE o1 f1 (_bind_SE o2 f2 (unit\<^sub>S\<^sub>E (post o1 o2))) = X
[PROOF STEP]
oops


[STATEMENT]
lemma ET_Source_Target [simp]:
  "\<lbrakk> SA \<in> SAs (HA ST); TS \<subseteq> ET ST; States SA \<inter> Source TS = {} \<rbrakk> \<Longrightarrow> States SA \<inter> Target TS = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>SA \<in> SAs (HA ST); TS \<subseteq> ET ST; States SA \<inter> Source TS = {}\<rbrakk> \<Longrightarrow> States SA \<inter> Target TS = {}
[PROOF STEP]
apply (unfold ET_def EnabledTrans_def Source_def Target_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>SA \<in> SAs (HA ST); TS \<subseteq> (\<Union>SA\<in>SAs (HA ST). ({(ST, SA, T). SA \<in> SAs (HA ST) \<and> T \<in> Delta SA \<and> source T \<in> Conf ST \<and> (Conf ST, Events ST, Value ST) |= label T} `` {ST}) `` {SA}); States SA \<inter> source ` TS = {}\<rbrakk> \<Longrightarrow> States SA \<inter> target ` TS = {}
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a aa ab ac b ba. \<lbrakk>SA \<in> SAs (HA ST); TS \<subseteq> (\<Union>x\<in>SAs (HA ST). {T \<in> Delta x. source T \<in> Conf ST \<and> (Conf ST, Events ST, Value ST) |= label T}); States SA \<inter> source ` TS = {}; ba \<in> States SA; (a, (aa, ab, ac, b), ba) \<in> TS\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (rename_tac Source Trigger Guard Action Update Target)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Source Trigger Guard Action Update Target. \<lbrakk>SA \<in> SAs (HA ST); TS \<subseteq> (\<Union>x\<in>SAs (HA ST). {T \<in> Delta x. source T \<in> Conf ST \<and> (Conf ST, Events ST, Value ST) |= label T}); States SA \<inter> source ` TS = {}; Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (erule subsetCE)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>Source Trigger Guard Action Update Target. \<lbrakk>SA \<in> SAs (HA ST); States SA \<inter> source ` TS = {}; Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; ?c29 Source Trigger Guard Action Update Target \<notin> TS\<rbrakk> \<Longrightarrow> False
 2. \<And>Source Trigger Guard Action Update Target. \<lbrakk>SA \<in> SAs (HA ST); States SA \<inter> source ` TS = {}; Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; ?c29 Source Trigger Guard Action Update Target \<in> (\<Union>x\<in>SAs (HA ST). {T \<in> Delta x. source T \<in> Conf ST \<and> (Conf ST, Events ST, Value ST) |= label T})\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Source Trigger Guard Action Update Target x. \<lbrakk>SA \<in> SAs (HA ST); States SA \<inter> source ` TS = {}; Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; x \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta x; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (rename_tac SAA)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); States SA \<inter> source ` TS = {}; Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (unfold image_def source_def Int_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); {x \<in> States SA. x \<in> {y. \<exists>x\<in>TS. y = fst x}} = {}; Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); \<forall>x. x \<in> States SA \<longrightarrow> (\<forall>xa\<in>TS. x \<noteq> fst xa); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (erule_tac x=Source in allE)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<in> States SA \<longrightarrow> (\<forall>x\<in>TS. Source \<noteq> fst x)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (frule Delta_source_States)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA; source (Source, (Trigger, Guard, Action, Update), Target) \<in> States SAA\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (unfold source_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA; fst (Source, (Trigger, Guard, Action, Update), Target) \<in> States SAA\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA; Source \<in> States SAA\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (case_tac "SA=SAA")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA; Source \<in> States SAA; SA = SAA\<rbrakk> \<Longrightarrow> False
 2. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA; Source \<in> States SAA; SA \<noteq> SAA\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA; Source \<in> States SAA; SA \<noteq> SAA\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (cut_tac HA="HA ST" in MutuallyDistinct_HA)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA; Source \<in> States SAA; SA \<noteq> SAA; MutuallyDistinct (SAs (HA ST))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (unfold MutuallyDistinct_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA; Source \<in> States SAA; SA \<noteq> SAA; \<forall>a\<in>SAs (HA ST). \<forall>b\<in>SAs (HA ST). a \<noteq> b \<longrightarrow> States a \<inter> States b = {}\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (erule_tac x=SA in ballE)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA; Source \<in> States SAA; SA \<noteq> SAA; \<forall>b\<in>SAs (HA ST). SA \<noteq> b \<longrightarrow> States SA \<inter> States b = {}\<rbrakk> \<Longrightarrow> False
 2. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA; Source \<in> States SAA; SA \<noteq> SAA; SA \<notin> SAs (HA ST)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (erule_tac x=SAA in ballE)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA; Source \<in> States SAA; SA \<noteq> SAA; SA \<noteq> SAA \<longrightarrow> States SA \<inter> States SAA = {}\<rbrakk> \<Longrightarrow> False
 2. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA; Source \<in> States SAA; SA \<noteq> SAA; SAA \<notin> SAs (HA ST)\<rbrakk> \<Longrightarrow> False
 3. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA; Source \<in> States SAA; SA \<noteq> SAA; SA \<notin> SAs (HA ST)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA; Source \<in> States SAA; SA \<noteq> SAA; States SA \<inter> States SAA = {}\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (frule Delta_target_States)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA; Source \<in> States SAA; SA \<noteq> SAA; States SA \<inter> States SAA = {}; target (Source, (Trigger, Guard, Action, Update), Target) \<in> States SAA\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (unfold target_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Source Trigger Guard Action Update Target SAA. \<lbrakk>SA \<in> SAs (HA ST); Target \<in> States SA; (Source, (Trigger, Guard, Action, Update), Target) \<in> TS; SAA \<in> SAs (HA ST); (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SAA; Source \<in> Conf ST; (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update); Source \<notin> States SA; Source \<in> States SAA; SA \<noteq> SAA; States SA \<inter> States SAA = {}; snd (snd (Source, (Trigger, Guard, Action, Update), Target)) \<in> States SAA\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply force
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "(x::('a, 'b, 'c) extpoint) = y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x = y
[PROOF STEP]
nitpick [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x = y
[PROOF STEP]
oops


[STATEMENT]
lemma test2: "In (I i) l \<in> set (Guards t2) \<Longrightarrow>
       In (I i) l' \<in> set (Guards t1) \<Longrightarrow>
       length ia = Arity t1 \<Longrightarrow>
       apply_guards (Guards t1) (join_ir ia c) \<Longrightarrow>
       x \<in> set l' \<Longrightarrow>
       x \<notin> set l \<Longrightarrow>
       \<forall>(v, l')\<in>insert (0, []) (set (get_Ins (Guards t1))). \<forall>g\<in>set (removeAll (In (I v) l') (Guards t1)). \<not> gexp_constrains g (V (I v)) \<Longrightarrow>
       Arity t1 = Arity t2 \<Longrightarrow>
       \<exists>i. length i = Arity t2 \<and> apply_guards (Guards t1) (join_ir i c) \<and> (length i = Arity t2 \<longrightarrow> \<not> apply_guards (Guards t2) (join_ir i c))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>In (I i) l \<in> set (Guards t2); In (I i) l' \<in> set (Guards t1); length ia = Arity t1; apply_guards (Guards t1) (join_ir ia c); x \<in> set l'; x \<notin> set l; \<forall>(v, l')\<in>insert (0, []) (set (get_Ins (Guards t1))). \<forall>g\<in>set (removeAll (In (I v) l') (Guards t1)). \<not> gexp_constrains g (V (I v)); Arity t1 = Arity t2\<rbrakk> \<Longrightarrow> \<exists>i. length i = Arity t2 \<and> apply_guards (Guards t1) (join_ir i c) \<and> (length i = Arity t2 \<longrightarrow> \<not> apply_guards (Guards t2) (join_ir i c))
[PROOF STEP]
using test[of i l "Guards t2" l' "Guards t1" x ia  c "Arity t2"]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>In (I i) l \<in> set (Guards t2); In (I i) l' \<in> set (Guards t1); x \<in> set l'; x \<notin> set l; apply_guards (Guards t1) (join_ir ia c); length ia = Arity t2; \<forall>g\<in>set (removeAll (In (I i) l') (Guards t1)). \<not> gexp_constrains g (V (I i))\<rbrakk> \<Longrightarrow> \<exists>i. length i = Arity t2 \<and> apply_guards (Guards t1) (join_ir i c) \<and> (length i = Arity t2 \<longrightarrow> \<not> apply_guards (Guards t2) (join_ir i c))

goal (1 subgoal):
 1. \<lbrakk>In (I i) l \<in> set (Guards t2); In (I i) l' \<in> set (Guards t1); length ia = Arity t1; apply_guards (Guards t1) (join_ir ia c); x \<in> set l'; x \<notin> set l; \<forall>(v, l')\<in>insert (0, []) (set (get_Ins (Guards t1))). \<forall>g\<in>set (removeAll (In (I v) l') (Guards t1)). \<not> gexp_constrains g (V (I v)); Arity t1 = Arity t2\<rbrakk> \<Longrightarrow> \<exists>i. length i = Arity t2 \<and> apply_guards (Guards t1) (join_ir i c) \<and> (length i = Arity t2 \<longrightarrow> \<not> apply_guards (Guards t2) (join_ir i c))
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>In (I i) l \<in> set (Guards t2); In (I i) l' \<in> set (Guards t1); length ia = Arity t2; apply_guards (Guards t1) (join_ir ia c); x \<in> set l'; x \<notin> set l; (\<forall>g\<in>set (Guards t1) - {In (I 0) []}. \<not> gexp_constrains g (V (I 0))) \<and> (\<forall>x\<in>set (get_Ins (Guards t1)). case x of (v, l') \<Rightarrow> \<forall>g\<in>set (Guards t1) - {In (I v) l'}. \<not> gexp_constrains g (V (I v))); Arity t1 = Arity t2; \<forall>g\<in>set (Guards t1) - {In (I i) l'}. \<not> gexp_constrains g (V (I i)) \<Longrightarrow> \<exists>i. length i = Arity t2 \<and> apply_guards (Guards t1) (join_ir i c) \<and> (length i = Arity t2 \<longrightarrow> \<not> apply_guards (Guards t2) (join_ir i c))\<rbrakk> \<Longrightarrow> \<exists>i. length i = Arity t2 \<and> apply_guards (Guards t1) (join_ir i c) \<and> (length i = Arity t2 \<longrightarrow> \<not> apply_guards (Guards t2) (join_ir i c))
[PROOF STEP]
apply (case_tac "\<forall>g\<in>set (Guards t1) - {In (I i) l'}. \<not> gexp_constrains g (V (I i))")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>In (I i) l \<in> set (Guards t2); In (I i) l' \<in> set (Guards t1); length ia = Arity t2; apply_guards (Guards t1) (join_ir ia c); x \<in> set l'; x \<notin> set l; (\<forall>g\<in>set (Guards t1) - {In (I 0) []}. \<not> gexp_constrains g (V (I 0))) \<and> (\<forall>x\<in>set (get_Ins (Guards t1)). case x of (v, l') \<Rightarrow> \<forall>g\<in>set (Guards t1) - {In (I v) l'}. \<not> gexp_constrains g (V (I v))); Arity t1 = Arity t2; \<forall>g\<in>set (Guards t1) - {In (I i) l'}. \<not> gexp_constrains g (V (I i)) \<Longrightarrow> \<exists>i. length i = Arity t2 \<and> apply_guards (Guards t1) (join_ir i c) \<and> (length i = Arity t2 \<longrightarrow> \<not> apply_guards (Guards t2) (join_ir i c)); \<forall>g\<in>set (Guards t1) - {In (I i) l'}. \<not> gexp_constrains g (V (I i))\<rbrakk> \<Longrightarrow> \<exists>i. length i = Arity t2 \<and> apply_guards (Guards t1) (join_ir i c) \<and> (length i = Arity t2 \<longrightarrow> \<not> apply_guards (Guards t2) (join_ir i c))
 2. \<lbrakk>In (I i) l \<in> set (Guards t2); In (I i) l' \<in> set (Guards t1); length ia = Arity t2; apply_guards (Guards t1) (join_ir ia c); x \<in> set l'; x \<notin> set l; (\<forall>g\<in>set (Guards t1) - {In (I 0) []}. \<not> gexp_constrains g (V (I 0))) \<and> (\<forall>x\<in>set (get_Ins (Guards t1)). case x of (v, l') \<Rightarrow> \<forall>g\<in>set (Guards t1) - {In (I v) l'}. \<not> gexp_constrains g (V (I v))); Arity t1 = Arity t2; \<forall>g\<in>set (Guards t1) - {In (I i) l'}. \<not> gexp_constrains g (V (I i)) \<Longrightarrow> \<exists>i. length i = Arity t2 \<and> apply_guards (Guards t1) (join_ir i c) \<and> (length i = Arity t2 \<longrightarrow> \<not> apply_guards (Guards t2) (join_ir i c)); \<not> (\<forall>g\<in>set (Guards t1) - {In (I i) l'}. \<not> gexp_constrains g (V (I i)))\<rbrakk> \<Longrightarrow> \<exists>i. length i = Arity t2 \<and> apply_guards (Guards t1) (join_ir i c) \<and> (length i = Arity t2 \<longrightarrow> \<not> apply_guards (Guards t2) (join_ir i c))
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>In (I i) l \<in> set (Guards t2); In (I i) l' \<in> set (Guards t1); length ia = Arity t2; apply_guards (Guards t1) (join_ir ia c); x \<in> set l'; x \<notin> set l; (\<forall>g\<in>set (Guards t1) - {In (I 0) []}. \<not> gexp_constrains g (V (I 0))) \<and> (\<forall>x\<in>set (get_Ins (Guards t1)). case x of (v, l') \<Rightarrow> \<forall>g\<in>set (Guards t1) - {In (I v) l'}. \<not> gexp_constrains g (V (I v))); Arity t1 = Arity t2; \<forall>g\<in>set (Guards t1) - {In (I i) l'}. \<not> gexp_constrains g (V (I i)) \<Longrightarrow> \<exists>i. length i = Arity t2 \<and> apply_guards (Guards t1) (join_ir i c) \<and> (length i = Arity t2 \<longrightarrow> \<not> apply_guards (Guards t2) (join_ir i c)); \<not> (\<forall>g\<in>set (Guards t1) - {In (I i) l'}. \<not> gexp_constrains g (V (I i)))\<rbrakk> \<Longrightarrow> \<exists>i. length i = Arity t2 \<and> apply_guards (Guards t1) (join_ir i c) \<and> (length i = Arity t2 \<longrightarrow> \<not> apply_guards (Guards t2) (join_ir i c))
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>In (I i) l \<in> set (Guards t2); In (I i) l' \<in> set (Guards t1); length ia = Arity t2; apply_guards (Guards t1) (join_ir ia c); x \<in> set l'; x \<notin> set l; (\<forall>g\<in>set (Guards t1) - {In (I 0) []}. \<not> gexp_constrains g (V (I 0))) \<and> (\<forall>x\<in>set (get_Ins (Guards t1)). case x of (v, l') \<Rightarrow> \<forall>g\<in>set (Guards t1) - {In (I v) l'}. \<not> gexp_constrains g (V (I v))); Arity t1 = Arity t2; \<exists>g\<in>set (Guards t1) - {In (I i) l'}. gexp_constrains g (V (I i))\<rbrakk> \<Longrightarrow> \<exists>i. length i = Arity t2 \<and> apply_guards (Guards t1) (join_ir i c) \<and> (length i = Arity t2 \<longrightarrow> \<not> apply_guards (Guards t2) (join_ir i c))
[PROOF STEP]
using In_in_get_Ins
[PROOF STATE]
proof (prove)
using this:
(In (I ?v) ?l \<in> set ?G) = ((?v, ?l) \<in> set (get_Ins ?G))

goal (1 subgoal):
 1. \<lbrakk>In (I i) l \<in> set (Guards t2); In (I i) l' \<in> set (Guards t1); length ia = Arity t2; apply_guards (Guards t1) (join_ir ia c); x \<in> set l'; x \<notin> set l; (\<forall>g\<in>set (Guards t1) - {In (I 0) []}. \<not> gexp_constrains g (V (I 0))) \<and> (\<forall>x\<in>set (get_Ins (Guards t1)). case x of (v, l') \<Rightarrow> \<forall>g\<in>set (Guards t1) - {In (I v) l'}. \<not> gexp_constrains g (V (I v))); Arity t1 = Arity t2; \<exists>g\<in>set (Guards t1) - {In (I i) l'}. gexp_constrains g (V (I i))\<rbrakk> \<Longrightarrow> \<exists>i. length i = Arity t2 \<and> apply_guards (Guards t1) (join_ir i c) \<and> (length i = Arity t2 \<longrightarrow> \<not> apply_guards (Guards t2) (join_ir i c))
[PROOF STEP]
by blast


[STATEMENT]
lemma random_scheduler_spec:
  assumes det: "\<alpha>.deterministic I"
  shows "scheduler_spec final r random_scheduler random_scheduler_invar thr_\<alpha> thr_invar ws_\<alpha> ws_invar is_\<alpha> is_invar I"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. scheduler_spec final r local.random_scheduler (\<lambda>_ _. True) thr_\<alpha> thr_invar ws_\<alpha> ws_invar is_\<alpha> is_invar I
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>\<sigma> s. \<lbrakk>local.random_scheduler \<sigma> s = None; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<alpha>.active_threads (state_\<alpha> s) = {}
 2. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x ln n. thr_\<alpha> (thr s) t = \<lfloor>(x, ln)\<rfloor> \<and> 0 < ln $ n \<and> \<not> waiting (ws_\<alpha> (wset s) t) \<and> may_acquire_all (locks s) t ln
 3. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x. thr_\<alpha> (thr s) t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> \<alpha>.r_syntax t x (shr s) ta x' m' \<and> \<alpha>.actions_ok (state_\<alpha> s) t ta
 4. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
 5. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
[PROOF STEP]
fix \<sigma> s
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>\<sigma> s. \<lbrakk>local.random_scheduler \<sigma> s = None; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<alpha>.active_threads (state_\<alpha> s) = {}
 2. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x ln n. thr_\<alpha> (thr s) t = \<lfloor>(x, ln)\<rfloor> \<and> 0 < ln $ n \<and> \<not> waiting (ws_\<alpha> (wset s) t) \<and> may_acquire_all (locks s) t ln
 3. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x. thr_\<alpha> (thr s) t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> \<alpha>.r_syntax t x (shr s) ta x' m' \<and> \<alpha>.actions_ok (state_\<alpha> s) t ta
 4. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
 5. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
[PROOF STEP]
assume rr: "random_scheduler \<sigma> s = None"
    and invar: "random_scheduler_invar \<sigma> (dom (thr_\<alpha> (thr s)))" "state_invar s" "state_\<alpha> s \<in> I"
[PROOF STATE]
proof (state)
this:
local.random_scheduler \<sigma> s = None
True
state_invar s
state_\<alpha> s \<in> I

goal (5 subgoals):
 1. \<And>\<sigma> s. \<lbrakk>local.random_scheduler \<sigma> s = None; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<alpha>.active_threads (state_\<alpha> s) = {}
 2. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x ln n. thr_\<alpha> (thr s) t = \<lfloor>(x, ln)\<rfloor> \<and> 0 < ln $ n \<and> \<not> waiting (ws_\<alpha> (wset s) t) \<and> may_acquire_all (locks s) t ln
 3. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x. thr_\<alpha> (thr s) t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> \<alpha>.r_syntax t x (shr s) ta x' m' \<and> \<alpha>.actions_ok (state_\<alpha> s) t ta
 4. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
 5. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
[PROOF STEP]
from invar(2)
[PROOF STATE]
proof (chain)
picking this:
state_invar s
[PROOF STEP]
have "thr'_invar (active_threads s)"
[PROOF STATE]
proof (prove)
using this:
state_invar s

goal (1 subgoal):
 1. thr'_invar (active_threads s)
[PROOF STEP]
by(rule active_threads_correct)
[PROOF STATE]
proof (state)
this:
thr'_invar (active_threads s)

goal (5 subgoals):
 1. \<And>\<sigma> s. \<lbrakk>local.random_scheduler \<sigma> s = None; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<alpha>.active_threads (state_\<alpha> s) = {}
 2. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x ln n. thr_\<alpha> (thr s) t = \<lfloor>(x, ln)\<rfloor> \<and> 0 < ln $ n \<and> \<not> waiting (ws_\<alpha> (wset s) t) \<and> may_acquire_all (locks s) t ln
 3. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x. thr_\<alpha> (thr s) t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> \<alpha>.r_syntax t x (shr s) ta x' m' \<and> \<alpha>.actions_ok (state_\<alpha> s) t ta
 4. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
 5. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
[PROOF STEP]
thus "\<alpha>.active_threads (state_\<alpha> s) = {}"
[PROOF STATE]
proof (prove)
using this:
thr'_invar (active_threads s)

goal (1 subgoal):
 1. \<alpha>.active_threads (state_\<alpha> s) = {}
[PROOF STEP]
using rr invar
[PROOF STATE]
proof (prove)
using this:
thr'_invar (active_threads s)
local.random_scheduler \<sigma> s = None
True
state_invar s
state_\<alpha> s \<in> I

goal (1 subgoal):
 1. \<alpha>.active_threads (state_\<alpha> s) = {}
[PROOF STEP]
by(auto simp add: random_scheduler_def Option_bind_eq_None_conv next_thread_eq_None_iff step_thread_eq_None_conv[OF det] dest: next_thread_eq_SomeD)
[PROOF STATE]
proof (state)
this:
\<alpha>.active_threads (state_\<alpha> s) = {}

goal (4 subgoals):
 1. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x ln n. thr_\<alpha> (thr s) t = \<lfloor>(x, ln)\<rfloor> \<and> 0 < ln $ n \<and> \<not> waiting (ws_\<alpha> (wset s) t) \<and> may_acquire_all (locks s) t ln
 2. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x. thr_\<alpha> (thr s) t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> \<alpha>.r_syntax t x (shr s) ta x' m' \<and> \<alpha>.actions_ok (state_\<alpha> s) t ta
 3. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
 4. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x ln n. thr_\<alpha> (thr s) t = \<lfloor>(x, ln)\<rfloor> \<and> 0 < ln $ n \<and> \<not> waiting (ws_\<alpha> (wset s) t) \<and> may_acquire_all (locks s) t ln
 2. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x. thr_\<alpha> (thr s) t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> \<alpha>.r_syntax t x (shr s) ta x' m' \<and> \<alpha>.actions_ok (state_\<alpha> s) t ta
 3. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
 4. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
[PROOF STEP]
fix \<sigma> s t \<sigma>'
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x ln n. thr_\<alpha> (thr s) t = \<lfloor>(x, ln)\<rfloor> \<and> 0 < ln $ n \<and> \<not> waiting (ws_\<alpha> (wset s) t) \<and> may_acquire_all (locks s) t ln
 2. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x. thr_\<alpha> (thr s) t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> \<alpha>.r_syntax t x (shr s) ta x' m' \<and> \<alpha>.actions_ok (state_\<alpha> s) t ta
 3. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
 4. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
[PROOF STEP]
assume rr: "random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>"
    and invar: "random_scheduler_invar \<sigma> (dom (thr_\<alpha> (thr s)))" "state_invar s" "state_\<alpha> s \<in> I"
[PROOF STATE]
proof (state)
this:
local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>
True
state_invar s
state_\<alpha> s \<in> I

goal (4 subgoals):
 1. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x ln n. thr_\<alpha> (thr s) t = \<lfloor>(x, ln)\<rfloor> \<and> 0 < ln $ n \<and> \<not> waiting (ws_\<alpha> (wset s) t) \<and> may_acquire_all (locks s) t ln
 2. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x. thr_\<alpha> (thr s) t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> \<alpha>.r_syntax t x (shr s) ta x' m' \<and> \<alpha>.actions_ok (state_\<alpha> s) t ta
 3. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
 4. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
[PROOF STEP]
thus "\<exists>x ln n. thr_\<alpha> (thr s) t = \<lfloor>(x, ln)\<rfloor> \<and> 0 < ln $ n \<and> \<not> waiting (ws_\<alpha> (wset s) t) \<and> may_acquire_all (locks s) t ln"
[PROOF STATE]
proof (prove)
using this:
local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>
True
state_invar s
state_\<alpha> s \<in> I

goal (1 subgoal):
 1. \<exists>x ln n. thr_\<alpha> (thr s) t = \<lfloor>(x, ln)\<rfloor> \<and> 0 < ln $ n \<and> \<not> waiting (ws_\<alpha> (wset s) t) \<and> may_acquire_all (locks s) t ln
[PROOF STEP]
by(fastforce simp add: random_scheduler_def bind_eq_Some_conv dest: step_thread_Some_NoneD[OF det])
[PROOF STATE]
proof (state)
this:
\<exists>x ln n. thr_\<alpha> (thr s) t = \<lfloor>(x, ln)\<rfloor> \<and> 0 < ln $ n \<and> \<not> waiting (ws_\<alpha> (wset s) t) \<and> may_acquire_all (locks s) t ln

goal (3 subgoals):
 1. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x. thr_\<alpha> (thr s) t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> \<alpha>.r_syntax t x (shr s) ta x' m' \<and> \<alpha>.actions_ok (state_\<alpha> s) t ta
 2. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
 3. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x. thr_\<alpha> (thr s) t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> \<alpha>.r_syntax t x (shr s) ta x' m' \<and> \<alpha>.actions_ok (state_\<alpha> s) t ta
 2. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
 3. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
[PROOF STEP]
fix \<sigma> s t ta x' m' \<sigma>'
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x. thr_\<alpha> (thr s) t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> \<alpha>.r_syntax t x (shr s) ta x' m' \<and> \<alpha>.actions_ok (state_\<alpha> s) t ta
 2. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
 3. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
[PROOF STEP]
assume rr: "random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>"
    and invar: "random_scheduler_invar \<sigma> (dom (thr_\<alpha> (thr s)))" "state_invar s" "state_\<alpha> s \<in> I"
[PROOF STATE]
proof (state)
this:
local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>
True
state_invar s
state_\<alpha> s \<in> I

goal (3 subgoals):
 1. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> \<exists>x. thr_\<alpha> (thr s) t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> \<alpha>.r_syntax t x (shr s) ta x' m' \<and> \<alpha>.actions_ok (state_\<alpha> s) t ta
 2. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
 3. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
[PROOF STEP]
thus "\<exists>x. thr_\<alpha> (thr s) t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> Predicate.eval (r t (x, shr s)) (ta, x', m') \<and> \<alpha>.actions_ok (state_\<alpha> s) t ta"
[PROOF STATE]
proof (prove)
using this:
local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>
True
state_invar s
state_\<alpha> s \<in> I

goal (1 subgoal):
 1. \<exists>x. thr_\<alpha> (thr s) t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> \<alpha>.r_syntax t x (shr s) ta x' m' \<and> \<alpha>.actions_ok (state_\<alpha> s) t ta
[PROOF STEP]
by(auto simp add: random_scheduler_def bind_eq_Some_conv dest: step_thread_Some_SomeD[OF det])
[PROOF STATE]
proof (state)
this:
\<exists>x. thr_\<alpha> (thr s) t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and> \<alpha>.r_syntax t x (shr s) ta x' m' \<and> \<alpha>.actions_ok (state_\<alpha> s) t ta

goal (2 subgoals):
 1. \<And>\<sigma> s t \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, None, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
 2. \<And>\<sigma> s t ta x' m' \<sigma>'. \<lbrakk>local.random_scheduler \<sigma> s = \<lfloor>(t, \<lfloor>(ta, x', m')\<rfloor>, \<sigma>')\<rfloor>; state_invar s; True; state_\<alpha> s \<in> I\<rbrakk> \<Longrightarrow> True
[PROOF STEP]
qed simp_all


[STATEMENT]
lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_tag_name_type_wf_preserved [simp]:
  "h \<turnstile> put_M element_ptr tag_name_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. h \<turnstile> put_M element_ptr tag_name_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> DocumentClass.type_wf h = DocumentClass.type_wf h'
[PROOF STEP]
apply(auto simp add: ElementMonad.put_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def
      DocumentClass.type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a DocumentClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
      DocumentClass.type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e DocumentClass.type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
      is_node_kind_def
      dest!: get_heap_E
      elim!: bind_returns_heap_E2
      intro!: type_wf_put_I CharacterDataMonad.type_wf_put_I ElementMonad.type_wf_put_I
      NodeMonad.type_wf_put_I ObjectMonad.type_wf_put_I)[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; DocumentClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h)\<rbrakk> \<Longrightarrow> DocumentClass.type_wf h
[PROOF STEP]
apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs NodeClass.type_wf_defs
      ElementMonad.get_M_defs ObjectClass.type_wf_defs
      CharacterDataClass.type_wf_defs split: option.splits)[1]
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x node_ptr. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; \<forall>document_ptr\<in>fset (document_ptr_kinds h). \<exists>y. get document_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; node_ptr |\<in>| node_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get node_ptr h = Some y
 2. \<And>x element_ptra. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; \<forall>document_ptr\<in>fset (document_ptr_kinds h). \<exists>y. get document_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; element_ptra |\<in>| element_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get element_ptra h = Some y
[PROOF STEP]
apply (metis NodeClass.a_type_wf_def NodeClass.get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf ObjectClass.a_type_wf_def
      bind.bind_lzero finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def l_type_wf_def\<^sub>N\<^sub>o\<^sub>d\<^sub>e.a_type_wf_def option.collapse
      option.distinct(1) option.simps(3))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x element_ptra. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; \<forall>document_ptr\<in>fset (document_ptr_kinds h). \<exists>y. get document_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>tag_name := v\<rparr>))) h; \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>tag_name := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>tag_name := v\<rparr>)) else get element_ptra h) = Some y; element_ptra |\<in>| element_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get element_ptra h = Some y
[PROOF STEP]
by (metis fmember.rep_eq)


[STATEMENT]
lemma cast_shadow_root_mode_document_document_element [simp]:
  "RShadowRoot.mode (the (cast (cast x\<lparr>document_element := y\<rparr>))) = RShadowRoot.mode x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mode (the (cast (cast x\<lparr>document_element := y\<rparr>))) = mode x
[PROOF STEP]
apply(auto simp add: cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_def cast\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def RDocument.extend_def RDocument.truncate_def
      split: option.splits)[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mode \<lparr>RObject.nothing = (), RDocument.nothing = (), doctype = doctype x, document_element = y, disconnected_nodes = disconnected_nodes x, \<dots> = RDocument.more x\<rparr> = mode x
[PROOF STEP]
by (metis RDocument.ext_inject RDocument.surjective RObject.ext_inject RShadowRoot.ext_inject RShadowRoot.surjective)


[STATEMENT]
lemma analz_Un_implConfidSet_2_aux_3:
  "Enc_keys_clean H \<Longrightarrow>
   Ag \<inter> broken (parts H \<inter> range LtK) = {} \<Longrightarrow>
   analz (implConfidSet_aux Ag G \<union> H) \<subseteq> synth (analz H) \<union> -payload"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Enc_keys_clean H; Ag \<inter> broken (parts H \<inter> range LtK) = {}\<rbrakk> \<Longrightarrow> analz (implSecureSet_aux Ag G \<union> H) \<subseteq> synth (analz H) \<union> - payload
[PROOF STEP]
by (rule subset_trans [OF analz_Un_implConfidSet_2_aux_1], auto)


[STATEMENT]
lemma wcode_backto_standard_pos_2_Oc_mv_hd[simp]:
  "wcode_backto_standard_pos_2 ires rs (b, Oc # list)
            \<Longrightarrow> wcode_backto_standard_pos_2 ires rs (tl b, hd b # Oc # list)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wcode_backto_standard_pos_2 ires rs (b, Oc # list) \<Longrightarrow> wcode_backto_standard_pos_2 ires rs (tl b, hd b # Oc # list)
[PROOF STEP]
apply(simp only: wcode_fourtimes_invs)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>ml mr ln rn. b = Oc \<up> ml @ Bk # Bk # Bk \<up> ln @ Oc # ires \<and> Oc # list = Oc \<up> mr @ Bk \<up> rn \<and> ml + mr = Suc (Suc rs) \<and> 0 < mr) \<or> (\<exists>ln rn. b = Bk # Bk \<up> ln @ Oc # ires \<and> Oc # list = Bk # Oc \<up> Suc (Suc rs) @ Bk \<up> rn) \<Longrightarrow> (\<exists>ml mr ln rn. tl b = Oc \<up> ml @ Bk # Bk # Bk \<up> ln @ Oc # ires \<and> hd b # Oc # list = Oc \<up> mr @ Bk \<up> rn \<and> ml + mr = Suc (Suc rs) \<and> 0 < mr) \<or> (\<exists>ln rn. tl b = Bk # Bk \<up> ln @ Oc # ires \<and> hd b # Oc # list = Bk # Oc \<up> Suc (Suc rs) @ Bk \<up> rn)
[PROOF STEP]
apply(erule_tac disjE)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<exists>ml mr ln rn. b = Oc \<up> ml @ Bk # Bk # Bk \<up> ln @ Oc # ires \<and> Oc # list = Oc \<up> mr @ Bk \<up> rn \<and> ml + mr = Suc (Suc rs) \<and> 0 < mr \<Longrightarrow> (\<exists>ml mr ln rn. tl b = Oc \<up> ml @ Bk # Bk # Bk \<up> ln @ Oc # ires \<and> hd b # Oc # list = Oc \<up> mr @ Bk \<up> rn \<and> ml + mr = Suc (Suc rs) \<and> 0 < mr) \<or> (\<exists>ln rn. tl b = Bk # Bk \<up> ln @ Oc # ires \<and> hd b # Oc # list = Bk # Oc \<up> Suc (Suc rs) @ Bk \<up> rn)
 2. \<exists>ln rn. b = Bk # Bk \<up> ln @ Oc # ires \<and> Oc # list = Bk # Oc \<up> Suc (Suc rs) @ Bk \<up> rn \<Longrightarrow> (\<exists>ml mr ln rn. tl b = Oc \<up> ml @ Bk # Bk # Bk \<up> ln @ Oc # ires \<and> hd b # Oc # list = Oc \<up> mr @ Bk \<up> rn \<and> ml + mr = Suc (Suc rs) \<and> 0 < mr) \<or> (\<exists>ln rn. tl b = Bk # Bk \<up> ln @ Oc # ires \<and> hd b # Oc # list = Bk # Oc \<up> Suc (Suc rs) @ Bk \<up> rn)
[PROOF STEP]
apply(erule_tac exE)+
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ml mr ln rn. b = Oc \<up> ml @ Bk # Bk # Bk \<up> ln @ Oc # ires \<and> Oc # list = Oc \<up> mr @ Bk \<up> rn \<and> ml + mr = Suc (Suc rs) \<and> 0 < mr \<Longrightarrow> (\<exists>ml mr ln rn. tl b = Oc \<up> ml @ Bk # Bk # Bk \<up> ln @ Oc # ires \<and> hd b # Oc # list = Oc \<up> mr @ Bk \<up> rn \<and> ml + mr = Suc (Suc rs) \<and> 0 < mr) \<or> (\<exists>ln rn. tl b = Bk # Bk \<up> ln @ Oc # ires \<and> hd b # Oc # list = Bk # Oc \<up> Suc (Suc rs) @ Bk \<up> rn)
 2. \<exists>ln rn. b = Bk # Bk \<up> ln @ Oc # ires \<and> Oc # list = Bk # Oc \<up> Suc (Suc rs) @ Bk \<up> rn \<Longrightarrow> (\<exists>ml mr ln rn. tl b = Oc \<up> ml @ Bk # Bk # Bk \<up> ln @ Oc # ires \<and> hd b # Oc # list = Oc \<up> mr @ Bk \<up> rn \<and> ml + mr = Suc (Suc rs) \<and> 0 < mr) \<or> (\<exists>ln rn. tl b = Bk # Bk \<up> ln @ Oc # ires \<and> hd b # Oc # list = Bk # Oc \<up> Suc (Suc rs) @ Bk \<up> rn)
[PROOF STEP]
apply(rename_tac ml mr ln rn)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ml mr ln rn. b = Oc \<up> ml @ Bk # Bk # Bk \<up> ln @ Oc # ires \<and> Oc # list = Oc \<up> mr @ Bk \<up> rn \<and> ml + mr = Suc (Suc rs) \<and> 0 < mr \<Longrightarrow> (\<exists>ml mr ln rn. tl b = Oc \<up> ml @ Bk # Bk # Bk \<up> ln @ Oc # ires \<and> hd b # Oc # list = Oc \<up> mr @ Bk \<up> rn \<and> ml + mr = Suc (Suc rs) \<and> 0 < mr) \<or> (\<exists>ln rn. tl b = Bk # Bk \<up> ln @ Oc # ires \<and> hd b # Oc # list = Bk # Oc \<up> Suc (Suc rs) @ Bk \<up> rn)
 2. \<exists>ln rn. b = Bk # Bk \<up> ln @ Oc # ires \<and> Oc # list = Bk # Oc \<up> Suc (Suc rs) @ Bk \<up> rn \<Longrightarrow> (\<exists>ml mr ln rn. tl b = Oc \<up> ml @ Bk # Bk # Bk \<up> ln @ Oc # ires \<and> hd b # Oc # list = Oc \<up> mr @ Bk \<up> rn \<and> ml + mr = Suc (Suc rs) \<and> 0 < mr) \<or> (\<exists>ln rn. tl b = Bk # Bk \<up> ln @ Oc # ires \<and> hd b # Oc # list = Bk # Oc \<up> Suc (Suc rs) @ Bk \<up> rn)
[PROOF STEP]
by (case_tac ml, force,force,force)


[STATEMENT]
lemma "P  \<sigma> \<Turnstile> (_  \<leftarrow> assume\<^sub>S\<^sub>E P ; x  \<leftarrow> M; assert\<^sub>S\<^sub>E (\<lambda>\<sigma>.  (x=X) \<and> Q x \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<sigma> \<Turnstile> _bind_SE _ (assume\<^sub>S\<^sub>E P) (_bind_SE x M (assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. x = X \<and> Q x \<sigma>)))
[PROOF STEP]
oops


[STATEMENT]
lemma " (b \<union> m \<union> ov \<union> s \<union> d) O (b \<union> m \<union> ov \<union> s \<union> d) \<subseteq>  b \<union> m \<union> ov \<union> s \<union> d"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (b \<union> m \<union> ov \<union> s \<union> d) O (b \<union> m \<union> ov \<union> s \<union> d) \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
[PROOF STEP]
apply (simp, intro conjI)
[PROOF STATE]
proof (prove)
goal (25 subgoals):
 1. b O b \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 2. m O b \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 3. ov O b \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 4. s O b \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 5. d O b \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 6. b O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 7. m O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 8. ov O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 9. s O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 10. d O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
A total of 25 subgoals...
[PROOF STEP]
using crb_rules
[PROOF STATE]
proof (prove)
using this:
b \<in> {e, m, b, ov, s, f, d, m\<inverse>, b\<inverse>, ov\<inverse>, s\<inverse>, f\<inverse>, d\<inverse>} \<Longrightarrow> e O b = b
b O b \<subseteq> b
m O b \<subseteq> b
ov O b \<subseteq> b
s O b \<subseteq> b
f O b \<subseteq> b
d O b \<subseteq> b
m\<inverse> O b \<subseteq> b \<union> m \<union> ov \<union> f\<inverse> \<union> d\<inverse>
b\<inverse> O b \<subseteq> b \<union> b\<inverse> \<union> m \<union> m\<inverse> \<union> e \<union> ov \<union> ov\<inverse> \<union> s \<union> s\<inverse> \<union> d \<union> d\<inverse> \<union> f \<union> f\<inverse>
ov\<inverse> O b \<subseteq> b \<union> m \<union> ov \<union> f\<inverse> \<union> d\<inverse>
s\<inverse> O b \<subseteq> b \<union> m \<union> ov \<union> f\<inverse> \<union> d\<inverse>
f\<inverse> O b \<subseteq> b
d\<inverse> O b \<subseteq> b \<union> m \<union> ov \<union> f\<inverse> \<union> d\<inverse>

goal (25 subgoals):
 1. b O b \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 2. m O b \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 3. ov O b \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 4. s O b \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 5. d O b \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 6. b O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 7. m O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 8. ov O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 9. s O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 10. d O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
A total of 25 subgoals...
[PROOF STEP]
apply auto[5]
[PROOF STATE]
proof (prove)
goal (20 subgoals):
 1. b O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 2. m O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 3. ov O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 4. s O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 5. d O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 6. b O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 7. m O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 8. ov O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 9. s O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 10. d O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
A total of 20 subgoals...
[PROOF STEP]
using crm_rules
[PROOF STATE]
proof (prove)
using this:
m \<in> {e, m, b, ov, s, f, d, m\<inverse>, b\<inverse>, ov\<inverse>, s\<inverse>, f\<inverse>, d\<inverse>} \<Longrightarrow> e O m = m
b O m \<subseteq> b
m O m \<subseteq> b
ov O m \<subseteq> b
s O m \<subseteq> b
f O m \<subseteq> m
d O m \<subseteq> b
m\<inverse> O m \<subseteq> s \<union> s\<inverse> \<union> e
b\<inverse> O m \<subseteq> b\<inverse> \<union> m\<inverse> \<union> ov\<inverse> \<union> f \<union> d
ov\<inverse> O m \<subseteq> ov \<union> f\<inverse> \<union> d\<inverse>
s\<inverse> O m \<subseteq> ov \<union> f\<inverse> \<union> d\<inverse>
f\<inverse> O m \<subseteq> m
d\<inverse> O m \<subseteq> ov \<union> d\<inverse> \<union> f\<inverse>

goal (20 subgoals):
 1. b O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 2. m O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 3. ov O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 4. s O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 5. d O m \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 6. b O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 7. m O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 8. ov O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 9. s O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 10. d O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
A total of 20 subgoals...
[PROOF STEP]
apply auto[5]
[PROOF STATE]
proof (prove)
goal (15 subgoals):
 1. b O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 2. m O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 3. ov O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 4. s O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 5. d O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 6. b O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 7. m O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 8. ov O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 9. s O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 10. d O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
A total of 15 subgoals...
[PROOF STEP]
using crov_rules
[PROOF STATE]
proof (prove)
using this:
ov \<in> {e, m, b, ov, s, f, d, m\<inverse>, b\<inverse>, ov\<inverse>, s\<inverse>, f\<inverse>, d\<inverse>} \<Longrightarrow> e O ov = ov
b O ov \<subseteq> b
m O ov \<subseteq> b
ov O ov \<subseteq> b \<union> m \<union> ov
s O ov \<subseteq> b \<union> m \<union> ov
f O ov \<subseteq> ov \<union> s \<union> d
d O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
m\<inverse> O ov \<subseteq> ov\<inverse> \<union> d \<union> f
b\<inverse> O ov \<subseteq> b\<inverse> \<union> m\<inverse> \<union> ov\<inverse> \<union> f \<union> d
ov\<inverse> O ov \<subseteq> e \<union> ov \<union> ov\<inverse> \<union> d \<union> d\<inverse> \<union> s \<union> s\<inverse> \<union> f \<union> f\<inverse>
s\<inverse> O ov \<subseteq> ov \<union> f\<inverse> \<union> d\<inverse>
f\<inverse> O ov \<subseteq> ov
d\<inverse> O ov \<subseteq> ov \<union> f\<inverse> \<union> d\<inverse>

goal (15 subgoals):
 1. b O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 2. m O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 3. ov O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 4. s O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 5. d O ov \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 6. b O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 7. m O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 8. ov O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 9. s O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 10. d O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
A total of 15 subgoals...
[PROOF STEP]
apply auto[5]
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. b O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 2. m O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 3. ov O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 4. s O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 5. d O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 6. b O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 7. m O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 8. ov O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 9. s O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 10. d O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
[PROOF STEP]
using crs_rules
[PROOF STATE]
proof (prove)
using this:
s \<in> {e, m, b, ov, s, f, d, m\<inverse>, b\<inverse>, ov\<inverse>, s\<inverse>, f\<inverse>, d\<inverse>} \<Longrightarrow> e O s = s
b O s \<subseteq> b
m O s \<subseteq> m
ov O s \<subseteq> ov
s O s \<subseteq> s
f O s \<subseteq> d
d O s \<subseteq> d
m\<inverse> O s \<subseteq> ov\<inverse> \<union> d \<union> f
b\<inverse> O s \<subseteq> b\<inverse> \<union> m\<inverse> \<union> ov\<inverse> \<union> f \<union> d
ov\<inverse> O s \<subseteq> ov\<inverse> \<union> f \<union> d
s\<inverse> O s \<subseteq> e \<union> s \<union> s\<inverse>
f\<inverse> O s \<subseteq> ov
d\<inverse> O s \<subseteq> ov \<union> f\<inverse> \<union> d\<inverse>

goal (10 subgoals):
 1. b O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 2. m O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 3. ov O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 4. s O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 5. d O s \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 6. b O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 7. m O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 8. ov O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 9. s O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 10. d O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
[PROOF STEP]
apply auto[5]
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. b O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 2. m O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 3. ov O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 4. s O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 5. d O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
[PROOF STEP]
using crd_rules
[PROOF STATE]
proof (prove)
using this:
d \<in> {e, m, b, ov, s, f, d, m\<inverse>, b\<inverse>, ov\<inverse>, s\<inverse>, f\<inverse>, d\<inverse>} \<Longrightarrow> e O d = d
b O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
m O d \<subseteq> s \<union> ov \<union> d
ov O d \<subseteq> s \<union> ov \<union> d
s O d \<subseteq> d
f O d \<subseteq> d
d O d \<subseteq> d
m\<inverse> O d \<subseteq> ov\<inverse> \<union> d \<union> f
b\<inverse> O d \<subseteq> b\<inverse> \<union> m\<inverse> \<union> ov\<inverse> \<union> f \<union> d
ov\<inverse> O d \<subseteq> ov\<inverse> \<union> f \<union> d
s\<inverse> O d \<subseteq> ov\<inverse> \<union> f \<union> d
f\<inverse> O d \<subseteq> s \<union> ov \<union> d
d\<inverse> O d \<subseteq> e \<union> ov \<union> ov\<inverse> \<union> d \<union> d\<inverse> \<union> s \<union> s\<inverse> \<union> f \<union> f\<inverse>

goal (5 subgoals):
 1. b O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 2. m O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 3. ov O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 4. s O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
 5. d O d \<subseteq> b \<union> m \<union> ov \<union> s \<union> d
[PROOF STEP]
by auto[5]


[STATEMENT]
lemma Outpts_A_Card_unique_key:
   "\<lbrakk> Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, V\<rbrace> \<in> set evs;
      Outpts (Card A') A' \<lbrace>Agent B', Nonce Nb', Key K, V'\<rbrace> \<in> set evs;
         evs \<in> srb \<rbrakk> \<Longrightarrow> A=A' \<and> B=B' \<and> Nb=Nb' \<and> V=V'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, V\<rbrace> \<in> set evs; Outpts (Card A') A' \<lbrace>Agent B', Nonce Nb', Key K, V'\<rbrace> \<in> set evs; evs \<in> srb\<rbrakk> \<Longrightarrow> A = A' \<and> B = B' \<and> Nb = Nb' \<and> V = V'
[PROOF STEP]
apply (erule rev_mp, erule rev_mp, erule srb.induct, simp_all)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>evs10 Aa Ka Nba Ba Na. \<lbrakk>evs10 \<in> srb; Outpts (Card A') A' \<lbrace>Agent B', Nonce Nb', Key K, V'\<rbrace> \<in> set evs10 \<longrightarrow> Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, V\<rbrace> \<in> set evs10 \<longrightarrow> A = A' \<and> B = B' \<and> Nb = Nb' \<and> V = V'; Card Aa \<notin> stolen; Aa \<noteq> Server; Ka = sesK (Nba, pairK (Aa, Ba)); Inputs Aa (Card Aa) \<lbrace>Agent Ba, Nonce Na, Nonce Nba, Nonce (Pairkey (Aa, Ba)), Crypt (shrK Aa) \<lbrace>Nonce (Pairkey (Aa, Ba)), Agent Ba\<rbrace>, Crypt (pairK (Aa, Ba)) \<lbrace>Nonce Na, Nonce Nba\<rbrace>, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> \<in> set evs10\<rbrakk> \<Longrightarrow> (A' = Aa \<and> B' = Ba \<and> Nb' = Nba \<and> K = sesK (Nba, pairK (Aa, Ba)) \<and> V' = Crypt (pairK (Aa, Ba)) (Nonce Nba) \<longrightarrow> Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key (sesK (Nba, pairK (Aa, Ba))), V\<rbrace> \<in> set evs10 \<longrightarrow> A = Aa \<and> B = Ba \<and> Nb = Nba \<and> V = Crypt (pairK (Aa, Ba)) (Nonce Nba)) \<and> (Outpts (Card A') A' \<lbrace>Agent B', Nonce Nb', Key K, V'\<rbrace> \<in> set evs10 \<longrightarrow> A = Aa \<and> B = Ba \<and> Nb = Nba \<and> K = sesK (Nba, pairK (Aa, Ba)) \<and> V = Crypt (pairK (Aa, Ba)) (Nonce Nba) \<longrightarrow> Aa = A' \<and> Ba = B' \<and> Nba = Nb' \<and> Crypt (pairK (Aa, Ba)) (Nonce Nba) = V')
 2. \<And>evs10F Aa Ka Nba Ba Na. \<lbrakk>evs10F \<in> srb; Outpts (Card A') A' \<lbrace>Agent B', Nonce Nb', Key K, V'\<rbrace> \<in> set evs10F \<longrightarrow> Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, V\<rbrace> \<in> set evs10F \<longrightarrow> A = A' \<and> B = B' \<and> Nb = Nb' \<and> V = V'; Card Aa \<in> stolen \<and> Aa \<in> bad \<or> Card Aa \<in> cloned; Ka = sesK (Nba, pairK (Aa, Ba)); Inputs Spy (Card Aa) \<lbrace>Agent Ba, Nonce Na, Nonce Nba, Nonce (Pairkey (Aa, Ba)), Crypt (shrK Aa) \<lbrace>Nonce (Pairkey (Aa, Ba)), Agent Ba\<rbrace>, Crypt (pairK (Aa, Ba)) \<lbrace>Nonce Na, Nonce Nba\<rbrace>, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> \<in> set evs10F\<rbrakk> \<Longrightarrow> (A' = Aa \<and> A' = Spy \<and> B' = Ba \<and> Nb' = Nba \<and> K = sesK (Nba, pairK (Aa, Ba)) \<and> V' = Crypt (pairK (Aa, Ba)) (Nonce Nba) \<longrightarrow> Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key (sesK (Nba, pairK (Aa, Ba))), V\<rbrace> \<in> set evs10F \<longrightarrow> A = Aa \<and> B = Ba \<and> Nb = Nba \<and> V = Crypt (pairK (Aa, Ba)) (Nonce Nba)) \<and> (Outpts (Card A') A' \<lbrace>Agent B', Nonce Nb', Key K, V'\<rbrace> \<in> set evs10F \<longrightarrow> A = Aa \<and> A = Spy \<and> B = Ba \<and> Nb = Nba \<and> K = sesK (Nba, pairK (Aa, Ba)) \<and> V = Crypt (pairK (Aa, Ba)) (Nonce Nba) \<longrightarrow> Aa = A' \<and> Ba = B' \<and> Nba = Nb' \<and> Crypt (pairK (Aa, Ba)) (Nonce Nba) = V')
[PROOF STEP]
apply (blast dest: Outpts_A_Card_form_bis)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evs10F Aa Ka Nba Ba Na. \<lbrakk>evs10F \<in> srb; Outpts (Card A') A' \<lbrace>Agent B', Nonce Nb', Key K, V'\<rbrace> \<in> set evs10F \<longrightarrow> Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key K, V\<rbrace> \<in> set evs10F \<longrightarrow> A = A' \<and> B = B' \<and> Nb = Nb' \<and> V = V'; Card Aa \<in> stolen \<and> Aa \<in> bad \<or> Card Aa \<in> cloned; Ka = sesK (Nba, pairK (Aa, Ba)); Inputs Spy (Card Aa) \<lbrace>Agent Ba, Nonce Na, Nonce Nba, Nonce (Pairkey (Aa, Ba)), Crypt (shrK Aa) \<lbrace>Nonce (Pairkey (Aa, Ba)), Agent Ba\<rbrace>, Crypt (pairK (Aa, Ba)) \<lbrace>Nonce Na, Nonce Nba\<rbrace>, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> \<in> set evs10F\<rbrakk> \<Longrightarrow> (A' = Aa \<and> A' = Spy \<and> B' = Ba \<and> Nb' = Nba \<and> K = sesK (Nba, pairK (Aa, Ba)) \<and> V' = Crypt (pairK (Aa, Ba)) (Nonce Nba) \<longrightarrow> Outpts (Card A) A \<lbrace>Agent B, Nonce Nb, Key (sesK (Nba, pairK (Aa, Ba))), V\<rbrace> \<in> set evs10F \<longrightarrow> A = Aa \<and> B = Ba \<and> Nb = Nba \<and> V = Crypt (pairK (Aa, Ba)) (Nonce Nba)) \<and> (Outpts (Card A') A' \<lbrace>Agent B', Nonce Nb', Key K, V'\<rbrace> \<in> set evs10F \<longrightarrow> A = Aa \<and> A = Spy \<and> B = Ba \<and> Nb = Nba \<and> K = sesK (Nba, pairK (Aa, Ba)) \<and> V = Crypt (pairK (Aa, Ba)) (Nonce Nba) \<longrightarrow> Aa = A' \<and> Ba = B' \<and> Nba = Nb' \<and> Crypt (pairK (Aa, Ba)) (Nonce Nba) = V')
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma True
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. True
[PROOF STEP]
nitpick [satisfy]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. True
[PROOF STEP]
oops


[STATEMENT]
lemma "P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P
[PROOF STEP]
oops