[STATEMENT]
lemma subst_v_eval_v[simp]:
  fixes v::v and v'::v
  assumes "i \<lbrakk> v \<rbrakk> ~  s" and "i \<lbrakk> (v'[x::=v]\<^sub>v\<^sub>v) \<rbrakk> ~ s'"
  shows "(i ( x \<mapsto> s )) \<lbrakk> v' \<rbrakk> ~ s'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> v' \<rbrakk> ~ s'
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> v'[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> v' \<rbrakk> ~ s'
[PROOF STEP]
proof(nominal_induct v' arbitrary: s' rule:v.strong_induct)
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>xa s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ xa ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ xa ]\<^sup>v \<rbrakk> ~ s'
 2. \<And>xa s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ xa ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ xa ]\<^sup>v \<rbrakk> ~ s'
 3. \<And>x1a x2a s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x1a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x1a \<rbrakk> ~ s' ; \<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x2a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x2a \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x1a , x2a ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x1a , x2a ]\<^sup>v \<rbrakk> ~ s'
 4. \<And>x1a x2a x3 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x3[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x3 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_cons x1a x2a x3)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_cons x1a x2a x3 \<rbrakk> ~ s'
 5. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
case (V_lit x)
[PROOF STATE]
proof (state)
this:
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> [ x ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'

goal (5 subgoals):
 1. \<And>xa s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ xa ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ xa ]\<^sup>v \<rbrakk> ~ s'
 2. \<And>xa s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ xa ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ xa ]\<^sup>v \<rbrakk> ~ s'
 3. \<And>x1a x2a s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x1a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x1a \<rbrakk> ~ s' ; \<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x2a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x2a \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x1a , x2a ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x1a , x2a ]\<^sup>v \<rbrakk> ~ s'
 4. \<And>x1a x2a x3 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x3[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x3 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_cons x1a x2a x3)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_cons x1a x2a x3 \<rbrakk> ~ s'
 5. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> [ x ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> [ x ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> [ x ]\<^sup>v \<rbrakk> ~ s'
[PROOF STEP]
using subst_vv.simps
[PROOF STATE]
proof (prove)
using this:
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> [ x ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'
[ ?l ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = [ ?l ]\<^sup>v
[ ?y ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = (if ?x = ?y then ?v else [ ?y ]\<^sup>v)
(V_cons ?tyid ?c ?v')[?x::=?v]\<^sub>v\<^sub>v = V_cons ?tyid ?c ?v'[?x::=?v]\<^sub>v\<^sub>v
(V_consp ?tyid ?c ?b ?v')[?x::=?v]\<^sub>v\<^sub>v = V_consp ?tyid ?c ?b ?v'[?x::=?v]\<^sub>v\<^sub>v
[ ?v1.0 , ?v2.0 ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = [ ?v1.0[?x::=?v]\<^sub>v\<^sub>v , ?v2.0[?x::=?v]\<^sub>v\<^sub>v ]\<^sup>v

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> [ x ]\<^sup>v \<rbrakk> ~ s'
[PROOF STEP]
by (metis eval_v_elims(1) eval_v_litI)
[PROOF STATE]
proof (state)
this:
i(x \<mapsto> s) \<lbrakk> [ x ]\<^sup>v \<rbrakk> ~ s'

goal (4 subgoals):
 1. \<And>xa s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ xa ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ xa ]\<^sup>v \<rbrakk> ~ s'
 2. \<And>x1a x2a s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x1a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x1a \<rbrakk> ~ s' ; \<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x2a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x2a \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x1a , x2a ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x1a , x2a ]\<^sup>v \<rbrakk> ~ s'
 3. \<And>x1a x2a x3 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x3[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x3 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_cons x1a x2a x3)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_cons x1a x2a x3 \<rbrakk> ~ s'
 4. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>xa s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ xa ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ xa ]\<^sup>v \<rbrakk> ~ s'
 2. \<And>x1a x2a s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x1a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x1a \<rbrakk> ~ s' ; \<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x2a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x2a \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x1a , x2a ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x1a , x2a ]\<^sup>v \<rbrakk> ~ s'
 3. \<And>x1a x2a x3 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x3[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x3 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_cons x1a x2a x3)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_cons x1a x2a x3 \<rbrakk> ~ s'
 4. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
case (V_var x')
[PROOF STATE]
proof (state)
this:
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'

goal (4 subgoals):
 1. \<And>xa s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ xa ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ xa ]\<^sup>v \<rbrakk> ~ s'
 2. \<And>x1a x2a s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x1a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x1a \<rbrakk> ~ s' ; \<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x2a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x2a \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x1a , x2a ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x1a , x2a ]\<^sup>v \<rbrakk> ~ s'
 3. \<And>x1a x2a x3 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x3[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x3 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_cons x1a x2a x3)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_cons x1a x2a x3 \<rbrakk> ~ s'
 4. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'
[PROOF STEP]
proof(cases "x=x'")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' ; x = x'\<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'
 2. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' ; x \<noteq> x'\<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
x = x'

goal (2 subgoals):
 1. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' ; x = x'\<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'
 2. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' ; x \<noteq> x'\<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'
[PROOF STEP]
hence "(V_var x')[x::=v]\<^sub>v\<^sub>v = v"
[PROOF STATE]
proof (prove)
using this:
x = x'

goal (1 subgoal):
 1. [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v = v
[PROOF STEP]
using subst_vv.simps
[PROOF STATE]
proof (prove)
using this:
x = x'
[ ?l ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = [ ?l ]\<^sup>v
[ ?y ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = (if ?x = ?y then ?v else [ ?y ]\<^sup>v)
(V_cons ?tyid ?c ?v')[?x::=?v]\<^sub>v\<^sub>v = V_cons ?tyid ?c ?v'[?x::=?v]\<^sub>v\<^sub>v
(V_consp ?tyid ?c ?b ?v')[?x::=?v]\<^sub>v\<^sub>v = V_consp ?tyid ?c ?b ?v'[?x::=?v]\<^sub>v\<^sub>v
[ ?v1.0 , ?v2.0 ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = [ ?v1.0[?x::=?v]\<^sub>v\<^sub>v , ?v2.0[?x::=?v]\<^sub>v\<^sub>v ]\<^sup>v

goal (1 subgoal):
 1. [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v = v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
[ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v = v

goal (2 subgoals):
 1. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' ; x = x'\<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'
 2. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' ; x \<noteq> x'\<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
[ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v = v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
[ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v = v

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'
[PROOF STEP]
using V_var eval_v_elims eval_v_varI eval_v_uniqueness True
[PROOF STATE]
proof (prove)
using this:
[ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v = v
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'
\<lbrakk>?i \<lbrakk> [ ?l ]\<^sup>v \<rbrakk> ~ ?s ; ?s = \<lbrakk> ?l \<rbrakk>  \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?i \<lbrakk> [ ?x ]\<^sup>v \<rbrakk> ~ ?s ; Some ?s = ?i ?x \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?i \<lbrakk> [ ?v1.0 , ?v2.0 ]\<^sup>v \<rbrakk> ~ ?s ; \<And>s1 s2. \<lbrakk>?s = SPair s1 s2; ?i \<lbrakk> ?v1.0 \<rbrakk> ~ s1 ; ?i \<lbrakk> ?v2.0 \<rbrakk> ~ s2 \<rbrakk> \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?i \<lbrakk> V_cons ?tyid ?dc ?v \<rbrakk> ~ ?s ; \<And>s. \<lbrakk>?s = SCons ?tyid ?dc s; ?i \<lbrakk> ?v \<rbrakk> ~ s \<rbrakk> \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?i \<lbrakk> V_consp ?tyid ?dc ?b ?v \<rbrakk> ~ ?s ; \<And>s. \<lbrakk>?s = SConsp ?tyid ?dc ?b s; ?i \<lbrakk> ?v \<rbrakk> ~ s \<rbrakk> \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
Some ?sv = ?i ?x \<Longrightarrow> ?i \<lbrakk> [ ?x ]\<^sup>v \<rbrakk> ~ ?sv
\<lbrakk>?i \<lbrakk> ?v \<rbrakk> ~ ?s ; ?i \<lbrakk> ?v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> ?s = ?s'
x = x'

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'
[PROOF STEP]
by (simp add: eval_v.eval_v_varI)
[PROOF STATE]
proof (state)
this:
i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'

goal (1 subgoal):
 1. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' ; x \<noteq> x'\<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' ; x \<noteq> x'\<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
x \<noteq> x'

goal (1 subgoal):
 1. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' ; x \<noteq> x'\<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'
[PROOF STEP]
hence "atom x \<sharp> (V_var x')"
[PROOF STATE]
proof (prove)
using this:
x \<noteq> x'

goal (1 subgoal):
 1. atom x \<sharp> [ x' ]\<^sup>v
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
atom x \<sharp> [ x' ]\<^sup>v

goal (1 subgoal):
 1. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' ; x \<noteq> x'\<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
atom x \<sharp> [ x' ]\<^sup>v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
atom x \<sharp> [ x' ]\<^sup>v

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'
[PROOF STEP]
using eval_v_i_upd False V_var
[PROOF STATE]
proof (prove)
using this:
atom x \<sharp> [ x' ]\<^sup>v
\<lbrakk>atom ?x \<sharp> ?v; ?i \<lbrakk> ?v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> ?i(?x \<mapsto> ?s) \<lbrakk> ?v \<rbrakk> ~ ?s'
x \<noteq> x'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> [ x' ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
i(x \<mapsto> s) \<lbrakk> [ x' ]\<^sup>v \<rbrakk> ~ s'

goal (3 subgoals):
 1. \<And>x1a x2a s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x1a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x1a \<rbrakk> ~ s' ; \<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x2a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x2a \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x1a , x2a ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x1a , x2a ]\<^sup>v \<rbrakk> ~ s'
 2. \<And>x1a x2a x3 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x3[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x3 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_cons x1a x2a x3)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_cons x1a x2a x3 \<rbrakk> ~ s'
 3. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>x1a x2a s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x1a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x1a \<rbrakk> ~ s' ; \<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x2a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x2a \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x1a , x2a ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x1a , x2a ]\<^sup>v \<rbrakk> ~ s'
 2. \<And>x1a x2a x3 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x3[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x3 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_cons x1a x2a x3)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_cons x1a x2a x3 \<rbrakk> ~ s'
 3. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
case (V_pair v1 v2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v2[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v2 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> [ v1 , v2 ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'

goal (3 subgoals):
 1. \<And>x1a x2a s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x1a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x1a \<rbrakk> ~ s' ; \<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x2a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x2a \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x1a , x2a ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x1a , x2a ]\<^sup>v \<rbrakk> ~ s'
 2. \<And>x1a x2a x3 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x3[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x3 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_cons x1a x2a x3)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_cons x1a x2a x3 \<rbrakk> ~ s'
 3. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v2[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v2 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> [ v1 , v2 ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'
[PROOF STEP]
obtain s1 and s2 where *:"eval_v i (v1[x::=v]\<^sub>v\<^sub>v) s1 \<and> eval_v i (v2[x::=v]\<^sub>v\<^sub>v) s2 \<and> s' = SPair s1 s2"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v2[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v2 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> [ v1 , v2 ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'

goal (1 subgoal):
 1. (\<And>s1 s2. i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1  \<and> i \<lbrakk> v2[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s2  \<and> s' = SPair s1 s2 \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using V_pair eval_v_elims subst_vv.simps
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v2[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v2 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> [ v1 , v2 ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v2[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v2 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> [ v1 , v2 ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'
\<lbrakk>?i \<lbrakk> [ ?l ]\<^sup>v \<rbrakk> ~ ?s ; ?s = \<lbrakk> ?l \<rbrakk>  \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?i \<lbrakk> [ ?x ]\<^sup>v \<rbrakk> ~ ?s ; Some ?s = ?i ?x \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?i \<lbrakk> [ ?v1.0 , ?v2.0 ]\<^sup>v \<rbrakk> ~ ?s ; \<And>s1 s2. \<lbrakk>?s = SPair s1 s2; ?i \<lbrakk> ?v1.0 \<rbrakk> ~ s1 ; ?i \<lbrakk> ?v2.0 \<rbrakk> ~ s2 \<rbrakk> \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?i \<lbrakk> V_cons ?tyid ?dc ?v \<rbrakk> ~ ?s ; \<And>s. \<lbrakk>?s = SCons ?tyid ?dc s; ?i \<lbrakk> ?v \<rbrakk> ~ s \<rbrakk> \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?i \<lbrakk> V_consp ?tyid ?dc ?b ?v \<rbrakk> ~ ?s ; \<And>s. \<lbrakk>?s = SConsp ?tyid ?dc ?b s; ?i \<lbrakk> ?v \<rbrakk> ~ s \<rbrakk> \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
[ ?l ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = [ ?l ]\<^sup>v
[ ?y ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = (if ?x = ?y then ?v else [ ?y ]\<^sup>v)
(V_cons ?tyid ?c ?v')[?x::=?v]\<^sub>v\<^sub>v = V_cons ?tyid ?c ?v'[?x::=?v]\<^sub>v\<^sub>v
(V_consp ?tyid ?c ?b ?v')[?x::=?v]\<^sub>v\<^sub>v = V_consp ?tyid ?c ?b ?v'[?x::=?v]\<^sub>v\<^sub>v
[ ?v1.0 , ?v2.0 ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = [ ?v1.0[?x::=?v]\<^sub>v\<^sub>v , ?v2.0[?x::=?v]\<^sub>v\<^sub>v ]\<^sup>v

goal (1 subgoal):
 1. (\<And>s1 s2. i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1  \<and> i \<lbrakk> v2[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s2  \<and> s' = SPair s1 s2 \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1  \<and> i \<lbrakk> v2[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s2  \<and> s' = SPair s1 s2

goal (3 subgoals):
 1. \<And>x1a x2a s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x1a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x1a \<rbrakk> ~ s' ; \<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x2a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x2a \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x1a , x2a ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x1a , x2a ]\<^sup>v \<rbrakk> ~ s'
 2. \<And>x1a x2a x3 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x3[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x3 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_cons x1a x2a x3)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_cons x1a x2a x3 \<rbrakk> ~ s'
 3. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
hence "(i ( x \<mapsto> s )) \<lbrakk> v1 \<rbrakk> ~ s1 \<and> (i ( x \<mapsto> s )) \<lbrakk> v2 \<rbrakk> ~ s2"
[PROOF STATE]
proof (prove)
using this:
i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1  \<and> i \<lbrakk> v2[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s2  \<and> s' = SPair s1 s2

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ s1  \<and> i(x \<mapsto> s) \<lbrakk> v2 \<rbrakk> ~ s2
[PROOF STEP]
using V_pair
[PROOF STATE]
proof (prove)
using this:
i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1  \<and> i \<lbrakk> v2[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s2  \<and> s' = SPair s1 s2
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v2[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v2 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> [ v1 , v2 ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ s1  \<and> i(x \<mapsto> s) \<lbrakk> v2 \<rbrakk> ~ s2
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ s1  \<and> i(x \<mapsto> s) \<lbrakk> v2 \<rbrakk> ~ s2

goal (3 subgoals):
 1. \<And>x1a x2a s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x1a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x1a \<rbrakk> ~ s' ; \<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x2a[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x2a \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> [ x1a , x2a ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> [ x1a , x2a ]\<^sup>v \<rbrakk> ~ s'
 2. \<And>x1a x2a x3 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x3[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x3 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_cons x1a x2a x3)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_cons x1a x2a x3 \<rbrakk> ~ s'
 3. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
thus  ?case
[PROOF STATE]
proof (prove)
using this:
i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ s1  \<and> i(x \<mapsto> s) \<lbrakk> v2 \<rbrakk> ~ s2

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> [ v1 , v2 ]\<^sup>v \<rbrakk> ~ s'
[PROOF STEP]
using eval_v_pairI subst_vv.simps * V_pair
[PROOF STATE]
proof (prove)
using this:
i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ s1  \<and> i(x \<mapsto> s) \<lbrakk> v2 \<rbrakk> ~ s2
\<lbrakk>?i \<lbrakk> ?v1.0 \<rbrakk> ~ ?s1.0 ; ?i \<lbrakk> ?v2.0 \<rbrakk> ~ ?s2.0 \<rbrakk> \<Longrightarrow> ?i \<lbrakk> [ ?v1.0 , ?v2.0 ]\<^sup>v \<rbrakk> ~ SPair ?s1.0 ?s2.0
[ ?l ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = [ ?l ]\<^sup>v
[ ?y ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = (if ?x = ?y then ?v else [ ?y ]\<^sup>v)
(V_cons ?tyid ?c ?v')[?x::=?v]\<^sub>v\<^sub>v = V_cons ?tyid ?c ?v'[?x::=?v]\<^sub>v\<^sub>v
(V_consp ?tyid ?c ?b ?v')[?x::=?v]\<^sub>v\<^sub>v = V_consp ?tyid ?c ?b ?v'[?x::=?v]\<^sub>v\<^sub>v
[ ?v1.0 , ?v2.0 ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = [ ?v1.0[?x::=?v]\<^sub>v\<^sub>v , ?v2.0[?x::=?v]\<^sub>v\<^sub>v ]\<^sup>v
i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1  \<and> i \<lbrakk> v2[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s2  \<and> s' = SPair s1 s2
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v2[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v2 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> [ v1 , v2 ]\<^sup>v[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> [ v1 , v2 ]\<^sup>v \<rbrakk> ~ s'
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
i(x \<mapsto> s) \<lbrakk> [ v1 , v2 ]\<^sup>v \<rbrakk> ~ s'

goal (2 subgoals):
 1. \<And>x1a x2a x3 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x3[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x3 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_cons x1a x2a x3)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_cons x1a x2a x3 \<rbrakk> ~ s'
 2. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x1a x2a x3 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x3[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x3 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_cons x1a x2a x3)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_cons x1a x2a x3 \<rbrakk> ~ s'
 2. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
case (V_cons tyid dc v1)
[PROOF STATE]
proof (state)
this:
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> (V_cons tyid dc v1)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'

goal (2 subgoals):
 1. \<And>x1a x2a x3 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x3[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x3 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_cons x1a x2a x3)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_cons x1a x2a x3 \<rbrakk> ~ s'
 2. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> (V_cons tyid dc v1)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'
[PROOF STEP]
obtain s1 where "eval_v i (v1[x::=v]\<^sub>v\<^sub>v) s1"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> (V_cons tyid dc v1)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'

goal (1 subgoal):
 1. (\<And>s1. i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1  \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using eval_v_elims subst_vv.simps
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> (V_cons tyid dc v1)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'
\<lbrakk>?i \<lbrakk> [ ?l ]\<^sup>v \<rbrakk> ~ ?s ; ?s = \<lbrakk> ?l \<rbrakk>  \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?i \<lbrakk> [ ?x ]\<^sup>v \<rbrakk> ~ ?s ; Some ?s = ?i ?x \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?i \<lbrakk> [ ?v1.0 , ?v2.0 ]\<^sup>v \<rbrakk> ~ ?s ; \<And>s1 s2. \<lbrakk>?s = SPair s1 s2; ?i \<lbrakk> ?v1.0 \<rbrakk> ~ s1 ; ?i \<lbrakk> ?v2.0 \<rbrakk> ~ s2 \<rbrakk> \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?i \<lbrakk> V_cons ?tyid ?dc ?v \<rbrakk> ~ ?s ; \<And>s. \<lbrakk>?s = SCons ?tyid ?dc s; ?i \<lbrakk> ?v \<rbrakk> ~ s \<rbrakk> \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?i \<lbrakk> V_consp ?tyid ?dc ?b ?v \<rbrakk> ~ ?s ; \<And>s. \<lbrakk>?s = SConsp ?tyid ?dc ?b s; ?i \<lbrakk> ?v \<rbrakk> ~ s \<rbrakk> \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
[ ?l ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = [ ?l ]\<^sup>v
[ ?y ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = (if ?x = ?y then ?v else [ ?y ]\<^sup>v)
(V_cons ?tyid ?c ?v')[?x::=?v]\<^sub>v\<^sub>v = V_cons ?tyid ?c ?v'[?x::=?v]\<^sub>v\<^sub>v
(V_consp ?tyid ?c ?b ?v')[?x::=?v]\<^sub>v\<^sub>v = V_consp ?tyid ?c ?b ?v'[?x::=?v]\<^sub>v\<^sub>v
[ ?v1.0 , ?v2.0 ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = [ ?v1.0[?x::=?v]\<^sub>v\<^sub>v , ?v2.0[?x::=?v]\<^sub>v\<^sub>v ]\<^sup>v

goal (1 subgoal):
 1. (\<And>s1. i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1  \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1

goal (2 subgoals):
 1. \<And>x1a x2a x3 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x3[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x3 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_cons x1a x2a x3)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_cons x1a x2a x3 \<rbrakk> ~ s'
 2. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> V_cons tyid dc v1 \<rbrakk> ~ s'
[PROOF STEP]
using eval_v_consI V_cons
[PROOF STATE]
proof (prove)
using this:
i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1
?i \<lbrakk> ?v \<rbrakk> ~ ?s  \<Longrightarrow> ?i \<lbrakk> V_cons ?tyid ?dc ?v \<rbrakk> ~ SCons ?tyid ?dc ?s
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> (V_cons tyid dc v1)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> V_cons tyid dc v1 \<rbrakk> ~ s'
[PROOF STEP]
by (metis eval_v_elims subst_vv.simps)
[PROOF STATE]
proof (state)
this:
i(x \<mapsto> s) \<lbrakk> V_cons tyid dc v1 \<rbrakk> ~ s'

goal (1 subgoal):
 1. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
case (V_consp tyid dc b1 v1)
[PROOF STATE]
proof (state)
this:
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> (V_consp tyid dc b1 v1)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'

goal (1 subgoal):
 1. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> (V_consp tyid dc b1 v1)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'
[PROOF STEP]
obtain s1 where *:"eval_v i (v1[x::=v]\<^sub>v\<^sub>v) s1 \<and> s' = SConsp tyid dc b1 s1"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> (V_consp tyid dc b1 v1)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'

goal (1 subgoal):
 1. (\<And>s1. i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1  \<and> s' = SConsp tyid dc b1 s1 \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using eval_v_elims subst_vv.simps
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> (V_consp tyid dc b1 v1)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'
\<lbrakk>?i \<lbrakk> [ ?l ]\<^sup>v \<rbrakk> ~ ?s ; ?s = \<lbrakk> ?l \<rbrakk>  \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?i \<lbrakk> [ ?x ]\<^sup>v \<rbrakk> ~ ?s ; Some ?s = ?i ?x \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?i \<lbrakk> [ ?v1.0 , ?v2.0 ]\<^sup>v \<rbrakk> ~ ?s ; \<And>s1 s2. \<lbrakk>?s = SPair s1 s2; ?i \<lbrakk> ?v1.0 \<rbrakk> ~ s1 ; ?i \<lbrakk> ?v2.0 \<rbrakk> ~ s2 \<rbrakk> \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?i \<lbrakk> V_cons ?tyid ?dc ?v \<rbrakk> ~ ?s ; \<And>s. \<lbrakk>?s = SCons ?tyid ?dc s; ?i \<lbrakk> ?v \<rbrakk> ~ s \<rbrakk> \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?i \<lbrakk> V_consp ?tyid ?dc ?b ?v \<rbrakk> ~ ?s ; \<And>s. \<lbrakk>?s = SConsp ?tyid ?dc ?b s; ?i \<lbrakk> ?v \<rbrakk> ~ s \<rbrakk> \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
[ ?l ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = [ ?l ]\<^sup>v
[ ?y ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = (if ?x = ?y then ?v else [ ?y ]\<^sup>v)
(V_cons ?tyid ?c ?v')[?x::=?v]\<^sub>v\<^sub>v = V_cons ?tyid ?c ?v'[?x::=?v]\<^sub>v\<^sub>v
(V_consp ?tyid ?c ?b ?v')[?x::=?v]\<^sub>v\<^sub>v = V_consp ?tyid ?c ?b ?v'[?x::=?v]\<^sub>v\<^sub>v
[ ?v1.0 , ?v2.0 ]\<^sup>v[?x::=?v]\<^sub>v\<^sub>v = [ ?v1.0[?x::=?v]\<^sub>v\<^sub>v , ?v2.0[?x::=?v]\<^sub>v\<^sub>v ]\<^sup>v

goal (1 subgoal):
 1. (\<And>s1. i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1  \<and> s' = SConsp tyid dc b1 s1 \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1  \<and> s' = SConsp tyid dc b1 s1

goal (1 subgoal):
 1. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
hence "i ( x \<mapsto> s ) \<lbrakk> v1 \<rbrakk> ~ s1"
[PROOF STATE]
proof (prove)
using this:
i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1  \<and> s' = SConsp tyid dc b1 s1

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ s1
[PROOF STEP]
using V_consp
[PROOF STATE]
proof (prove)
using this:
i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1  \<and> s' = SConsp tyid dc b1 s1
\<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ ?s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ ?s'
i \<lbrakk> v \<rbrakk> ~ s
i \<lbrakk> (V_consp tyid dc b1 v1)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s'

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ s1
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ s1

goal (1 subgoal):
 1. \<And>x1a x2a x3 x4 s'. \<lbrakk>\<And>s'. \<lbrakk>i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> x4[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> x4 \<rbrakk> ~ s' ; i \<lbrakk> v \<rbrakk> ~ s ; i \<lbrakk> (V_consp x1a x2a x3 x4)[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s' \<rbrakk> \<Longrightarrow> i(x \<mapsto> s) \<lbrakk> V_consp x1a x2a x3 x4 \<rbrakk> ~ s'
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ s1

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> V_consp tyid dc b1 v1 \<rbrakk> ~ s'
[PROOF STEP]
using * eval_v_conspI
[PROOF STATE]
proof (prove)
using this:
i(x \<mapsto> s) \<lbrakk> v1 \<rbrakk> ~ s1
i \<lbrakk> v1[x::=v]\<^sub>v\<^sub>v \<rbrakk> ~ s1  \<and> s' = SConsp tyid dc b1 s1
?i \<lbrakk> ?v \<rbrakk> ~ ?s  \<Longrightarrow> ?i \<lbrakk> V_consp ?tyid ?dc ?b ?v \<rbrakk> ~ SConsp ?tyid ?dc ?b ?s

goal (1 subgoal):
 1. i(x \<mapsto> s) \<lbrakk> V_consp tyid dc b1 v1 \<rbrakk> ~ s'
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
i(x \<mapsto> s) \<lbrakk> V_consp tyid dc b1 v1 \<rbrakk> ~ s'

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma GatewaySystem_L3:
 assumes h1:"Gateway req dt a stop lose d ack i vc"
     and h2:"ServiceCenter i a"
     and h3:"GatewayReq req dt a stop lose d ack i vc"
     and h4:"msg (Suc 0) req"
     and h5:"msg (Suc 0) stop"
     and h6:"msg (Suc 0) a"
     and h7:"ts lose"
     and h8: "dt (Suc t) \<noteq> [] \<or> dt (Suc (Suc t)) \<noteq> []"
     and h9: "ack t = [init_state]"
     and h10:"req (Suc t) = [init]"
     and h11:"\<forall>t1\<le>t. req t1 = []"
     and h12:"\<forall>m \<le> k + 2. req (t + m) \<noteq> [send]"
     and h13:"req (t + 3 + k) = [send]"
     and h14:"\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]"
 shows "vc (2 * d + (t + (4 + k))) = [vc_com]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
have "Suc 0 \<le> 2 * d + (4 + k)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Suc 0 \<le> 2 * d + (4 + k)
[PROOF STEP]
by arith
[PROOF STATE]
proof (state)
this:
Suc 0 \<le> 2 * d + (4 + k)

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h14 and this
[PROOF STATE]
proof (chain)
picking this:
\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]
Suc 0 \<le> 2 * d + (4 + k)
[PROOF STEP]
have "lose (t + Suc 0) = [False]"
[PROOF STATE]
proof (prove)
using this:
\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]
Suc 0 \<le> 2 * d + (4 + k)

goal (1 subgoal):
 1. lose (t + Suc 0) = [False]
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
lose (t + Suc 0) = [False]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
lose (t + Suc 0) = [False]
[PROOF STEP]
have sg1:"lose (Suc t) = [False]"
[PROOF STATE]
proof (prove)
using this:
lose (t + Suc 0) = [False]

goal (1 subgoal):
 1. lose (Suc t) = [False]
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
lose (Suc t) = [False]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
have "Suc (Suc 0) \<le> 2 * d + (4 + k)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Suc (Suc 0) \<le> 2 * d + (4 + k)
[PROOF STEP]
by arith
[PROOF STATE]
proof (state)
this:
Suc (Suc 0) \<le> 2 * d + (4 + k)

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h14 and this
[PROOF STATE]
proof (chain)
picking this:
\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]
Suc (Suc 0) \<le> 2 * d + (4 + k)
[PROOF STEP]
have "lose (t + Suc (Suc 0)) = [False]"
[PROOF STATE]
proof (prove)
using this:
\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]
Suc (Suc 0) \<le> 2 * d + (4 + k)

goal (1 subgoal):
 1. lose (t + Suc (Suc 0)) = [False]
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
lose (t + Suc (Suc 0)) = [False]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
lose (t + Suc (Suc 0)) = [False]
[PROOF STEP]
have sg2:"lose (Suc (Suc t)) = [False]"
[PROOF STATE]
proof (prove)
using this:
lose (t + Suc (Suc 0)) = [False]

goal (1 subgoal):
 1. lose (Suc (Suc t)) = [False]
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
lose (Suc (Suc t)) = [False]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h3 and h4 and h5 and h6 and h7 and h10 and h9 and sg1 and sg2
[PROOF STATE]
proof (chain)
picking this:
GatewayReq req dt a stop lose d ack i vc
msg (Suc 0) req
msg (Suc 0) stop
msg (Suc 0) a
ts lose
req (Suc t) = [init]
ack t = [init_state]
lose (Suc t) = [False]
lose (Suc (Suc t)) = [False]
[PROOF STEP]
have sg3:
   "ack (t + 2) = [connection_ok]"
[PROOF STATE]
proof (prove)
using this:
GatewayReq req dt a stop lose d ack i vc
msg (Suc 0) req
msg (Suc 0) stop
msg (Suc 0) a
ts lose
req (Suc t) = [init]
ack t = [init_state]
lose (Suc t) = [False]
lose (Suc (Suc t)) = [False]

goal (1 subgoal):
 1. ack (t + 2) = [connection_ok]
[PROOF STEP]
by (simp add: GatewayReq_def)
[PROOF STATE]
proof (state)
this:
ack (t + 2) = [connection_ok]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h14
[PROOF STATE]
proof (chain)
picking this:
\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]
[PROOF STEP]
have sg4:" \<forall>j\<le>k. lose (t + 2 + j) = [False]"
[PROOF STATE]
proof (prove)
using this:
\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]

goal (1 subgoal):
 1. \<forall>j\<le>k. lose (t + 2 + j) = [False]
[PROOF STEP]
by (clarify, rule aux4lose1, simp)
[PROOF STATE]
proof (state)
this:
\<forall>j\<le>k. lose (t + 2 + j) = [False]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h12
[PROOF STATE]
proof (chain)
picking this:
\<forall>m\<le>k + 2. req (t + m) \<noteq> [send]
[PROOF STEP]
have sg5:"\<forall>m \<le> k. req (t + 2 + m) \<noteq> [send]"
[PROOF STATE]
proof (prove)
using this:
\<forall>m\<le>k + 2. req (t + m) \<noteq> [send]

goal (1 subgoal):
 1. \<forall>m\<le>k. req (t + 2 + m) \<noteq> [send]
[PROOF STEP]
by (clarify, rule aux4req, auto)
[PROOF STATE]
proof (state)
this:
\<forall>m\<le>k. req (t + 2 + m) \<noteq> [send]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
(* stable connection *)
[PROOF STATE]
proof (state)
this:
\<forall>m\<le>k. req (t + 2 + m) \<noteq> [send]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h1 and sg5 and sg4 and sg3 and h4 and h5 and h6 and h7
[PROOF STATE]
proof (chain)
picking this:
Gateway req dt a stop lose d ack i vc
\<forall>m\<le>k. req (t + 2 + m) \<noteq> [send]
\<forall>j\<le>k. lose (t + 2 + j) = [False]
ack (t + 2) = [connection_ok]
msg (Suc 0) req
msg (Suc 0) stop
msg (Suc 0) a
ts lose
[PROOF STEP]
have sg6:
   "\<forall>m \<le> k. ack (t + 2 + m) = [connection_ok]"
[PROOF STATE]
proof (prove)
using this:
Gateway req dt a stop lose d ack i vc
\<forall>m\<le>k. req (t + 2 + m) \<noteq> [send]
\<forall>j\<le>k. lose (t + 2 + j) = [False]
ack (t + 2) = [connection_ok]
msg (Suc 0) req
msg (Suc 0) stop
msg (Suc 0) a
ts lose

goal (1 subgoal):
 1. \<forall>m\<le>k. ack (t + 2 + m) = [connection_ok]
[PROOF STEP]
by (rule Gateway_L6)
[PROOF STATE]
proof (state)
this:
\<forall>m\<le>k. ack (t + 2 + m) = [connection_ok]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from sg6
[PROOF STATE]
proof (chain)
picking this:
\<forall>m\<le>k. ack (t + 2 + m) = [connection_ok]
[PROOF STEP]
have sg6a:"ack (t + 2 + k) = [connection_ok]"
[PROOF STATE]
proof (prove)
using this:
\<forall>m\<le>k. ack (t + 2 + m) = [connection_ok]

goal (1 subgoal):
 1. ack (t + 2 + k) = [connection_ok]
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
ack (t + 2 + k) = [connection_ok]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
(* sending data*)
[PROOF STATE]
proof (state)
this:
ack (t + 2 + k) = [connection_ok]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h3 and h4 and h5 and h6 and h7 and h13 and h14 and sg6
[PROOF STATE]
proof (chain)
picking this:
GatewayReq req dt a stop lose d ack i vc
msg (Suc 0) req
msg (Suc 0) stop
msg (Suc 0) a
ts lose
req (t + 3 + k) = [send]
\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]
\<forall>m\<le>k. ack (t + 2 + m) = [connection_ok]
[PROOF STEP]
have sg10:
   "ack (t + 3 + k) = [sending_data]"
[PROOF STATE]
proof (prove)
using this:
GatewayReq req dt a stop lose d ack i vc
msg (Suc 0) req
msg (Suc 0) stop
msg (Suc 0) a
ts lose
req (t + 3 + k) = [send]
\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]
\<forall>m\<le>k. ack (t + 2 + m) = [connection_ok]

goal (1 subgoal):
 1. ack (t + 3 + k) = [sending_data]
[PROOF STEP]
by (simp add: GatewayReq_L1)
[PROOF STATE]
proof (state)
this:
ack (t + 3 + k) = [sending_data]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h3 and h4 and h5 and h6 and h7
[PROOF STATE]
proof (chain)
picking this:
GatewayReq req dt a stop lose d ack i vc
msg (Suc 0) req
msg (Suc 0) stop
msg (Suc 0) a
ts lose
[PROOF STEP]
have sg11a:
   "ack (t + 2 + k) = [connection_ok] \<and>
    req (Suc (t + 2 + k)) = [send] \<and>
    (\<forall>j\<le>Suc d. lose ((t + 2 + k) + j) = [False]) \<longrightarrow>
    i (Suc (t + (2::nat) + k + d)) = inf_last_ti dt (t + 2 + k)"
[PROOF STATE]
proof (prove)
using this:
GatewayReq req dt a stop lose d ack i vc
msg (Suc 0) req
msg (Suc 0) stop
msg (Suc 0) a
ts lose

goal (1 subgoal):
 1. ack (t + 2 + k) = [connection_ok] \<and> req (Suc (t + 2 + k)) = [send] \<and> (\<forall>j\<le>Suc d. lose (t + 2 + k + j) = [False]) \<longrightarrow> i (Suc (t + 2 + k + d)) = inf_last_ti dt (t + 2 + k)
[PROOF STEP]
apply (simp only: GatewayReq_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>msg 1 req \<and> msg 1 a \<and> msg 1 stop \<and> True \<longrightarrow> (\<forall>t. (ack t = [init_state] \<and> req (Suc t) = [init] \<and> lose (t + 1) = [False] \<and> lose (t + 2) = [False] \<longrightarrow> ack (t + 2) = [connection_ok]) \<and> (ack t = [connection_ok] \<and> req (Suc t) = [send] \<and> (\<forall>k\<le>d + 1. lose (t + k) = [False]) \<longrightarrow> i (Suc t + d) = inf_last_ti dt t \<and> ack (Suc t) = [sending_data]) \<and> (ack (t + d) = [sending_data] \<and> a (Suc t) = [sc_ack] \<and> (\<forall>k\<le>d + 1. lose (t + k) = [False]) \<longrightarrow> vc (Suc t + d) = [vc_com])); msg (Suc 0) req; msg (Suc 0) stop; msg (Suc 0) a; ts lose\<rbrakk> \<Longrightarrow> ack (t + 2 + k) = [connection_ok] \<and> req (Suc (t + 2 + k)) = [send] \<and> (\<forall>j\<le>Suc d. lose (t + 2 + k + j) = [False]) \<longrightarrow> i (Suc (t + 2 + k + d)) = inf_last_ti dt (t + 2 + k)
[PROOF STEP]
by (rule GatewaySystem_L3aux, auto)
[PROOF STATE]
proof (state)
this:
ack (t + 2 + k) = [connection_ok] \<and> req (Suc (t + 2 + k)) = [send] \<and> (\<forall>j\<le>Suc d. lose (t + 2 + k + j) = [False]) \<longrightarrow> i (Suc (t + 2 + k + d)) = inf_last_ti dt (t + 2 + k)

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
have sg12:"Suc (t + 2 + k) = t + 3 + k"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Suc (t + 2 + k) = t + 3 + k
[PROOF STEP]
by arith
[PROOF STATE]
proof (state)
this:
Suc (t + 2 + k) = t + 3 + k

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h13 and sg12
[PROOF STATE]
proof (chain)
picking this:
req (t + 3 + k) = [send]
Suc (t + 2 + k) = t + 3 + k
[PROOF STEP]
have sg12a:"req (Suc (t + 2 + k)) = [send]"
[PROOF STATE]
proof (prove)
using this:
req (t + 3 + k) = [send]
Suc (t + 2 + k) = t + 3 + k

goal (1 subgoal):
 1. req (Suc (t + 2 + k)) = [send]
[PROOF STEP]
by (simp add: eval_nat_numeral)
[PROOF STATE]
proof (state)
this:
req (Suc (t + 2 + k)) = [send]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h14
[PROOF STATE]
proof (chain)
picking this:
\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]
[PROOF STEP]
have sg13:"\<forall>j\<le>Suc d. lose ((t + 2 + k) + j) = [False]"
[PROOF STATE]
proof (prove)
using this:
\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]

goal (1 subgoal):
 1. \<forall>j\<le>Suc d. lose (t + 2 + k + j) = [False]
[PROOF STEP]
by (rule streamValue12)
[PROOF STATE]
proof (state)
this:
\<forall>j\<le>Suc d. lose (t + 2 + k + j) = [False]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from sg11a and sg6a and h13 and sg12a and sg13
[PROOF STATE]
proof (chain)
picking this:
ack (t + 2 + k) = [connection_ok] \<and> req (Suc (t + 2 + k)) = [send] \<and> (\<forall>j\<le>Suc d. lose (t + 2 + k + j) = [False]) \<longrightarrow> i (Suc (t + 2 + k + d)) = inf_last_ti dt (t + 2 + k)
ack (t + 2 + k) = [connection_ok]
req (t + 3 + k) = [send]
req (Suc (t + 2 + k)) = [send]
\<forall>j\<le>Suc d. lose (t + 2 + k + j) = [False]
[PROOF STEP]
have sg14:
    "i (Suc (t + (2::nat) + k + d)) = inf_last_ti dt (t + 2 + k)"
[PROOF STATE]
proof (prove)
using this:
ack (t + 2 + k) = [connection_ok] \<and> req (Suc (t + 2 + k)) = [send] \<and> (\<forall>j\<le>Suc d. lose (t + 2 + k + j) = [False]) \<longrightarrow> i (Suc (t + 2 + k + d)) = inf_last_ti dt (t + 2 + k)
ack (t + 2 + k) = [connection_ok]
req (t + 3 + k) = [send]
req (Suc (t + 2 + k)) = [send]
\<forall>j\<le>Suc d. lose (t + 2 + k + j) = [False]

goal (1 subgoal):
 1. i (Suc (t + 2 + k + d)) = inf_last_ti dt (t + 2 + k)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
i (Suc (t + 2 + k + d)) = inf_last_ti dt (t + 2 + k)

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h8
[PROOF STATE]
proof (chain)
picking this:
dt (Suc t) \<noteq> [] \<or> dt (Suc (Suc t)) \<noteq> []
[PROOF STEP]
have sg15:"inf_last_ti dt (t + 2 + k) \<noteq> []"
[PROOF STATE]
proof (prove)
using this:
dt (Suc t) \<noteq> [] \<or> dt (Suc (Suc t)) \<noteq> []

goal (1 subgoal):
 1. inf_last_ti dt (t + 2 + k) \<noteq> []
[PROOF STEP]
by (rule inf_last_ti_Suc2)
[PROOF STATE]
proof (state)
this:
inf_last_ti dt (t + 2 + k) \<noteq> []

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from sg14 and sg15
[PROOF STATE]
proof (chain)
picking this:
i (Suc (t + 2 + k + d)) = inf_last_ti dt (t + 2 + k)
inf_last_ti dt (t + 2 + k) \<noteq> []
[PROOF STEP]
have sg16: "i (t + 3 + k + d) \<noteq> []"
[PROOF STATE]
proof (prove)
using this:
i (Suc (t + 2 + k + d)) = inf_last_ti dt (t + 2 + k)
inf_last_ti dt (t + 2 + k) \<noteq> []

goal (1 subgoal):
 1. i (t + 3 + k + d) \<noteq> []
[PROOF STEP]
by (simp add: arith_sum4)
[PROOF STATE]
proof (state)
this:
i (t + 3 + k + d) \<noteq> []

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
(* waiting for sc-ack *)
[PROOF STATE]
proof (state)
this:
i (t + 3 + k + d) \<noteq> []

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h14
[PROOF STATE]
proof (chain)
picking this:
\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]
[PROOF STEP]
have sg17:"\<forall>j\<le>k + d + 3. lose (t + j) = [False]"
[PROOF STATE]
proof (prove)
using this:
\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]

goal (1 subgoal):
 1. \<forall>j\<le>k + d + 3. lose (t + j) = [False]
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>j\<le>k + d + 3. lose (t + j) = [False]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h12
[PROOF STATE]
proof (chain)
picking this:
\<forall>m\<le>k + 2. req (t + m) \<noteq> [send]
[PROOF STEP]
have sg18:"\<forall>m < (k + 3). req (t + m) \<noteq> [send]"
[PROOF STATE]
proof (prove)
using this:
\<forall>m\<le>k + 2. req (t + m) \<noteq> [send]

goal (1 subgoal):
 1. \<forall>m<k + 3. req (t + m) \<noteq> [send]
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>m<k + 3. req (t + m) \<noteq> [send]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h1 and h4 and h5 and h6 and h7 and h10 and sg18 and h13 and h9 and sg17 and h11
[PROOF STATE]
proof (chain)
picking this:
Gateway req dt a stop lose d ack i vc
msg (Suc 0) req
msg (Suc 0) stop
msg (Suc 0) a
ts lose
req (Suc t) = [init]
\<forall>m<k + 3. req (t + m) \<noteq> [send]
req (t + 3 + k) = [send]
ack t = [init_state]
\<forall>j\<le>k + d + 3. lose (t + j) = [False]
\<forall>t1\<le>t. req t1 = []
[PROOF STEP]
have sg19:"\<forall> t2 < (t + 3 + k + d). i t2 = []"
[PROOF STATE]
proof (prove)
using this:
Gateway req dt a stop lose d ack i vc
msg (Suc 0) req
msg (Suc 0) stop
msg (Suc 0) a
ts lose
req (Suc t) = [init]
\<forall>m<k + 3. req (t + m) \<noteq> [send]
req (t + 3 + k) = [send]
ack t = [init_state]
\<forall>j\<le>k + d + 3. lose (t + j) = [False]
\<forall>t1\<le>t. req t1 = []

goal (1 subgoal):
 1. \<forall>t2<t + 3 + k + d. i t2 = []
[PROOF STEP]
by (simp add: Gateway_L7)
[PROOF STATE]
proof (state)
this:
\<forall>t2<t + 3 + k + d. i t2 = []

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h2 and sg19
[PROOF STATE]
proof (chain)
picking this:
ServiceCenter i a
\<forall>t2<t + 3 + k + d. i t2 = []
[PROOF STEP]
have sg20:"\<forall> t3 \<le> (t + 3 + k + d). a t3 = []"
[PROOF STATE]
proof (prove)
using this:
ServiceCenter i a
\<forall>t2<t + 3 + k + d. i t2 = []

goal (1 subgoal):
 1. \<forall>t3\<le>t + 3 + k + d. a t3 = []
[PROOF STEP]
by (simp add: ServiceCenter_L2)
[PROOF STATE]
proof (state)
this:
\<forall>t3\<le>t + 3 + k + d. a t3 = []

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h14
[PROOF STATE]
proof (chain)
picking this:
\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]
[PROOF STEP]
have sg21:"\<forall>j\<le>2 * d. lose (t + 3 + k + j) = [False]"
[PROOF STATE]
proof (prove)
using this:
\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]

goal (1 subgoal):
 1. \<forall>j\<le>2 * d. lose (t + 3 + k + j) = [False]
[PROOF STEP]
by (simp add: streamValue43)
[PROOF STATE]
proof (state)
this:
\<forall>j\<le>2 * d. lose (t + 3 + k + j) = [False]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h1 and h4 and h5 and h6 and h7 and sg21 and sg10 and sg20
[PROOF STATE]
proof (chain)
picking this:
Gateway req dt a stop lose d ack i vc
msg (Suc 0) req
msg (Suc 0) stop
msg (Suc 0) a
ts lose
\<forall>j\<le>2 * d. lose (t + 3 + k + j) = [False]
ack (t + 3 + k) = [sending_data]
\<forall>t3\<le>t + 3 + k + d. a t3 = []
[PROOF STEP]
have
    "\<forall>x \<le> d + d. ack (t + 3 + k + x) = [sending_data]"
[PROOF STATE]
proof (prove)
using this:
Gateway req dt a stop lose d ack i vc
msg (Suc 0) req
msg (Suc 0) stop
msg (Suc 0) a
ts lose
\<forall>j\<le>2 * d. lose (t + 3 + k + j) = [False]
ack (t + 3 + k) = [sending_data]
\<forall>t3\<le>t + 3 + k + d. a t3 = []

goal (1 subgoal):
 1. \<forall>x\<le>d + d. ack (t + 3 + k + x) = [sending_data]
[PROOF STEP]
by (simp add: Gateway_L8)
[PROOF STATE]
proof (state)
this:
\<forall>x\<le>d + d. ack (t + 3 + k + x) = [sending_data]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
from h2 and h3 and h4 and h5 and h6 and h7 and h14 and sg16 and this
[PROOF STATE]
proof (chain)
picking this:
ServiceCenter i a
GatewayReq req dt a stop lose d ack i vc
msg (Suc 0) req
msg (Suc 0) stop
msg (Suc 0) a
ts lose
\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]
i (t + 3 + k + d) \<noteq> []
\<forall>x\<le>d + d. ack (t + 3 + k + x) = [sending_data]
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ServiceCenter i a
GatewayReq req dt a stop lose d ack i vc
msg (Suc 0) req
msg (Suc 0) stop
msg (Suc 0) a
ts lose
\<forall>j\<le>2 * d + (4 + k). lose (t + j) = [False]
i (t + 3 + k + d) \<noteq> []
\<forall>x\<le>d + d. ack (t + 3 + k + x) = [sending_data]

goal (1 subgoal):
 1. vc (2 * d + (t + (4 + k))) = [vc_com]
[PROOF STEP]
by (simp add: GatewaySystem_L1)
[PROOF STATE]
proof (state)
this:
vc (2 * d + (t + (4 + k))) = [vc_com]

goal:
No subgoals!
[PROOF STEP]
qed